<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>123013</bug_id>
          
          <creation_ts>2013-10-18 02:48:37 -0700</creation_ts>
          <short_desc>Bad cast with toRenderBoxModelObject in RenderBlock::updateFirstLetter()</short_desc>
          <delta_ts>2013-10-21 17:28:08 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>Layout and Rendering</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>All</rep_platform>
          <op_sys>All</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords></keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Joone Hur">joone</reporter>
          <assigned_to name="Joone Hur">joone</assigned_to>
          <cc>commit-queue</cc>
    
    <cc>esprehn+autocc</cc>
    
    <cc>glenn</cc>
    
    <cc>kling</cc>
    
    <cc>kondapallykalyan</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>941129</commentid>
    <comment_count>0</comment_count>
    <who name="Joone Hur">joone</who>
    <bug_when>2013-10-18 02:48:37 -0700</bug_when>
    <thetext>There is a case that toRenderBoxModelObject cause a crash in RenderBlock::updateFirstLetter() due to bad cast.  (http://trac.webkit.org/changeset/156742)</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>941255</commentid>
    <comment_count>1</comment_count>
      <attachid>214584</attachid>
    <who name="Joone Hur">joone</who>
    <bug_when>2013-10-18 10:14:16 -0700</bug_when>
    <thetext>Created attachment 214584
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>941321</commentid>
    <comment_count>2</comment_count>
      <attachid>214584</attachid>
    <who name="Andreas Kling">kling</who>
    <bug_when>2013-10-18 13:48:03 -0700</bug_when>
    <thetext>Comment on attachment 214584
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=214584&amp;action=review

Can we make a test for this?

&gt; Source/WebCore/rendering/RenderBlock.cpp:5179
&gt; +                RenderObject* oldRemainingText = oldFirstLetter-&gt;firstLetterRemainingText();

You should use a tighter type than RenderObject* here, since firstLetterRemainingText() returns a RenderTextFragment.
I would use auto, like so:

    auto oldRemainingText = oldFirstLetter-&gt;firstLetterRemainingText();

&gt; Source/WebCore/rendering/RenderBlock.cpp:5180
&gt; +                if (oldRemainingText &amp;&amp; oldRemainingText-&gt;isText()) {

isText() here will always be true.

&gt; Source/WebCore/rendering/RenderBlock.cpp:5183
&gt; +                    toRenderText(oldRemainingText)-&gt;setText(toText(oldRemainingText-&gt;node())-&gt;data().impl());

If you use a tighter type like I suggested above, this line could become:
oldRemainingText-&gt;setText(oldRemainingText-&gt;textNode()-&gt;data());</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>941477</commentid>
    <comment_count>3</comment_count>
      <attachid>214584</attachid>
    <who name="Joone Hur">joone</who>
    <bug_when>2013-10-19 01:35:51 -0700</bug_when>
    <thetext>Comment on attachment 214584
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=214584&amp;action=review

I don&apos;t know the exact case that can reproduce this crash because it happened in ClusterFuzz:
https://codereview.chromium.org/25713009/

&gt;&gt; Source/WebCore/rendering/RenderBlock.cpp:5179
&gt;&gt; +                RenderObject* oldRemainingText = oldFirstLetter-&gt;firstLetterRemainingText();
&gt; 
&gt; You should use a tighter type than RenderObject* here, since firstLetterRemainingText() returns a RenderTextFragment.
&gt; I would use auto, like so:
&gt; 
&gt;     auto oldRemainingText = oldFirstLetter-&gt;firstLetterRemainingText();

Done.

&gt;&gt; Source/WebCore/rendering/RenderBlock.cpp:5180
&gt;&gt; +                if (oldRemainingText &amp;&amp; oldRemainingText-&gt;isText()) {
&gt; 
&gt; isText() here will always be true.

Done.

