Deferred image decoding to handle broken GIFs

With some broken animated images the decoder could report a smaller
frame number as more data is received. We should handle this edge case
by early out. The animation sequence might not be correct. That's okay
because it's a broken file.

BUG=352421

Review URL: https://codereview.chromium.org/205333004

git-svn-id: svn://svn.chromium.org/blink/trunk@169698 bbb929c8-8fbe-4397-9dbb-9b2b20218538

third_party/WebKit/Source/platform/graphics/DeferredImageDecoder.cpp

@@ -227,6 +227,11 @@ void DeferredImageDecoder::prepareLazyDecodedFrames()
 
     const size_t previousSize = m_lazyDecodedFrames.size();
     m_lazyDecodedFrames.resize(m_actualDecoder->frameCount());
+
+    // We have encountered a broken image file. Simply bail.
+    if (m_lazyDecodedFrames.size() < previousSize)
+        return;
+
     for (size_t i = previousSize; i < m_lazyDecodedFrames.size(); ++i) {
         OwnPtr<ImageFrame> frame(adoptPtr(new ImageFrame()));
         frame->setSkBitmap(createBitmap(i));

third_party/WebKit/Source/platform/graphics/DeferredImageDecoderTest.cpp

@@ -325,4 +325,17 @@ TEST_F(DeferredImageDecoderTest, decodedSize)
     EXPECT_EQ(1, m_frameBufferRequestCount);
 }
 
+TEST_F(DeferredImageDecoderTest, smallerFrameCount)
+{
+    m_frameCount = 1;
+    m_lazyDecoder->setData(m_data.get(), false);
+    EXPECT_EQ(m_frameCount, m_lazyDecoder->frameCount());
+    m_frameCount = 2;
+    m_lazyDecoder->setData(m_data.get(), false);
+    EXPECT_EQ(m_frameCount, m_lazyDecoder->frameCount());
+    m_frameCount = 0;
+    m_lazyDecoder->setData(m_data.get(), true);
+    EXPECT_EQ(m_frameCount, m_lazyDecoder->frameCount());
+}
+
 } // namespace WebCore