<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>131609</bug_id>
          
          <creation_ts>2014-04-14 01:30:29 -0700</creation_ts>
          <short_desc>Array.prototype.concat should allocate output storage only once.</short_desc>
          <delta_ts>2014-04-14 11:04:55 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>JavaScriptCore</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>Unspecified</rep_platform>
          <op_sys>Unspecified</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>Performance</keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          <dependson>131621</dependson>
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Andreas Kling">kling</reporter>
          <assigned_to name="Andreas Kling">kling</assigned_to>
          <cc>commit-queue</cc>
    
    <cc>kling</cc>
    
    <cc>oliver</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>1000438</commentid>
    <comment_count>0</comment_count>
    <who name="Andreas Kling">kling</who>
    <bug_when>2014-04-14 01:30:29 -0700</bug_when>
    <thetext>Array.prototype.concat should allocate output storage only once.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1000439</commentid>
    <comment_count>1</comment_count>
      <attachid>229273</attachid>
    <who name="Andreas Kling">kling</who>
    <bug_when>2014-04-14 01:32:40 -0700</bug_when>
    <thetext>Created attachment 229273
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1000440</commentid>
    <comment_count>2</comment_count>
      <attachid>229273</attachid>
    <who name="Darin Adler">darin</who>
    <bug_when>2014-04-14 01:36:20 -0700</bug_when>
    <thetext>Comment on attachment 229273
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=229273&amp;action=review

&gt; Source/JavaScriptCore/runtime/ArrayPrototype.cpp:421
&gt; +    unsigned finalArraySize = 0;

This is unsigned.

&gt; Source/JavaScriptCore/runtime/ArrayPrototype.cpp:423
&gt; +    for (size_t i = 0; i &lt;= argCount; ++i) {

Yet this is size_t. What guarantees we don’t overflow the unsigned?

&gt; Source/JavaScriptCore/runtime/ArrayPrototype.cpp:428
&gt; +        curArg = exec-&gt;uncheckedArgument(i);

A little lame to do this one extra time at the end of the loop but then discard the result.

&gt; Source/JavaScriptCore/runtime/ArrayPrototype.cpp:431
&gt; +    JSArray* arr = constructEmptyArray(exec, nullptr, finalArraySize);

Go nuts and call this array instead of arr?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1000500</commentid>
    <comment_count>3</comment_count>
    <who name="Andreas Kling">kling</who>
    <bug_when>2014-04-14 09:20:28 -0700</bug_when>
    <thetext>(In reply to comment #2)
&gt; (From update of attachment 229273 [details])
&gt; View in context: https://bugs.webkit.org/attachment.cgi?id=229273&amp;action=review
&gt; 
&gt; &gt; Source/JavaScriptCore/runtime/ArrayPrototype.cpp:421
&gt; &gt; +    unsigned finalArraySize = 0;
&gt; 
&gt; This is unsigned.
&gt; 
&gt; &gt; Source/JavaScriptCore/runtime/ArrayPrototype.cpp:423
&gt; &gt; +    for (size_t i = 0; i &lt;= argCount; ++i) {
&gt; 
&gt; Yet this is size_t. What guarantees we don’t overflow the unsigned?

Let&apos;s Checked&lt;&gt; it.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1000501</commentid>
    <comment_count>4</comment_count>
    <who name="Andreas Kling">kling</who>
    <bug_when>2014-04-14 09:20:37 -0700</bug_when>
    <thetext>Committed r167249: &lt;http://trac.webkit.org/changeset/167249&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1000506</commentid>
    <comment_count>5</comment_count>
      <attachid>229273</attachid>
    <who name="Oliver Hunt">oliver</who>
    <bug_when>2014-04-14 09:40:28 -0700</bug_when>
    <thetext>Comment on attachment 229273
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=229273&amp;action=review

&gt;&gt; Source/JavaScriptCore/runtime/ArrayPrototype.cpp:423
&gt;&gt; +    for (size_t i = 0; i &lt;= argCount; ++i) {
&gt; 
&gt; Yet this is size_t. What guarantees we don’t overflow the unsigned?

