In ImageDecoderCairo.cpp: RGBA32Buffer::asNewNativeImage() call cairo_image_surface_create_for_data(). cairo_image_surface_create_for_data() do not copy the data to use,but hold the pointer to access.That will cause the crash happen. GIFImageDecoder::frameCount() will call m_frameBufferCache.resize(reader.images_count),that will cause the data of the cairo_image_surface_create_for_data() holding be invalid.
Duplicate of bug 16200.
*** This bug has been marked as a duplicate of bug 111179 ***