<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>130879</bug_id>
          <alias>CVE-2013-2875</alias>
          <creation_ts>2014-03-27 17:47:08 -0700</creation_ts>
          <short_desc>Clear SVGInlineTextBox fragments when the text changes.</short_desc>
          <delta_ts>2014-05-02 14:39:12 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>New Bugs</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>Unspecified</rep_platform>
          <op_sys>Unspecified</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>InRadar</keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Myles C. Maxfield">mmaxfield</reporter>
          <assigned_to name="Myles C. Maxfield">mmaxfield</assigned_to>
          <cc>ddkilzer</cc>
    
    <cc>dino</cc>
    
    <cc>jeffcz</cc>
    
    <cc>jonlee</cc>
    
    <cc>simon.fraser</cc>
    
    <cc>thorton</cc>
    
    <cc>webkit-bug-importer</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>995182</commentid>
    <comment_count>0</comment_count>
    <who name="Myles C. Maxfield">mmaxfield</who>
    <bug_when>2014-03-27 17:47:08 -0700</bug_when>
    <thetext>Clear SVGInlineTextBox fragments when the text changes.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>995184</commentid>
    <comment_count>1</comment_count>
      <attachid>228012</attachid>
    <who name="Myles C. Maxfield">mmaxfield</who>
    <bug_when>2014-03-27 17:48:38 -0700</bug_when>
    <thetext>Created attachment 228012
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>995186</commentid>
    <comment_count>2</comment_count>
    <who name="Myles C. Maxfield">mmaxfield</who>
    <bug_when>2014-03-27 17:49:14 -0700</bug_when>
    <thetext>&lt;rdar://problem/15695951&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>995269</commentid>
    <comment_count>3</comment_count>
      <attachid>228012</attachid>
    <who name="Darin Adler">darin</who>
    <bug_when>2014-03-28 01:03:03 -0700</bug_when>
    <thetext>Comment on attachment 228012
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=228012&amp;action=review

&gt; Source/WebCore/ChangeLog:16
&gt; +        Also cleans up virtual, OVERRIDE and FINAL for SVGRootInlineBox, which was all messed up.

I don’t understand this comment. The patch adds a few final. but I don’t see any cleanup of virtual or override.

Maybe this is just a comment from Blink that makes no sense here.

&gt; Source/WebCore/rendering/svg/SVGInlineTextBox.cpp:70
&gt; +    InlineTextBox* nextBox = nextTextBox();
&gt; +    if (nextBox)

I’d suggest putting the variable definition inside the if statement.

&gt; Source/WebCore/rendering/svg/SVGInlineTextBox.cpp:71
&gt; +        nextBox-&gt;dirtyLineBoxes();

I’m slightly concerned that this is a recursive algorithm, which might end up using stack proportional to the number of successive SVGInlineTextBox objects. Is there a clean way to do this in an iterative fashion rather than recursive? Maybe the compiler’s tail call optimization will take care of it?

&gt; LayoutTests/ChangeLog:16
&gt; +        This patch modifies SVGInlineTextBox::dirtyLineBoxes to clear all
&gt; +        following text boxes when invoked. Typically this method is called
&gt; +        when the underlying text string changes, and that change needs to
&gt; +        be propagated to all the boxes that use the text beyond the point
&gt; +        where the text is first modified.
&gt; +        
&gt; +        Also cleans up virtual, OVERRIDE and FINAL for SVGRootInlineBox, which was all messed up.

We should not be repeating these comments here. The comments here should just talk about the tests.

&gt; LayoutTests/svg/custom/unicode-in-tspan-multi-svg-crash.html:36
&gt; +    &lt;p&gt;Test Passes if there is no crash in Debug or Asan builds. There should be no characters preceding &quot;Test&quot;.&lt;/p&gt;

Seems pretty weak to have a test where passing is “not crashing”. It seems to me that we could come up with a test that shows checks for correct behavior, maybe a reference test.

But I guess it’s efficient to just use the test the Blink contributor provided with his patch, even though it has serious shortcomings.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>995374</commentid>
    <comment_count>4</comment_count>
      <attachid>228012</attachid>
    <who name="Myles C. Maxfield">mmaxfield</who>
    <bug_when>2014-03-28 10:23:47 -0700</bug_when>
    <thetext>Comment on attachment 228012
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=228012&amp;action=review

&gt;&gt; Source/WebCore/ChangeLog:16
&gt;&gt; +        Also cleans up virtual, OVERRIDE and FINAL for SVGRootInlineBox, which was all messed up.
&gt; 
&gt; I don’t understand this comment. The patch adds a few final. but I don’t see any cleanup of virtual or override.
&gt; 
&gt; Maybe this is just a comment from Blink that makes no sense here.

