<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>12947</bug_id>
          
          <creation_ts>2007-03-02 11:03:09 -0800</creation_ts>
          <short_desc>REGRESSION: ASSERTION FAILED: maxWidth &gt;= 0 in StringTruncator.cpp:109 in WebCore::truncateString()</short_desc>
          <delta_ts>2024-05-07 21:28:16 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>New Bugs</component>
          <version>523.x (Safari 3)</version>
          <rep_platform>Mac (Intel)</rep_platform>
          <op_sys>OS X 10.4</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc>http://www.network-drivers.com/drivers/53/53064.htm</bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>HasReduction, Regression</keywords>
          <priority>P1</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="David Kilzer (:ddkilzer)">ddkilzer</reporter>
          <assigned_to name="Nobody">webkit-unassigned</assigned_to>
          <cc>ap</cc>
    
    <cc>mrowe</cc>
    
    <cc>webkit</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>20687</commentid>
    <comment_count>0</comment_count>
    <who name="David Kilzer (:ddkilzer)">ddkilzer</who>
    <bug_when>2007-03-02 11:03:09 -0800</bug_when>
    <thetext>Summary:

Opening a page in a background tab (via command-clicking) that opens a pop-under window causes an assertion failure in a debug build of WebKit.

Steps to reproduce:

1. Open Safari/WebKit.
2. Make sure the &quot;popunder&quot; cookie for network-drivers.com is NOT set via Safari preferences.
3. Make sure &quot;Block Pop-Up Windows&quot; is NOT set.
4. Command-click on URL:  http://www.network-drivers.com/drivers/53/53064.htm

Expected results:

The page should open without an assertion failure.

Actual results:

The page causes an assertion failure and Safari/WebKit crashes on a debug build.

Regression:

Not tested for regression with Safari 2.0.4 yet.

Notes:

Console output from assertion failure:

ASSERTION FAILED: maxWidth &gt;= 0
(/Users/dkilzer/Projects/WebKit/WebCore/platform/StringTruncator.cpp:109 WebCore::String WebCore::truncateString(const WebCore::String&amp;, float, const WebCore::Font&amp;, unsigned int (*)(const WebCore::String&amp;, unsigned int, unsigned int, UChar*)))
Segmentation fault

Stack trace:

Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_INVALID_ADDRESS (0x0001) at 0xbbadbeef

