Bug 23743 - Memory smasher in public GIFImageDecoder
: Memory smasher in public GIFImageDecoder
: WebKit
: 528+ (Nightly build)
: PC All
: P2 Normal
Assigned To:
  Show dependency treegraph
Reported: 2009-02-04 14:36 PST by
Modified: 2009-02-04 16:00 PST (History)

patch v1 (10.79 KB, patch)
2009-02-04 14:38 PST, Peter Kasting
hyatt: review+
Review Patch | Details | Formatted Diff | Diff


You need to log in before you can comment on or make changes to this bug.

Description From 2009-02-04 14:36:01 PST
GIFImageDecoder.cpp (both the skia and Cairo versions) has a memory smashing bug.  This doesn't affect Safari, but is a topcrash cause for the Chromium trunk.

The problem is that clearFrameBufferCache() assumes it only needs to worry about preserving the last complete frame, but initFrameBuffer() and other functions can skip over frames with a DisposeOverwritePrevious disposal method to find prior complete frames.  So the code in clearFrameBufferCache() needs to get more complex to take this into account.

Additionally, to avoid wasting more memory than we need to, RGBA32Buffer::clear() should only clear the minimum amount of metadata it needs to, because various functions will still need other data after the framebuffer itself is no longer necessary.  If we don't change clear() we'd need to clear fewer frames.

Patch coming shortly.
------- Comment #1 From 2009-02-04 14:38:31 PST -------
Created an attachment (id=27329) [details]
patch v1

Note that the Cairo and Skia changes here are identical modulo the RGBA32Buffer members.  Just another reminder that I eventually need to merge these into one set of decoders.
------- Comment #2 From 2009-02-04 15:27:24 PST -------
(From update of attachment 27329 [details])
------- Comment #3 From 2009-02-04 16:00:43 PST -------
Fixed in r40641.