It is. I&apos;ll update this comment.

&gt;&gt; LayoutTests/svg/custom/unicode-in-tspan-multi-svg-crash.html:36
&gt;&gt; +    &lt;p&gt;Test Passes if there is no crash in Debug or Asan builds. There should be no characters preceding &quot;Test&quot;.&lt;/p&gt;
&gt; 
&gt; Seems pretty weak to have a test where passing is “not crashing”. It seems to me that we could come up with a test that shows checks for correct behavior, maybe a reference test.
&gt; 
&gt; But I guess it’s efficient to just use the test the Blink contributor provided with his patch, even though it has serious shortcomings.

Without the patch, this line doesn&apos;t get shown at all on my mac. Instead, garbage characters are shown instead. A dump-as-text test should be reasonable in this case.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>995408</commentid>
    <comment_count>5</comment_count>
      <attachid>228012</attachid>
    <who name="Myles C. Maxfield">mmaxfield</who>
    <bug_when>2014-03-28 11:26:12 -0700</bug_when>
    <thetext>Comment on attachment 228012
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=228012&amp;action=review

&gt;&gt;&gt; Source/WebCore/ChangeLog:16
&gt;&gt;&gt; +        Also cleans up virtual, OVERRIDE and FINAL for SVGRootInlineBox, which was all messed up.
&gt;&gt; 
&gt;&gt; I don’t understand this comment. The patch adds a few final. but I don’t see any cleanup of virtual or override.
&gt;&gt; 
&gt;&gt; Maybe this is just a comment from Blink that makes no sense here.
&gt; 
&gt; It is. I&apos;ll update this comment.

Done.

&gt;&gt; Source/WebCore/rendering/svg/SVGInlineTextBox.cpp:70
&gt;&gt; +    if (nextBox)
&gt; 
&gt; I’d suggest putting the variable definition inside the if statement.

Done.

&gt;&gt; Source/WebCore/rendering/svg/SVGInlineTextBox.cpp:71
&gt;&gt; +        nextBox-&gt;dirtyLineBoxes();
&gt; 
&gt; I’m slightly concerned that this is a recursive algorithm, which might end up using stack proportional to the number of successive SVGInlineTextBox objects. Is there a clean way to do this in an iterative fashion rather than recursive? Maybe the compiler’s tail call optimization will take care of it?

Done.

&gt;&gt; LayoutTests/ChangeLog:16
&gt;&gt; +        Also cleans up virtual, OVERRIDE and FINAL for SVGRootInlineBox, which was all messed up.
&gt; 
&gt; We should not be repeating these comments here. The comments here should just talk about the tests.

Done.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>995409</commentid>
    <comment_count>6</comment_count>
    <who name="Myles C. Maxfield">mmaxfield</who>
    <bug_when>2014-03-28 11:26:24 -0700</bug_when>
    <thetext>http://trac.webkit.org/changeset/166420</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>228012</attachid>
            <date>2014-03-27 17:48:38 -0700</date>
            <delta_ts>2014-03-28 11:26:12 -0700</delta_ts>
            <desc>Patch</desc>
            <filename>bug-130879-20140327174817.patch</filename>
            <type>text/plain</type>
            <size>7542</size>
            <attacher name="Myles C. Maxfield">mmaxfield</attacher>
            
