Bug 15097 - PNGImageDecoder.cpp throws away data in some cases
Summary: PNGImageDecoder.cpp throws away data in some cases
Alias: None
Product: WebKit
Classification: Unclassified
Component: Images (show other bugs)
Version: 523.x (Safari 3)
Hardware: PC All
: P2 Normal
Assignee: Nobody
Depends on:
Reported: 2007-08-27 17:38 PDT by Peter Kasting
Modified: 2007-08-29 10:37 PDT (History)
0 users

See Also:

patch v1 (2.73 KB, patch)
2007-08-27 17:41 PDT, Peter Kasting
mjs: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Peter Kasting 2007-08-27 17:38:46 PDT
The code in PNGImageDecoder.cpp (not used for Safari Mac/Win, but used by Cairo/QT) can throw away data when consumers call any decoding-related functions on it before frameBufferAtIndex().

This is because the libpng code will only decode incoming data once (it remembers it's already decoded the existing data when asked to decode it again), and if no frame buffer is set up when it makes its callbacks, the relevant data is simply discarded.  And the frame buffer vector isn't resized to 1 frame (from 0) until frameBufferAtIndex() is called.

I don't see a good reason for this.  A single frame buffer entry takes up almost no memory before the underlying RGBA32Buffer is set up, so there really isn't a penalty for just sizing m_frameBufferCache to 1 in the constructor.  This also saves some conditionals in various places that no longer need to worry about whether this vector is empty.

Patch to fix coming shortly.
Comment 1 Peter Kasting 2007-08-27 17:41:19 PDT
Created attachment 16138 [details]
patch v1

With this patch, consumers can call any function on the PNGImageDecoder and trust that the image data won't be discarded.
Comment 2 Maciej Stachowiak 2007-08-28 21:20:29 PDT
Comment on attachment 16138 [details]
patch v1

Comment 3 Mark Rowe (bdash) 2007-08-29 10:37:38 PDT
Landed in r25294.