<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>13300</bug_id>
          
          <creation_ts>2007-04-07 02:22:35 -0700</creation_ts>
          <short_desc>Reproducible crash opening anekdot.ru</short_desc>
          <delta_ts>2007-04-21 02:10:27 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>DOM</component>
          <version>523.x (Safari 3)</version>
          <rep_platform>Mac</rep_platform>
          <op_sys>OS X 10.4</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc>http://www.anekdot.ru/last/o.html</bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>HasReduction</keywords>
          <priority>P1</priority>
          <bug_severity>Major</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Alexey Proskuryakov">ap</reporter>
          <assigned_to name="Alexey Proskuryakov">ap</assigned_to>
          
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>15398</commentid>
    <comment_count>0</comment_count>
    <who name="Alexey Proskuryakov">ap</who>
    <bug_when>2007-04-07 02:22:35 -0700</bug_when>
    <thetext>This is not even a regression.

Looks like HTMLParser uses an already deallocated form object in getNode().

Thread 0 Crashed:
0   com.apple.WebCore        	0x01632edc void WTF::Vector&lt;WebCore::HTMLGenericFormElement*, (unsigned long)0&gt;::insert&lt;WebCore::HTMLGenericFormElement*&gt;(unsigned long, WebCore::HTMLGenericFormElement* const&amp;) + 324 (Vector.h:649)
1   com.apple.WebCore        	0x010dd0a4 WebCore::HTMLFormElement::registerFormElement(WebCore::HTMLGenericFormElement*) + 476 (HTMLFormElement.cpp:555)
2   com.apple.WebCore        	0x010d9e7c WebCore::HTMLGenericFormElement::HTMLGenericFormElement[not-in-charge](WebCore::QualifiedName const&amp;, WebCore::Document*, WebCore::HTMLFormElement*) + 224 (HTMLGenericFormElement.cpp:50)
3   com.apple.WebCore        	0x010d7f84 WebCore::HTMLInputElement::HTMLInputElement[in-charge](WebCore::Document*, WebCore::HTMLFormElement*) + 68 (HTMLInputElement.cpp:93)
4   com.apple.WebCore        	0x0105eeb4 WebCore::inputConstructor(WebCore::AtomicString const&amp;, WebCore::Document*, WebCore::HTMLFormElement*, bool) + 76 (HTMLElementFactory.cpp:160)
5   com.apple.WebCore        	0x01060ad0 WebCore::HTMLElementFactory::createHTMLElement(WebCore::AtomicString const&amp;, WebCore::Document*, WebCore::HTMLFormElement*, bool) + 208 (HTMLElementFactory.cpp:475)
6   com.apple.WebCore        	0x01023b84 WebCore::HTMLParser::getNode(WebCore::Token*) + 3932 (HTMLParser.cpp:832)
7   com.apple.WebCore        	0x010240d4 WebCore::HTMLParser::parseToken(WebCore::Token*) + 1272 (HTMLParser.cpp:224)
8   com.apple.WebCore        	0x01027d18 WebCore::HTMLTokenizer::processToken() + 632 (HTMLTokenizer.cpp:1590)
9   com.apple.WebCore        	0x0102b420 WebCore::HTMLTokenizer::parseTag(WebCore::SegmentedString&amp;, WebCore::HTMLTokenizer::State) + 6076 (HTMLTokenizer.cpp:1163)
10  com.apple.WebCore        	0x0102bf88 WebCore::HTMLTokenizer::write(WebCore::SegmentedString const&amp;, bool) + 1444 (HTMLTokenizer.cpp:1389)
11  com.apple.WebCore        	0x010279fc WebCore::HTMLTokenizer::notifyFinished(WebCore::CachedResource*) + 876 (HTMLTokenizer.cpp:1682)
12  com.apple.WebCore        	0x01128bdc WebCore::CachedScript::checkNotify() + 108 (CachedScript.cpp:92)
13  com.apple.WebCore        	0x01128db8 WebCore::CachedScript::data(WTF::PassRefPtr&lt;WebCore::SharedBuffer&gt;, bool) + 336 (CachedScript.cpp:84)
14  com.apple.WebCore        	0x0112b2e8 WebCore::Loader::didFinishLoading(WebCore::SubresourceLoader*) + 376 (loader.cpp:107)
15  com.apple.WebCore        	0x014a779c WebCore::SubresourceLoader::didFinishLoading() + 204 (SubresourceLoader.cpp:192)
16  com.apple.WebCore        	0x014a55e4 WebCore::ResourceLoader::didFinishLoading(WebCore::ResourceHandle*) + 60
17  com.apple.WebCore        	0x0147af38 -[WebCoreResourceHandleAsDelegate connectionDidFinishLoading:] + 144 (ResourceHandleMac.mm:370)
18  com.apple.Foundation     	0x92c1389c -[NSURLConnection(NSURLConnectionInternal) _sendDidFinishLoadingCallback] + 188
19  com.apple.Foundation     	0x92c11b08 -[NSURLConnection(NSURLConnectionInternal) _sendCallbacks] + 556
20  com.apple.Foundation     	0x92c11860 _sendCallbacks + 156
21  com.apple.CoreFoundation 	0x907df4fc __CFRunLoopDoSources0 + 384
22  com.apple.CoreFoundation 	0x907dea2c __CFRunLoopRun + 452
23  com.apple.CoreFoundation 	0x907de4ac CFRunLoopRunSpecific + 268
24  com.apple.HIToolbox      	0x93298b20 RunCurrentEventLoopInMode + 264
25  com.apple.HIToolbox      	0x932981b4 ReceiveNextEventCommon + 380
26  com.apple.HIToolbox      	0x93298020 BlockUntilNextEventMatchingListInMode + 96
27  com.apple.AppKit         	0x9379eae4 _DPSNextEvent + 384
28  com.apple.AppKit         	0x9379e7a8 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 116
29  com.apple.Safari         	0x00006740 0x1000 + 22336
30  com.apple.AppKit         	0x9379acec -[NSApplication run] + 472
31  com.apple.AppKit         	0x9388b87c NSApplicationMain + 452</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>15396</commentid>
    <comment_count>1</comment_count>
    <who name="Alexey Proskuryakov">ap</who>
    <bug_when>2007-04-07 02:27:19 -0700</bug_when>
    <thetext>Stack trace under GuardMalloc:

#0	0x01630260 in WTF::Vector&lt;WebCore::HTMLImageElement*, 0ul&gt;::size at Vector.h:395
#1	0x01633360 in WTF::Vector&lt;WebCore::HTMLImageElement*, 0ul&gt;::append&lt;WebCore::HTMLImageElement*&gt; at Vector.h:628
#2	0x010dd0f4 in WebCore::HTMLFormElement::registerImgElement at HTMLFormElement.cpp:576
#3	0x0135b210 in WebCore::HTMLImageElement::HTMLImageElement at HTMLImageElement.cpp:51
#4	0x0105fad4 in imageConstructor at HTMLElementFactory.cpp:290
#5	0x01060ad0 in WebCore::HTMLElementFactory::createHTMLElement at HTMLElementFactory.cpp:475
#6	0x01023b84 in WebCore::HTMLParser::getNode at HTMLParser.cpp:832
#7	0x010240d4 in WebCore::HTMLParser::parseToken at HTMLParser.cpp:224
#8	0x01027d18 in WebCore::HTMLTokenizer::processToken at HTMLTokenizer.cpp:1590
#9	0x0102b420 in WebCore::HTMLTokenizer::parseTag at HTMLTokenizer.cpp:1163
#10	0x0102bf88 in WebCore::HTMLTokenizer::write at HTMLTokenizer.cpp:1389
#11	0x01109710 in WebCore::Document::write at Document.cpp:1505
#12	0x012f2758 in KJS::JSHTMLDocumentPrototypeFunction::callAsFunction at kjs_html.cpp:135
#13	0x00557e3c in KJS::JSObject::call at object.cpp:97
#14	0x0054d268 in KJS::FunctionCallDotNode::evaluate at nodes.cpp:781
#15	0x00549628 in KJS::ExprStatementNode::execute at nodes.cpp:1681
#16	0x00546bb8 in KJS::SourceElementsNode::execute at nodes.cpp:2464
#17	0x00544520 in KJS::BlockNode::execute at nodes.cpp:1657
#18	0x0053d280 in KJS::Interpreter::evaluate at interpreter.cpp:365
#19	0x012f9d28 in WebCore::KJSProxy::evaluate at kjs_proxy.cpp:78
#20	0x0149e298 in WebCore::FrameLoader::executeScript at FrameLoader.cpp:685
#21	0x01025f38 in WebCore::HTMLTokenizer::scriptExecution at HTMLTokenizer.cpp:502
#22	0x01028f18 in WebCore::HTMLTokenizer::scriptHandler at HTMLTokenizer.cpp:452
#23	0x0102957c in WebCore::HTMLTokenizer::parseSpecial at HTMLTokenizer.cpp:310
#24	0x0102b660 in WebCore::HTMLTokenizer::parseTag at HTMLTokenizer.cpp:1176
#25	0x0102bf88 in WebCore::HTMLTokenizer::write at HTMLTokenizer.cpp:1389
#26	0x010279fc in WebCore::HTMLTokenizer::notifyFinished at HTMLTokenizer.cpp:1682
#27	0x01128bdc in WebCore::CachedScript::checkNotify at CachedScript.cpp:93
#28	0x01128db8 in WebCore::CachedScript::data at CachedScript.cpp:83
#29	0x0112b2e8 in WebCore::Loader::didFinishLoading at loader.cpp:107
#30	0x014a779c in WebCore::SubresourceLoader::didFinishLoading at SubresourceLoader.cpp:190
#31	0x014a55e4 in WebCore::ResourceLoader::didFinishLoading at ResourceLoader.cpp:335
#32	0x0147af38 in -[WebCoreResourceHandleAsDelegate connectionDidFinishLoading:] at ResourceHandleMac.mm:369
#33	0x92c1389c in -[NSURLConnection(NSURLConnectionInternal) _sendDidFinishLoadingCallback]
#34	0x92c11b08 in -[NSURLConnection(NSURLConnectionInternal) _sendCallbacks]
#35	0x92c11860 in _sendCallbacks
#36	0x907df4fc in __CFRunLoopDoSources0
#37	0x907dea2c in __CFRunLoopRun
#38	0x907de4ac in CFRunLoopRunSpecific
#39	0x93298b20 in RunCurrentEventLoopInMode
#40	0x932981b4 in ReceiveNextEventCommon
#41	0x93298020 in BlockUntilNextEventMatchingListInMode
#42	0x9379eae4 in _DPSNextEvent
#43	0x9379e7a8 in -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:]
#44	0x00006740 in ??
#45	0x9379acec in -[NSApplication run]
#46	0x9388b87c in NSApplicationMain

</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>15387</commentid>
    <comment_count>2</comment_count>
    <who name="Alexey Proskuryakov">ap</who>
    <bug_when>2007-04-07 03:04:43 -0700</bug_when>
    <thetext>Making HTMLParser::form a RefPtr fixes this crash. I&apos;m still trying to make a reduction.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>15385</commentid>
    <comment_count>3</comment_count>
      <attachid>13984</attachid>
    <who name="Alexey Proskuryakov">ap</who>
    <bug_when>2007-04-07 04:04:26 -0700</bug_when>
    <thetext>Created attachment 13984
reduction (will crash)</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>15386</commentid>
    <comment_count>4</comment_count>
      <attachid>13985</attachid>
    <who name="Alexey Proskuryakov">ap</who>
    <bug_when>2007-04-07 04:22:19 -0700</bug_when>
    <thetext>Created attachment 13985
proposed fix</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>15375</commentid>
    <comment_count>5</comment_count>
      <attachid>13987</attachid>
    <who name="">mitz</who>
    <bug_when>2007-04-07 07:34:05 -0700</bug_when>
    <thetext>Created attachment 13987
Further reduction (will crash too).

Perhaps this makes it more clear what the essence of the problem is. What does the DOM for this look like with the proposed fix?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>15369</commentid>
    <comment_count>6</comment_count>
    <who name="Alexey Proskuryakov">ap</who>
    <bug_when>2007-04-07 09:14:00 -0700</bug_when>
    <thetext>  Interestingly, the new reduction only crashes for me when closing the page. Must be some random glitch - I&apos;ve seen this behavior come and go while making my original reduction.

&gt; What does the DOM for this look like with the proposed fix?

  According to Hixie&apos;s live DOM viewer, it&apos;s essentially the same as in Firefox (modulo empty text nodes and an implicit HEAD). NB: to test in Firefox, you need to have an explicit &lt;body&gt; element.

HTML
  BODY
    DIV id=&quot;anekdotforsearch&quot;
      FORM id=&quot;b&quot;
    #text:
    SCRIPT
      #text: document.getElementById(&apos;anekdotforsearch&apos;).innerHTML=&quot;&lt;form id=&apos;b&apos;&gt;&lt;/form&gt;&quot;;
    #text:
    #text:
    INPUT
    #text:
    #text:
</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>15354</commentid>
    <comment_count>7</comment_count>
      <attachid>13985</attachid>
    <who name="Darin Adler">darin</who>
    <bug_when>2007-04-07 16:39:12 -0700</bug_when>
    <thetext>Comment on attachment 13985
proposed fix

Since you had to visit almost every call site, I might have wanted to see you change the name from form to m_currentFormElement.