              <data encoding="base64">U3VidmVyc2lvbiBSZXZpc2lvbjogMTY2MzY4CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D
aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggYzAwNzcxMTA3NTNhMmI0
ODkyNjQ3OGQwYzdlNjczMjI1MDllNzE3Mi4uMWQ5NDk3YTc3Y2UwNTU4MjA3MTVhNDUzMzkyN2Yw
Mjg1NzdiYjNkMyAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv
dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDI3IEBACisyMDE0LTAzLTI3ICBNeWxl
cyBDLiBNYXhmaWVsZCAgPG1tYXhmaWVsZEBhcHBsZS5jb20+CisKKyAgICAgICAgQ2xlYXIgU1ZH
SW5saW5lVGV4dEJveCBmcmFnbWVudHMgd2hlbiB0aGUgdGV4dCBjaGFuZ2VzLgorICAgICAgICBo
dHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTMwODc5CisKKyAgICAgICAg
UmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgUG9ydGVkIGZyb20gQmxpbms6
IGh0dHBzOi8vc3JjLmNocm9taXVtLm9yZy92aWV3dmMvYmxpbms/cmV2aXNpb249MTUwNDU2JnZp
ZXc9cmV2aXNpb24KKworICAgICAgICBUaGlzIHBhdGNoIG1vZGlmaWVzIFNWR0lubGluZVRleHRC
b3g6OmRpcnR5TGluZUJveGVzIHRvIGNsZWFyIGFsbAorICAgICAgICBmb2xsb3dpbmcgdGV4dCBi
b3hlcyB3aGVuIGludm9rZWQuIFR5cGljYWxseSB0aGlzIG1ldGhvZCBpcyBjYWxsZWQKKyAgICAg
ICAgd2hlbiB0aGUgdW5kZXJseWluZyB0ZXh0IHN0cmluZyBjaGFuZ2VzLCBhbmQgdGhhdCBjaGFu
Z2UgbmVlZHMgdG8KKyAgICAgICAgYmUgcHJvcGFnYXRlZCB0byBhbGwgdGhlIGJveGVzIHRoYXQg
dXNlIHRoZSB0ZXh0IGJleW9uZCB0aGUgcG9pbnQKKyAgICAgICAgd2hlcmUgdGhlIHRleHQgaXMg
Zmlyc3QgbW9kaWZpZWQuCisgICAgICAgIAorICAgICAgICBBbHNvIGNsZWFucyB1cCB2aXJ0dWFs
LCBPVkVSUklERSBhbmQgRklOQUwgZm9yIFNWR1Jvb3RJbmxpbmVCb3gsIHdoaWNoIHdhcyBhbGwg
bWVzc2VkIHVwLgorCisgICAgICAgIFRlc3Q6IHN2Zy9jdXN0b20vdW5pY29kZS1pbi10c3Bhbi1t
dWx0aS1zdmctY3Jhc2guaHRtbAorCisgICAgICAgICogcmVuZGVyaW5nL3N2Zy9TVkdJbmxpbmVU
ZXh0Qm94LmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OlNWR0lubGluZVRleHRCb3g6OmRpcnR5TGlu
ZUJveGVzKToKKyAgICAgICAgKiByZW5kZXJpbmcvc3ZnL1NWR0lubGluZVRleHRCb3guaDoKKyAg
ICAgICAgKiByZW5kZXJpbmcvc3ZnL1NWR1Jvb3RJbmxpbmVCb3guaDoKKwogMjAxNC0wMy0yNyAg
QWRlbmlsc29uIENhdmFsY2FudGkgIDxjYXZhbGNhbnRpaUBnbWFpbC5jb20+CiAKICAgICAgICAg
UmVtb3ZlIGNvbW1lbnQgZnJvbSBGaWx0ZXIuaApkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUv
cmVuZGVyaW5nL3N2Zy9TVkdJbmxpbmVUZXh0Qm94LmNwcCBiL1NvdXJjZS9XZWJDb3JlL3JlbmRl
cmluZy9zdmcvU1ZHSW5saW5lVGV4dEJveC5jcHAKaW5kZXggZmU3NTI0NjE5MWEyMjNiMmM2ZGU3
