Changeset 213448 in webkit

Timestamp:

Mar 6, 2017 6:19:40 AM (7 years ago)

Author:

magomez@igalia.com

Message:

[GTK] WebProcess from WebKitGtk+ 2.15.x SIGSEVs in GIFLZWContext::doLZW(unsigned char const*, unsigned long) at Source/WebCore/platform/image-decoders/gif/GIFImageReader.cpp:303
​https://bugs.webkit.org/show_bug.cgi?id=167304

Reviewed by Carlos Garcia Campos.

Add a lock to ensure that the GIFImageReader that we are using for decoding is not deleted while
the decoding thread is using it.

No new tests.

• platform/image-decoders/gif/GIFImageDecoder.cpp:

(WebCore::GIFImageDecoder::clearFrameBufferCache):

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• platform/image-decoders/gif/GIFImageDecoder.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2017-03-06  Miguel Gomez  <magomez@igalia.com>
+
+        [GTK] WebProcess from WebKitGtk+ 2.15.x SIGSEVs in GIFLZWContext::doLZW(unsigned char const*, unsigned long) at Source/WebCore/platform/image-decoders/gif/GIFImageReader.cpp:303
+        https://bugs.webkit.org/show_bug.cgi?id=167304
+
+        Reviewed by Carlos Garcia Campos.
+
+        Add a lock to ensure that the GIFImageReader that we are using for decoding is not deleted while
+        the decoding thread is using it.
+
+        No new tests.
+
+        * platform/image-decoders/gif/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::clearFrameBufferCache):
+
 2017-03-06  Antti Koivisto  <antti@apple.com>
 

trunk/Source/WebCore/platform/image-decoders/gif/GIFImageDecoder.cpp

@@ -134 +134 @@
         return; // Nothing to do.
 
+    // Lock the decodelock here, as we are going to destroy the GIFImageReader and doing so while
+    // there's an ongoing decode will cause a crash.
+    LockHolder locker(m_decodeLock);
+
     // The "-1" here is tricky.  It does not mean that |clearBeforeFrame| is the
     // last frame we wish to preserve, but rather that we never want to clear