<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>122462</bug_id>
          
          <creation_ts>2013-10-07 12:17:49 -0700</creation_ts>
          <short_desc>sunspider-1.0/math-spectral-norm.js.dfg-eager occasionally fails with Trap 5 (i.e int $3)</short_desc>
          <delta_ts>2013-10-11 21:09:45 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>JavaScriptCore</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>All</rep_platform>
          <op_sys>All</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords></keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Filip Pizlo">fpizlo</reporter>
          <assigned_to name="Filip Pizlo">fpizlo</assigned_to>
          <cc>ap</cc>
    
    <cc>barraclough</cc>
    
    <cc>ggaren</cc>
    
    <cc>mark.lam</cc>
    
    <cc>mhahnenberg</cc>
    
    <cc>msaboff</cc>
    
    <cc>nrotem</cc>
    
    <cc>oliver</cc>
    
    <cc>sam</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>937179</commentid>
    <comment_count>0</comment_count>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2013-10-07 12:17:49 -0700</bug_when>
    <thetext>I see it when running with Tools/Scripts/run-javascriptcore-tests --debug --ftl-jit</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>937198</commentid>
    <comment_count>1</comment_count>
    <who name="Mark Lam">mark.lam</who>
    <bug_when>2013-10-07 12:53:03 -0700</bug_when>
    <thetext>I&apos;m seeing SIGTRAPs reloading https://github.com/WebKit/webkit while debugging https://bugs.webkit.org/show_bug.cgi?id=122445.  Could be the same issue.  FYI.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>937199</commentid>
    <comment_count>2</comment_count>
    <who name="Mark Lam">mark.lam</who>
    <bug_when>2013-10-07 12:53:40 -0700</bug_when>
    <thetext>(In reply to comment #1)
&gt; I&apos;m seeing SIGTRAPs reloading https://github.com/WebKit/webkit while debugging https://bugs.webkit.org/show_bug.cgi?id=122445.  Could be the same issue.  FYI.

Sorry.  The interesting point here is that I&apos;m not running with the FTL JIT.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>937249</commentid>
    <comment_count>3</comment_count>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2013-10-07 15:47:15 -0700</bug_when>
    <thetext>(In reply to comment #2)
&gt; (In reply to comment #1)
&gt; &gt; I&apos;m seeing SIGTRAPs reloading https://github.com/WebKit/webkit while debugging https://bugs.webkit.org/show_bug.cgi?id=122445.  Could be the same issue.  FYI.
&gt; 
&gt; Sorry.  The interesting point here is that I&apos;m not running with the FTL JIT.

No.  The test fails in the DFG.  So it could be the same issue.

I only point out that I&apos;m building with --ftl-jit since this is a heisenbug that triggers very rarely, so building with the FTL JIT *might* have something to do with it.  Or it might not.  Who knows - it&apos;s a heisenbug.  But it&apos;s not an FTL bug because that test definitely doesn&apos;t tier-up to the FTL.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>937250</commentid>
    <comment_count>4</comment_count>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2013-10-07 15:48:24 -0700</bug_when>
    <thetext>(In reply to comment #3)
&gt; (In reply to comment #2)
&gt; &gt; (In reply to comment #1)
&gt; &gt; &gt; I&apos;m seeing SIGTRAPs reloading https://github.com/WebKit/webkit while debugging https://bugs.webkit.org/show_bug.cgi?id=122445.  Could be the same issue.  FYI.
&gt; &gt; 
&gt; &gt; Sorry.  The interesting point here is that I&apos;m not running with the FTL JIT.
&gt; 
&gt; No.  The test fails in the DFG.  So it could be the same issue.
&gt; 
&gt; I only point out that I&apos;m building with --ftl-jit since this is a heisenbug that triggers very rarely, so building with the FTL JIT *might* have something to do with it.  Or it might not.  Who knows - it&apos;s a heisenbug.  But it&apos;s not an FTL bug because that test definitely doesn&apos;t tier-up to the FTL.

