Fix required frame bug in APNGs

third_party/WebKit/Source/platform/image-decoders/ImageDecoder.cpp

Index: third_party/WebKit/Source/platform/image-decoders/ImageDecoder.cpp
diff --git a/third_party/WebKit/Source/platform/image-decoders/ImageDecoder.cpp b/third_party/WebKit/Source/platform/image-decoders/ImageDecoder.cpp
index 69399dcfcb500eb3b77d84908024d504d6df4dce..a30255c7126d4059205720a1b2a072b48471310d 100644
--- a/third_party/WebKit/Source/platform/image-decoders/ImageDecoder.cpp
+++ b/third_party/WebKit/Source/platform/image-decoders/ImageDecoder.cpp
@@ -442,6 +442,17 @@ size_t ImageDecoder::FindRequiredPreviousFrame(size_t frame_index,
   // disposal method.
   size_t prev_frame = frame_index - 1;
   const ImageFrame* prev_buffer = &frame_buffer_cache_[prev_frame];
+  while (prev_buffer->GetDisposalMethod() ==
+         ImageFrame::kDisposeOverwritePrevious) {
+    // Frames that use the DisposeOverwritePrevious method are effectively

[Peter Kasting, 2017/05/17 23:30:53]

Nit: I'd put this comment above the loop rather than inside it, since it
describes the function of the whole loop.

[scroggo_chromium, 2017/05/18 12:24:05]

Done.

+    // no-ops in terms of changing the starting state of a frame compared to
+    // the starting state of the previous frame, so skip over them.
+    if (prev_frame == 0) {
+      return kNotFound;
+    }
+    prev_frame--;
+    prev_buffer = &frame_buffer_cache_[prev_frame];
+  }
 
   switch (prev_buffer->GetDisposalMethod()) {
     case ImageFrame::kDisposeNotSpecified:
@@ -450,12 +461,6 @@ size_t ImageDecoder::FindRequiredPreviousFrame(size_t frame_index,
       // FIXME: Be even smarter by checking the frame sizes and/or
       // alpha-containing regions.
       return prev_frame;
-    case ImageFrame::kDisposeOverwritePrevious:
-      // Frames that use the DisposeOverwritePrevious method are effectively
-      // no-ops in terms of changing the starting state of a frame compared to
-      // the starting state of the previous frame, so skip over them and
-      // return the required previous frame of it.
-      return prev_buffer->RequiredPreviousFrameIndex();
     case ImageFrame::kDisposeOverwriteBgcolor:
       // If the previous frame fills the whole image, then the current frame
       // can be decoded alone. Likewise, if the previous frame could be
@@ -467,6 +472,7 @@ size_t ImageDecoder::FindRequiredPreviousFrame(size_t frame_index,
               (prev_buffer->RequiredPreviousFrameIndex() == kNotFound))
                  ? kNotFound
                  : prev_frame;
+    case ImageFrame::kDisposeOverwritePrevious:
     default:
       NOTREACHED();
       return kNotFound;