From 05d56705c8f8d8d196e428243dad1480ffaaac2c Mon Sep 17 00:00:00 2001 From: "philringnalda%gmail.com" Date: Sun, 26 Aug 2007 04:38:18 +0000 Subject: [PATCH] =?UTF-8?q?Bug=20298717=20=C3=A2=C2=80=C2=93=20Crash=20on?= =?UTF-8?q?=20multipart/x-mixed-replace:=20gif,jpeg,jpeg=20sequence=20[@?= =?UTF-8?q?=20nsJPEGDecoder::OutputScanlines][@=20gdk=5Frgb=5Fconvert=5F08?= =?UTF-8?q?88][@=20gdk=5Frgb=5Finit],=20patch=20by=20andrew=20smith=20,=20r+sr=3Dpavlov,=20a1.9=3Ditsablock?= =?UTF-8?q?er?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit git-svn-id: svn://10.0.0.236/trunk@233095 18797224-902f-48f8-a5cc-f745e15eee43 --- mozilla/gfx/src/shared/gfxImageFrame.cpp | 2 -- mozilla/gfx/src/thebes/nsThebesImage.cpp | 4 ++++ mozilla/modules/libpr0n/decoders/jpeg/nsJPEGDecoder.cpp | 6 +++++- 3 files changed, 9 insertions(+), 3 deletions(-) diff --git a/mozilla/gfx/src/shared/gfxImageFrame.cpp b/mozilla/gfx/src/shared/gfxImageFrame.cpp index 53d72d1fbd4..6194105fef3 100644 --- a/mozilla/gfx/src/shared/gfxImageFrame.cpp +++ b/mozilla/gfx/src/shared/gfxImageFrame.cpp @@ -270,8 +270,6 @@ NS_IMETHODIMP gfxImageFrame::GetImageData(PRUint8 **aData, PRUint32 *length) if (!mInitialized) return NS_ERROR_NOT_INITIALIZED; - NS_ASSERTION(mMutable, "trying to get data on an immutable frame"); - *aData = mImage->GetBits(); *length = mImage->GetLineStride() * mSize.height; diff --git a/mozilla/gfx/src/thebes/nsThebesImage.cpp b/mozilla/gfx/src/thebes/nsThebesImage.cpp index 164ff80ddf6..8b968fbb335 100644 --- a/mozilla/gfx/src/thebes/nsThebesImage.cpp +++ b/mozilla/gfx/src/thebes/nsThebesImage.cpp @@ -319,6 +319,10 @@ nsThebesImage::UnlockImagePixels(PRBool aMaskPixels) if (aMaskPixels) return NS_ERROR_NOT_IMPLEMENTED; if (mImageSurface && mOptSurface) { + nsRefPtr context = new gfxContext(mOptSurface); + context->SetOperator(gfxContext::OPERATOR_SOURCE); + context->SetSource(mImageSurface); + context->Paint(); // Don't need the pixel data anymore mImageSurface = nsnull; } diff --git a/mozilla/modules/libpr0n/decoders/jpeg/nsJPEGDecoder.cpp b/mozilla/modules/libpr0n/decoders/jpeg/nsJPEGDecoder.cpp index 0a16c4b008b..e6c39f34079 100644 --- a/mozilla/modules/libpr0n/decoders/jpeg/nsJPEGDecoder.cpp +++ b/mozilla/modules/libpr0n/decoders/jpeg/nsJPEGDecoder.cpp @@ -555,6 +555,8 @@ nsJPEGDecoder::OutputScanlines() const PRUint32 top = mInfo.output_scanline; PRBool rv = PR_TRUE; + mFrame->LockImageData(); + // we're thebes. we can write stuff directly to the data PRUint8 *imageData; PRUint32 imageDataLength; @@ -605,7 +607,9 @@ nsJPEGDecoder::OutputScanlines() img->ImageUpdated(nsnull, nsImageUpdateFlags_kBitsChanged, &r); mObserver->OnDataAvailable(nsnull, mFrame, &r); } - + + mFrame->UnlockImageData(); + return rv; }