Why &lt;= argCount? That means we always walk off the end of the argument list.  What am i missing?

&gt;&gt; Source/JavaScriptCore/runtime/ArrayPrototype.cpp:428
&gt;&gt; +        curArg = exec-&gt;uncheckedArgument(i);
&gt; 
&gt; A little lame to do this one extra time at the end of the loop but then discard the result.

ah i see. do {} while loop instead maybe?

&gt; Source/JavaScriptCore/runtime/ArrayPrototype.cpp:442
&gt;              for (unsigned k = 0; k &lt; length; ++k) {
&gt; -                JSValue v = getProperty(exec, curObject, k);
&gt; +                JSValue v = getProperty(exec, currentArray, k);

currentArray is an object, i would do a canGetFastIndex, and fastGet -- so two loops but the get should be much faster.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1000526</commentid>
    <comment_count>6</comment_count>
    <who name="WebKit Commit Bot">commit-queue</who>
    <bug_when>2014-04-14 10:23:58 -0700</bug_when>
    <thetext>Re-opened since this is blocked by bug 131621</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1000536</commentid>
    <comment_count>7</comment_count>
      <attachid>229291</attachid>
    <who name="Andreas Kling">kling</who>
    <bug_when>2014-04-14 10:50:20 -0700</bug_when>
    <thetext>Created attachment 229291
Patch

Derp, let&apos;s not read past the last argument, shall we. Wish we had a debug-ews to tell me I&apos;m doing dumb stuff sometimes.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1000537</commentid>
    <comment_count>8</comment_count>
      <attachid>229291</attachid>
    <who name="Oliver Hunt">oliver</who>
    <bug_when>2014-04-14 10:51:51 -0700</bug_when>
    <thetext>Comment on attachment 229291
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=229291&amp;action=review

&gt; Source/JavaScriptCore/runtime/ArrayPrototype.cpp:444
&gt; -                JSValue v = getProperty(exec, curObject, k);
&gt; +                JSValue v = getProperty(exec, currentArray, k);

Follow on patch to optimise this get</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1000544</commentid>
    <comment_count>9</comment_count>
    <who name="Andreas Kling">kling</who>
    <bug_when>2014-04-14 11:04:55 -0700</bug_when>
    <thetext>Committed r167255: &lt;http://trac.webkit.org/changeset/167255&gt;</thetext>
  </long_desc>
      
          <attachment
              isobsolete="1"
              ispatch="1"
              isprivate="0"
          >
            <attachid>229273</attachid>
            <date>2014-04-14 01:32:40 -0700</date>
            <delta_ts>2014-04-14 10:50:20 -0700</delta_ts>
            <desc>Patch</desc>
            <filename>bug-131609.diff</filename>
            <type>text/plain</type>
            <size>3483</size>
            <attacher name="Andreas Kling">kling</attacher>
            