Thread 0 Crashed:
0   com.apple.WebCore        	0x013c7cbc WebCore::truncateString(WebCore::String const&amp;, float, WebCore::Font const&amp;, unsigned (*)(WebCore::String const&amp;, unsigned, unsigned, unsigned short*)) + 124
1   com.apple.WebCore        	0x013c81c9 WebCore::StringTruncator::centerTruncate(WebCore::String const&amp;, float, WebCore::Font const&amp;) + 57
2   com.apple.WebKit         	0x00311149 +[WebStringTruncator centerTruncateString:toWidth:withFont:] + 67 (WebStringTruncator.m:74)
3   com.apple.Safari         	0x000108f3 0x1000 + 63731
4   com.apple.AppKit         	0x93375246 -[NSView resizeWithOldSuperviewSize:] + 451
5   com.apple.AppKit         	0x932b7f45 -[NSView resizeSubviewsWithOldSize:] + 168
6   com.apple.AppKit         	0x93296b4d -[NSView setFrameSize:] + 288
7   com.apple.AppKit         	0x93374996 -[NSThemeFrame setFrameSize:] + 421
8   com.apple.AppKit         	0x932f5d41 -[NSWindow _oldPlaceWindow:] + 1414
9   com.apple.AppKit         	0x932f54bb -[NSWindow _setFrameCommon:display:stashSize:] + 418
10  com.apple.AppKit         	0x932fa0ea -[NSWindow setFrame:display:] + 77
11  com.apple.Safari         	0x000107f3 0x1000 + 63475
12  com.apple.Safari         	0x00093cc1 0x1000 + 601281
13  com.apple.Safari         	0x00093d7c 0x1000 + 601468
14  com.apple.Safari         	0x000a87da 0x1000 + 686042
15  libobjc.A.dylib          	0x90a59d76 objc_msgSendv + 54
16  com.apple.Foundation     	0x925ff43e -[NSInvocation invoke] + 932
17  com.apple.Foundation     	0x92625433 -[NSInvocation invokeWithTarget:] + 67
18  com.apple.WebKit         	0x0035f58a -[_WebSafeForwarder forwardInvocation:] + 448 (WebView.mm:1452)
19  com.apple.Foundation     	0x925fe4f4 -[NSObject(NSForwardInvocation) forward::] + 469
20  libobjc.A.dylib          	0x90a59cc1 _objc_msgForward + 49
21  com.apple.WebKit         	0x00397312 WebChromeClient::setWindowRect(WebCore::FloatRect const&amp;) + 202 (WebChromeClient.mm:73)
22  com.apple.WebCore        	0x013836b5 WebCore::Chrome::setWindowRect(WebCore::FloatRect const&amp;) const + 37 (Chrome.cpp:51)
23  com.apple.WebCore        	0x01373fe2 WebCore::FrameLoader::createWindow(WebCore::FrameLoadRequest const&amp;, WebCore::WindowFeatures const&amp;) + 1410 (FrameLoader.cpp:300)
24  com.apple.WebCore        	0x012470c0 KJS::WindowFunc::callAsFunction(KJS::ExecState*, KJS::JSObject*, KJS::List const&amp;) + 4006 (kjs_window.cpp:1651)
25  com.apple.JavaScriptCore 	0x004fc038 KJS::JSObject::call(KJS::ExecState*, KJS::JSObject*, KJS::List const&amp;) + 210 (object.cpp:97)
26  com.apple.JavaScriptCore 	0x004f1ebf KJS::FunctionCallDotNode::evaluate(KJS::ExecState*) + 843 (nodes.cpp:780)
27  com.apple.JavaScriptCore 	0x004f5779 KJS::AssignResolveNode::evaluate(KJS::ExecState*) + 313 (nodes.cpp:1428)
28  com.apple.JavaScriptCore 	0x004ef0dc KJS::ExprStatementNode::execute(KJS::ExecState*) + 148 (nodes.cpp:1680)
29  com.apple.JavaScriptCore 	0x004eccd4 KJS::SourceElementsNode::execute(KJS::ExecState*) + 256 (nodes.cpp:2457)
30  com.apple.JavaScriptCore 	0x004eb60c KJS::BlockNode::execute(KJS::ExecState*) + 140 (nodes.cpp:1656)
31  com.apple.JavaScriptCore 	0x004dde96 KJS::DeclaredFunctionImp::execute(KJS::ExecState*) + 50 (function.cpp:362)
32  com.apple.JavaScriptCore 	0x004e0179 KJS::FunctionImp::callAsFunction(KJS::ExecState*, KJS::JSObject*, KJS::List const&amp;) + 573 (function.cpp:111)