I should also note that a trap is the way that the DFG does JIT assertions.  So saying that your bug is the same as this bug because it traps in JIT code is like saying that some ASSERT() failure that you saw is a duplicate of another ASSERT() failure just because both bugs involved ASSERT().</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>937251</commentid>
    <comment_count>5</comment_count>
    <who name="Mark Lam">mark.lam</who>
    <bug_when>2013-10-07 15:49:46 -0700</bug_when>
    <thetext>(In reply to comment #4)
&gt; I should also note that a trap is the way that the DFG does JIT assertions.  So saying that your bug is the same as this bug because it traps in JIT code is like saying that some ASSERT() failure that you saw is a duplicate of another ASSERT() failure just because both bugs involved ASSERT().

I see.  So, the two may not be related at all.  Thanks for the clarification.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>938932</commentid>
    <comment_count>6</comment_count>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2013-10-11 12:30:25 -0700</bug_when>
    <thetext>*** Bug 122665 has been marked as a duplicate of this bug. ***</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>938942</commentid>
    <comment_count>7</comment_count>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2013-10-11 13:05:50 -0700</bug_when>
    <thetext>This looks like a missing type check.  Even according to the abstract state, the first operand of the DFG GetByVal Int32 is not known to have Int32Shape.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>938953</commentid>
    <comment_count>8</comment_count>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2013-10-11 13:24:41 -0700</bug_when>
    <thetext>The type check is being eliminated by constant folding.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>938965</commentid>
    <comment_count>9</comment_count>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2013-10-11 14:04:49 -0700</bug_when>
    <thetext>Here&apos;s what&apos;s happening: DFG OSR entry checks if it can enter at a given loop by looking at what the DFG&apos;s abstract interpreter (AI) proved about all values on the stack.  If the values on the stack don&apos;t contravene the proof, then we can enter.

But to increase the likelihood that the AI won&apos;t construct a proof that makes it impossible for the current values on the stack to &quot;fit&quot;, the AI will inject the values on the stack that were seen at the beginning of compilation at some basic block that is the DFG&apos;s guess of where we&apos;ll OSR enter.  This is through the DFG::Plan::mustHandleValues.

Unfrotunately, mustHandleValues are JSValues.  The DFG AI does the injection by converting the JSValues into AbstractValues, and it may do this more than once.  But the JSValues may be heap pointers, so each time you do it, you might get different structures, resulting in contradictory AbstractValues.  Hence multiple runs of the DFG AI may contract each other, leading to one run of AI removing type checks for some type T and another run of AI deciding that some different type S is legal; OSR entry then feels that it&apos;s OK to enter with type S, even though the graph requires type T.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>938973</commentid>
    <comment_count>10</comment_count>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2013-10-11 14:37:20 -0700</bug_when>
    <thetext>Fixing that appears to reduce the likelihood of crashes, but there is still something else going on that leads to type check being removed.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>938975</commentid>
    <comment_count>11</comment_count>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2013-10-11 14:44:06 -0700</bug_when>
    <thetext>Oh boo, in some cases we&apos;re proving that the only way to enter the loop is via OSR.  And then we&apos;re constant folding every use of the variable whose type morphs.  The constant folder is now folding based on the AbstractValue from before when the type morphed.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>938983</commentid>
    <comment_count>12</comment_count>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2013-10-11 15:24:48 -0700</bug_when>
    <thetext>Well, the constant folder has a really fun bug: lets say we&apos;ve proven that a node has a constant object value and that object must have a particular structure.  And then we replace that node with a constant.

That&apos;s wrong.

The JSConstant that we introduce into the graph could then have any structure, and previously we would have removed checks for the particular structure.