Do we need the same fix for m_currentMapElement and head?

r=me</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>13770</commentid>
    <comment_count>8</comment_count>
      <attachid>14114</attachid>
    <who name="Alexey Proskuryakov">ap</who>
    <bug_when>2007-04-20 13:48:10 -0700</bug_when>
    <thetext>Created attachment 14114
proposed fix

(In reply to comment #7)
&gt; Since you had to visit almost every call site, I might have wanted to see you
&gt; change the name from form to m_currentFormElement.

  Done.

&gt; Do we need the same fix for m_currentMapElement and head?

  I have now found a (slightly different) case for m_currentMapElement; not sure about head.

  I&apos;ve replaced my reduction with the simpler one done by Mitz.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>13771</commentid>
    <comment_count>9</comment_count>
      <attachid>14114</attachid>
    <who name="Darin Adler">darin</who>
    <bug_when>2007-04-20 13:53:46 -0700</bug_when>
    <thetext>Comment on attachment 14114
proposed fix

r=me</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>13629</commentid>
    <comment_count>10</comment_count>
    <who name="Alexey Proskuryakov">ap</who>
    <bug_when>2007-04-21 02:10:27 -0700</bug_when>
    <thetext>Committed revision 20996.
</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="0"
              isprivate="0"
          >
            <attachid>13984</attachid>
            <date>2007-04-07 04:04:26 -0700</date>
            <delta_ts>2007-04-07 04:04:26 -0700</delta_ts>
            <desc>reduction (will crash)</desc>
            <filename>o.html</filename>
            <type>text/html</type>
            <size>571</size>
            <attacher name="Alexey Proskuryakov">ap</attacher>
            
              <data encoding="base64">PGh0bWw+Cjxib2R5Pgo8ZGl2IGlkPSJhbmVrZG90Zm9yc2VhcmNoIj4KCjxmb3JtIGFjdGlvbj0i
IyIgbWV0aG9kPUdFVD4KICAgIDxwcmU+Zm9vPC9wcmU+CjwvZGl2PgoKPHNjcmlwdD4KICB2YXIg
c2VhcmNoX2RhdGE9ZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoJ2FuZWtkb3Rmb3JzZWFyY2gnKTsK
CiAgc2VhcmNoID0gZnVuY3Rpb24gKCl7CQogICAgdmFyIHJlZyA9IG5ldyBSZWdFeHAoIihbXmEt
el0rKSgoZm9vfGJhcikoW2Etel0rfCkpIiwiZ2kiKTsKCgl2YXIgcz1TdHJpbmcoc2VhcmNoX2Rh
dGEuaW5uZXJIVE1MKTsKCXNlYXJjaF9kYXRhLmlubmVySFRNTD1zLnJlcGxhY2UocmVnLHNlYXJj
aF9saW5rKTsKICB9CgogIGZ1bmN0aW9uIHNlYXJjaF9saW5rKHdvcmQsd29yZDEsd29yZDIpIHsK
CXJldHVybiB3b3JkMSsiPGEgaHJlZj1cIlwiPiIrd29yZDIrIjwvYT4iOwogIH0KCiAgc2VhcmNo
KCk7Cjwvc2NyaXB0PgoKPGZvcm0gbWV0aG9kPUdFVCBhY3Rpb249IiMiPgogICAgPGlucHV0IHR5
cGU9ImhpZGRlbiIgbmFtZT0iaWQiIHZhbHVlPSIxIj4KPC9mb3JtPgoKPC9ib2R5Pgo8L2h0bWw+
Cg==
</data>

          </attachment>
          <attachment
              isobsolete="1"
              ispatch="1"
              isprivate="0"
          >
            <attachid>13985</attachid>
            <date>2007-04-07 04:22:19 -0700</date>
            <delta_ts>2007-04-20 13:48:46 -0700</delta_ts>
            <desc>proposed fix</desc>
            <filename>13300r1_patch.txt</filename>
            <type>text/plain</type>
            <size>5230</size>
            <attacher name="Alexey Proskuryakov">ap</attacher>
            
