Fix caching bug in JPEGImageDecoder

Source/platform/image-decoders/jpeg/JPEGImageDecoder.cpp

 /*
  * Copyright (C) 2006 Apple Computer, Inc.
  *
  * Portions are Copyright (C) 2001-6 mozilla.org
  *
  * Other contributors:
  *   Stuart Parmenter <stuart@mozilla.com>
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Lesser General Public
@@ skipping 374 matching lines @@
         // We updated |next_input_byte|, so we need to update |m_lastByteSet|
         // so we know not to update |m_restartPosition| again.
         m_lastSetByte = m_info.src->next_input_byte;
     }
 
     bool fillBuffer()
     {
         if (m_needsRestart) {
             m_needsRestart = false;
             m_nextReadPosition = m_restartPosition;
-        } else if (m_lastSetByte != m_info.src->next_input_byte) {
-            // next_input_byte was updated by jpeg, meaning that it found a restart position.
-            m_restartPosition = m_nextReadPosition - m_info.src->bytes_in_buffer;
+        } else {
+            updateRestartPosition();
         }
 
         const char* segment;
         const unsigned bytes = m_data->getSomeData(segment, m_nextReadPosition);
         if (bytes == 0) {
             // We had to suspend. When we resume, we will need to start from the restart position.
             m_needsRestart = true;
-            // Let libjpeg know that the buffer needs to be refilled.
-            m_info.src->bytes_in_buffer = 0;
-            m_info.src->next_input_byte = nullptr;
-            m_lastSetByte = nullptr;
+            clearBuffer();
             return false;
         }
 
         m_nextReadPosition += bytes;
         m_info.src->bytes_in_buffer = bytes;
         const JOCTET* nextByte = reinterpret_cast_ptr<const JOCTET*>(segment);
         m_info.src->next_input_byte = nextByte;
         m_lastSetByte = nextByte;
         return true;
     }
 
     void setData(SharedBuffer* data)
     {
         if (m_data.get() == data)
             return;
 
         m_data = data;
 
         // If a restart is needed, the next call to fillBuffer will read from the new SharedBuffer.
         if (m_needsRestart)
             return;
 
         // Otherwise, empty the buffer, and leave the position the same, so fillBuffer continues
         // reading from the same position in the new SharedBuffer.
         m_nextReadPosition -= m_info.src->bytes_in_buffer;
-        m_info.src->bytes_in_buffer = 0;
-        m_info.src->next_input_byte = nullptr;
-        m_lastSetByte = nullptr;
+        clearBuffer();
     }
 
     bool decode(bool onlySize)
     {
         // We need to do the setjmp here. Otherwise bad things will happen
         if (setjmp(m_err.setjmp_buffer))
             return m_decoder->setFailed();
 
         J_COLOR_SPACE overrideColorSpace = JCS_UNKNOWN;
         switch (m_state) {
@@ skipping 77 matching lines @@
 
             // Don't allocate a giant and superfluous memory buffer when the
             // image is a sequential JPEG.
             m_info.buffered_image = jpeg_has_multiple_scans(&m_info);
             if (m_info.buffered_image) {
                 m_err.pub.emit_message = emit_message;
                 m_err.num_corrupt_warnings = 0;
             }
 
             if (onlySize) {
+                // This exits the function while there is still potentially
+                // data in the buffer. Before this function is called again,
+                // the SharedBuffer may be collapsed (by a call to
+                // mergeSegmentsIntoBuffer), invalidating the "buffer" (which
+                // in reality is a pointer into the SharedBuffer's data).
+                // Defensively empty the buffer, but first find the latest
+                // restart position and signal to restart, so the next call to
+                // fillBuffer will resume from the correct point.
+                m_needsRestart = true;
+                updateRestartPosition();
+                clearBuffer();
                 return true;
             }
         // FALL THROUGH
 
         case JPEG_START_DECOMPRESS:
             // Set parameters for decompression.
             // FIXME -- Should reset dct_method and dither mode for final pass
             // of progressive JPEG.
             m_info.dct_method = JDCT_ISLOW;
             m_info.dither_mode = JDITHER_FS;
@@ skipping 131 matching lines @@
         // We currently only support color profiles for RGB profiled images.
         ASSERT(rgbData == qcms_profile_get_color_space(inputProfile));
         qcms_data_type dataFormat = hasAlpha ? QCMS_DATA_RGBA_8 : QCMS_DATA_RGB_8;
         // FIXME: Don't force perceptual intent if the image profile contains an intent.
         m_transform = qcms_transform_create(inputProfile, dataFormat, deviceProfile, dataFormat, QCMS_INTENT_PERCEPTUAL);
         qcms_profile_release(inputProfile);
     }
 #endif
 
 private:
+    void updateRestartPosition()
+    {
+        if (m_lastSetByte != m_info.src->next_input_byte) {
+            // next_input_byte was updated by jpeg, meaning that it found a restart position.
+            m_restartPosition = m_nextReadPosition - m_info.src->bytes_in_buffer;
+        }
+    }
+
+    void clearBuffer()
+    {
+        // Let libjpeg know that the buffer needs to be refilled.
+        m_info.src->bytes_in_buffer = 0;
+        m_info.src->next_input_byte = nullptr;
+        m_lastSetByte = nullptr;
+    }
+
     RefPtr<SharedBuffer> m_data;
     JPEGImageDecoder* m_decoder;
     // True if we need to back up to m_restartPosition.
     bool m_needsRestart;
     // If libjpeg needed to restart, this is the position to restart from.
     unsigned m_restartPosition;
     // This is the position where we will read from, unless there is a restart.
     unsigned m_nextReadPosition;
     // This is how we know to update the restart position. It is the last value
     // we set to next_input_byte. libjpeg will update next_input_byte when it
@@ skipping 360 matching lines @@
     // has failed.
     if (!m_reader->decode(onlySize) && isAllDataReceived())
         setFailed();
 
     // If decoding is done or failed, we don't need the JPEGImageReader anymore.
     if (isComplete(this, onlySize) || failed())
         m_reader.clear();
 }
 
 }