              <data encoding="base64">ZGlmZiAtLWdpdCBhL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cgYi9Tb3VyY2UvSmF2
YVNjcmlwdENvcmUvQ2hhbmdlTG9nCmluZGV4IGEzOTM2OWMuLmQ1YTRmZDggMTAwNjQ0Ci0tLSBh
L1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKKysrIGIvU291cmNlL0phdmFTY3JpcHRD
b3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDI3IEBACisyMDE0LTA0LTE0ICBBbmRyZWFzIEtsaW5n
ICA8YWtsaW5nQGFwcGxlLmNvbT4KKworICAgICAgICBBcnJheS5wcm90b3R5cGUuY29uY2F0IHNo
b3VsZCBhbGxvY2F0ZSBvdXRwdXQgc3RvcmFnZSBvbmx5IG9uY2UuCisgICAgICAgIDxodHRwczov
L3dlYmtpdC5vcmcvYi8xMzE2MDk+CisKKyAgICAgICAgRG8gYSBmaXJzdCBwYXNzIGFjcm9zcyAn
dGhpcycgYW5kIGFueSBhcmd1bWVudHMgdG8gY29tcHV0ZSB0aGUKKyAgICAgICAgZmluYWwgc2l6
ZSBvZiB0aGUgcmVzdWx0aW5nIGFycmF5IGZyb20gQXJyYXkucHJvdG90eXBlLmNvbmNhdC4KKyAg
ICAgICAgVGhpcyBhdm9pZHMgaGF2aW5nIHRvIGdyb3cgdGhlIG91dHB1dCBpbmNyZW1lbnRhbGx5
IGFzIHdlIGdvLgorCisgICAgICAgIFRoaXMgYWxzbyBpbmNsdWRlcyB0d28gb3RoZXIgbWljcm8t
b3B0aW1pemF0aW9uczoKKworICAgICAgICAtIE1hcmsgZ2V0UHJvcGVydHkoKSB3aXRoIEFMV0FZ
U19JTkxJTkUuCisKKyAgICAgICAgLSBVc2UgSlNBcnJheTo6bGVuZ3RoKCkgaW5zdGVhZCBvZiB0
YWtpbmcgdGhlIGdlbmVyaWMgcHJvcGVydHkKKyAgICAgICAgICBsb29rdXAgcGF0aCB3aGVuIHdl
IGtub3cgYW4gYXJndW1lbnQgaXMgYW4gQXJyYXkuCisKKyAgICAgICAgTXkgTUJQIHNheXMgfjMl
IHByb2dyZXNzaW9uIG9uIERyb21hZW8vanNsaWItdHJhdmVyc2UtanF1ZXJ5LgorCisgICAgICAg
IFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgICogcnVudGltZS9BcnJheVBy
b3RvdHlwZS5jcHA6CisgICAgICAgIChKU0M6OmdldFByb3BlcnR5KToKKyAgICAgICAgKEpTQzo6
YXJyYXlQcm90b0Z1bmNDb25jYXQpOgorCiAyMDE0LTA0LTA4ICBPbGl2ZXIgSHVudCAgPG9saXZl
ckBhcHBsZS5jb20+CiAKICAgICAgICAgUmV3cml0ZSBGdW5jdGlvbi5iaW5kIGFzIGEgYnVpbHRp
bgpkaWZmIC0tZ2l0IGEvU291cmNlL0phdmFTY3JpcHRDb3JlL3J1bnRpbWUvQXJyYXlQcm90b3R5
cGUuY3BwIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL3J1bnRpbWUvQXJyYXlQcm90b3R5cGUuY3Bw