&gt;&gt; Source/WebCore/rendering/RenderBlock.cpp:5183
&gt;&gt; +                    toRenderText(oldRemainingText)-&gt;setText(toText(oldRemainingText-&gt;node())-&gt;data().impl());
&gt; 
&gt; If you use a tighter type like I suggested above, this line could become:
&gt; oldRemainingText-&gt;setText(oldRemainingText-&gt;textNode()-&gt;data());

Done.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>941478</commentid>
    <comment_count>4</comment_count>
      <attachid>214644</attachid>
    <who name="Joone Hur">joone</who>
    <bug_when>2013-10-19 01:38:22 -0700</bug_when>
    <thetext>Created attachment 214644
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>941484</commentid>
    <comment_count>5</comment_count>
      <attachid>214644</attachid>
    <who name="Andreas Kling">kling</who>
    <bug_when>2013-10-19 03:37:19 -0700</bug_when>
    <thetext>Comment on attachment 214644
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=214644&amp;action=review

&gt; Source/WebCore/ChangeLog:10
&gt; +        There is a case that toRenderBoxModelObject causes a crash in RenderBlock::updateFirstLetter() 
&gt; +        due to bad cast, so we need to check whether the RenderObject is a RenderBoxModelObject 
&gt; +        by running isBoxModelObject() before calling toRenderBoxModelObject.  

This needs a comment about why we don&apos;t have a test.

&gt; Source/WebCore/rendering/RenderBlock.cpp:5178
&gt; +            if (RenderBoxModelObject* oldFirstLetter = descendant-&gt;parent()-&gt;isBoxModelObject() ? toRenderBoxModelObject(descendant-&gt;parent()) : 0) { 

Can we use auto instead of spelling out RenderBoxModelObject twice here?
0 -&gt; nullptr

&gt; Source/WebCore/rendering/RenderBlock.cpp:5183
&gt; +                    createFirstLetterRenderer(firstLetterBlock, toRenderText(remainingText));

We will now only call createFirstLetterRenderer() if oldFirstLetter is a RenderBoxModelObject and there was an oldRemainingText.
Is this intentional, or should it go after the two if blocks?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>941771</commentid>
    <comment_count>6</comment_count>
      <attachid>214644</attachid>
    <who name="Joone Hur">joone</who>
    <bug_when>2013-10-21 02:15:00 -0700</bug_when>
    <thetext>Comment on attachment 214644
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=214644&amp;action=review

&gt;&gt; Source/WebCore/ChangeLog:10
&gt;&gt; +        by running isBoxModelObject() before calling toRenderBoxModelObject.  
&gt; 
&gt; This needs a comment about why we don&apos;t have a test.

Done.

&gt;&gt; Source/WebCore/rendering/RenderBlock.cpp:5178
&gt;&gt; +            if (RenderBoxModelObject* oldFirstLetter = descendant-&gt;parent()-&gt;isBoxModelObject() ? toRenderBoxModelObject(descendant-&gt;parent()) : 0) { 
&gt; 
&gt; Can we use auto instead of spelling out RenderBoxModelObject twice here?
&gt; 0 -&gt; nullptr

Done.

&gt;&gt; Source/WebCore/rendering/RenderBlock.cpp:5183
&gt;&gt; +                    createFirstLetterRenderer(firstLetterBlock, toRenderText(remainingText));
&gt; 
&gt; We will now only call createFirstLetterRenderer() if oldFirstLetter is a RenderBoxModelObject and there was an oldRemainingText.
&gt; Is this intentional, or should it go after the two if blocks?

This is intentional because we can remove the old first letter by running setText and then create a new one. These operations should be done together.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>941774</commentid>
    <comment_count>7</comment_count>
      <attachid>214718</attachid>
    <who name="Joone Hur">joone</who>
    <bug_when>2013-10-21 02:21:05 -0700</bug_when>
    <thetext>Created attachment 214718
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>941781</commentid>
    <comment_count>8</comment_count>
      <attachid>214718</attachid>
    <who name="Andreas Kling">kling</who>
    <bug_when>2013-10-21 02:31:40 -0700</bug_when>
    <thetext>Comment on attachment 214718
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=214718&amp;action=review

Ok, r=me.

&gt; Source/WebCore/rendering/RenderBlock.cpp:5183
&gt; +                    createFirstLetterRenderer(firstLetterBlock, toRenderText(remainingText));

You don&apos;t need the toRenderText() here.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>942066</commentid>
    <comment_count>9</comment_count>
      <attachid>214718</attachid>
    <who name="Joone Hur">joone</who>
    <bug_when>2013-10-21 16:23:01 -0700</bug_when>
    <thetext>Comment on attachment 214718
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=214718&amp;action=review

&gt;&gt; Source/WebCore/rendering/RenderBlock.cpp:5183
&gt;&gt; +                    createFirstLetterRenderer(firstLetterBlock, toRenderText(remainingText));
&gt; 
&gt; You don&apos;t need the toRenderText() here.

