There is currently following line #if !ENABLE(IMAGE_DECODER_DOWN_SAMPLING) && defined(TURBO_JPEG_RGB_SWIZZLE) in JPEGImaggeDecoder.cpp. The reason of this !ENABLE(IMAGE_DECODER_DOWN_SAMPLING) check is we cannot do swizzling when the buffer wants a down-sampled image. However this doesn't work. As there is no such check when it sets the colorspace. If you enable both IMAGE_DECODER_DOWN_SAMPLING and TURBO_JPEG_RGB_SWIZZLE, it will crash for sure. ENABLE(IMAGE_DECODER_DOWN_SAMPLING) is probably not widely used, and could be improved. However, I found it super easy to make TURBO_JPEG_RGB_SWIZZLE work with it, so why not?
seems the crash has been fixed.
Created attachment 176995 [details] the patch
+Recent JPEGImageDecoder reviewers and Antonio
This is safe since http://trac.webkit.org/changeset/131075. (See bug 98878)
Noel: could you unofficially review this?
Thank you Yong Li. Looks good to me.
(In reply to comment #1) > seems the crash has been fixed. Yes. Fixed on bug 98878.
Comment on attachment 176995 [details] the patch LGTM.
Comment on attachment 176995 [details] the patch Clearing flags on attachment: 176995 Committed r136401: <http://trac.webkit.org/changeset/136401>
All reviewed patches have been landed. Closing bug.