33  com.apple.JavaScriptCore 	0x004fc038 KJS::JSObject::call(KJS::ExecState*, KJS::JSObject*, KJS::List const&amp;) + 210 (object.cpp:97)
34  com.apple.JavaScriptCore 	0x004f2640 KJS::FunctionCallResolveNode::evaluate(KJS::ExecState*) + 716 (nodes.cpp:687)
35  com.apple.JavaScriptCore 	0x004ef0dc KJS::ExprStatementNode::execute(KJS::ExecState*) + 148 (nodes.cpp:1680)
36  com.apple.JavaScriptCore 	0x004eccd4 KJS::SourceElementsNode::execute(KJS::ExecState*) + 256 (nodes.cpp:2457)
37  com.apple.JavaScriptCore 	0x004eb60c KJS::BlockNode::execute(KJS::ExecState*) + 140 (nodes.cpp:1656)
38  com.apple.JavaScriptCore 	0x004eefd0 KJS::IfNode::execute(KJS::ExecState*) + 420 (nodes.cpp:1699)
39  com.apple.JavaScriptCore 	0x004eccd4 KJS::SourceElementsNode::execute(KJS::ExecState*) + 256 (nodes.cpp:2457)
40  com.apple.JavaScriptCore 	0x004eb60c KJS::BlockNode::execute(KJS::ExecState*) + 140 (nodes.cpp:1656)
41  com.apple.JavaScriptCore 	0x004dde96 KJS::DeclaredFunctionImp::execute(KJS::ExecState*) + 50 (function.cpp:362)
42  com.apple.JavaScriptCore 	0x004e0179 KJS::FunctionImp::callAsFunction(KJS::ExecState*, KJS::JSObject*, KJS::List const&amp;) + 573 (function.cpp:111)
43  com.apple.JavaScriptCore 	0x004fc038 KJS::JSObject::call(KJS::ExecState*, KJS::JSObject*, KJS::List const&amp;) + 210 (object.cpp:97)
44  com.apple.JavaScriptCore 	0x004f2640 KJS::FunctionCallResolveNode::evaluate(KJS::ExecState*) + 716 (nodes.cpp:687)
45  com.apple.JavaScriptCore 	0x004ef0dc KJS::ExprStatementNode::execute(KJS::ExecState*) + 148 (nodes.cpp:1680)
46  com.apple.JavaScriptCore 	0x004ef037 KJS::IfNode::execute(KJS::ExecState*) + 523 (nodes.cpp:1706)
47  com.apple.JavaScriptCore 	0x004ece0a KJS::SourceElementsNode::execute(KJS::ExecState*) + 566 (nodes.cpp:2463)
48  com.apple.JavaScriptCore 	0x004eb60c KJS::BlockNode::execute(KJS::ExecState*) + 140 (nodes.cpp:1656)
49  com.apple.JavaScriptCore 	0x004e5a45 KJS::Interpreter::evaluate(KJS::UString const&amp;, int, KJS::UChar const*, int, KJS::JSValue*) + 977 (interpreter.cpp:369)
50  com.apple.WebCore        	0x0123c159 WebCore::KJSProxy::evaluate(WebCore::String const&amp;, int, WebCore::String const&amp;, WebCore::Node*) + 319 (kjs_proxy.cpp:74)
51  com.apple.WebCore        	0x01373453 WebCore::FrameLoader::executeScript(WebCore::String const&amp;, int, WebCore::Node*, WebCore::String const&amp;) + 99 (FrameLoader.cpp:681)
52  com.apple.WebCore        	0x0101ddaa WebCore::HTMLTokenizer::scriptExecution(WebCore::DeprecatedString const&amp;, WebCore::HTMLTokenizer::State, WebCore::DeprecatedString, int) + 316 (HTMLTokenizer.cpp:502)
53  com.apple.WebCore        	0x01020565 WebCore::HTMLTokenizer::scriptHandler(WebCore::HTMLTokenizer::State) + 1449 (HTMLTokenizer.cpp:452)
54  com.apple.WebCore        	0x01020a5e WebCore::HTMLTokenizer::parseSpecial(WebCore::SegmentedString&amp;, WebCore::HTMLTokenizer::State) + 918 (HTMLTokenizer.cpp:310)
55  com.apple.WebCore        	0x010223fd WebCore::HTMLTokenizer::parseTag(WebCore::SegmentedString&amp;, WebCore::HTMLTokenizer::State) + 5255 (HTMLTokenizer.cpp:1175)
56  com.apple.WebCore        	0x01022bc1 WebCore::HTMLTokenizer::write(WebCore::SegmentedString const&amp;, bool) + 1173 (HTMLTokenizer.cpp:1389)
57  com.apple.WebCore        	0x01368ae9 WebCore::FrameLoader::write(char const*, int, bool) + 923 (FrameLoader.cpp:878)