But, there is a build error:
../../Source/WebCore/rendering/RenderBlock.cpp:5183:78: error: invalid conversion from &apos;WebCore::RenderObject*&apos; to &apos;WebCore::RenderText*&apos; [-fpermissive]</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>942093</commentid>
    <comment_count>10</comment_count>
      <attachid>214718</attachid>
    <who name="Andreas Kling">kling</who>
    <bug_when>2013-10-21 17:03:29 -0700</bug_when>
    <thetext>Comment on attachment 214718
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=214718&amp;action=review

&gt;&gt;&gt; Source/WebCore/rendering/RenderBlock.cpp:5183
&gt;&gt;&gt; +                    createFirstLetterRenderer(firstLetterBlock, toRenderText(remainingText));
&gt;&gt; 
&gt;&gt; You don&apos;t need the toRenderText() here.
&gt; 
&gt; But, there is a build error:
&gt; ../../Source/WebCore/rendering/RenderBlock.cpp:5183:78: error: invalid conversion from &apos;WebCore::RenderObject*&apos; to &apos;WebCore::RenderText*&apos; [-fpermissive]

Oh, you&apos;re right! I confused it with oldRemainingText. Sorry about that :)</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>942097</commentid>
    <comment_count>11</comment_count>
    <who name="Joone Hur">joone</who>
    <bug_when>2013-10-21 17:14:41 -0700</bug_when>
    <thetext>(In reply to comment #10)
&gt; (From update of attachment 214718 [details])
&gt; View in context: https://bugs.webkit.org/attachment.cgi?id=214718&amp;action=review
&gt; 
&gt; &gt;&gt;&gt; Source/WebCore/rendering/RenderBlock.cpp:5183
&gt; &gt;&gt;&gt; +                    createFirstLetterRenderer(firstLetterBlock, toRenderText(remainingText));
&gt; &gt;&gt; 
&gt; &gt;&gt; You don&apos;t need the toRenderText() here.
&gt; &gt; 
&gt; &gt; But, there is a build error:
&gt; &gt; ../../Source/WebCore/rendering/RenderBlock.cpp:5183:78: error: invalid conversion from &apos;WebCore::RenderObject*&apos; to &apos;WebCore::RenderText*&apos; [-fpermissive]
&gt; 
&gt; Oh, you&apos;re right! I confused it with oldRemainingText. Sorry about that :)

Thank you for the review! :)</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>942104</commentid>
    <comment_count>12</comment_count>
      <attachid>214718</attachid>
    <who name="WebKit Commit Bot">commit-queue</who>
    <bug_when>2013-10-21 17:28:06 -0700</bug_when>
    <thetext>Comment on attachment 214718
Patch

Clearing flags on attachment: 214718

Committed r157768: &lt;http://trac.webkit.org/changeset/157768&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>942105</commentid>
    <comment_count>13</comment_count>
    <who name="WebKit Commit Bot">commit-queue</who>
    <bug_when>2013-10-21 17:28:08 -0700</bug_when>
    <thetext>All reviewed patches have been landed.  Closing bug.</thetext>
  </long_desc>
      
          <attachment
              isobsolete="1"
              ispatch="1"
              isprivate="0"
          >
            <attachid>214584</attachid>
            <date>2013-10-18 10:14:16 -0700</date>
            <delta_ts>2013-10-19 01:38:19 -0700</delta_ts>
            <desc>Patch</desc>
            <filename>bug-123013-20131018031413.patch</filename>
            <type>text/plain</type>
            <size>2597</size>
            <attacher name="Joone Hur">joone</attacher>
            