              <data encoding="base64">SW5kZXg6IExheW91dFRlc3RzL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9D
aGFuZ2VMb2cJKHJldmlzaW9uIDIwNzgwKQorKysgTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCSh3b3Jr
aW5nIGNvcHkpCkBAIC0xLDMgKzEsMTMgQEAKKzIwMDctMDQtMDcgIEFsZXhleSBQcm9za3VyeWFr
b3YgIDxhcEB3ZWJraXQub3JnPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEp
LgorCisgICAgICAgIGh0dHA6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTEzMzAw
CisgICAgICAgIFJlcHJvZHVjaWJsZSBjcmFzaCBvcGVuaW5nIGFuZWtkb3QucnUKKworICAgICAg
ICAqIGZhc3QvZm9ybXMvcmV3cml0ZS1mb3JtLWVsZW1lbnQtZXhwZWN0ZWQudHh0OiBBZGRlZC4K
KyAgICAgICAgKiBmYXN0L2Zvcm1zL3Jld3JpdGUtZm9ybS1lbGVtZW50Lmh0bWw6IEFkZGVkLgor
CiAyMDA3LTA0LTA2ICBHZW9mZnJleSBHYXJlbiAgPGdnYXJlbkBhcHBsZS5jb20+CiAKICAgICAg
ICAgUmV2aWV3ZWQgYnkgQmV0aCBEYWtpbi4KSW5kZXg6IExheW91dFRlc3RzL2Zhc3QvZm9ybXMv
cmV3cml0ZS1mb3JtLWVsZW1lbnQtZXhwZWN0ZWQudHh0Cj09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExheW91dFRl
c3RzL2Zhc3QvZm9ybXMvcmV3cml0ZS1mb3JtLWVsZW1lbnQtZXhwZWN0ZWQudHh0CShyZXZpc2lv
biAwKQorKysgTGF5b3V0VGVzdHMvZmFzdC9mb3Jtcy9yZXdyaXRlLWZvcm0tZWxlbWVudC1leHBl
Y3RlZC50eHQJKHJldmlzaW9uIDApCkBAIC0wLDAgKzEsNiBAQAorVGVzdCBmb3IgYnVnIDEzMzAw
OiBSZXByb2R1Y2libGUgY3Jhc2ggb3BlbmluZyBhbmVrZG90LnJ1LgorCitObyBjcmFzaCA9PSBT
VUNDRVNTCisKK2ZvbworCgpQcm9wZXJ0eSBjaGFuZ2VzIG9uOiBMYXlvdXRUZXN0cy9mYXN0L2Zv
cm1zL3Jld3JpdGUtZm9ybS1lbGVtZW50LWV4cGVjdGVkLnR4dApfX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCk5hbWU6IHN2
bjptaW1lLXR5cGUKICAgKyB0ZXh0L3BsYWluCk5hbWU6IHN2bjplb2wtc3R5bGUKICAgKyBuYXRp
dmUKCkluZGV4OiBMYXlvdXRUZXN0cy9mYXN0L2Zvcm1zL3Jld3JpdGUtZm9ybS1lbGVtZW50Lmh0
bWwKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvZmFzdC9mb3Jtcy9yZXdyaXRlLWZvcm0tZWxl
bWVudC5odG1sCShyZXZpc2lvbiAwKQorKysgTGF5b3V0VGVzdHMvZmFzdC9mb3Jtcy9yZXdyaXRl
LWZvcm0tZWxlbWVudC5odG1sCShyZXZpc2lvbiAwKQpAQCAtMCwwICsxLDM5IEBACis8aHRtbD4K
Kzxib2R5PgorPHA+VGVzdCBmb3IgPGEgaHJlZj0iaHR0cDovL2J1Z3Mud2Via2l0Lm9yZy9zaG93
X2J1Zy5jZ2k/aWQ9MTMzMDAiPmJ1ZyAxMzMwMDwvYT46CitSZXByb2R1Y2libGUgY3Jhc2ggb3Bl
bmluZyBhbmVrZG90LnJ1LjwvcD4KKzxwPk5vIGNyYXNoID09IFNVQ0NFU1M8L3A+Cis8c2NyaXB0
PgorICBpZiAod2luZG93LmxheW91dFRlc3RDb250cm9sbGVyKQorICAgIGxheW91dFRlc3RDb250
cm9sbGVyLmR1bXBBc1RleHQoKTsKKzwvc2NyaXB0PgorCis8ZGl2IGlkPSJhbmVrZG90Zm9yc2Vh
cmNoIj4KKworPGZvcm0gYWN0aW9uPSIjIiBtZXRob2Q9R0VUPgorICAgIDxwcmU+Zm9vPC9wcmU+
Cis8L2Rpdj4KKworPHNjcmlwdD4KKyAgdmFyIHNlYXJjaF9kYXRhPWRvY3VtZW50LmdldEVsZW1l
bnRCeUlkKCdhbmVrZG90Zm9yc2VhcmNoJyk7CisKKyAgc2VhcmNoID0gZnVuY3Rpb24gKCl7CQor
ICAgIHZhciByZWcgPSBuZXcgUmVnRXhwKCIoW15hLXpdKykoKGZvb3xiYXIpKFthLXpdK3wpKSIs
ImdpIik7CisKKwl2YXIgcz1TdHJpbmcoc2VhcmNoX2RhdGEuaW5uZXJIVE1MKTsKKwlzZWFyY2hf
ZGF0YS5pbm5lckhUTUw9cy5yZXBsYWNlKHJlZyxzZWFyY2hfbGluayk7CisgIH0KKworICBmdW5j
dGlvbiBzZWFyY2hfbGluayh3b3JkLHdvcmQxLHdvcmQyKSB7CisJcmV0dXJuIHdvcmQxKyI8YSBo
cmVmPVwiXCI+Iit3b3JkMisiPC9hPiI7CisgIH0KKworICBzZWFyY2goKTsKKzwvc2NyaXB0Pgor
Cis8Zm9ybSBtZXRob2Q9R0VUIGFjdGlvbj0iIyI+CisgICAgPGlucHV0IHR5cGU9ImhpZGRlbiIg
bmFtZT0iaWQiIHZhbHVlPSIxIj4KKzwvZm9ybT4KKworPC9ib2R5PgorPC9odG1sPgoKUHJvcGVy
dHkgY2hhbmdlcyBvbjogTGF5b3V0VGVzdHMvZmFzdC9mb3Jtcy9yZXdyaXRlLWZvcm0tZWxlbWVu
dC5odG1sCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX18KTmFtZTogc3ZuOm1pbWUtdHlwZQogICArIHRleHQvaHRtbAoKSW5k
ZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9nCShy
ZXZpc2lvbiAyMDc4MCkKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBAIC0x
LDMgKzEsMTcgQEAKKzIwMDctMDQtMDcgIEFsZXhleSBQcm9za3VyeWFrb3YgIDxhcEB3ZWJraXQu
b3JnPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIGh0
dHA6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTEzMzAwCisgICAgICAgIFJlcHJv
ZHVjaWJsZSBjcmFzaCBvcGVuaW5nIGFuZWtkb3QucnUKKworICAgICAgICAqIGh0bWwvSFRNTFBh