CmluZGV4IGZlMDgwZDYuLjM0ZjM5MDkgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9KYXZhU2NyaXB0Q29y
ZS9ydW50aW1lL0FycmF5UHJvdG90eXBlLmNwcAorKysgYi9Tb3VyY2UvSmF2YVNjcmlwdENvcmUv
cnVudGltZS9BcnJheVByb3RvdHlwZS5jcHAKQEAgLTE0Niw3ICsxNDYsNyBAQCBib29sIEFycmF5
UHJvdG90eXBlOjpnZXRPd25Qcm9wZXJ0eVNsb3QoSlNPYmplY3QqIG9iamVjdCwgRXhlY1N0YXRl
KiBleGVjLCBQcm9wZQogLy8gLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tIEFycmF5IEZ1
bmN0aW9ucyAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tCiAKIC8vIEhlbHBlciBmdW5jdGlv
bgotc3RhdGljIEpTVmFsdWUgZ2V0UHJvcGVydHkoRXhlY1N0YXRlKiBleGVjLCBKU09iamVjdCog
b2JqLCB1bnNpZ25lZCBpbmRleCkKK3N0YXRpYyBBTFdBWVNfSU5MSU5FIEpTVmFsdWUgZ2V0UHJv
cGVydHkoRXhlY1N0YXRlKiBleGVjLCBKU09iamVjdCogb2JqLCB1bnNpZ25lZCBpbmRleCkKIHsK
ICAgICBQcm9wZXJ0eVNsb3Qgc2xvdChvYmopOwogICAgIGlmICghb2JqLT5nZXRQcm9wZXJ0eVNs
b3QoZXhlYywgaW5kZXgsIHNsb3QpKQpAQCAtNDE2LDE5ICs0MTYsMzAgQEAgRW5jb2RlZEpTVmFs
dWUgSlNDX0hPU1RfQ0FMTCBhcnJheVByb3RvRnVuY0pvaW4oRXhlY1N0YXRlKiBleGVjKQogRW5j
b2RlZEpTVmFsdWUgSlNDX0hPU1RfQ0FMTCBhcnJheVByb3RvRnVuY0NvbmNhdChFeGVjU3RhdGUq
IGV4ZWMpCiB7CiAgICAgSlNWYWx1ZSB0aGlzVmFsdWUgPSBleGVjLT50aGlzVmFsdWUoKS50b1Ro
aXMoZXhlYywgU3RyaWN0TW9kZSk7Ci0gICAgSlNBcnJheSogYXJyID0gY29uc3RydWN0RW1wdHlB
cnJheShleGVjLCBudWxscHRyKTsKLSAgICB1bnNpZ25lZCBuID0gMDsKKyAgICBzaXplX3QgYXJn
Q291bnQgPSBleGVjLT5hcmd1bWVudENvdW50KCk7CiAgICAgSlNWYWx1ZSBjdXJBcmcgPSB0aGlz
VmFsdWUudG9PYmplY3QoZXhlYyk7CisgICAgdW5zaWduZWQgZmluYWxBcnJheVNpemUgPSAwOwor
CisgICAgZm9yIChzaXplX3QgaSA9IDA7IGkgPD0gYXJnQ291bnQ7ICsraSkgeworICAgICAgICBp
ZiAoSlNBcnJheSogY3VycmVudEFycmF5ID0ganNEeW5hbWljQ2FzdDxKU0FycmF5Kj4oY3VyQXJn
KSkKKyAgICAgICAgICAgIGZpbmFsQXJyYXlTaXplICs9IGN1cnJlbnRBcnJheS0+bGVuZ3RoKCk7
CisgICAgICAgIGVsc2UKKyAgICAgICAgICAgIGZpbmFsQXJyYXlTaXplKys7CisgICAgICAgIGN1
ckFyZyA9IGV4ZWMtPnVuY2hlY2tlZEFyZ3VtZW50KGkpOworICAgIH0KKworICAgIEpTQXJyYXkq
