Changeset 70392 in webkit

Timestamp:

Oct 23, 2010 9:48:02 AM (14 years ago)

Author:

abarth@webkit.org

Message:

2010-10-23 Adam Barth <​abarth@webkit.org>

Reviewed by Andreas Kling.

WebP decoding hits ASSERT
​https://bugs.webkit.org/show_bug.cgi?id=48168

Calling reserveCapacity only allocates the memory. It doesn't actually
set the length. When you try to access the zeroth element, you hit an
ASSERT.

Covered by fast/images/webp-image-decoding.html in debug.

• platform/image-decoders/webp/WEBPImageDecoder.cpp: (WebCore::WEBPImageDecoder::decode):

Location:

trunk/WebCore

Files:

• ChangeLog (modified) (1 diff)
• platform/image-decoders/webp/WEBPImageDecoder.cpp (modified) (1 diff)

trunk/WebCore/ChangeLog

@@ +1 @@
+2010-10-23  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        WebP decoding hits ASSERT
+        https://bugs.webkit.org/show_bug.cgi?id=48168
+
+        Calling reserveCapacity only allocates the memory.  It doesn't actually
+        set the length.  When you try to access the zeroth element, you hit an
+        ASSERT.
+
+        Covered by fast/images/webp-image-decoding.html in debug.
+
+        * platform/image-decoders/webp/WEBPImageDecoder.cpp:
+        (WebCore::WEBPImageDecoder::decode):
+
 2010-10-23  Martin Robinson  <mrobinson@igalia.com>
 

trunk/WebCore/platform/image-decoders/webp/WEBPImageDecoder.cpp

@@ -104 +104 @@
     const int stride = width * bytesPerPixel;
     Vector<uint8_t> rgb;
-    rgb.reserveCapacity(height * stride);
-    if (!WebPDecodeBGRInto(dataBytes, dataSize, &rgb[0], height * stride, stride))
+    rgb.resize(height * stride);
+    if (!WebPDecodeBGRInto(dataBytes, dataSize, rgb.data(), rgb.size(), stride))
         return setFailed();
     // FIXME: remove this data copy.