58  com.apple.WebCore        	0x01368c1b WebCore::FrameLoader::addData(char const*, int) + 275 (FrameLoader.cpp:1492)
59  com.apple.WebCore        	0x010cfd6d -[WebCoreFrameBridge addData:] + 163 (WebCoreFrameBridge.mm:294)
60  com.apple.WebCore        	0x010d30f8 -[WebCoreFrameBridge receivedData:textEncodingName:] + 250 (WebCoreFrameBridge.mm:1484)
61  com.apple.WebKit         	0x00331c19 -[WebHTMLRepresentation receivedData:withDataSource:] + 199 (WebHTMLRepresentation.mm:175)
62  com.apple.WebKit         	0x0032d2cb -[WebDataSource(WebInternal) _receivedData:] + 89 (WebDataSource.mm:178)
63  com.apple.WebKit         	0x00393bb9 WebFrameLoaderClient::committedLoad(WebCore::DocumentLoader*, char const*, int) + 127 (WebFrameLoaderClient.mm:644)
64  com.apple.WebCore        	0x01365515 WebCore::FrameLoader::committedLoad(WebCore::DocumentLoader*, char const*, int) + 53 (FrameLoader.cpp:2877)
65  com.apple.WebCore        	0x013759c7 WebCore::DocumentLoader::commitLoad(char const*, int) + 87 (DocumentLoader.cpp:339)
66  com.apple.WebCore        	0x01375a20 WebCore::DocumentLoader::receivedData(char const*, int) + 76 (DocumentLoader.cpp:352)
67  com.apple.WebCore        	0x01364a23 WebCore::FrameLoader::receivedData(char const*, int) + 41 (FrameLoader.cpp:1884)
68  com.apple.WebCore        	0x0137725e WebCore::MainResourceLoader::addData(char const*, int, bool) + 80 (MainResourceLoader.cpp:133)
69  com.apple.WebCore        	0x013792ab WebCore::ResourceLoader::didReceiveData(char const*, int, long long, bool) + 83
70  com.apple.WebCore        	0x01377593 WebCore::MainResourceLoader::didReceiveData(char const*, int, long long, bool) + 281 (MainResourceLoader.cpp:290)
71  com.apple.WebCore        	0x01378f12 WebCore::ResourceLoader::didReceiveData(WebCore::ResourceHandle*, char const*, int, int) + 58
72  com.apple.WebCore        	0x01358768 -[WebCoreResourceHandleAsDelegate connection:didReceiveData:lengthReceived:] + 172 (ResourceHandleMac.mm:352)
73  com.apple.Foundation     	0x9265eb86 -[NSURLConnection(NSURLConnectionInternal) _sendDidReceiveDataCallback] + 641
74  com.apple.Foundation     	0x9265ce67 -[NSURLConnection(NSURLConnectionInternal) _sendCallbacks] + 686
75  com.apple.Foundation     	0x9265cb41 _sendCallbacks + 201
76  com.apple.CoreFoundation 	0x9082afd2 CFRunLoopRunSpecific + 1213
77  com.apple.CoreFoundation 	0x9082ab0e CFRunLoopRunInMode + 61
78  com.apple.HIToolbox      	0x92ddabef RunCurrentEventLoopInMode + 285
79  com.apple.HIToolbox      	0x92dda2fd ReceiveNextEventCommon + 385
80  com.apple.HIToolbox      	0x92dda154 BlockUntilNextEventMatchingListInMode + 81
81  com.apple.AppKit         	0x9327f465 _DPSNextEvent + 572
82  com.apple.AppKit         	0x9327f056 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 137
83  com.apple.Safari         	0x00006cea 0x1000 + 23786
84  com.apple.AppKit         	0x93278ddb -[NSApplication run] + 512
85  com.apple.AppKit         	0x9326cd2f NSApplicationMain + 573
86  com.apple.Safari         	0x0005f54a 0x1000 + 386378
87  com.apple.Safari         	0x0005f471 0x1000 + 386161</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>20688</commentid>
    <comment_count>1</comment_count>
    <who name="David Kilzer (:ddkilzer)">ddkilzer</who>
    <bug_when>2007-03-02 11:08:53 -0800</bug_when>
    <thetext>This is a regression from shipping Safari 2.0.4 (419.3) on Mac OS X 10.4.8 (8N1037).

