GIFImageDecoder.cpp (both the skia and Cairo versions) has a memory smashing bug. This doesn't affect Safari, but is a topcrash cause for the Chromium trunk. The problem is that clearFrameBufferCache() assumes it only needs to worry about preserving the last complete frame, but initFrameBuffer() and other functions can skip over frames with a DisposeOverwritePrevious disposal method to find prior complete frames. So the code in clearFrameBufferCache() needs to get more complex to take this into account. Additionally, to avoid wasting more memory than we need to, RGBA32Buffer::clear() should only clear the minimum amount of metadata it needs to, because various functions will still need other data after the framebuffer itself is no longer necessary. If we don't change clear() we'd need to clear fewer frames. Patch coming shortly.