              <data encoding="base64">U3VidmVyc2lvbiBSZXZpc2lvbjogMTU3NjI2CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D
aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggNzcwNTg4NWFjMmYxZjcz
ZjM0ZTU1NDAzNmI3Mjg5ZmZmZGQ3YzZhNS4uYjdmZjBhZGYzOWEwNjg5NGFiZmRkYmNlMjg5NGNh
MWNlYWY1N2QxZSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv
dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE3IEBACisyMDEzLTEwLTE4ICBKb29u
ZSBIdXIgIDxqb29uZS5odXJAaW50ZWwuY29tPgorCisgICAgICAgIEJhZCBjYXN0IHdpdGggdG9S
ZW5kZXJCb3hNb2RlbE9iamVjdCBpbiBSZW5kZXJCbG9jazo6dXBkYXRlRmlyc3RMZXR0ZXIoKQor
ICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTIzMDEzCisK
KyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgVGhlcmUgaXMg
YSBjYXNlIHRoYXQgdG9SZW5kZXJCb3hNb2RlbE9iamVjdCBjYXVzZXMgYSBjcmFzaCBpbiBSZW5k
ZXJCbG9jazo6dXBkYXRlRmlyc3RMZXR0ZXIoKSAKKyAgICAgICAgZHVlIHRvIGJhZCBjYXN0LCBz
byB3ZSBuZWVkIHRvIGNoZWNrIHdoZXRoZXIgdGhlIFJlbmRlck9iamVjdCBpcyBhIFJlbmRlckJv
eE1vZGVsT2JqZWN0IAorICAgICAgICBieSBydW5uaW5nIGlzQm94TW9kZWxPYmplY3QoKSBiZWZv
cmUgY2FsbGluZyB0b1JlbmRlckJveE1vZGVsT2JqZWN0LiAgCisKKyAgICAgICAgKiByZW5kZXJp
bmcvUmVuZGVyQmxvY2suY3BwOgorICAgICAgICAoV2ViQ29yZTo6UmVuZGVyQmxvY2s6OnVwZGF0
ZUZpcnN0TGV0dGVyKToKKwogMjAxMy0xMC0xOCAgQnJlbmRhbiBMb25nICA8Yi5sb25nQGNhYmxl
bGFicy5jb20+CiAKICAgICAgICAgW0dTdHJlYW1lcl1bR1RLXSBBZGQgR1JlZlB0cjo6b3V0UHRy
KCkKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL3JlbmRlcmluZy9SZW5kZXJCbG9jay5jcHAg
Yi9Tb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyQmxvY2suY3BwCmluZGV4IDVmZGU5Njdh
NDYxNjhlYmUwMGIxZTk0YTVhYmQ5YTg4Y2Q2NDA1ZDcuLjNmYjg2ODdkYmJlZDdiN2QwYTkwNTli
ZWNmMjQ1ZTc5NzNhMDRiZmIgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL3JlbmRlcmluZy9S
ZW5kZXJCbG9jay5jcHAKKysrIGIvU291cmNlL1dlYkNvcmUvcmVuZGVyaW5nL1JlbmRlckJsb2Nr
LmNwcApAQCAtNTE3NSwxMiArNTE3NSwxNiBAQCB2b2lkIFJlbmRlckJsb2NrOjp1cGRhdGVGaXJz
dExldHRlcigpCiAgICAgICAgICAgICBpZiAoIXJlbWFpbmluZ1RleHQtPmlzVGV4dCgpIHx8IHJl
bWFpbmluZ1RleHQtPmlzQlIoKSkKICAgICAgICAgICAgICAgICByZXR1cm47CiAKLSAgICAgICAg
ICAgIExheW91dFN0YXRlRGlzYWJsZXIgbGF5b3V0U3RhdGVEaXNhYmxlcigmdmlldygpKTsKKyAg
ICAgICAgICAgIGlmIChSZW5kZXJCb3hNb2RlbE9iamVjdCogb2xkRmlyc3RMZXR0ZXIgPSBkZXNj
ZW5kYW50LT5wYXJlbnQoKS0+aXNCb3hNb2RlbE9iamVjdCgpID8gdG9SZW5kZXJCb3hNb2RlbE9i
amVjdChkZXNjZW5kYW50LT5wYXJlbnQoKSkgOiAwKSB7IAorICAgICAgICAgICAgICAgIFJlbmRl
ck9iamVjdCogb2xkUmVtYWluaW5nVGV4dCA9IG9sZEZpcnN0TGV0dGVyLT5maXJzdExldHRlclJl
bWFpbmluZ1RleHQoKTsKKyAgICAgICAgICAgICAgICBpZiAob2xkUmVtYWluaW5nVGV4dCAmJiBv
bGRSZW1haW5pbmdUZXh0LT5pc1RleHQoKSkgeworICAgICAgICAgICAgICAgICAgICBMYXlvdXRT
dGF0ZURpc2FibGVyIGxheW91dFN0YXRlRGlzYWJsZXIoJnZpZXcoKSk7CisgICAgICAgICAgICAg
ICAgICAgIC8vIERlc3Ryb3kgdGhlIHRleHQgZnJhZ21lbnQgZm9yIHRoZSBvbGQgZmlyc3QtbGV0
dGVyIGFuZCB1cGRhdGUgb2xkUmVtYWluaW5nVGV4dCB3aXRoIGl0cyBET00gdGV4dC4KKyAgICAg
ICAgICAgICAgICAgICAgdG9SZW5kZXJUZXh0KG9sZFJlbWFpbmluZ1RleHQpLT5zZXRUZXh0KHRv
VGV4dChvbGRSZW1haW5pbmdUZXh0LT5ub2RlKCkpLT5kYXRhKCkuaW1wbCgpKTsKKyAgICAgICAg
ICAgICAgICAgICAgY3JlYXRlRmlyc3RMZXR0ZXJSZW5kZXJlcihmaXJzdExldHRlckJsb2NrLCB0
b1JlbmRlclRleHQocmVtYWluaW5nVGV4dCkpOworICAgICAgICAgICAgICAgIH0gICAgCisgICAg
ICAgICAgICB9ICAgIAogCi0gICAgICAgICAgICBpZiAoUmVuZGVyT2JqZWN0KiBvbGRSZW1haW5p
bmdUZXh0ID0gdG9SZW5kZXJCb3hNb2RlbE9iamVjdChkZXNjZW5kYW50LT5wYXJlbnQoKSktPmZp
cnN0TGV0dGVyUmVtYWluaW5nVGV4dCgpKQotICAgICAgICAgICAgICAgIHRvUmVuZGVyVGV4dChv
bGRSZW1haW5pbmdUZXh0KS0+c2V0VGV4dCh0b1RleHQob2xkUmVtYWluaW5nVGV4dC0+bm9kZSgp
KS0+ZGF0YSgpLmltcGwoKSk7Ci0KLSAgICAgICAgICAgIGNyZWF0ZUZpcnN0TGV0dGVyUmVuZGVy
ZXIoZmlyc3RMZXR0ZXJCbG9jaywgdG9SZW5kZXJUZXh0KHJlbWFpbmluZ1RleHQpKTsKICAgICAg
ICAgICAgIHJldHVybjsKICAgICAgICAgfSAgICAKIAo=
</data>

