Deferred image decoding to handle broken GIFs

Source/platform/graphics/DeferredImageDecoder.cpp

 /*
  * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 209 matching lines @@
     if (!s_enabled
         || !m_actualDecoder
         || !m_actualDecoder->isSizeAvailable()
         || m_actualDecoder->filenameExtension() == "ico")
         return;
 
     activateLazyDecoding();
 
     const size_t previousSize = m_lazyDecodedFrames.size();
     m_lazyDecodedFrames.resize(m_actualDecoder->frameCount());
+
+    // We have encountered a broken image file. Simply bail.
+    if (m_lazyDecodedFrames.size() < previousSize)
+        return;
+
     for (size_t i = previousSize; i < m_lazyDecodedFrames.size(); ++i) {
         OwnPtr<ImageFrame> frame(adoptPtr(new ImageFrame()));
         frame->setSkBitmap(createBitmap(i));
         frame->setDuration(m_actualDecoder->frameDurationAtIndex(i));
         frame->setStatus(m_actualDecoder->frameIsCompleteAtIndex(i) ? ImageFrame::FrameComplete : ImageFrame::FramePartial);
         m_lazyDecodedFrames[i] = frame.release();
     }
 
     // The last lazy decoded frame created from previous call might be
     // incomplete so update its state.
@@ skipping 76 matching lines @@
     return bitmap;
 }
 
 bool DeferredImageDecoder::hotSpot(IntPoint& hotSpot) const
 {
     // TODO: Implement.
     return m_actualDecoder ? m_actualDecoder->hotSpot(hotSpot) : false;
 }
 
 } // namespace WebCore