Fix memory corruption in the GIF decoder if a GIF specified a frame with no p...

Fix memory corruption in the GIF decoder if a GIF specified a frame with no pixel data.  When creating the subsequent frame, we'd try and copy this frame's data, assuming it was sized properly, when in fact we'd allocated no space; then writing pixel data into this buffer overwrote whatever was sitting in memory.

Basically, we need to ensure that every frame gets properly initialized (sized, allocated, and data copied or cleared as appropriate) before we move to the next frame.  Since we can't rely on haveDecodedRow() getting called for all frames, we now also initialize as needed in frameComplete().

BUG=5573
Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=7103

[brettw, 2008-12-16 21:21:56]

LGTM

http://codereview.chromium.org/14168/diff/1/2
File webkit/port/platform/image-decoders/gif/GIFImageDecoder.cpp (right):

http://codereview.chromium.org/14168/diff/1/2#newcode416
Line 416: // so we never reach haveDecodedRow() before getting here.
"so we never" -> "in which case we never" (seems like you might be implying you
never reach here because some gifs insert do nothing frames).

[Mohamed Mansour (USE mhm), 2008-12-16 21:39:23]

http://codereview.chromium.org/14168/diff/1/2
File webkit/port/platform/image-decoders/gif/GIFImageDecoder.cpp (right):

http://codereview.chromium.org/14168/diff/1/2#newcode418
Line 418: if ((buffer.status() == RGBA32Buffer::FrameEmpty) &&
!initFrameBuffer(frameIndex))
my turn :)
nit: let second parameter go in the next line since it is > 80 chars

[Peter Kasting, 2008-12-16 21:42:17]

http://codereview.chromium.org/14168/diff/1/2
File webkit/port/platform/image-decoders/gif/GIFImageDecoder.cpp (right):

http://codereview.chromium.org/14168/diff/1/2#newcode418
Line 418: if ((buffer.status() == RGBA32Buffer::FrameEmpty) &&
!initFrameBuffer(frameIndex))
On 2008/12/16 21:39:23, Mohamed Mansour wrote:
> nit: let second parameter go in the next line since it is > 80 chars

No, this is WebKit code and WebKit style.  Google style is 80-column limit,
WebKit style is to have arbitrary-length lines.