Bug 411874 - "Crash [@ ffff068b nsGIFDecoder2::EndImageFrame] while loading MySpace page (hard to repro)" [p=alfredkayser@gmail.com (Alfred Kayser) r=stuart a1.9=schrep]
authorreed@reedloden.com
Fri, 18 Jan 2008 23:00:24 -0800
changeset 10433 f78bd6803a42108b1208e09b56a782cd37f122c9
parent 10432 90fb8862e4ac560ce2bf4e3c9d670038f302397c
child 10434 b9c40f39aaf9e3e406c3979c3e1f8784d018a5aa
push id1
push userbsmedberg@mozilla.com
push dateThu, 20 Mar 2008 16:49:24 +0000
treeherdermozilla-central@61007906a1f8 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersstuart
bugs411874
milestone1.9b3pre
Bug 411874 - "Crash [@ ffff068b nsGIFDecoder2::EndImageFrame] while loading MySpace page (hard to repro)" [p=alfredkayser@gmail.com (Alfred Kayser) r=stuart a1.9=schrep]
modules/libpr0n/decoders/gif/nsGIFDecoder2.cpp
--- a/modules/libpr0n/decoders/gif/nsGIFDecoder2.cpp
+++ b/modules/libpr0n/decoders/gif/nsGIFDecoder2.cpp
@@ -390,17 +390,17 @@ void nsGIFDecoder2::EndImageFrame()
   }
   mCurrentRow = mLastFlushedRow = -1;
   mCurrentPass = mLastFlushedPass = 0;
 
   // Only add frame if we have any rows at all
   if (mGIFStruct.rows_remaining != mGIFStruct.height) {
     if (mGIFStruct.rows_remaining && mGIFStruct.images_decoded) {
       // Clear the remaining rows (only needed for the animation frames)
-      PRUint8 *rowp = mImageData + ((mGIFStruct.rows_remaining - mGIFStruct.height) * mGIFStruct.width);
+      PRUint8 *rowp = mImageData + ((mGIFStruct.height - mGIFStruct.rows_remaining) * mGIFStruct.width);
       memset(rowp, 0, mGIFStruct.rows_remaining * mGIFStruct.width);
     }
 
     // We actually have the timeout information before we get the lzw encoded 
     // image data, at least according to the spec, but we delay in setting the 
     // timeout for the image until here to help ensure that we have the whole 
     // image frame decoded before we go off and try to display another frame.
     mImageFrame->SetTimeout(mGIFStruct.delay_time);