SDWebImage
diff --git a/‎SDWebImage/Core/SDImageIOAnimatedCoder.m‎
Lines changed: 34 additions & 18 deletions b/‎SDWebImage/Core/SDImageIOAnimatedCoder.m‎
Lines changed: 34 additions & 18 deletions
@@ -313,11 +313,20 @@ - (void)dealloc
 
 - (void)didReceiveMemoryWarning:(NSNotification *)notification
 {
+    // Incremental decoding may concurrently read/write _imageSource from the
+    // frame fetch queue and updateIncrementalData:; hold the same lock to
+    // prevent races with CGImageSourceRemoveCacheAtIndex.
+    if (_incremental) {
+        SD_LOCK(_lock);
+    }
     if (_imageSource) {
         for (size_t i = 0; i < _frameCount; i++) {
             CGImageSourceRemoveCacheAtIndex(_imageSource, i);
         }
     }
+    if (_incremental) {
+        SD_UNLOCK(_lock);
+    }
 }
 
 #pragma mark - Subclass Override
@@ -781,15 +790,20 @@ - (void)updateIncrementalData:(NSData *)data finished:(BOOL)finished {
     if (_finished) {
         return;
     }
-    _imageData = data;
-    _finished = finished;
-    
     // The following code is from http://www.cocoaintheshell.com/2011/05/progressive-images-download-imageio/
     // Thanks to the author @Nyx0uf
-    
+
+    // Lock before updating state and the image source to prevent concurrent access from the frame fetch queue.
+    // CGImageSource is not thread-safe for simultaneous read+write.
+    // _imageData and _finished must be set inside the lock so readers cannot observe
+    // _finished == YES while _imageSource still has old data.
+    SD_LOCK(_lock);
+    _imageData = data;
+    _finished = finished;
+
     // Update the data source, we must pass ALL the data, not just the new bytes
     CGImageSourceUpdateData(_imageSource, (__bridge CFDataRef)data, finished);
-    
+
     if (_width + _height == 0) {
         CFDictionaryRef properties = CGImageSourceCopyPropertiesAtIndex(_imageSource, 0, NULL);
         if (properties) {
@@ -800,12 +814,10 @@ - (void)updateIncrementalData:(NSData *)data finished:(BOOL)finished {
             CFRelease(properties);
         }
     }
-    
-    SD_LOCK(_lock);
+
     // For animated image progressive decoding because the frame count and duration may be changed.
     [self scanAndCheckFramesValidWithImageSource:_imageSource];
-    SD_UNLOCK(_lock);
-    
+
     // Scale down to limit bytes if need
     if (_limitBytes > 0) {
         // Hack since ImageIO public API (not CGImageDecompressor/CMPhoto) always return back RGBA8888 CGImage
@@ -815,23 +827,27 @@ - (void)updateIncrementalData:(NSData *)data finished:(BOOL)finished {
         _thumbnailSize = framePixelSize;
         _preserveAspectRatio = YES;
     }
+
+    SD_UNLOCK(_lock);
 }
 
 - (UIImage *)incrementalDecodedImageWithOptions:(SDImageCoderOptions *)options {
     NSCParameterAssert(_incremental);
     UIImage *image;
 
+    // Create the image
+    CGFloat scale = _scale;
+    NSNumber *scaleFactor = options[SDImageCoderDecodeScaleFactor];
+    if (scaleFactor != nil) {
+        scale = MAX([scaleFactor doubleValue], 1);
+    }
+    SD_LOCK(_lock);
     if (_width + _height > 0) {
-        // Create the image
-        CGFloat scale = _scale;
-        NSNumber *scaleFactor = options[SDImageCoderDecodeScaleFactor];
-        if (scaleFactor != nil) {
-            scale = MAX([scaleFactor doubleValue], 1);
-        }
         image = [self.class createFrameAtIndex:0 source:_imageSource scale:scale preserveAspectRatio:_preserveAspectRatio thumbnailSize:_thumbnailSize lazyDecode:_lazyDecode animatedImage:NO decodeToHDR:_finished ? _decodeToHDR : NO];
-        if (image) {
-            image.sd_imageFormat = self.class.imageFormat;
-        }
+    }
+    SD_UNLOCK(_lock);
+    if (image) {
+        image.sd_imageFormat = self.class.imageFormat;
     }
 
     return image;