          </attachment>
          <attachment
              isobsolete="1"
              ispatch="1"
              isprivate="0"
          >
            <attachid>214644</attachid>
            <date>2013-10-19 01:38:22 -0700</date>
            <delta_ts>2013-10-21 02:21:02 -0700</delta_ts>
            <desc>Patch</desc>
            <filename>bug-123013-20131018183818.patch</filename>
            <type>text/plain</type>
            <size>2498</size>
            <attacher name="Joone Hur">joone</attacher>
            
              <data encoding="base64">U3VidmVyc2lvbiBSZXZpc2lvbjogMTU3NjI2CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D
aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggNzcwNTg4NWFjMmYxZjcz
ZjM0ZTU1NDAzNmI3Mjg5ZmZmZGQ3YzZhNS4uYjdmZjBhZGYzOWEwNjg5NGFiZmRkYmNlMjg5NGNh
MWNlYWY1N2QxZSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv
dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE3IEBACisyMDEzLTEwLTE4ICBKb29u
ZSBIdXIgIDxqb29uZS5odXJAaW50ZWwuY29tPgorCisgICAgICAgIEJhZCBjYXN0IHdpdGggdG9S
ZW5kZXJCb3hNb2RlbE9iamVjdCBpbiBSZW5kZXJCbG9jazo6dXBkYXRlRmlyc3RMZXR0ZXIoKQor
ICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTIzMDEzCisK
KyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgVGhlcmUgaXMg
YSBjYXNlIHRoYXQgdG9SZW5kZXJCb3hNb2RlbE9iamVjdCBjYXVzZXMgYSBjcmFzaCBpbiBSZW5k
ZXJCbG9jazo6dXBkYXRlRmlyc3RMZXR0ZXIoKSAKKyAgICAgICAgZHVlIHRvIGJhZCBjYXN0LCBz
byB3ZSBuZWVkIHRvIGNoZWNrIHdoZXRoZXIgdGhlIFJlbmRlck9iamVjdCBpcyBhIFJlbmRlckJv
eE1vZGVsT2JqZWN0IAorICAgICAgICBieSBydW5uaW5nIGlzQm94TW9kZWxPYmplY3QoKSBiZWZv
cmUgY2FsbGluZyB0b1JlbmRlckJveE1vZGVsT2JqZWN0LiAgCisKKyAgICAgICAgKiByZW5kZXJp
bmcvUmVuZGVyQmxvY2suY3BwOgorICAgICAgICAoV2ViQ29yZTo6UmVuZGVyQmxvY2s6OnVwZGF0
ZUZpcnN0TGV0dGVyKToKKwogMjAxMy0xMC0xOCAgQnJlbmRhbiBMb25nICA8Yi5sb25nQGNhYmxl
bGFicy5jb20+CiAKICAgICAgICAgW0dTdHJlYW1lcl1bR1RLXSBBZGQgR1JlZlB0cjo6b3V0UHRy
KCkKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL3JlbmRlcmluZy9SZW5kZXJCbG9jay5jcHAg
