Fix crashes while displaying large animated GIFs. Our old understanding of t...

webkit/port/platform/graphics/ImageSourceSkia.cpp

 /*
  * Copyright 2006 Google Inc. All Rights Reserved.
  *
  * Portions Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
@@ skipping 154 matching lines @@
     if (!m_decoder)
         return 0;
 
     // Note that the buffer can have NULL bytes even when it is marked as
     // non-empty. It seems "FrameEmpty" is only set before the frame has been
     // initialized. If it is decoded and it happens to be empty, it will be
     // marked as "FrameComplete" but will still have NULL bytes.
     RGBA32Buffer* buffer = m_decoder->frameBufferAtIndex(index);
     if (!buffer || buffer->status() == RGBA32Buffer::FrameEmpty)
         return 0;
-    return reinterpret_cast<NativeImagePtr>(&buffer->bitmap());
+
+    // Copy the bitmap.  The pixel data is refcounted internally by SkBitmap, so
+    // this doesn't cost much.  This pointer will be owned by the BitmapImage
+    // and freed in FrameData::clear().
+    return new NativeImageSkia(buffer->bitmap());
 }
 
 bool ImageSource::frameIsCompleteAtIndex(size_t index)
 {
     if (!m_decoder)
         return false;
 
     RGBA32Buffer* buffer = m_decoder->frameBufferAtIndex(index);
     return buffer && buffer->status() == RGBA32Buffer::FrameComplete;
 }
@@ skipping 33 matching lines @@
                               bool allDataReceived,
                               const IntSize& preferredIconSize)
 {
     if (!m_decoder)
         m_decoder = createDecoder(data->buffer(), preferredIconSize);
 
     ImageSource::setData(data, allDataReceived);
 }
 
 }