Fix crashes while displaying large animated GIFs. Our old understanding of t...

webkit/port/platform/graphics/ImageSkia.cpp

 // Copyright (c) 2008, Google Inc.
 // All rights reserved.
 //
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 // notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
@@ skipping 272 matching lines @@
     SkPoint dest_points[3];
     matrix.mapPoints(dest_points, src_points, 3);
     *dest_width = SkScalarToFloat((dest_points[1] - dest_points[0]).length());
     *dest_height = SkScalarToFloat((dest_points[2] - dest_points[0]).length());
 }
 
 }  // namespace
 
 void FrameData::clear()
 {
-    // The frame data is released in ImageSource::clear.
+    // ImageSource::createFrameAtIndex() allocated |m_frame| and passed
+    // ownership to BitmapImage; we must delete it here.
+    delete m_frame;
     m_frame = 0;
     // NOTE: We purposefully don't reset metadata here, so that even if we
     // throw away previously-decoded data, animation loops can still access
     // properties like frame durations without re-decoding.
 }
 
 PassRefPtr<Image> Image::loadPlatformResource(const char *name)
 {
     return ChromiumBridge::loadPlatformImageResource(name);
 }
@@ skipping 141 matching lines @@
 PassRefPtr<BitmapImageSingleFrameSkia> BitmapImageSingleFrameSkia::create(
     const SkBitmap& bitmap)
 {
     RefPtr<BitmapImageSingleFrameSkia> image(new BitmapImageSingleFrameSkia());
     if (!bitmap.copyTo(&image->m_nativeImage, bitmap.config()))
         return 0;
     return image.release();
 }
 
 }  // namespace WebCore