IGFyciA9IGNvbnN0cnVjdEVtcHR5QXJyYXkoZXhlYywgbnVsbHB0ciwgZmluYWxBcnJheVNpemUp
OwogICAgIGlmIChleGVjLT5oYWRFeGNlcHRpb24oKSkKICAgICAgICAgcmV0dXJuIEpTVmFsdWU6
OmVuY29kZShqc1VuZGVmaW5lZCgpKTsKKworICAgIGN1ckFyZyA9IHRoaXNWYWx1ZS50b09iamVj
dChleGVjKTsKKyAgICB1bnNpZ25lZCBuID0gMDsKICAgICBzaXplX3QgaSA9IDA7Ci0gICAgc2l6
ZV90IGFyZ0NvdW50ID0gZXhlYy0+YXJndW1lbnRDb3VudCgpOwogICAgIHdoaWxlICgxKSB7Ci0g
ICAgICAgIGlmIChjdXJBcmcuaW5oZXJpdHMoSlNBcnJheTo6aW5mbygpKSkgewotICAgICAgICAg
ICAgdW5zaWduZWQgbGVuZ3RoID0gY3VyQXJnLmdldChleGVjLCBleGVjLT5wcm9wZXJ0eU5hbWVz
KCkubGVuZ3RoKS50b1VJbnQzMihleGVjKTsKLSAgICAgICAgICAgIEpTT2JqZWN0KiBjdXJPYmpl
Y3QgPSBjdXJBcmcudG9PYmplY3QoZXhlYyk7CisgICAgICAgIGlmIChKU0FycmF5KiBjdXJyZW50
QXJyYXkgPSBqc0R5bmFtaWNDYXN0PEpTQXJyYXkqPihjdXJBcmcpKSB7CisgICAgICAgICAgICB1
bnNpZ25lZCBsZW5ndGggPSBjdXJyZW50QXJyYXktPmxlbmd0aCgpOwogICAgICAgICAgICAgZm9y
ICh1bnNpZ25lZCBrID0gMDsgayA8IGxlbmd0aDsgKytrKSB7Ci0gICAgICAgICAgICAgICAgSlNW
YWx1ZSB2ID0gZ2V0UHJvcGVydHkoZXhlYywgY3VyT2JqZWN0LCBrKTsKKyAgICAgICAgICAgICAg
ICBKU1ZhbHVlIHYgPSBnZXRQcm9wZXJ0eShleGVjLCBjdXJyZW50QXJyYXksIGspOwogICAgICAg
ICAgICAgICAgIGlmIChleGVjLT5oYWRFeGNlcHRpb24oKSkKICAgICAgICAgICAgICAgICAgICAg
cmV0dXJuIEpTVmFsdWU6OmVuY29kZShqc1VuZGVmaW5lZCgpKTsKICAgICAgICAgICAgICAgICBp
ZiAodikK
</data>
<flag name="review"
          id="253643"
          type_id="1"
          status="-"
          setter="oliver"
    />
          </attachment>
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>229291</attachid>
            <date>2014-04-14 10:50:20 -0700</date>
            <delta_ts>2014-04-14 10:51:51 -0700</delta_ts>
            <desc>Patch</desc>
            <filename>bug-131609-2.diff</filename>
            <type>text/plain</type>
            <size>3561</size>
            <attacher name="Andreas Kling">kling</attacher>
            