Tested with a local debug build of WebKit r19943 with the above software.
</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>20689</commentid>
    <comment_count>2</comment_count>
    <who name="Alexey Proskuryakov">ap</who>
    <bug_when>2007-03-02 11:16:42 -0800</bug_when>
    <thetext>I cannot reproduce this on a PowerPC Mac.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>20694</commentid>
    <comment_count>3</comment_count>
    <who name="David Kilzer (:ddkilzer)">ddkilzer</who>
    <bug_when>2007-03-02 11:45:17 -0800</bug_when>
    <thetext>(In reply to comment #2)
&gt; I cannot reproduce this on a PowerPC Mac.

Weird!  I can&apos;t reproduce this with my PB G4, either.  Local debug build of WebKit r19943 with Safari 2.0.4 (419.3) on Mac OS X 10.4.8 (8L127).
</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>20703</commentid>
    <comment_count>4</comment_count>
    <who name="David Kilzer (:ddkilzer)">ddkilzer</who>
    <bug_when>2007-03-02 13:46:27 -0800</bug_when>
    <thetext>(In reply to comment #2)
&gt; I cannot reproduce this on a PowerPC Mac.

The issue is most likely caused by differences in how NaN floating point values are handled on PowerPC versus Intel architectures.  Obviously, this code from StringTruncator.cpp (line 109) returns true with a NaN on PowerPC, but false with a NaN on Intel:

     ASSERT(maxWidth &gt;= 0);

I added an additional ASSERT() macro to the Intel debug build:

+    ASSERT(!isnan(maxWidth));
     ASSERT(maxWidth &gt;= 0);

And rerunning the steps to reproduce demonstrated that maxWidth was a NaN value:

ASSERTION FAILED: !isnan(maxWidth)
(/Users/dkilzer/Projects/WebKit/WebCore/platform/StringTruncator.cpp:109 WebCore::String WebCore::truncateString(const WebCore::String&amp;, float, const WebCore::Font&amp;, unsigned int (*)(const WebCore::String&amp;, unsigned int, unsigned int, UChar*)))
Segmentation fault

Not sure if we need to determine where the NaN is generated, or simply handle the NaN case differently in the truncateString(const String&amp; string, float maxWidth, const Font&amp; font, TruncationFunction truncateToBuffer) method.

</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>20451</commentid>
    <comment_count>5</comment_count>
    <who name="Jeff McGlynn">webkit</who>
    <bug_when>2007-03-02 15:28:25 -0800</bug_when>
    <thetext>This bug is hard to reproduce.  The steps that I take to reliably test the bug are:

1. Open Webkit
2. Make sure the &quot;popunder&quot; cookie for network-drivers.com is NOT set via Safari preferences.
3. Set &quot;Accept Cookies&quot; to Never.
3. Make sure &quot;Block Pop-Up Windows&quot; is NOT set.
4. Command-click on URL:  http://www.network-drivers.com/drivers/53/53064.htm
5. Repeat step 4 until you see detailed popup that contains bar graphs.

So far I have isolated the bug to between WebKit-SVN-r17653.dmg (works) and WebKit-SVN-r17656.dmg (crashes).

I have an iMac G5 and 10.4.8.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>20459</commentid>
    <comment_count>6</comment_count>
      <attachid>13457</attachid>
    <who name="Jeff McGlynn">webkit</who>
    <bug_when>2007-03-02 16:30:40 -0800</bug_when>
    <thetext>Created attachment 13457
Reduction

Command-click to open this attachment to crash Webkit.

I believe that this bug is a GC-related error.  The original page can be fixed by removing the &quot;left=85,top=20,&quot; from the popup parameters.