cnNlci5jcHA6CisgICAgICAgIChXZWJDb3JlOjpIVE1MUGFyc2VyOjpIVE1MUGFyc2VyKToKKyAg
ICAgICAgKFdlYkNvcmU6OkhUTUxQYXJzZXI6OmdldE5vZGUpOgorICAgICAgICAoV2ViQ29yZTo6
SFRNTFBhcnNlcjo6aGFuZGxlSXNpbmRleCk6CisgICAgICAgICogaHRtbC9IVE1MUGFyc2VyLmg6
CisgICAgICAgIE1ha2UgSFRNTFBhcnNlcjo6Zm9ybSBhIFJlZlB0ci4KKwogMjAwNy0wNC0wNiAg
T2xpdmVyIEh1bnQgIDxvbGl2ZXJAYXBwbGUuY29tPgogCiAgICAgICAgIFJldmlld2VkIGJ5IEFk
YW0uCkluZGV4OiBXZWJDb3JlL2h0bWwvSFRNTFBhcnNlci5jcHAKPT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gV2Vi
Q29yZS9odG1sL0hUTUxQYXJzZXIuY3BwCShyZXZpc2lvbiAyMDc1NikKKysrIFdlYkNvcmUvaHRt
bC9IVE1MUGFyc2VyLmNwcAkod29ya2luZyBjb3B5KQpAQCAtMTEyLDcgKzExMiw2IEBAIEhUTUxQ
YXJzZXI6OkhUTUxQYXJzZXIoSFRNTERvY3VtZW50KiBkb2MKICAgICAsIGN1cnJlbnQoZG9jKQog
ICAgICwgZGlkUmVmQ3VycmVudChmYWxzZSkKICAgICAsIGJsb2NrU3RhY2soMCkKLSAgICAsIGZv
cm0oMCkKICAgICAsIG1fY3VycmVudE1hcEVsZW1lbnQoMCkKICAgICAsIGhlYWQoMCkKICAgICAs
IGluQm9keShmYWxzZSkKQEAgLTEyOCw3ICsxMjcsNiBAQCBIVE1MUGFyc2VyOjpIVE1MUGFyc2Vy
KERvY3VtZW50RnJhZ21lbnQqCiAgICAgLCBjdXJyZW50KGZyYWcpCiAgICAgLCBkaWRSZWZDdXJy
ZW50KHRydWUpCiAgICAgLCBibG9ja1N0YWNrKDApCi0gICAgLCBmb3JtKDApCiAgICAgLCBtX2N1
cnJlbnRNYXBFbGVtZW50KDApCiAgICAgLCBoZWFkKDApCiAgICAgLCBpbkJvZHkodHJ1ZSkKQEAg
LTgyOSw3ICs4MjcsNyBAQCBQYXNzUmVmUHRyPE5vZGU+IEhUTUxQYXJzZXI6OmdldE5vZGUoVG9r
CiAgICAgaWYgKENyZWF0ZUVycm9yQ2hlY2tGdW5jIGVycm9yQ2hlY2tGdW5jID0gZ0Z1bmN0aW9u
TWFwLmdldCh0LT50YWdOYW1lLmltcGwoKSkpCiAgICAgICAgIHByb2NlZWQgPSAodGhpcy0+KmVy
cm9yQ2hlY2tGdW5jKSh0LCByZXN1bHQpOwogICAgIGlmIChwcm9jZWVkKQotICAgICAgICByZXN1
bHQgPSBIVE1MRWxlbWVudEZhY3Rvcnk6OmNyZWF0ZUhUTUxFbGVtZW50KHQtPnRhZ05hbWUsIGRv
Y3VtZW50LCBmb3JtKTsKKyAgICAgICAgcmVzdWx0ID0gSFRNTEVsZW1lbnRGYWN0b3J5OjpjcmVh
dGVIVE1MRWxlbWVudCh0LT50YWdOYW1lLCBkb2N1bWVudCwgZm9ybS5nZXQoKSk7CiAgICAgcmV0
dXJuIHJlc3VsdC5yZWxlYXNlKCk7CiB9CiAKQEAgLTEzNjQsNyArMTM2Miw3IEBAIFBhc3NSZWZQ
dHI8Tm9kZT4gSFRNTFBhcnNlcjo6aGFuZGxlSXNpbmQKIAogICAgIE5hbWVkTWFwcGVkQXR0ck1h
cCogYXR0cnMgPSB0LT5hdHRycy5nZXQoKTsKIAotICAgIFJlZlB0cjxIVE1MSXNJbmRleEVsZW1l
bnQ+IGlzSW5kZXggPSBuZXcgSFRNTElzSW5kZXhFbGVtZW50KGRvY3VtZW50LCBmb3JtKTsKKyAg
ICBSZWZQdHI8SFRNTElzSW5kZXhFbGVtZW50PiBpc0luZGV4ID0gbmV3IEhUTUxJc0luZGV4RWxl
bWVudChkb2N1bWVudCwgZm9ybS5nZXQoKSk7CiAgICAgaXNJbmRleC0+c2V0QXR0cmlidXRlTWFw
KGF0dHJzKTsKICAgICBpc0luZGV4LT5zZXRBdHRyaWJ1dGUodHlwZUF0dHIsICJraHRtbF9pc2lu
ZGV4Iik7CiAKSW5kZXg6IFdlYkNvcmUvaHRtbC9IVE1MUGFyc2VyLmgKPT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0g
V2ViQ29yZS9odG1sL0hUTUxQYXJzZXIuaAkocmV2aXNpb24gMjA3NTYpCisrKyBXZWJDb3JlL2h0
bWwvSFRNTFBhcnNlci5oCSh3b3JraW5nIGNvcHkpCkBAIC0xMzcsNyArMTM3LDcgQEAgcHJpdmF0
ZToKIAogICAgIEhUTUxTdGFja0VsZW0qIGJsb2NrU3RhY2s7CiAKLSAgICBIVE1MRm9ybUVsZW1l
bnQqIGZvcm07IC8vIGN1cnJlbnRseSBhY3RpdmUgZm9ybQorICAgIFJlZlB0cjxIVE1MRm9ybUVs
ZW1lbnQ+IGZvcm07IC8vIGN1cnJlbnRseSBhY3RpdmUgZm9ybQogICAgIEhUTUxNYXBFbGVtZW50
KiBtX2N1cnJlbnRNYXBFbGVtZW50OyAvLyBjdXJyZW50IG1hcAogICAgIEhUTUxIZWFkRWxlbWVu
dCogaGVhZDsgLy8gaGVhZCBlbGVtZW50OyBuZWVkZWQgZm9yIEhUTUwgd2hpY2ggZGVmaW5lcyA8
YmFzZT4gYWZ0ZXIgPC9oZWFkPgogICAgIFJlZlB0cjxOb2RlPiBtX2lzaW5kZXhFbGVtZW50OyAv
LyBhIHBvc3NpYmxlIDxpc2luZGV4PiBlbGVtZW50IGluIHRoZSBoZWFkCg==
</data>
<flag name="review"
          id="5639"
          type_id="1"
          status="+"
          setter="darin"
    />
          </attachment>
          <attachment
              isobsolete="0"
              ispatch="0"
              isprivate="0"
          >
            <attachid>13987</attachid>
            <date>2007-04-07 07:34:05 -0700</date>
            <delta_ts>2007-04-20 13:48:59 -0700</delta_ts>
            <desc>Further reduction (will crash too).</desc>
            <filename>o.html</filename>
            <type>text/html</type>
            <size>186</size>
            <attacher>mitz</attacher>
            
