Fix required frame bug in APNGs

third_party/WebKit/Source/platform/image-decoders/ImageDecoder.cpp

Index: third_party/WebKit/Source/platform/image-decoders/ImageDecoder.cpp
diff --git a/third_party/WebKit/Source/platform/image-decoders/ImageDecoder.cpp b/third_party/WebKit/Source/platform/image-decoders/ImageDecoder.cpp
index 69399dcfcb500eb3b77d84908024d504d6df4dce..b663ac9dbf4623640dd19f363cd01930c767e6f9 100644
--- a/third_party/WebKit/Source/platform/image-decoders/ImageDecoder.cpp
+++ b/third_party/WebKit/Source/platform/image-decoders/ImageDecoder.cpp
@@ -443,6 +443,18 @@ size_t ImageDecoder::FindRequiredPreviousFrame(size_t frame_index,
   size_t prev_frame = frame_index - 1;
   const ImageFrame* prev_buffer = &frame_buffer_cache_[prev_frame];
 
+  // Frames that use the DisposeOverwritePrevious method are effectively
+  // no-ops in terms of changing the starting state of a frame compared to
+  // the starting state of the previous frame, so skip over them.
+  while (prev_buffer->GetDisposalMethod() ==
+         ImageFrame::kDisposeOverwritePrevious) {
+    if (prev_frame == 0) {
+      return kNotFound;
+    }
+    prev_frame--;
+    prev_buffer = &frame_buffer_cache_[prev_frame];
+  }
+
   switch (prev_buffer->GetDisposalMethod()) {
     case ImageFrame::kDisposeNotSpecified:
     case ImageFrame::kDisposeKeep:
@@ -450,12 +462,6 @@ size_t ImageDecoder::FindRequiredPreviousFrame(size_t frame_index,
       // FIXME: Be even smarter by checking the frame sizes and/or
       // alpha-containing regions.
       return prev_frame;
-    case ImageFrame::kDisposeOverwritePrevious:
-      // Frames that use the DisposeOverwritePrevious method are effectively
-      // no-ops in terms of changing the starting state of a frame compared to
-      // the starting state of the previous frame, so skip over them and
-      // return the required previous frame of it.
-      return prev_buffer->RequiredPreviousFrameIndex();
     case ImageFrame::kDisposeOverwriteBgcolor:
       // If the previous frame fills the whole image, then the current frame
       // can be decoded alone. Likewise, if the previous frame could be
@@ -467,6 +473,7 @@ size_t ImageDecoder::FindRequiredPreviousFrame(size_t frame_index,
               (prev_buffer->RequiredPreviousFrameIndex() == kNotFound))
                  ? kNotFound
                  : prev_frame;
+    case ImageFrame::kDisposeOverwritePrevious:
     default:
       NOTREACHED();
       return kNotFound;