GIFImageDecoder.cpp (not used by Safari, but used by Cairo/QT) has a bug in some buffer overflow prevention code that results in the frame buffer never being written for rows near the bottom of some interlaced GIFs (resulting in either nothing or garbage showing up for those rows). Specifically, the repeated rows code in haveDecodedRow() double-compensates for sizeof(unsigned) in its buffer overrun check, by adding a pre-multiplied scalar to a pointer (which causes the compiler to multiply it again). Patch coming shortly.
Created attachment 16148 [details] patch v1 Simple fix.
Comment on attachment 16148 [details] patch v1 r=me It might also be helpful to provide a test case of a bad gif like this.
Landed in r25293. Peter, can you please be sure to use spaces rather than tabs for indentation in your ChangeLog entries? Thanks! :)