GIF reader can call "setSize()" multiple times. The current implementation doesn't clear the old down-sampling maps before adding new entries. Subsequent binary searches can give unexpected results.
Created attachment 63479 [details]
Comment on attachment 63479 [details]
Clearing flags on attachment: 63479
Committed r64777: <http://trac.webkit.org/changeset/64777>
All reviewed patches have been landed. Closing bug.