The solution is to not constant fold objects if we&apos;ve proven a particular structure.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>939000</commentid>
    <comment_count>13</comment_count>
      <attachid>214033</attachid>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2013-10-11 16:10:11 -0700</bug_when>
    <thetext>Created attachment 214033
the patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>939002</commentid>
    <comment_count>14</comment_count>
      <attachid>214033</attachid>
    <who name="Mark Hahnenberg">mhahnenberg</who>
    <bug_when>2013-10-11 16:21:25 -0700</bug_when>
    <thetext>Comment on attachment 214033
the patch

View in context: https://bugs.webkit.org/attachment.cgi?id=214033&amp;action=review

r=me

&gt; Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp:342
&gt; +            // we&apos;ve proven for this node wouldn&apos;t widen the proof. If so, then we cannot

Aren&apos;t we checking if it *would* widen the proof, and then skipping over if it does? As I understand it, proofs are supposed to get narrower and narrower as we prove more and more things, right?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>939004</commentid>
    <comment_count>15</comment_count>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2013-10-11 16:25:56 -0700</bug_when>
    <thetext>(In reply to comment #14)
&gt; (From update of attachment 214033 [details])
&gt; View in context: https://bugs.webkit.org/attachment.cgi?id=214033&amp;action=review
&gt; 
&gt; r=me
&gt; 
&gt; &gt; Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp:342
&gt; &gt; +            // we&apos;ve proven for this node wouldn&apos;t widen the proof. If so, then we cannot
&gt; 
&gt; Aren&apos;t we checking if it *would* widen the proof, and then skipping over if it does? As I understand it, proofs are supposed to get narrower and narrower as we prove more and more things, right?

Yeah I meant to say something exactly like what you said.  I&apos;ll change the text to:

            // Check if merging the abstract value of the constant into the abstract value
            // we&apos;ve proven for this node wouldn&apos;t widen the proof. If it widens the proof
            // (i.e. says that the set contains more things in it than it previously did)
            // then we refuse to fold.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>939005</commentid>
    <comment_count>16</comment_count>
    <who name="Mark Hahnenberg">mhahnenberg</who>
    <bug_when>2013-10-11 16:28:19 -0700</bug_when>
    <thetext>(In reply to comment #15)
&gt; (In reply to comment #14)
&gt; &gt; (From update of attachment 214033 [details] [details])
&gt; &gt; View in context: https://bugs.webkit.org/attachment.cgi?id=214033&amp;action=review
&gt; &gt; 
&gt; &gt; r=me
&gt; &gt; 
&gt; &gt; &gt; Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp:342
&gt; &gt; &gt; +            // we&apos;ve proven for this node wouldn&apos;t widen the proof. If so, then we cannot
&gt; &gt; 
&gt; &gt; Aren&apos;t we checking if it *would* widen the proof, and then skipping over if it does? As I understand it, proofs are supposed to get narrower and narrower as we prove more and more things, right?
&gt; 
&gt; Yeah I meant to say something exactly like what you said.  I&apos;ll change the text to:
&gt; 
&gt;             // Check if merging the abstract value of the constant into the abstract value
&gt;             // we&apos;ve proven for this node wouldn&apos;t widen the proof. If it widens the proof
&gt;             // (i.e. says that the set contains more things in it than it previously did)
&gt;             // then we refuse to fold.

Sounds good to me.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>939023</commentid>
    <comment_count>17</comment_count>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2013-10-11 18:35:03 -0700</bug_when>
    <thetext>Landed in http://trac.webkit.org/changeset/157327</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>939050</commentid>
    <comment_count>18</comment_count>
    <who name="Nadav Rotem">nrotem</who>
    <bug_when>2013-10-11 21:09:45 -0700</bug_when>
    <thetext>Thanks. This test was also failing for me from time to time.</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>214033</attachid>
            <date>2013-10-11 16:10:11 -0700</date>
            <delta_ts>2013-10-11 16:21:25 -0700</delta_ts>
            <desc>the patch</desc>
            <filename>blah.patch</filename>
            <type>text/plain</type>
            <size>5654</size>
            <attacher name="Filip Pizlo">fpizlo</attacher>
            
