mirror of
https://github.com/LadybirdBrowser/ladybird
synced 2026-04-25 17:25:08 +02:00
1193409f64
HTMLImageElement's update-the-image-data step 16 queues its state transition and load event dispatch via a 1 ms BatchingDispatcher, so the current request does not become CompletelyAvailable synchronously when the fetch finishes. decode()'s on_finish callback, however, was queuing its resolve task directly on the event loop, bypassing the batch. That race meant decode() could resolve while the image request was still in Unavailable state, so any .then() handler inspecting img.width / img.height (or anything derived from the bitmap) would see zeros. Google Maps hits this on its .9.png road shield icons: after awaiting img.decode() it reads a.width / a.height and calls ctx.getImageData(0, 0, 0, 0), which throws IndexSizeError and aborts the tile rendering pipeline. Route decode()'s on_finish through the same BatchingDispatcher so both are processed in the same batch, with the decode resolution queued after step 16's element task.