Accessing the zero index of an array and either a left= or top= parameter are necessary for this crash.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>20565</commentid>
    <comment_count>7</comment_count>
    <who name="Mark Rowe (bdash)">mrowe</who>
    <bug_when>2007-03-05 00:23:46 -0800</bug_when>
    <thetext>The root of this problem is that kjs_window.cpp:1616 calls WebCore::screenRect with null as the argument.  This results in toUserSpace invoking Objective-C methods on nil objects, which will either return zero or an undefined value depending on the return type of the method in question.  This looks to cause userRect to be scaled by NaN, eventually leading to the assertion failure mentioned in this bug report.

One strange thing I noticed while debugging this is that the x/y/width/height members of the WindowFeatures structure are not initialized, and in many cases are used before initialization.  This could lead in some cases for windows created via window.open to have arbitrary sizes and locations while still being constrained within the screens bounds.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>20567</commentid>
    <comment_count>8</comment_count>
      <attachid>13477</attachid>
    <who name="Mark Rowe (bdash)">mrowe</who>
    <bug_when>2007-03-05 00:51:36 -0800</bug_when>
    <thetext>Created attachment 13477
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>20570</commentid>
    <comment_count>9</comment_count>
      <attachid>13477</attachid>
    <who name="Mark Rowe (bdash)">mrowe</who>
    <bug_when>2007-03-05 01:36:32 -0800</bug_when>
    <thetext>Comment on attachment 13477
Patch

I didn&apos;t include a layout test in this patch as I didn&apos;t see any way to test popups via DRT.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>20573</commentid>
    <comment_count>10</comment_count>
    <who name="Mark Rowe (bdash)">mrowe</who>
    <bug_when>2007-03-05 01:56:58 -0800</bug_when>
    <thetext>Landed in r19961.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>20434</commentid>
    <comment_count>11</comment_count>
    <who name="David Kilzer (:ddkilzer)">ddkilzer</who>
    <bug_when>2007-03-05 04:01:52 -0800</bug_when>
    <thetext>(In reply to comment #9)
&gt; I didn&apos;t include a layout test in this patch as I didn&apos;t see any way to test
&gt; popups via DRT.

Do we need a separate bug to implement this feature in DRT?  Should DRT be dumping the list of pop-up menu items in each pop-up?  What should happen in text mode versus layout mode?

</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>20414</commentid>
    <comment_count>12</comment_count>
    <who name="Mark Rowe (bdash)">mrowe</who>
    <bug_when>2007-03-05 05:18:24 -0800</bug_when>
    <thetext>I meant popups in the sense of popup windows created via window.open.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>6444</commentid>
    <comment_count>13</comment_count>
    <who name="David Kilzer (:ddkilzer)">ddkilzer</who>
    <bug_when>2007-06-24 12:04:49 -0700</bug_when>
    <thetext>Mass removal of NeedsRadar keyword from my bugs that have already been RESOLVED.

</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>2033913</commentid>
    <comment_count>14</comment_count>
    <who name="Frances Cornwall">frances_c</who>
    <bug_when>2024-05-07 21:28:16 -0700</bug_when>
    <thetext>*** Bug 12540 has been marked as a duplicate of this bug. ***</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="0"
              isprivate="0"
          >
            <attachid>13457</attachid>
            <date>2007-03-02 16:30:40 -0800</date>
            <delta_ts>2007-03-02 16:30:40 -0800</delta_ts>
            <desc>Reduction</desc>
            <filename>reduction2.html</filename>
            <type>text/html</type>
            <size>568</size>
            <attacher name="Jeff McGlynn">webkit</attacher>
            