              <data encoding="base64">SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291
cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTU3MzIyKQorKysgU291cmNl
L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDM1IEBA
CisyMDEzLTEwLTExICBGaWxpcCBQaXpsbyAgPGZwaXpsb0BhcHBsZS5jb20+CisKKyAgICAgICAg
c3Vuc3BpZGVyLTEuMC9tYXRoLXNwZWN0cmFsLW5vcm0uanMuZGZnLWVhZ2VyIG9jY2FzaW9uYWxs
eSBmYWlscyB3aXRoIFRyYXAgNSAoaS5lIGludCAkMykKKyAgICAgICAgaHR0cHM6Ly9idWdzLndl
YmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTEyMjQ2MgorCisgICAgICAgIFJldmlld2VkIGJ5IE5P
Qk9EWSAoT09QUyEpLgorICAgICAgICAKKyAgICAgICAgVGhpcyBmaXhlcyB0d28gYnVncywgYm90
aCBvZiB3aGljaCBsZWQgdG8gR2V0QnlWYWwgb24gSW50MzIgdHJhcHBpbmcgYmVjYXVzZSB0aGUK
KyAgICAgICAgYXJyYXkgbm8gbG9uZ2VyIGhhZCBJbnQzMiBzaGFwZSBidXQgdGhlIGNoZWNrIHdh
c24ndCBleGVjdXRlZDoKKyAgICAgICAgCisgICAgICAgIDEpIFdlIHdlcmVuJ3Qgc25hcHNob3R0
aW5nIHRoZSBzdHJ1Y3R1cmVzIG9mIG11c3RIYW5kbGVWYWx1ZXMuIFRoaXMgbGVkIHRvIGFuIGF3
ZXNvbWUKKyAgICAgICAgICAgcmFjZSB3aGVyZSBpZiBhIG11c3RIYW5kbGVWYWx1ZSBKU1ZhbHVl
J3Mgc3RydWN0dXJlIGNoYW5nZWQgb24gdGhlIG1haW4gdGhyZWFkCisgICAgICAgICAgIGJldHdl
ZW4gcnVucyBvZiB0aGUgQUksIHRoZSBBSSB3b3VsZCBjb250cmFkaWN0IGVhY2ggb3RoZXIgYW5k
IHRoaW5ncyB3b3VsZCBqdXN0CisgICAgICAgICAgIGdldCBjb3JydXB0ZWQgaW4gZnVubnkgd2F5
cy4KKyAgICAgICAgCisgICAgICAgIDIpIFRoZSBjb25zdGFudCBmb2xkZXIgaGFzIGEgbG9uZyBz
dGFuZGluZyBidWchIEl0IHdpbGwgZm9sZCBhIG5vZGUgdG8gYSBjb25zdGFudCBpZgorICAgICAg
ICAgICB0aGUgQUkgcHJvdmVkIGl0IHRvIGJlIGEgY29uc3RhbnQuIEJ1dCBpdCdzIHBvc3NpYmxl
IHRoYXQgdGhlIG9yaWdpbmFsIG5vZGUgYWxzbworICAgICAgICAgICBwcm92ZWQgdGhpbmdzIGFi
b3V0IHRoZSBjb25zdGFudCdzIHN0cnVjdHVyZS4gSW4gdGhhdCBjYXNlICJmb2xkaW5nIiB0byBh
CisgICAgICAgICAgIEpTQ29uc3RhbnQgYWN0dWFsbHkgbG9zZXMgaW5mb3JtYXRpb24gc2luY2Ug
SlNDb25zdGFudCBkb2Vzbid0IGd1YXJhbnRlZSBhbnl0aGluZworICAgICAgICAgICBhYm91dCBh
IGNvbnN0YW50J3Mgc3RydWN0dXJlLiBUaGVyZSBhcmUgdmFyaW91cyB0aGluZ3Mgd2UgY291bGQg
ZG8gaGVyZSB0byBlbnN1cmUKKyAgICAgICAgICAgdGhhdCBhIGZvbGRlZCBjb25zdGFudCdzIHN0