              <data encoding="base64">ZGlmZiAtLWdpdCBhL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cgYi9Tb3VyY2UvSmF2
YVNjcmlwdENvcmUvQ2hhbmdlTG9nCmluZGV4IGIwMmFhOTguLmVkODNhYWEgMTAwNjQ0Ci0tLSBh
L1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKKysrIGIvU291cmNlL0phdmFTY3JpcHRD
b3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDI3IEBACisyMDE0LTA0LTE0ICBBbmRyZWFzIEtsaW5n
ICA8YWtsaW5nQGFwcGxlLmNvbT4KKworICAgICAgICBBcnJheS5wcm90b3R5cGUuY29uY2F0IHNo
b3VsZCBhbGxvY2F0ZSBvdXRwdXQgc3RvcmFnZSBvbmx5IG9uY2UuCisgICAgICAgIDxodHRwczov
L3dlYmtpdC5vcmcvYi8xMzE2MDk+CisKKyAgICAgICAgRG8gYSBmaXJzdCBwYXNzIGFjcm9zcyAn
dGhpcycgYW5kIGFueSBhcmd1bWVudHMgdG8gY29tcHV0ZSB0aGUKKyAgICAgICAgZmluYWwgc2l6
ZSBvZiB0aGUgcmVzdWx0aW5nIGFycmF5IGZyb20gQXJyYXkucHJvdG90eXBlLmNvbmNhdC4KKyAg
ICAgICAgVGhpcyBhdm9pZHMgaGF2aW5nIHRvIGdyb3cgdGhlIG91dHB1dCBpbmNyZW1lbnRhbGx5
IGFzIHdlIGdvLgorCisgICAgICAgIFRoaXMgYWxzbyBpbmNsdWRlcyB0d28gb3RoZXIgbWljcm8t
b3B0aW1pemF0aW9uczoKKworICAgICAgICAtIE1hcmsgZ2V0UHJvcGVydHkoKSB3aXRoIEFMV0FZ
U19JTkxJTkUuCisKKyAgICAgICAgLSBVc2UgSlNBcnJheTo6bGVuZ3RoKCkgaW5zdGVhZCBvZiB0
YWtpbmcgdGhlIGdlbmVyaWMgcHJvcGVydHkKKyAgICAgICAgICBsb29rdXAgcGF0aCB3aGVuIHdl
IGtub3cgYW4gYXJndW1lbnQgaXMgYW4gQXJyYXkuCisKKyAgICAgICAgTXkgTUJQIHNheXMgfjMl
IHByb2dyZXNzaW9uIG9uIERyb21hZW8vanNsaWItdHJhdmVyc2UtanF1ZXJ5LgorCisgICAgICAg
IFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgICogcnVudGltZS9BcnJheVBy
b3RvdHlwZS5jcHA6CisgICAgICAgIChKU0M6OmdldFByb3BlcnR5KToKKyAgICAgICAgKEpTQzo6
YXJyYXlQcm90b0Z1bmNDb25jYXQpOgorCiAyMDE0LTA0LTE0ICBDb21taXQgUXVldWUgIDxjb21t
aXQtcXVldWVAd2Via2l0Lm9yZz4KIAogICAgICAgICBVbnJldmlld2VkLCByb2xsaW5nIG91dCBy
MTY3MjQ5LgpkaWZmIC0tZ2l0IGEvU291cmNlL0phdmFTY3JpcHRDb3JlL3J1bnRpbWUvQXJyYXlQ
cm90b3R5cGUuY3BwIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL3J1bnRpbWUvQXJyYXlQcm90b3R5
cGUuY3BwCmluZGV4IGZlMDgwZDYuLjE0OTNjZTMgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9KYXZhU2Ny
aXB0Q29yZS9ydW50aW1lL0FycmF5UHJvdG90eXBlLmNwcAorKysgYi9Tb3VyY2UvSmF2YVNjcmlw
dENvcmUvcnVudGltZS9BcnJheVByb3RvdHlwZS5jcHAKQEAgLTE0Niw3ICsxNDYsNyBAQCBib29s
IEFycmF5UHJvdG90eXBlOjpnZXRPd25Qcm9wZXJ0eVNsb3QoSlNPYmplY3QqIG9iamVjdCwgRXhl
Y1N0YXRlKiBleGVjLCBQcm9wZQogLy8gLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tIEFy
cmF5IEZ1bmN0aW9ucyAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tCiAKIC8vIEhlbHBlciBm
dW5jdGlvbgotc3RhdGljIEpTVmFsdWUgZ2V0UHJvcGVydHkoRXhlY1N0YXRlKiBleGVjLCBKU09i
amVjdCogb2JqLCB1bnNpZ25lZCBpbmRleCkKK3N0YXRpYyBBTFdBWVNfSU5MSU5FIEpTVmFsdWUg
Z2V0UHJvcGVydHkoRXhlY1N0YXRlKiBleGVjLCBKU09iamVjdCogb2JqLCB1bnNpZ25lZCBpbmRl
