[Webkit-unassigned] [Bug 116494] New: Fix crash in BitmapImage::destroyDecodedData()

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=116494

           Summary: Fix crash in BitmapImage::destroyDecodedData()
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: NEW
          Keywords: BlinkMergeCandidate
          Severity: Normal
          Priority: P2
         Component: Images
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: rniwa at webkit.org
                CC: dino at apple.com, benjamin at webkit.org


Merge https://chromium.googlesource.com/chromium/blink/+/6b6887bf53068f8537908e501fdc7317ad2c6d86

In some cases, m_currentFrame may be bigger than m_frames.size().
Should limit the upper bound of the loop to m_frames.size().

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.