              <data encoding="base64">PGRpdiBpZD0iYW5la2RvdGZvcnNlYXJjaCI+CiAgICA8Zm9ybSBpZD0nYSc+CjwvZGl2Pgo8c2Ny
aXB0PgogIGRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCdhbmVrZG90Zm9yc2VhcmNoJykuaW5uZXJI
VE1MPSI8Zm9ybSBpZD0nYic+PC9mb3JtPiI7Cjwvc2NyaXB0Pgo8Zm9ybSBpZD0nYyc+CiAgICA8
aW5wdXQ+CjwvZm9ybT4K
</data>

          </attachment>
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>14114</attachid>
            <date>2007-04-20 13:48:10 -0700</date>
            <delta_ts>2007-04-20 13:53:46 -0700</delta_ts>
            <desc>proposed fix</desc>
            <filename>13300r2_patch.txt</filename>
            <type>text/plain</type>
            <size>9996</size>
            <attacher name="Alexey Proskuryakov">ap</attacher>
            
              <data encoding="base64">SW5kZXg6IExheW91dFRlc3RzL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9D
aGFuZ2VMb2cJKHJldmlzaW9uIDIwOTcxKQorKysgTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCSh3b3Jr
aW5nIGNvcHkpCkBAIC0xLDMgKzEsMTUgQEAKKzIwMDctMDQtMjEgIEFsZXhleSBQcm9za3VyeWFr
b3YgIDxhcEB3ZWJraXQub3JnPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEp
LgorCisgICAgICAgIGh0dHA6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTEzMzAw
CisgICAgICAgIFJlcHJvZHVjaWJsZSBjcmFzaCBvcGVuaW5nIGFuZWtkb3QucnUKKworICAgICAg
ICAqIGZhc3QvcGFyc2VyL3Jld3JpdGUtZm9ybS1leHBlY3RlZC50eHQ6IEFkZGVkLgorICAgICAg
ICAqIGZhc3QvcGFyc2VyL3Jld3JpdGUtZm9ybS5odG1sOiBBZGRlZC4KKyAgICAgICAgKiBmYXN0
L3BhcnNlci9yZXdyaXRlLW1hcC1leHBlY3RlZC50eHQ6IEFkZGVkLgorICAgICAgICAqIGZhc3Qv
cGFyc2VyL3Jld3JpdGUtbWFwLmh0bWw6IEFkZGVkLgorCiAyMDA3LTA0LTE5ICBNaXR6IFBldHRl
bCAgPG1pdHpAd2Via2l0Lm9yZz4KIAogICAgICAgICBSdWJiZXItc3RhbXBlZCBieSBBZGFtLgpJ
bmRleDogTGF5b3V0VGVzdHMvZmFzdC9wYXJzZXIvcmV3cml0ZS1mb3JtLWV4cGVjdGVkLnR4dAo9
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9mYXN0L3BhcnNlci9yZXdyaXRlLWZvcm0tZXhwZWN0
ZWQudHh0CShyZXZpc2lvbiAwKQorKysgTGF5b3V0VGVzdHMvZmFzdC9wYXJzZXIvcmV3cml0ZS1m
b3JtLWV4cGVjdGVkLnR4dAkocmV2aXNpb24gMCkKQEAgLTAsMCArMSw1IEBACitUZXN0IGZvciBi
dWcgMTMzMDA6IFJlcHJvZHVjaWJsZSBjcmFzaCBvcGVuaW5nIGFuZWtkb3QucnUuCisKK05vIGNy
YXNoID09IFNVQ0NFU1MKKworCgpQcm9wZXJ0eSBjaGFuZ2VzIG9uOiBMYXlvdXRUZXN0cy9mYXN0
L3BhcnNlci9yZXdyaXRlLWZvcm0tZXhwZWN0ZWQudHh0Cl9fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KTmFtZTogc3ZuOm1p
bWUtdHlwZQogICArIHRleHQvcGxhaW4KTmFtZTogc3ZuOmVvbC1zdHlsZQogICArIG5hdGl2ZQoK
SW5kZXg6IExheW91dFRlc3RzL2Zhc3QvcGFyc2VyL3Jld3JpdGUtZm9ybS5odG1sCj09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT0KLS0tIExheW91dFRlc3RzL2Zhc3QvcGFyc2VyL3Jld3JpdGUtZm9ybS5odG1sCShyZXZpc2lv
biAwKQorKysgTGF5b3V0VGVzdHMvZmFzdC9wYXJzZXIvcmV3cml0ZS1mb3JtLmh0bWwJKHJldmlz
aW9uIDApCkBAIC0wLDAgKzEsMjIgQEAKKzxodG1sPgorPGJvZHk+Cis8cD5UZXN0IGZvciA8YSBo
cmVmPSJodHRwOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xMzMwMCI+YnVnIDEz
MzAwPC9hPjoKK1JlcHJvZHVjaWJsZSBjcmFzaCBvcGVuaW5nIGFuZWtkb3QucnUuPC9wPgorPHA+
Tm8gY3Jhc2ggPT0gU1VDQ0VTUzwvcD4KKzxzY3JpcHQ+CisgIGlmICh3aW5kb3cubGF5b3V0VGVz
dENvbnRyb2xsZXIpCisgICAgbGF5b3V0VGVzdENvbnRyb2xsZXIuZHVtcEFzVGV4dCgpOworPC9z
Y3JpcHQ+CisKKzxkaXYgaWQ9ImFuZWtkb3Rmb3JzZWFyY2giPgorICAgIDxmb3JtIGlkPSdhJz4K
KzwvZGl2PgorPHNjcmlwdD4KKyAgZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoJ2FuZWtkb3Rmb3Jz
ZWFyY2gnKS5pbm5lckhUTUw9Ijxmb3JtIGlkPSdiJz48L2Zvcm0+IjsKKzwvc2NyaXB0PgorPGZv
cm0gaWQ9J2MnPgorICAgIDxpbnB1dD4KKzwvZm9ybT4KKworPC9ib2R5PgorPC9odG1sPgoKUHJv
cGVydHkgY2hhbmdlcyBvbjogTGF5b3V0VGVzdHMvZmFzdC9wYXJzZXIvcmV3cml0ZS1mb3JtLmh0
bWwKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fXwpOYW1lOiBzdm46bWltZS10eXBlCiAgICsgdGV4dC9odG1sCgpJbmRleDog