NTNiZTQ0ZjQ0ODdlZmVjOWI2ZC4uZTQ3Njg3YWZhZmE4M2Y3OGM3MzIzNDVhODIwMjYyODEzYTYy
NWU0OCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvcmVuZGVyaW5nL3N2Zy9TVkdJbmxpbmVU
ZXh0Qm94LmNwcAorKysgYi9Tb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvc3ZnL1NWR0lubGluZVRl
eHRCb3guY3BwCkBAIC02Myw2ICs2MywxMiBAQCB2b2lkIFNWR0lubGluZVRleHRCb3g6OmRpcnR5
TGluZUJveGVzKCkKIAogICAgIC8vIENsZWFyIHRoZSBub3cgc3RhbGUgdGV4dCBmcmFnbWVudHMK
ICAgICBjbGVhclRleHRGcmFnbWVudHMoKTsKKworICAgIC8vIEFuZCBjbGVhciBhbnkgZm9sbG93
aW5nIHRleHQgZnJhZ21lbnRzIGFzIHRoZSB0ZXh0IG9uIHdoaWNoIHRoZXkKKyAgICAvLyBkZXBl
bmQgbWF5IG5vdyBubyBsb25nZXIgZXhpc3QsIG9yIGdseXBoIHBvc2l0aW9ucyBtYXkgYmUgd3Jv
bmcKKyAgICBJbmxpbmVUZXh0Qm94KiBuZXh0Qm94ID0gbmV4dFRleHRCb3goKTsKKyAgICBpZiAo
bmV4dEJveCkKKyAgICAgICAgbmV4dEJveC0+ZGlydHlMaW5lQm94ZXMoKTsKIH0KIAogaW50IFNW
R0lubGluZVRleHRCb3g6Om9mZnNldEZvclBvc2l0aW9uKGZsb2F0LCBib29sKSBjb25zdApkaWZm
IC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvcmVuZGVyaW5nL3N2Zy9TVkdJbmxpbmVUZXh0Qm94Lmgg
Yi9Tb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvc3ZnL1NWR0lubGluZVRleHRCb3guaAppbmRleCA1
MjljOWYzZjRiZGYyOWE2MjkyYjkxZDNhYmYzMWUxMjFkZWI1OGUxLi42ODBkNDZmYzA4ZDdmNjMw
MmNmZjFmY2EwMjE0ZTg4OGY4ZWQ0ZDExIDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9yZW5k
ZXJpbmcvc3ZnL1NWR0lubGluZVRleHRCb3guaAorKysgYi9Tb3VyY2UvV2ViQ29yZS9yZW5kZXJp
bmcvc3ZnL1NWR0lubGluZVRleHRCb3guaApAQCAtNTcsNyArNTcsNyBAQCBwdWJsaWM6CiAgICAg
VmVjdG9yPFNWR1RleHRGcmFnbWVudD4mIHRleHRGcmFnbWVudHMoKSB7IHJldHVybiBtX3RleHRG
cmFnbWVudHM7IH0KICAgICBjb25zdCBWZWN0b3I8U1ZHVGV4dEZyYWdtZW50PiYgdGV4dEZyYWdt
ZW50cygpIGNvbnN0IHsgcmV0dXJuIG1fdGV4dEZyYWdtZW50czsgfQogCi0gICAgdmlydHVhbCB2
b2lkIGRpcnR5TGluZUJveGVzKCkgb3ZlcnJpZGU7CisgICAgdmlydHVhbCB2b2lkIGRpcnR5TGlu
ZUJveGVzKCkgb3ZlcnJpZGUgZmluYWw7CiAKICAgICBib29sIHN0YXJ0c05ld1RleHRDaHVuaygp
IGNvbnN0IHsgcmV0dXJuIG1fc3RhcnRzTmV3VGV4dENodW5rOyB9CiAgICAgdm9pZCBzZXRTdGFy
dHNOZXdUZXh0Q2h1bmsoYm9vbCBuZXdUZXh0Q2h1bmspIHsgbV9zdGFydHNOZXdUZXh0Q2h1bmsg
PSBuZXdUZXh0Q2h1bms7IH0KZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL3JlbmRlcmluZy9z
dmcvU1ZHUm9vdElubGluZUJveC5oIGIvU291cmNlL1dlYkNvcmUvcmVuZGVyaW5nL3N2Zy9TVkdS