eCkKIHsKICAgICBQcm9wZXJ0eVNsb3Qgc2xvdChvYmopOwogICAgIGlmICghb2JqLT5nZXRQcm9w
ZXJ0eVNsb3QoZXhlYywgaW5kZXgsIHNsb3QpKQpAQCAtNDE2LDE5ICs0MTYsMzIgQEAgRW5jb2Rl
ZEpTVmFsdWUgSlNDX0hPU1RfQ0FMTCBhcnJheVByb3RvRnVuY0pvaW4oRXhlY1N0YXRlKiBleGVj
KQogRW5jb2RlZEpTVmFsdWUgSlNDX0hPU1RfQ0FMTCBhcnJheVByb3RvRnVuY0NvbmNhdChFeGVj
U3RhdGUqIGV4ZWMpCiB7CiAgICAgSlNWYWx1ZSB0aGlzVmFsdWUgPSBleGVjLT50aGlzVmFsdWUo
KS50b1RoaXMoZXhlYywgU3RyaWN0TW9kZSk7Ci0gICAgSlNBcnJheSogYXJyID0gY29uc3RydWN0
RW1wdHlBcnJheShleGVjLCBudWxscHRyKTsKLSAgICB1bnNpZ25lZCBuID0gMDsKKyAgICBzaXpl
X3QgYXJnQ291bnQgPSBleGVjLT5hcmd1bWVudENvdW50KCk7CiAgICAgSlNWYWx1ZSBjdXJBcmcg
PSB0aGlzVmFsdWUudG9PYmplY3QoZXhlYyk7CisgICAgdW5zaWduZWQgZmluYWxBcnJheVNpemUg
PSAwOworCisgICAgZm9yIChzaXplX3QgaSA9IDA7OykgeworICAgICAgICBpZiAoSlNBcnJheSog
Y3VycmVudEFycmF5ID0ganNEeW5hbWljQ2FzdDxKU0FycmF5Kj4oY3VyQXJnKSkKKyAgICAgICAg
ICAgIGZpbmFsQXJyYXlTaXplICs9IGN1cnJlbnRBcnJheS0+bGVuZ3RoKCk7CisgICAgICAgIGVs
c2UKKyAgICAgICAgICAgIGZpbmFsQXJyYXlTaXplKys7CisgICAgICAgIGlmIChpID09IGFyZ0Nv
dW50KQorICAgICAgICAgICAgYnJlYWs7CisgICAgICAgIGN1ckFyZyA9IGV4ZWMtPnVuY2hlY2tl
ZEFyZ3VtZW50KGkpOworICAgICAgICArK2k7CisgICAgfQorCisgICAgSlNBcnJheSogYXJyID0g
Y29uc3RydWN0RW1wdHlBcnJheShleGVjLCBudWxscHRyLCBmaW5hbEFycmF5U2l6ZSk7CiAgICAg
aWYgKGV4ZWMtPmhhZEV4Y2VwdGlvbigpKQogICAgICAgICByZXR1cm4gSlNWYWx1ZTo6ZW5jb2Rl
KGpzVW5kZWZpbmVkKCkpOwotICAgIHNpemVfdCBpID0gMDsKLSAgICBzaXplX3QgYXJnQ291bnQg
PSBleGVjLT5hcmd1bWVudENvdW50KCk7Ci0gICAgd2hpbGUgKDEpIHsKLSAgICAgICAgaWYgKGN1
ckFyZy5pbmhlcml0cyhKU0FycmF5OjppbmZvKCkpKSB7Ci0gICAgICAgICAgICB1bnNpZ25lZCBs
ZW5ndGggPSBjdXJBcmcuZ2V0KGV4ZWMsIGV4ZWMtPnByb3BlcnR5TmFtZXMoKS5sZW5ndGgpLnRv
VUludDMyKGV4ZWMpOwotICAgICAgICAgICAgSlNPYmplY3QqIGN1ck9iamVjdCA9IGN1ckFyZy50
b09iamVjdChleGVjKTsKKworICAgIGN1ckFyZyA9IHRoaXNWYWx1ZS50b09iamVjdChleGVjKTsK
KyAgICB1bnNpZ25lZCBuID0gMDsKKyAgICBmb3IgKHNpemVfdCBpID0gMDs7KSB7CisgICAgICAg
IGlmIChKU0FycmF5KiBjdXJyZW50QXJyYXkgPSBqc0R5bmFtaWNDYXN0PEpTQXJyYXkqPihjdXJB
cmcpKSB7CisgICAgICAgICAgICB1bnNpZ25lZCBsZW5ndGggPSBjdXJyZW50QXJyYXktPmxlbmd0
aCgpOwogICAgICAgICAgICAgZm9yICh1bnNpZ25lZCBrID0gMDsgayA8IGxlbmd0aDsgKytrKSB7
Ci0gICAgICAgICAgICAgICAgSlNWYWx1ZSB2ID0gZ2V0UHJvcGVydHkoZXhlYywgY3VyT2JqZWN0
LCBrKTsKKyAgICAgICAgICAgICAgICBKU1ZhbHVlIHYgPSBnZXRQcm9wZXJ0eShleGVjLCBjdXJy
ZW50QXJyYXksIGspOwogICAgICAgICAgICAgICAgIGlmIChleGVjLT5oYWRFeGNlcHRpb24oKSkK
ICAgICAgICAgICAgICAgICAgICAgcmV0dXJuIEpTVmFsdWU6OmVuY29kZShqc1VuZGVmaW5lZCgp
KTsKICAgICAgICAgICAgICAgICBpZiAodikK
</data>
<flag name="review"
          id="253660"
          type_id="1"
          status="+"
          setter="oliver"
    />
          </attachment>
      

    </bug>

</bugzilla>