bug 110076 r=biesi sr=tor a=roc+moz Access violation in Trunk M100 N70PR1 [@ imgContainer::StartAnimation]

modules/libpr0n/decoders/gif/imgContainerGIF.cpp

@@ -186,28 +186,16 @@ NS_IMETHODIMP imgContainerGIF::AppendFrame(gfxIImageFrame *item)
       BuildCompositeMask(mCompositingFrame, firstFrame);
     }
   }
-  // If this is our second frame, init a timer so we don't display
-  // the next frame until the delay timer has expired for the current
-  // frame.
 
-  if (!mTimer && (numFrames >= 1)) {
+  if (numFrames > 0) {
-      PRInt32 timeout;
+    // If this is our second frame, init a timer so we don't display
-      nsCOMPtr<gfxIImageFrame> currentFrame;
+    // the next frame until the delay timer has expired for the current
-      inlinedGetFrameAt(mCurrentDecodingFrameIndex, getter_AddRefs(currentFrame));
+    // frame.
-      currentFrame->GetTimeout(&timeout);
+    if (!mAnimating)
-      if (timeout > 0) { // -1 means display this frame forever
+      StartAnimation();
-
+    mCurrentDecodingFrameIndex++;
-        if (mAnimating) {
-          // Since we have more than one frame we need a timer
-          mTimer = do_CreateInstance("@mozilla.org/timer;1");
-          mTimer->InitWithCallback(NS_STATIC_CAST(nsITimerCallback*, this),
-                                   timeout, nsITimer::TYPE_REPEATING_SLACK);
-        }
-      }
   }
 
-  if (numFrames > 0) mCurrentDecodingFrameIndex++;
-
   mCurrentFrameIsFinishedDecoding = PR_FALSE;
 
   return mFrames.AppendElement(NS_STATIC_CAST(nsISupports*, item));
@@ -234,7 +222,6 @@ NS_IMETHODIMP imgContainerGIF::EndFrameDecode(PRUint32 aFrameNum, PRUint32 aTime
 
   currentFrame->SetTimeout(aTimeout);
 
-  StartAnimation();
   return NS_OK;
 }
 
@@ -299,40 +286,33 @@ NS_IMETHODIMP imgContainerGIF::SetAnimationMode(PRUint16 aAnimationMode)
 /* void startAnimation () */
 NS_IMETHODIMP imgContainerGIF::StartAnimation()
 {
-  if (mAnimationMode == kDontAnimMode)      // don't animate
+  if (mAnimationMode == kDontAnimMode)
-  {
-    mAnimating = PR_FALSE;
     return NS_OK;
-  }
 
-  mAnimating = PR_TRUE;
+  if (mAnimating || mTimer)
-
-  if (mTimer)
     return NS_OK;
 
   PRUint32 numFrames = inlinedGetNumFrames();
-
   if (numFrames > 1) {
     PRInt32 timeout;
     nsCOMPtr<gfxIImageFrame> currentFrame;
+
     inlinedGetCurrentFrame(getter_AddRefs(currentFrame));
-    if (currentFrame) {
+    if (currentFrame)
       currentFrame->GetTimeout(&timeout);
-      if (timeout > 0) { // -1 means display this frame forever
+    else
+      timeout = 100; // XXX hack.. the timer notify code will do the right thing,
+                     // so just get that started
 
-        mAnimating = PR_TRUE;
+    if (timeout > 0) { // -1 means display this frame forever
-        if (!mTimer) mTimer = do_CreateInstance("@mozilla.org/timer;1");
+      mTimer = do_CreateInstance("@mozilla.org/timer;1");
+      if (!mTimer)
+        return NS_ERROR_OUT_OF_MEMORY;
 
-        mTimer->InitWithCallback(NS_STATIC_CAST(nsITimerCallback*, this),
+      // The only way mAnimating becomes true is if the mTimer is created
-                                 timeout, nsITimer::TYPE_REPEATING_SLACK);
-      }
-    } else {
-      // XXX hack.. the timer notify code will do the right thing, so just get that started
       mAnimating = PR_TRUE;
-      if (!mTimer) mTimer = do_CreateInstance("@mozilla.org/timer;1");
-
       mTimer->InitWithCallback(NS_STATIC_CAST(nsITimerCallback*, this),
-                               100, nsITimer::TYPE_REPEATING_SLACK);
+                               timeout, nsITimer::TYPE_REPEATING_SLACK);
     }
   }