b290SW5saW5lQm94LmgKaW5kZXggZjZjZTFkOGQ1ZTY0MDA0ZmVmOWViYTRmMDU2NjNmN2RiYzE4
ZWYxOS4uNzQwMjNiNTNhMmYwMjJlMGRhNWYxZjE1ODYwYWQxN2JiZTJiNWFlZSAxMDA2NDQKLS0t
IGEvU291cmNlL1dlYkNvcmUvcmVuZGVyaW5nL3N2Zy9TVkdSb290SW5saW5lQm94LmgKKysrIGIv
U291cmNlL1dlYkNvcmUvcmVuZGVyaW5nL3N2Zy9TVkdSb290SW5saW5lQm94LmgKQEAgLTM4LDE3
ICszOCwxNyBAQCBwdWJsaWM6CiAKICAgICBSZW5kZXJTVkdUZXh0JiByZW5kZXJTVkdUZXh0KCk7
CiAKLSAgICB2aXJ0dWFsIGZsb2F0IHZpcnR1YWxMb2dpY2FsSGVpZ2h0KCkgY29uc3Qgb3ZlcnJp
ZGUgeyByZXR1cm4gbV9sb2dpY2FsSGVpZ2h0OyB9CisgICAgdmlydHVhbCBmbG9hdCB2aXJ0dWFs
TG9naWNhbEhlaWdodCgpIGNvbnN0IG92ZXJyaWRlIGZpbmFsIHsgcmV0dXJuIG1fbG9naWNhbEhl
aWdodDsgfQogICAgIHZvaWQgc2V0TG9naWNhbEhlaWdodChmbG9hdCBoZWlnaHQpIHsgbV9sb2dp
Y2FsSGVpZ2h0ID0gaGVpZ2h0OyB9CiAKLSAgICB2aXJ0dWFsIHZvaWQgcGFpbnQoUGFpbnRJbmZv
JiwgY29uc3QgTGF5b3V0UG9pbnQmLCBMYXlvdXRVbml0IGxpbmVUb3AsIExheW91dFVuaXQgbGlu
ZUJvdHRvbSkgb3ZlcnJpZGU7CisgICAgdmlydHVhbCB2b2lkIHBhaW50KFBhaW50SW5mbyYsIGNv
bnN0IExheW91dFBvaW50JiwgTGF5b3V0VW5pdCBsaW5lVG9wLCBMYXlvdXRVbml0IGxpbmVCb3R0
b20pIG92ZXJyaWRlIGZpbmFsOwogCiAgICAgdm9pZCBjb21wdXRlUGVyQ2hhcmFjdGVyTGF5b3V0
SW5mb3JtYXRpb24oKTsKIAogICAgIElubGluZUJveCogY2xvc2VzdExlYWZDaGlsZEZvclBvc2l0
aW9uKGNvbnN0IExheW91dFBvaW50Jik7CiAKIHByaXZhdGU6Ci0gICAgdmlydHVhbCBib29sIGlz
U1ZHUm9vdElubGluZUJveCgpIGNvbnN0IG92ZXJyaWRlIHsgcmV0dXJuIHRydWU7IH0KKyAgICB2
aXJ0dWFsIGJvb2wgaXNTVkdSb290SW5saW5lQm94KCkgY29uc3Qgb3ZlcnJpZGUgZmluYWwgeyBy
ZXR1cm4gdHJ1ZTsgfQogICAgIHZvaWQgcmVvcmRlclZhbHVlTGlzdHMoVmVjdG9yPFNWR1RleHRM
YXlvdXRBdHRyaWJ1dGVzKj4mKTsKICAgICB2b2lkIGxheW91dENoYXJhY3RlcnNJblRleHRCb3hl
cyhJbmxpbmVGbG93Qm94KiwgU1ZHVGV4dExheW91dEVuZ2luZSYpOwogICAgIHZvaWQgbGF5b3V0
Q2hpbGRCb3hlcyhJbmxpbmVGbG93Qm94KiwgRmxvYXRSZWN0KiA9IDApOwpkaWZmIC0tZ2l0IGEv
TGF5b3V0VGVzdHMvQ2hhbmdlTG9nIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCmluZGV4IDM1YmM0
NDc2MWQ2M2ViYzc2ZDMyYzg4YjczZmQ3MTgyMTM3ODg3ZjAuLjljOWMyZTI5ZGZkMzk5NWEzNmIy
YzYzODkxMDg1ZDQ4ODAyYmE5NDggMTAwNjQ0Ci0tLSBhL0xheW91dFRlc3RzL0NoYW5nZUxvZwor
KysgYi9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKQEAgLTEsMyArMSwyMyBAQAorMjAxNC0wMy0yNyAg
TXlsZXMgQy4gTWF4ZmllbGQgIDxtbWF4ZmllbGRAYXBwbGUuY29tPgorCisgICAgICAgIENsZWFy