cnVjdHVyZSBkb2Vzbid0IGNoYW5nZSwgYW5kIHRoYXQgaWYgaXQgZG9lcywgd2UKKyAgICAgICAg
ICAgZGVvcHRpbWl6ZSB0aGUgY29kZS4gQnV0IGZvciBub3cgd2UgY2FuIGp1c3QgbWFrZSB0aGlz
IHNvdW5kIGJ5IGRpc2FibGluZyBmb2xkaW5nCisgICAgICAgICAgIGluIHRoaXMgcGF0aG9sb2dp
Y2FsIGNhc2UuCisKKyAgICAgICAgKiBkZmcvREZHQ29uc3RhbnRGb2xkaW5nUGhhc2UuY3BwOgor
ICAgICAgICAoSlNDOjpERkc6OkNvbnN0YW50Rm9sZGluZ1BoYXNlOjpmb2xkQ29uc3RhbnRzKToK
KyAgICAgICAgKiBkZmcvREZHR3JhcGguY3BwOgorICAgICAgICAoSlNDOjpERkc6OkdyYXBoOjpH
cmFwaCk6CisgICAgICAgICogZGZnL0RGR0dyYXBoLmg6CisgICAgICAgICogZGZnL0RGR0luUGxh
Y2VBYnN0cmFjdFN0YXRlLmNwcDoKKyAgICAgICAgKEpTQzo6REZHOjpJblBsYWNlQWJzdHJhY3RT
dGF0ZTo6aW5pdGlhbGl6ZSk6CisKIDIwMTMtMTAtMTEgIENvbW1pdCBRdWV1ZSAgPGNvbW1pdC1x
dWV1ZUB3ZWJraXQub3JnPgogCiAgICAgICAgIFVucmV2aWV3ZWQsIHJvbGxpbmcgb3V0IHIxNTcz
MDcuCkluZGV4OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR0NvbnN0YW50Rm9sZGluZ1Bo
YXNlLmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR0NvbnN0
YW50Rm9sZGluZ1BoYXNlLmNwcAkocmV2aXNpb24gMTU3MzA5KQorKysgU291cmNlL0phdmFTY3Jp
cHRDb3JlL2RmZy9ERkdDb25zdGFudEZvbGRpbmdQaGFzZS5jcHAJKHdvcmtpbmcgY29weSkKQEAg
LTMzNyw2ICszMzcsMTUgQEAgcHJpdmF0ZToKICAgICAgICAgICAgIEpTVmFsdWUgdmFsdWUgPSBt
X3N0YXRlLmZvck5vZGUobm9kZSkudmFsdWUoKTsKICAgICAgICAgICAgIGlmICghdmFsdWUpCiAg
ICAgICAgICAgICAgICAgY29udGludWU7CisgICAgICAgICAgICAKKyAgICAgICAgICAgIC8vIENo
ZWNrIGlmIG1lcmdpbmcgdGhlIGFic3RyYWN0IHZhbHVlIG9mIHRoZSBjb25zdGFudCBpbnRvIHRo
ZSBhYnN0cmFjdCB2YWx1ZQorICAgICAgICAgICAgLy8gd2UndmUgcHJvdmVuIGZvciB0aGlzIG5v
ZGUgd291bGRuJ3Qgd2lkZW4gdGhlIHByb29mLiBJZiBzbywgdGhlbiB3ZSBjYW5ub3QKKyAgICAg
ICAgICAgIC8vIGZvbGQuCisgICAgICAgICAgICBBYnN0cmFjdFZhbHVlIG9sZFZhbHVlID0gbV9z
dGF0ZS5mb3JOb2RlKG5vZGUpOworICAgICAgICAgICAgQWJzdHJhY3RWYWx1ZSBjb25zdGFudFZh
bHVlOworICAgICAgICAgICAgY29uc3RhbnRWYWx1ZS5zZXQobV9ncmFwaCwgdmFsdWUpOworICAg
ICAgICAgICAgaWYgKG9sZFZhbHVlLm1lcmdlKGNvbnN0YW50VmFsdWUpKQorICAgICAgICAgICAg
ICAgIGNvbnRpbnVlOwogICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgQ29kZU9yaWdpbiBj
