GIFImageDecoder.cpp (both the skia and Cairo versions) has a memory smashing bug. This doesn't affect Safari, but is a topcrash cause for the Chromium trunk. The problem is that clearFrameBufferCache() assumes it only needs to worry about preserving the last complete frame, but initFrameBuffer() and other functions can skip over frames with a DisposeOverwritePrevious disposal method to find prior complete frames. So the code in clearFrameBufferCache() needs to get more complex to take this into account. Additionally, to avoid wasting more memory than we need to, RGBA32Buffer::clear() should only clear the minimum amount of metadata it needs to, because various functions will still need other data after the framebuffer itself is no longer necessary. If we don't change clear() we'd need to clear fewer frames. Patch coming shortly.
Created attachment 27329 [details] patch v1 Note that the Cairo and Skia changes here are identical modulo the RGBA32Buffer members. Just another reminder that I eventually need to merge these into one set of decoders.
Comment on attachment 27329 [details] patch v1 r=me
Fixed in r40641.