TGF5b3V0VGVzdHMvZmFzdC9wYXJzZXIvcmV3cml0ZS1tYXAtZXhwZWN0ZWQudHh0Cj09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT0KLS0tIExheW91dFRlc3RzL2Zhc3QvcGFyc2VyL3Jld3JpdGUtbWFwLWV4cGVjdGVkLnR4dAko
cmV2aXNpb24gMCkKKysrIExheW91dFRlc3RzL2Zhc3QvcGFyc2VyL3Jld3JpdGUtbWFwLWV4cGVj
dGVkLnR4dAkocmV2aXNpb24gMCkKQEAgLTAsMCArMSw1IEBACitUZXN0IGZvciBidWcgMTMzMDA6
IFJlcHJvZHVjaWJsZSBjcmFzaCBvcGVuaW5nIGFuZWtkb3QucnUuCisKK05vIGNyYXNoID09IFNV
Q0NFU1MKKworCgpQcm9wZXJ0eSBjaGFuZ2VzIG9uOiBMYXlvdXRUZXN0cy9mYXN0L3BhcnNlci9y
ZXdyaXRlLW1hcC1leHBlY3RlZC50eHQKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwpOYW1lOiBzdm46bWltZS10eXBlCiAg
ICsgdGV4dC9wbGFpbgpOYW1lOiBzdm46ZW9sLXN0eWxlCiAgICsgbmF0aXZlCgpJbmRleDogTGF5
b3V0VGVzdHMvZmFzdC9wYXJzZXIvcmV3cml0ZS1tYXAuaHRtbAo9PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlv
dXRUZXN0cy9mYXN0L3BhcnNlci9yZXdyaXRlLW1hcC5odG1sCShyZXZpc2lvbiAwKQorKysgTGF5
b3V0VGVzdHMvZmFzdC9wYXJzZXIvcmV3cml0ZS1tYXAuaHRtbAkocmV2aXNpb24gMCkKQEAgLTAs
MCArMSwyNSBAQAorPGh0bWw+Cis8Ym9keT4KKzxwPlRlc3QgZm9yIDxhIGhyZWY9Imh0dHA6Ly9i
dWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTEzMzAwIj5idWcgMTMzMDA8L2E+OgorUmVw
cm9kdWNpYmxlIGNyYXNoIG9wZW5pbmcgYW5la2RvdC5ydS48L3A+Cis8cD5ObyBjcmFzaCA9PSBT
VUNDRVNTPC9wPgorPHNjcmlwdD4KKyAgaWYgKHdpbmRvdy5sYXlvdXRUZXN0Q29udHJvbGxlcikK
KyAgICBsYXlvdXRUZXN0Q29udHJvbGxlci5kdW1wQXNUZXh0KCk7Cis8L3NjcmlwdD4KKworPGRp
diBpZD0iYW5la2RvdGZvcnNlYXJjaCI+CisKKzxtYXAgbmFtZT0ibWFwIj4KKyAgICA8cHJlPmZv
bzwvcHJlPgorPC9kaXY+CisKKzxzY3JpcHQ+CisgIGRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCdh
bmVrZG90Zm9yc2VhcmNoJykuaW5uZXJIVE1MPSI8bWFwIG5hbWU9J21hcCc+PC9tYXA+IgorPC9z
Y3JpcHQ+CisKKzxhcmVhPgorPC9tYXA+CisKKzwvYm9keT4KKzwvaHRtbD4KClByb3BlcnR5IGNo
YW5nZXMgb246IExheW91dFRlc3RzL2Zhc3QvcGFyc2VyL3Jld3JpdGUtbWFwLmh0bWwKX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fXwpOYW1lOiBzdm46bWltZS10eXBlCiAgICsgdGV4dC9odG1sCgpJbmRleDogV2ViQ29yZS9D
aGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PQotLS0gV2ViQ29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDIwOTcx
KQorKysgV2ViQ29yZS9DaGFuZ2VMb2cJKHdvcmtpbmcgY29weSkKQEAgLTEsMyArMSwxNyBAQAor
MjAwNy0wNC0yMCAgQWxleGV5IFByb3NrdXJ5YWtvdiAgPGFwQHdlYmtpdC5vcmc+CisKKyAgICAg
ICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgaHR0cDovL2J1Z3Mud2Vi
a2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTMzMDAKKyAgICAgICAgUmVwcm9kdWNpYmxlIGNyYXNo
IG9wZW5pbmcgYW5la2RvdC5ydQorCisgICAgICAgICogaHRtbC9IVE1MUGFyc2VyLmNwcDoKKyAg
ICAgICAgKFdlYkNvcmU6OkhUTUxQYXJzZXI6OkhUTUxQYXJzZXIpOgorICAgICAgICAoV2ViQ29y
ZTo6SFRNTFBhcnNlcjo6Z2V0Tm9kZSk6CisgICAgICAgIChXZWJDb3JlOjpIVE1MUGFyc2VyOjpo
YW5kbGVJc2luZGV4KToKKyAgICAgICAgKiBodG1sL0hUTUxQYXJzZXIuaDoKKyAgICAgICAgTWFr
ZSBIVE1MUGFyc2VyOjpmb3JtIGEgUmVmUHRyLgorCiAyMDA3LTA0LTE5ICBBbHAgVG9rZXIgIDxh
bHBAYXRva2VyLmNvbT4KIAogICAgICAgICBSZXZpZXdlZCBieSBNYXJrLgpJbmRleDogV2ViQ29y
ZS9odG1sL0hUTUxQYXJzZXIuY3BwCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvaHRtbC9IVE1MUGFy
c2VyLmNwcAkocmV2aXNpb24gMjA5NzEpCisrKyBXZWJDb3JlL2h0bWwvSFRNTFBhcnNlci5jcHAJ
KHdvcmtpbmcgY29weSkKQEAgLTExMiw4ICsxMTIsNiBAQCBIVE1MUGFyc2VyOjpIVE1MUGFyc2Vy
KEhUTUxEb2N1bWVudCogZG9jCiAgICAgLCBjdXJyZW50KGRvYykKICAgICAsIGRpZFJlZkN1cnJl
bnQoZmFsc2UpCiAgICAgLCBibG9ja1N0YWNrKDApCi0gICAgLCBmb3JtKDApCi0gICAgLCBtX2N1
cnJlbnRNYXBFbGVtZW50KDApCiAgICAgLCBoZWFkKDApCiAgICAgLCBpbkJvZHkoZmFsc2UpCiAg
ICAgLCBoYXZlQ29udGVudChmYWxzZSkKQEAgLTEyOCw4ICsxMjYsNiBAQCBIVE1MUGFyc2VyOjpI
VE1MUGFyc2VyKERvY3VtZW50RnJhZ21lbnQqCiAgICAgLCBjdXJyZW50KGZyYWcpCiAgICAgLCBk