b2RlT3JpZ2luID0gbm9kZS0+Y29kZU9yaWdpbjsKICAgICAgICAgICAgIEFkamFjZW5jeUxpc3Qg
Y2hpbGRyZW4gPSBub2RlLT5jaGlsZHJlbjsKSW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9k
ZmcvREZHR3JhcGguY3BwCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9kZmcv
REZHR3JhcGguY3BwCShyZXZpc2lvbiAxNTczMDkpCisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUv
ZGZnL0RGR0dyYXBoLmNwcAkod29ya2luZyBjb3B5KQpAQCAtNTQsNiArNTQsNyBAQCBHcmFwaDo6
R3JhcGgoVk0mIHZtLCBQbGFuJiBwbGFuLCBMb25nTGl2CiAgICAgLCBtX2NvZGVCbG9jayhtX3Bs
YW4uY29kZUJsb2NrLmdldCgpKQogICAgICwgbV9wcm9maWxlZEJsb2NrKG1fY29kZUJsb2NrLT5h
bHRlcm5hdGl2ZSgpKQogICAgICwgbV9hbGxvY2F0b3IobG9uZ0xpdmVkU3RhdGUubV9hbGxvY2F0
b3IpCisgICAgLCBtX211c3RIYW5kbGVBYnN0cmFjdFZhbHVlcyhPcGVyYW5kc0xpa2UsIHBsYW4u
bXVzdEhhbmRsZVZhbHVlcykKICAgICAsIG1faW5saW5lQ2FsbEZyYW1lcyhhZG9wdFB0cihuZXcg
SW5saW5lQ2FsbEZyYW1lU2V0KCkpKQogICAgICwgbV9oYXNBcmd1bWVudHMoZmFsc2UpCiAgICAg
LCBtX25leHRNYWNoaW5lTG9jYWwoMCkKQEAgLTY0LDYgKzY1LDkgQEAgR3JhcGg6OkdyYXBoKFZN
JiB2bSwgUGxhbiYgcGxhbiwgTG9uZ0xpdgogICAgICwgbV9yZWZDb3VudFN0YXRlKEV2ZXJ5dGhp
bmdJc0xpdmUpCiB7CiAgICAgQVNTRVJUKG1fcHJvZmlsZWRCbG9jayk7CisgICAgCisgICAgZm9y
ICh1bnNpZ25lZCBpID0gbV9tdXN0SGFuZGxlQWJzdHJhY3RWYWx1ZXMuc2l6ZSgpOyBpLS07KQor
ICAgICAgICBtX211c3RIYW5kbGVBYnN0cmFjdFZhbHVlc1tpXS5zZXRNb3N0U3BlY2lmaWMoKnRo
aXMsIHBsYW4ubXVzdEhhbmRsZVZhbHVlc1tpXSk7CiB9CiAKIEdyYXBoOjp+R3JhcGgoKQpJbmRl
eDogU291cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9ERkdHcmFwaC5oCj09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNv
dXJjZS9KYXZhU2NyaXB0Q29yZS9kZmcvREZHR3JhcGguaAkocmV2aXNpb24gMTU3MzA5KQorKysg
U291cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9ERkdHcmFwaC5oCSh3b3JraW5nIGNvcHkpCkBAIC03
NzYsNiArNzc2LDggQEAgcHVibGljOgogICAgIAogICAgIE5vZGVBbGxvY2F0b3ImIG1fYWxsb2Nh
dG9yOwogCisgICAgT3BlcmFuZHM8QWJzdHJhY3RWYWx1ZT4gbV9tdXN0SGFuZGxlQWJzdHJhY3RW
YWx1ZXM7CisgICAgCiAgICAgVmVjdG9yPCBSZWZQdHI8QmFzaWNCbG9jaz4gLCA4PiBtX2Jsb2Nr
