Index: gtkhtml/ChangeLog
===================================================================
--- gtkhtml/ChangeLog	(revision 9115)
+++ gtkhtml/ChangeLog	(working copy)
@@ -1,3 +1,11 @@
+2009-01-27  Milan Crha  <mcrha@redhat.com>
+
+	** Fix for bug #532165
+
+	* htmlimage.c: (destroy), (update_or_redraw),
+	(html_image_pointer_queue_animation),
+	(html_image_pointer_load): Do not crash when factory gone.
+
 2009-01-23  Denis Pauk  <pauk.denis@gmail.com>
 
 	** Fix for bug #567697
Index: gtkhtml/htmlimage.c
===================================================================
--- gtkhtml/htmlimage.c	(revision 9114)
+++ gtkhtml/htmlimage.c	(working copy)
@@ -149,8 +149,9 @@ destroy (HTMLObject *o)
 {
 	HTMLImage *image = HTML_IMAGE (o);
 
-	html_image_factory_unregister (image->image_ptr->factory,
-				       image->image_ptr, HTML_IMAGE (image));
+	if (image->image_ptr->factory)
+		html_image_factory_unregister (image->image_ptr->factory,
+					       image->image_ptr, HTML_IMAGE (image));
 
 	g_free (image->url);
 	g_free (image->target);
@@ -1060,6 +1061,10 @@ update_or_redraw (HTMLImagePointer *ip){
 	GSList *list;
 	gboolean update = FALSE;
 
+	/* do nothing when factory gone; maybe the message drawing has been cancelled */
+	if (!ip->factory)
+		return;
+
 	for (list = ip->interests; list; list = list->next) {
 		if (list->data == NULL)
 			update = TRUE;
@@ -1164,10 +1169,12 @@ html_image_pointer_queue_animation (HTML
 static gint
 html_image_pointer_update (HTMLImagePointer *ip)
 {
-	HTMLEngine *engine = ip->factory->engine;
+	HTMLEngine *engine;
 	GSList *cur;
 
 	g_return_val_if_fail (ip->factory != NULL, FALSE);
+
+	engine = ip->factory->engine;
 	ip->animation_timeout = 0;
 
 	DA (printf ("animation_timeout (%p)\n", ip);)
@@ -1400,7 +1407,7 @@ html_image_pointer_unref (HTMLImagePoint
 static GtkHTMLStream *
 html_image_pointer_load (HTMLImagePointer *ip)
 {
-	if (ip->factory->engine->stopped)
+	if (!ip->factory || ip->factory->engine->stopped)
 		return NULL;
 
 	html_image_pointer_ref (ip);