Yi9Tb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyQmxvY2suY3BwCmluZGV4IDVmZGU5Njdh
NDYxNjhlYmUwMGIxZTk0YTVhYmQ5YTg4Y2Q2NDA1ZDcuLjczYWQzNTZkNzk5ODQzMzc5YTNhMjcx
YTI1OWRlNjAwYmZhMDExOTEgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL3JlbmRlcmluZy9S
ZW5kZXJCbG9jay5jcHAKKysrIGIvU291cmNlL1dlYkNvcmUvcmVuZGVyaW5nL1JlbmRlckJsb2Nr
LmNwcApAQCAtNTE3NSwxMiArNTE3NSwxNSBAQCB2b2lkIFJlbmRlckJsb2NrOjp1cGRhdGVGaXJz
dExldHRlcigpCiAgICAgICAgICAgICBpZiAoIXJlbWFpbmluZ1RleHQtPmlzVGV4dCgpIHx8IHJl
bWFpbmluZ1RleHQtPmlzQlIoKSkKICAgICAgICAgICAgICAgICByZXR1cm47CiAKLSAgICAgICAg
ICAgIExheW91dFN0YXRlRGlzYWJsZXIgbGF5b3V0U3RhdGVEaXNhYmxlcigmdmlldygpKTsKKyAg
ICAgICAgICAgIGlmIChSZW5kZXJCb3hNb2RlbE9iamVjdCogb2xkRmlyc3RMZXR0ZXIgPSBkZXNj
ZW5kYW50LT5wYXJlbnQoKS0+aXNCb3hNb2RlbE9iamVjdCgpID8gdG9SZW5kZXJCb3hNb2RlbE9i
amVjdChkZXNjZW5kYW50LT5wYXJlbnQoKSkgOiAwKSB7IAorICAgICAgICAgICAgICAgIGlmIChh
dXRvIG9sZFJlbWFpbmluZ1RleHQgPSBvbGRGaXJzdExldHRlci0+Zmlyc3RMZXR0ZXJSZW1haW5p
bmdUZXh0KCkpIHsKKyAgICAgICAgICAgICAgICAgICAgTGF5b3V0U3RhdGVEaXNhYmxlciBsYXlv
dXRTdGF0ZURpc2FibGVyKCZ2aWV3KCkpOworICAgICAgICAgICAgICAgICAgICAvLyBEZXN0cm95
IHRoZSB0ZXh0IGZyYWdtZW50IGZvciB0aGUgb2xkIGZpcnN0LWxldHRlciBhbmQgdXBkYXRlIG9s
ZFJlbWFpbmluZ1RleHQgd2l0aCBpdHMgRE9NIHRleHQuCisgICAgICAgICAgICAgICAgICAgIG9s
ZFJlbWFpbmluZ1RleHQtPnNldFRleHQob2xkUmVtYWluaW5nVGV4dC0+dGV4dE5vZGUoKS0+ZGF0
YSgpKTsKKyAgICAgICAgICAgICAgICAgICAgY3JlYXRlRmlyc3RMZXR0ZXJSZW5kZXJlcihmaXJz
dExldHRlckJsb2NrLCB0b1JlbmRlclRleHQocmVtYWluaW5nVGV4dCkpOworICAgICAgICAgICAg
ICAgIH0gICAgCisgICAgICAgICAgICB9ICAgIAogCi0gICAgICAgICAgICBpZiAoUmVuZGVyT2Jq
ZWN0KiBvbGRSZW1haW5pbmdUZXh0ID0gdG9SZW5kZXJCb3hNb2RlbE9iamVjdChkZXNjZW5kYW50
LT5wYXJlbnQoKSktPmZpcnN0TGV0dGVyUmVtYWluaW5nVGV4dCgpKQotICAgICAgICAgICAgICAg
IHRvUmVuZGVyVGV4dChvbGRSZW1haW5pbmdUZXh0KS0+c2V0VGV4dCh0b1RleHQob2xkUmVtYWlu
aW5nVGV4dC0+bm9kZSgpKS0+ZGF0YSgpLmltcGwoKSk7Ci0KLSAgICAgICAgICAgIGNyZWF0ZUZp
cnN0TGV0dGVyUmVuZGVyZXIoZmlyc3RMZXR0ZXJCbG9jaywgdG9SZW5kZXJUZXh0KHJlbWFpbmlu
Z1RleHQpKTsKICAgICAgICAgICAgIHJldHVybjsKICAgICAgICAgfSAgICAKIAo=
</data>