              <data encoding="base64">U3RlcHMgdG8gY3Jhc2ggd2Via2l0Ogo8dWw+Cgk8bGk+RGlzYWJsZSBwb3B1cCBibG9ja2luZy48
L2xpPgoJPGxpPkNvbW1hbmQtY2xpY2sgPHNwYW4gaWQ9Imluc2VydHVybCI+PC9zcGFuPiB0byBj
cmFzaCBXZWJraXQuPC9saT4KPC91bD4KCjxzY3JpcHQ+CmlmIChkb2N1bWVudC5sb2NhdGlvbi5z
ZWFyY2guaW5kZXhPZignY3Jhc2g9MScpICE9IC0xKSB7Ci8vLyBCRUdJTiBDUkFTSCBDT0RFIEhF
UkUKCQoJdmFyIHBvcHVuZGVyID0gWyJhYm91dDpibGFuayJdOwoJCgl3aW5kb3cub3Blbihwb3B1
bmRlclswXSwgIiIsICJsZWZ0PTg1Iik7IC8vIG9yIHRvcD04NSwgdGhlIGFjdHVhbCBudW1iZXIg
ZG9lc24ndCBtYXR0ZXIuCgkKLy8vIEVORCBDUkFTSCBDT0RFIEhFUkUKfQoKZG9jdW1lbnQuZ2V0
RWxlbWVudEJ5SWQoImluc2VydHVybCIpLmlubmVySFRNTCA9ICI8YSBocmVmPVwiIiArIGRvY3Vt
ZW50LmxvY2F0aW9uLmhyZWYgKyAod2luZG93LmxvY2F0aW9uLmhyZWYuaW5kZXhPZignPycpID09
IC0xID8gJz8nIDogJyYnKSArICJjcmFzaD0xXCI+dGhpcyBsaW5rPC9hPiI7Cjwvc2NyaXB0Pg==
</data>

          </attachment>
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>13477</attachid>
            <date>2007-03-05 00:51:36 -0800</date>
            <delta_ts>2007-03-05 01:43:50 -0800</delta_ts>
            <desc>Patch</desc>
            <filename>webkit-bug-12947-v1.patch</filename>
            <type>text/plain</type>
            <size>2202</size>
            <attacher name="Mark Rowe (bdash)">mrowe</attacher>
            