IFNWR0lubGluZVRleHRCb3ggZnJhZ21lbnRzIHdoZW4gdGhlIHRleHQgY2hhbmdlcy4KKyAgICAg
ICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTEzMDg3OQorCisgICAg
ICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIFBvcnRlZCBmcm9tIEJs
aW5rOiBodHRwczovL3NyYy5jaHJvbWl1bS5vcmcvdmlld3ZjL2JsaW5rP3JldmlzaW9uPTE1MDQ1
NiZ2aWV3PXJldmlzaW9uCisKKyAgICAgICAgVGhpcyBwYXRjaCBtb2RpZmllcyBTVkdJbmxpbmVU
ZXh0Qm94OjpkaXJ0eUxpbmVCb3hlcyB0byBjbGVhciBhbGwKKyAgICAgICAgZm9sbG93aW5nIHRl
eHQgYm94ZXMgd2hlbiBpbnZva2VkLiBUeXBpY2FsbHkgdGhpcyBtZXRob2QgaXMgY2FsbGVkCisg
ICAgICAgIHdoZW4gdGhlIHVuZGVybHlpbmcgdGV4dCBzdHJpbmcgY2hhbmdlcywgYW5kIHRoYXQg
Y2hhbmdlIG5lZWRzIHRvCisgICAgICAgIGJlIHByb3BhZ2F0ZWQgdG8gYWxsIHRoZSBib3hlcyB0
aGF0IHVzZSB0aGUgdGV4dCBiZXlvbmQgdGhlIHBvaW50CisgICAgICAgIHdoZXJlIHRoZSB0ZXh0
IGlzIGZpcnN0IG1vZGlmaWVkLgorICAgICAgICAKKyAgICAgICAgQWxzbyBjbGVhbnMgdXAgdmly
dHVhbCwgT1ZFUlJJREUgYW5kIEZJTkFMIGZvciBTVkdSb290SW5saW5lQm94LCB3aGljaCB3YXMg
YWxsIG1lc3NlZCB1cC4KKworICAgICAgICAqIHN2Zy9jdXN0b20vdW5pY29kZS1pbi10c3Bhbi1t
dWx0aS1zdmctY3Jhc2gtZXhwZWN0ZWQudHh0OiBBZGRlZC4KKyAgICAgICAgKiBzdmcvY3VzdG9t
L3VuaWNvZGUtaW4tdHNwYW4tbXVsdGktc3ZnLWNyYXNoLmh0bWw6IEFkZGVkLgorCiAyMDE0LTAz
LTI3ICBCcmVudCBGdWxnaGFtICA8YmZ1bGdoYW1AYXBwbGUuY29tPgogCiAgICAgICAgIEZpeCBh
IGNyYXNoIGNhdXNlZCBieSB0cmFjayBpbnNlcnRpb24gYWZ0ZXIgbG9hZCgpCmRpZmYgLS1naXQg
YS9MYXlvdXRUZXN0cy9zdmcvY3VzdG9tL3VuaWNvZGUtaW4tdHNwYW4tbXVsdGktc3ZnLWNyYXNo
LWV4cGVjdGVkLnR4dCBiL0xheW91dFRlc3RzL3N2Zy9jdXN0b20vdW5pY29kZS1pbi10c3Bhbi1t
dWx0aS1zdmctY3Jhc2gtZXhwZWN0ZWQudHh0Cm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAw
MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAuLmJmZWU3ZTllMGNhMTk3MWE5
ZGMwOTUwNjg4NDZkOTcxYzhiMTc0MTAKLS0tIC9kZXYvbnVsbAorKysgYi9MYXlvdXRUZXN0cy9z
dmcvY3VzdG9tL3VuaWNvZGUtaW4tdHNwYW4tbXVsdGktc3ZnLWNyYXNoLWV4cGVjdGVkLnR4dApA
QCAtMCwwICsxIEBACitUZXN0IFBhc3NlcyBpZiB0aGVyZSBpcyBubyBjcmFzaCBpbiBEZWJ1ZyBv
ciBBc2FuIGJ1aWxkcy4gVGhlcmUgc2hvdWxkIGJlIG5vIGNoYXJhY3RlcnMgcHJlY2VkaW5nICJU
ZXN0Ii4KZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL3N2Zy9jdXN0b20vdW5pY29kZS1pbi10c3Bh
bi1tdWx0aS1zdmctY3Jhc2guaHRtbCBiL0xheW91dFRlc3RzL3N2Zy9jdXN0b20vdW5pY29kZS1p