czsKICAgICBWZWN0b3I8RWRnZSwgMTY+IG1fdmFyQXJnQ2hpbGRyZW47CiAgICAgVmVjdG9yPFN0
b3JhZ2VBY2Nlc3NEYXRhPiBtX3N0b3JhZ2VBY2Nlc3NEYXRhOwpJbmRleDogU291cmNlL0phdmFT
Y3JpcHRDb3JlL2RmZy9ERkdJblBsYWNlQWJzdHJhY3RTdGF0ZS5jcHAKPT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0g
U291cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9ERkdJblBsYWNlQWJzdHJhY3RTdGF0ZS5jcHAJKHJl
dmlzaW9uIDE1NzMwOSkKKysrIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9kZmcvREZHSW5QbGFjZUFi
c3RyYWN0U3RhdGUuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC0xNTksMTAgKzE1OSw5IEBAIHZvaWQg
SW5QbGFjZUFic3RyYWN0U3RhdGU6OmluaXRpYWxpemUoKQogICAgICAgICAgICAgY29udGludWU7
CiAgICAgICAgIGlmIChibG9jay0+Ynl0ZWNvZGVCZWdpbiAhPSBtX2dyYXBoLm1fcGxhbi5vc3JF
bnRyeUJ5dGVjb2RlSW5kZXgpCiAgICAgICAgICAgICBjb250aW51ZTsKLSAgICAgICAgZm9yIChz
aXplX3QgaSA9IDA7IGkgPCBtX2dyYXBoLm1fcGxhbi5tdXN0SGFuZGxlVmFsdWVzLnNpemUoKTsg
KytpKSB7Ci0gICAgICAgICAgICBBYnN0cmFjdFZhbHVlIHZhbHVlOwotICAgICAgICAgICAgdmFs
dWUuc2V0TW9zdFNwZWNpZmljKG1fZ3JhcGgsIG1fZ3JhcGgubV9wbGFuLm11c3RIYW5kbGVWYWx1
ZXNbaV0pOwotICAgICAgICAgICAgaW50IG9wZXJhbmQgPSBtX2dyYXBoLm1fcGxhbi5tdXN0SGFu
ZGxlVmFsdWVzLm9wZXJhbmRGb3JJbmRleChpKTsKKyAgICAgICAgZm9yIChzaXplX3QgaSA9IDA7
IGkgPCBtX2dyYXBoLm1fbXVzdEhhbmRsZUFic3RyYWN0VmFsdWVzLnNpemUoKTsgKytpKSB7Cisg
ICAgICAgICAgICBBYnN0cmFjdFZhbHVlIHZhbHVlID0gbV9ncmFwaC5tX211c3RIYW5kbGVBYnN0
cmFjdFZhbHVlc1tpXTsKKyAgICAgICAgICAgIGludCBvcGVyYW5kID0gbV9ncmFwaC5tX211c3RI
YW5kbGVBYnN0cmFjdFZhbHVlcy5vcGVyYW5kRm9ySW5kZXgoaSk7CiAgICAgICAgICAgICBibG9j
ay0+dmFsdWVzQXRIZWFkLm9wZXJhbmQob3BlcmFuZCkubWVyZ2UodmFsdWUpOwogI2lmIERGR19F
TkFCTEUoREVCVUdfUFJPUEFHQVRJT05fVkVSQk9TRSkKICAgICAgICAgICAgIGRhdGFMb2dGKCIg
ICAgSW5pdGlhbGl6aW5nIEJsb2NrICMldSwgb3BlcmFuZCByJWQsIHRvICIsIGJsb2NrSW5kZXgs
IG9wZXJhbmQpOwo=
</data>
<flag name="review"
          id="236512"
          type_id="1"
          status="+"
          setter="mhahnenberg"
    />
          </attachment>
      

    </bug>

</bugzilla>