Bug 298717 ��� Crash on multipart/x-mixed-replace: gif,jpeg,jpeg sequence [@ nsJPEGDecoder::OutputScanlines][@ gdk_rgb_convert_0888][@ gdk_rgb_init], patch by andrew smith <asmith15@learn.senecac.on.ca>, r+sr=pavlov, a1.9=itsablocker

gfx/src/shared/gfxImageFrame.cpp

@@ -270,8 +270,6 @@ NS_IMETHODIMP gfxImageFrame::GetImageData(PRUint8 **aData, PRUint32 *length)
   if (!mInitialized)
     return NS_ERROR_NOT_INITIALIZED;
 
-  NS_ASSERTION(mMutable, "trying to get data on an immutable frame");
-
   *aData = mImage->GetBits();
   *length = mImage->GetLineStride() * mSize.height;
 

gfx/src/thebes/nsThebesImage.cpp

@@ -319,6 +319,10 @@ nsThebesImage::UnlockImagePixels(PRBool aMaskPixels)
     if (aMaskPixels)
         return NS_ERROR_NOT_IMPLEMENTED;
     if (mImageSurface && mOptSurface) {
+        nsRefPtr<gfxContext> context = new gfxContext(mOptSurface);
+        context->SetOperator(gfxContext::OPERATOR_SOURCE);
+        context->SetSource(mImageSurface);
+        context->Paint();
         // Don't need the pixel data anymore
         mImageSurface = nsnull;
     }

modules/libpr0n/decoders/jpeg/nsJPEGDecoder.cpp

@@ -555,6 +555,8 @@ nsJPEGDecoder::OutputScanlines()
   const PRUint32 top = mInfo.output_scanline;
   PRBool rv = PR_TRUE;
 
+  mFrame->LockImageData();
+  
   // we're thebes. we can write stuff directly to the data
   PRUint8 *imageData;
   PRUint32 imageDataLength;
@@ -605,7 +607,9 @@ nsJPEGDecoder::OutputScanlines()
       img->ImageUpdated(nsnull, nsImageUpdateFlags_kBitsChanged, &r);
       mObserver->OnDataAvailable(nsnull, mFrame, &r);
   }
-
+  
+  mFrame->UnlockImageData();
+  
   return rv;
 }