          </attachment>
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>214718</attachid>
            <date>2013-10-21 02:21:05 -0700</date>
            <delta_ts>2013-10-21 17:28:06 -0700</delta_ts>
            <desc>Patch</desc>
            <filename>bug-123013-20131020192058.patch</filename>
            <type>text/plain</type>
            <size>2612</size>
            <attacher name="Joone Hur">joone</attacher>
            
              <data encoding="base64">U3VidmVyc2lvbiBSZXZpc2lvbjogMTU3NjI2CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D
aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggNzcwNTg4NWFjMmYxZjcz
ZjM0ZTU1NDAzNmI3Mjg5ZmZmZGQ3YzZhNS4uZWIzNTQzODM4ODU5MDFiZjdhNTkwZmRmNWE4ODVk
ZGZlMDkwYjRmNyAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv
dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDIwIEBACisyMDEzLTEwLTE4ICBKb29u
ZSBIdXIgIDxqb29uZS5odXJAaW50ZWwuY29tPgorCisgICAgICAgIEJhZCBjYXN0IHdpdGggdG9S
ZW5kZXJCb3hNb2RlbE9iamVjdCBpbiBSZW5kZXJCbG9jazo6dXBkYXRlRmlyc3RMZXR0ZXIoKQor
ICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTIzMDEzCisK
KyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgTm8gbmV3IHRl
c3RzIGJlY2F1c2UgdGhpcyB3YXMgcmVwb3J0ZWQgYnkgR29vZ2xlIENsdXN0ZXJGdXp6LgorICAg
ICAgICBodHRwczovL2NvZGVyZXZpZXcuY2hyb21pdW0ub3JnLzI1NzEzMDA5LworCisgICAgICAg
IFRoZXJlIGlzIGEgY2FzZSB0aGF0IHRvUmVuZGVyQm94TW9kZWxPYmplY3QgY2F1c2VzIGEgY3Jh
c2ggaW4gUmVuZGVyQmxvY2s6OnVwZGF0ZUZpcnN0TGV0dGVyKCkgCisgICAgICAgIGR1ZSB0byBi
YWQgY2FzdCwgc28gd2UgbmVlZCB0byBjaGVjayB3aGV0aGVyIHRoZSBSZW5kZXJPYmplY3QgaXMg
YSBSZW5kZXJCb3hNb2RlbE9iamVjdCAKKyAgICAgICAgYnkgcnVubmluZyBpc0JveE1vZGVsT2Jq
ZWN0KCkgYmVmb3JlIGNhbGxpbmcgdG9SZW5kZXJCb3hNb2RlbE9iamVjdC4gIAorCisgICAgICAg
ICogcmVuZGVyaW5nL1JlbmRlckJsb2NrLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OlJlbmRlckJs
b2NrOjp1cGRhdGVGaXJzdExldHRlcik6CisKIDIwMTMtMTAtMTggIEJyZW5kYW4gTG9uZyAgPGIu
bG9uZ0BjYWJsZWxhYnMuY29tPgogCiAgICAgICAgIFtHU3RyZWFtZXJdW0dUS10gQWRkIEdSZWZQ
dHI6Om91dFB0cigpCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVy
QmxvY2suY3BwIGIvU291cmNlL1dlYkNvcmUvcmVuZGVyaW5nL1JlbmRlckJsb2NrLmNwcAppbmRl
eCA1ZmRlOTY3YTQ2MTY4ZWJlMDBiMWU5NGE1YWJkOWE4OGNkNjQwNWQ3Li5kNzkxNjNiYjc3M2Nh
ZDkzYzIwOTk5Mjg0MDlmOTA1YjA0OTg5N2QzIDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9y
ZW5kZXJpbmcvUmVuZGVyQmxvY2suY3BwCisrKyBiL1NvdXJjZS9XZWJDb3JlL3JlbmRlcmluZy9S
ZW5kZXJCbG9jay5jcHAKQEAgLTUxNzUsMTIgKzUxNzUsMTUgQEAgdm9pZCBSZW5kZXJCbG9jazo6
dXBkYXRlRmlyc3RMZXR0ZXIoKQogICAgICAgICAgICAgaWYgKCFyZW1haW5pbmdUZXh0LT5pc1Rl
eHQoKSB8fCByZW1haW5pbmdUZXh0LT5pc0JSKCkpCiAgICAgICAgICAgICAgICAgcmV0dXJuOwog
Ci0gICAgICAgICAgICBMYXlvdXRTdGF0ZURpc2FibGVyIGxheW91dFN0YXRlRGlzYWJsZXIoJnZp
ZXcoKSk7CisgICAgICAgICAgICBpZiAoYXV0byBvbGRGaXJzdExldHRlciA9IGRlc2NlbmRhbnQt
PnBhcmVudCgpLT5pc0JveE1vZGVsT2JqZWN0KCkgPyAgdG9SZW5kZXJCb3hNb2RlbE9iamVjdChk
ZXNjZW5kYW50LT5wYXJlbnQoKSkgOiBudWxscHRyKSB7IAorICAgICAgICAgICAgICAgIGlmIChh
dXRvIG9sZFJlbWFpbmluZ1RleHQgPSBvbGRGaXJzdExldHRlci0+Zmlyc3RMZXR0ZXJSZW1haW5p
bmdUZXh0KCkpIHsKKyAgICAgICAgICAgICAgICAgICAgTGF5b3V0U3RhdGVEaXNhYmxlciBsYXlv
dXRTdGF0ZURpc2FibGVyKCZ2aWV3KCkpOworICAgICAgICAgICAgICAgICAgICAvLyBEZXN0cm95
IHRoZSB0ZXh0IGZyYWdtZW50IGZvciB0aGUgb2xkIGZpcnN0LWxldHRlciBhbmQgdXBkYXRlIG9s
ZFJlbWFpbmluZ1RleHQgd2l0aCBpdHMgRE9NIHRleHQuCisgICAgICAgICAgICAgICAgICAgIG9s
ZFJlbWFpbmluZ1RleHQtPnNldFRleHQob2xkUmVtYWluaW5nVGV4dC0+dGV4dE5vZGUoKS0+ZGF0
YSgpKTsKKyAgICAgICAgICAgICAgICAgICAgY3JlYXRlRmlyc3RMZXR0ZXJSZW5kZXJlcihmaXJz
dExldHRlckJsb2NrLCB0b1JlbmRlclRleHQocmVtYWluaW5nVGV4dCkpOworICAgICAgICAgICAg
ICAgIH0gICAgCisgICAgICAgICAgICB9ICAgIAogCi0gICAgICAgICAgICBpZiAoUmVuZGVyT2Jq
ZWN0KiBvbGRSZW1haW5pbmdUZXh0ID0gdG9SZW5kZXJCb3hNb2RlbE9iamVjdChkZXNjZW5kYW50
LT5wYXJlbnQoKSktPmZpcnN0TGV0dGVyUmVtYWluaW5nVGV4dCgpKQotICAgICAgICAgICAgICAg
IHRvUmVuZGVyVGV4dChvbGRSZW1haW5pbmdUZXh0KS0+c2V0VGV4dCh0b1RleHQob2xkUmVtYWlu
aW5nVGV4dC0+bm9kZSgpKS0+ZGF0YSgpLmltcGwoKSk7Ci0KLSAgICAgICAgICAgIGNyZWF0ZUZp
cnN0TGV0dGVyUmVuZGVyZXIoZmlyc3RMZXR0ZXJCbG9jaywgdG9SZW5kZXJUZXh0KHJlbWFpbmlu
Z1RleHQpKTsKICAgICAgICAgICAgIHJldHVybjsKICAgICAgICAgfSAgICAKIAo=
</data>

          </attachment>
      

    </bug>

</bugzilla>