bi10c3Bhbi1tdWx0aS1zdmctY3Jhc2guaHRtbApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAw
MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwLi4xOWI0MzAxN2I1MDU1NGE2
ZTAzYTRmM2YxMmFlNjQ2YTZiODZiZWYxCi0tLSAvZGV2L251bGwKKysrIGIvTGF5b3V0VGVzdHMv
c3ZnL2N1c3RvbS91bmljb2RlLWluLXRzcGFuLW11bHRpLXN2Zy1jcmFzaC5odG1sCkBAIC0wLDAg
KzEsMzggQEAKKzwhRE9DVFlQRSBodG1sPgorPGh0bWw+CisgIDxzY3JpcHQ+CisgICAgaWYgKHdp
bmRvdy50ZXN0UnVubmVyKQorICAgICAgdGVzdFJ1bm5lci5kdW1wQXNUZXh0KGZhbHNlKTsKKwor
ICAgIG9ubG9hZCA9IGZ1bmN0aW9uKCkgeworICAgICAgdFNwYW5FbGVtZW50ID0gZG9jdW1lbnQu
Z2V0RWxlbWVudEJ5SWQoJ3RTcGFuSW5GaXJzdFJvb3QnKTsKKyAgICAgIHRTcGFuRWxlbWVudC5h
cHBlbmRDaGlsZChkb2N1bWVudC5jcmVhdGVUZXh0Tm9kZSh1bmVzY2FwZSgnJXVmZTllJXVlMjhm
JXVlNDdlJykpKTsKKworICAgICAgZG9jdW1lbnQuYm9keS5vZmZzZXRUb3A7CisgICAgICBkb2N1
bWVudC5ib2R5LnN0eWxlLnpvb209MC45OworCisgICAgICBkb2N1bWVudC5kZXNpZ25Nb2RlPSdv
bic7CisgICAgICBmaWx0ZXJJbkZpcnN0Um9vdCA9IGRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCdm
aWx0ZXJJbkZpcnN0Um9vdCcpOworICAgICAgdXNlRWxlbWVudCA9IGRvY3VtZW50LmdldEVsZW1l
bnRCeUlkKCd1c2VFbGVtZW50Jyk7CisgICAgICB3aW5kb3cuZ2V0U2VsZWN0aW9uKCkuc2V0QmFz
ZUFuZEV4dGVudChmaWx0ZXJJbkZpcnN0Um9vdCwgdXNlRWxlbWVudCwgNSk7CisgICAgICBkb2N1
bWVudC5leGVjQ29tbWFuZCgnRm9yd2FyZERlbGV0ZScpOworICAgICAgZG9jdW1lbnQuZGVzaWdu
TW9kZT0nb2ZmJzsKKyAgICB9CisgIDwvc2NyaXB0PgorICA8Ym9keT4KKyAgICA8c3ZnIHhtbG5z
PSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+CisgICAgICA8dGV4dD4KKyAgICAgICAgPGZp
bHRlciBpZD0iZmlsdGVySW5GaXJzdFJvb3QiLz4KKyAgICAgICAgPHRzcGFuIGlkPSJ0U3Bhbklu
Rmlyc3RSb290Ii8+CisgICAgICA8L3RleHQ+CisgICAgICA8cGF0aCBmaWx0ZXI9InVybCgjZmls
dGVySW5TZWNvbmRSb290KSIvPgorICAgIDwvc3ZnPgorCisgICAgPHN2ZyB4bWxucz0iaHR0cDov
L3d3dy53My5vcmcvMjAwMC9zdmciPgorICAgICAgPHVzZSBpZD0idXNlRWxlbWVudCIvPgorICAg
ICAgPGZpbHRlciBpZD0iZmlsdGVySW5TZWNvbmRSb290Ii8+CisgICAgPC9zdmc+CisKKyAgICA8
cD5UZXN0IFBhc3NlcyBpZiB0aGVyZSBpcyBubyBjcmFzaCBpbiBEZWJ1ZyBvciBBc2FuIGJ1aWxk
cy4gVGhlcmUgc2hvdWxkIGJlIG5vIGNoYXJhY3RlcnMgcHJlY2VkaW5nICJUZXN0Ii48L3A+Cisg
IDwvYm9keT4KKzwvaHRtbD4K
</data>
<flag name="review"
          id="252273"
          type_id="1"
          status="+"
          setter="darin"
    />
          </attachment>
      

    </bug>

</bugzilla>