In the cairo implementation of ImageGStreamer, with gstreamer 1.0, the GstBuffer memory is mapped to construct a cairo_surface_t using cairo_image_surface_create_for_data() and then the buffer memory is unmapped right after. The documentation for cairo_image_surface_create_for_data() says that "The output buffer must be kept around until the cairo_surface_t is destroyed or cairo_surface_finish() is called on the surface." Unfortunately, the memory is unmapped while the image is still alive and the cairo_surface_t points internally to memory that is no longer valid. This may lead to crashes.
Created attachment 182998 [details] Patch
Comment on attachment 182998 [details] Patch Clearing flags on attachment: 182998 Committed r139896: <http://trac.webkit.org/changeset/139896>
All reviewed patches have been landed. Closing bug.