              <data encoding="base64">SW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9n
CShyZXZpc2lvbiAxOTk1OSkKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA
IC0xLDMgKzEsMTggQEAKKzIwMDctMDMtMDUgIE1hcmsgUm93ZSAgPG1yb3dlQGFwcGxlLmNvbT4K
KworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBGaXggaHR0
cDovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTI5NDcKKyAgICAgICAgQnVnIDEy
OTQ3OiBSRUdSRVNTSU9OOiBBU1NFUlRJT04gRkFJTEVEOiBtYXhXaWR0aCA+PSAwIGluIFN0cmlu
Z1RydW5jYXRvci5jcHA6MTA5IGluIFdlYkNvcmU6OnRydW5jYXRlU3RyaW5nKCkKKworICAgICAg
ICBIYW5kbGUgbmlsIHdpbmRvdyBjb3JyZWN0bHkgaW4gdG9Vc2VyU3BhY2UgYW5kIHRvRGV2aWNl
U3BhY2UuICBPbiBJbnRlbCBNYWMncyBhIG1lc3NhZ2UgdG8gbmlsIHRoYXQgcmV0dXJucyBhCisg
ICAgICAgIGZsb2F0IHdpbGwgcmV0dXJuIDAuMC4gIFdlIHVzZSB0aGlzIGFzIHRoZSBkaXZpc29y
IGluIGNhbGN1bGF0aW5nIGEgc2NhbGUgZmFjdG9yLCB3aGljaCByZXN1bHRzIGluIE5hTiBiZWlu
ZworICAgICAgICBpbnRyb2R1Y2VkIGludG8gb3VyIHJlY3QuCisKKyAgICAgICAgKiBwbGF0Zm9y
bS9tYWMvU2NyZWVuTWFjLm1tOgorICAgICAgICAoV2ViQ29yZTo6dG9Vc2VyU3BhY2UpOgorICAg
ICAgICAoV2ViQ29yZTo6dG9EZXZpY2VTcGFjZSk6CisKIDIwMDctMDMtMDQgIEFkZWxlIFBldGVy
c29uICA8YWRlbGVAYXBwbGUuY29tPgogCiAgICAgICAgIFJldmlld2VkIGJ5IERhcmluLgpJbmRl
eDogV2ViQ29yZS9wbGF0Zm9ybS9tYWMvU2NyZWVuTWFjLm1tCj09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNv
cmUvcGxhdGZvcm0vbWFjL1NjcmVlbk1hYy5tbQkocmV2aXNpb24gMTk5NTkpCisrKyBXZWJDb3Jl
L3BsYXRmb3JtL21hYy9TY3JlZW5NYWMubW0JKHdvcmtpbmcgY29weSkKQEAgLTgzLDE2ICs4Mywx
OCBAQCBOU1NjcmVlbiAqc2NyZWVuRm9yV2luZG93KE5TV2luZG93ICp3aW5kCiBGbG9hdFJlY3Qg
dG9Vc2VyU3BhY2UoY29uc3QgTlNSZWN0JiByZWN0LCBOU1dpbmRvdyAqZGVzdGluYXRpb24pCiB7
CiAgICAgRmxvYXRSZWN0IHVzZXJSZWN0ID0gcmVjdDsKLSAgICB1c2VyUmVjdC5zZXRZKE5TTWF4
WShbW2Rlc3RpbmF0aW9uIHNjcmVlbl0gZnJhbWVdKSAtICh1c2VyUmVjdC55KCkgKyB1c2VyUmVj
dC5oZWlnaHQoKSkpOyAvLyBmbGlwCi0gICAgdXNlclJlY3Quc2NhbGUoMSAvIFtkZXN0aW5hdGlv
biB1c2VyU3BhY2VTY2FsZUZhY3Rvcl0pOyAvLyBzY2FsZSBkb3duCisgICAgdXNlclJlY3Quc2V0
WShOU01heFkoW3NjcmVlbkZvcldpbmRvdyhkZXN0aW5hdGlvbikgZnJhbWVdKSAtICh1c2VyUmVj
dC55KCkgKyB1c2VyUmVjdC5oZWlnaHQoKSkpOyAvLyBmbGlwCisgICAgaWYgKGRlc3RpbmF0aW9u
KQorICAgICAgICB1c2VyUmVjdC5zY2FsZSgxIC8gW2Rlc3RpbmF0aW9uIHVzZXJTcGFjZVNjYWxl
RmFjdG9yXSk7IC8vIHNjYWxlIGRvd24KICAgICByZXR1cm4gdXNlclJlY3Q7CiB9CiAKIE5TUmVj
dCB0b0RldmljZVNwYWNlKGNvbnN0IEZsb2F0UmVjdCYgcmVjdCwgTlNXaW5kb3cgKnNvdXJjZSkK
IHsKICAgICBGbG9hdFJlY3QgZGV2aWNlUmVjdCA9IHJlY3Q7Ci0gICAgZGV2aWNlUmVjdC5zY2Fs
ZShbc291cmNlIHVzZXJTcGFjZVNjYWxlRmFjdG9yXSk7IC8vIHNjYWxlIHVwCi0gICAgZGV2aWNl
UmVjdC5zZXRZKE5TTWF4WShbW3NvdXJjZSBzY3JlZW5dIGZyYW1lXSkgLSAoZGV2aWNlUmVjdC55
KCkgKyBkZXZpY2VSZWN0LmhlaWdodCgpKSk7IC8vIGZsaXAKKyAgICBpZiAoc291cmNlKQorICAg
ICAgICBkZXZpY2VSZWN0LnNjYWxlKFtzb3VyY2UgdXNlclNwYWNlU2NhbGVGYWN0b3JdKTsgLy8g
c2NhbGUgdXAKKyAgICBkZXZpY2VSZWN0LnNldFkoTlNNYXhZKFtzY3JlZW5Gb3JXaW5kb3coc291
cmNlKSBmcmFtZV0pIC0gKGRldmljZVJlY3QueSgpICsgZGV2aWNlUmVjdC5oZWlnaHQoKSkpOyAv
LyBmbGlwCiAgICAgcmV0dXJuIGRldmljZVJlY3Q7CiB9CiAK
</data>
<flag name="review"
          id="5319"
          type_id="1"
          status="+"
          setter="lars.knoll"
    />
          </attachment>
      

    </bug>

</bugzilla>