aWRSZWZDdXJyZW50KHRydWUpCiAgICAgLCBibG9ja1N0YWNrKDApCi0gICAgLCBmb3JtKDApCi0g
ICAgLCBtX2N1cnJlbnRNYXBFbGVtZW50KDApCiAgICAgLCBoZWFkKDApCiAgICAgLCBpbkJvZHko
dHJ1ZSkKICAgICAsIGhhdmVDb250ZW50KGZhbHNlKQpAQCAtMTYxLDcgKzE1Nyw3IEBAIHZvaWQg
SFRNTFBhcnNlcjo6cmVzZXQoKQogICAgIGhhdmVDb250ZW50ID0gZmFsc2U7CiAgICAgaW5TdHJh
eVRhYmxlQ29udGVudCA9IDA7CiAKLSAgICBmb3JtID0gMDsKKyAgICBtX2N1cnJlbnRGb3JtRWxl
bWVudCA9IDA7CiAgICAgbV9jdXJyZW50TWFwRWxlbWVudCA9IDA7CiAgICAgaGVhZCA9IDA7CiAg
ICAgbV9pc2luZGV4RWxlbWVudCA9IDA7CkBAIC0yNTEsOCArMjQ3LDggQEAgUGFzc1JlZlB0cjxO
b2RlPiBIVE1MUGFyc2VyOjpwYXJzZVRva2VuKAogICAgICAgICBpZiAobV9jdXJyZW50TWFwRWxl
bWVudCA9PSBuKQogICAgICAgICAgICAgbV9jdXJyZW50TWFwRWxlbWVudCA9IDA7CiAKLSAgICAg
ICAgaWYgKGZvcm0gPT0gbikKLSAgICAgICAgICAgIGZvcm0gPSAwOworICAgICAgICBpZiAobV9j
dXJyZW50Rm9ybUVsZW1lbnQgPT0gbikKKyAgICAgICAgICAgIG1fY3VycmVudEZvcm1FbGVtZW50
ID0gMDsKIAogICAgICAgICBpZiAoaGVhZCA9PSBuKQogICAgICAgICAgICAgaGVhZCA9IDA7CkBA
IC00MDQsOCArNDAwLDggQEAgYm9vbCBIVE1MUGFyc2VyOjpoYW5kbGVFcnJvcihOb2RlKiBuLCBi
bwogICAgICAgICAgICAgZWxzZSBpZiAoIWN1cnJlbnQtPmlzRG9jdW1lbnROb2RlKCkpCiAgICAg
ICAgICAgICAgICAgcmV0dXJuIGZhbHNlOwogICAgICAgICB9IGVsc2UgaWYgKGgtPmhhc0xvY2Fs
TmFtZShpbnB1dFRhZykpIHsKLSAgICAgICAgICAgIGlmIChlcXVhbElnbm9yaW5nQ2FzZShoLT5n
ZXRBdHRyaWJ1dGUodHlwZUF0dHIpLCAiaGlkZGVuIikgJiYgZm9ybSkgewotICAgICAgICAgICAg
ICAgIGZvcm0tPmFkZENoaWxkKG4pOworICAgICAgICAgICAgaWYgKGVxdWFsSWdub3JpbmdDYXNl
KGgtPmdldEF0dHJpYnV0ZSh0eXBlQXR0ciksICJoaWRkZW4iKSAmJiBtX2N1cnJlbnRGb3JtRWxl
bWVudCkgeworICAgICAgICAgICAgICAgIG1fY3VycmVudEZvcm1FbGVtZW50LT5hZGRDaGlsZChu
KTsKICAgICAgICAgICAgICAgICBpZiAoIW4tPmF0dGFjaGVkKCkgJiYgIW1faXNQYXJzaW5nRnJh
Z21lbnQpCiAgICAgICAgICAgICAgICAgICAgIG4tPmF0dGFjaCgpOwogICAgICAgICAgICAgICAg
IHJldHVybiB0cnVlOwpAQCAtNjkzLDkgKzY4OSw5IEBAIGJvb2wgSFRNTFBhcnNlcjo6Zm9ybUNy
ZWF0ZUVycm9yQ2hlY2soVG8KIHsKICAgICAvLyBPbmx5IGNyZWF0ZSBhIG5ldyBmb3JtIGlmIHdl
J3JlIG5vdCBhbHJlYWR5IGluc2lkZSBvbmUuCiAgICAgLy8gVGhpcyBpcyBjb25zaXN0ZW50IHdp
dGggb3RoZXIgYnJvd3NlcnMnIGJlaGF2aW9yLgotICAgIGlmICghZm9ybSkgewotICAgICAgICBm
b3JtID0gbmV3IEhUTUxGb3JtRWxlbWVudChkb2N1bWVudCk7Ci0gICAgICAgIHJlc3VsdCA9IGZv
cm07CisgICAgaWYgKCFtX2N1cnJlbnRGb3JtRWxlbWVudCkgeworICAgICAgICBtX2N1cnJlbnRG
b3JtRWxlbWVudCA9IG5ldyBIVE1MRm9ybUVsZW1lbnQoZG9jdW1lbnQpOworICAgICAgICByZXN1
bHQgPSBtX2N1cnJlbnRGb3JtRWxlbWVudDsKICAgICB9CiAgICAgcmV0dXJuIGZhbHNlOwogfQpA
QCAtODI5LDcgKzgyNSw3IEBAIFBhc3NSZWZQdHI8Tm9kZT4gSFRNTFBhcnNlcjo6Z2V0Tm9kZShU
b2sKICAgICBpZiAoQ3JlYXRlRXJyb3JDaGVja0Z1bmMgZXJyb3JDaGVja0Z1bmMgPSBnRnVuY3Rp
b25NYXAuZ2V0KHQtPnRhZ05hbWUuaW1wbCgpKSkKICAgICAgICAgcHJvY2VlZCA9ICh0aGlzLT4q
ZXJyb3JDaGVja0Z1bmMpKHQsIHJlc3VsdCk7CiAgICAgaWYgKHByb2NlZWQpCi0gICAgICAgIHJl
c3VsdCA9IEhUTUxFbGVtZW50RmFjdG9yeTo6Y3JlYXRlSFRNTEVsZW1lbnQodC0+dGFnTmFtZSwg
ZG9jdW1lbnQsIGZvcm0pOworICAgICAgICByZXN1bHQgPSBIVE1MRWxlbWVudEZhY3Rvcnk6OmNy
ZWF0ZUhUTUxFbGVtZW50KHQtPnRhZ05hbWUsIGRvY3VtZW50LCBtX2N1cnJlbnRGb3JtRWxlbWVu
dC5nZXQoKSk7CiAgICAgcmV0dXJuIHJlc3VsdC5yZWxlYXNlKCk7CiB9CiAKQEAgLTg1NCw3ICs4
NTAsNyBAQCB2b2lkIEhUTUxQYXJzZXI6OnByb2Nlc3NDbG9zZVRhZyhUb2tlbiogCiAgICAgICAg
IHJldHVybjsKICAgICAKICAgICBpZiAodC0+dGFnTmFtZSA9PSBmb3JtVGFnKQotICAgICAgICBm
b3JtID0gMDsKKyAgICAgICAgbV9jdXJyZW50Rm9ybUVsZW1lbnQgPSAwOwogICAgIGVsc2UgaWYg
KHQtPnRhZ05hbWUgPT0gbWFwVGFnKQogICAgICAgICBtX2N1cnJlbnRNYXBFbGVtZW50ID0gMDsK
ICAgICAgICAgCkBAIC0xMDkxLDggKzEwODcsOCBAQCB2b2lkIEhUTUxQYXJzZXI6OmhhbmRsZVJl
c2lkdWFsU3R5bGVDbG9zCiAgICAgLy8gVGhlIGVuZCByZXN1bHQgd2lsbCBiZTogPGI+Li4uPC9i
PjxwPjxiPkZvbzwvYj5Hb288L3A+CiAgICAgLy8KICAgICAvLyBTdGVwIDE6IFJlbW92ZSB8Ymxv
Y2tFbGVtfCBmcm9tIGl0cyBwYXJlbnQsIGRvaW5nIGEgYmF0Y2ggZGV0YWNoIG9mIGFsbCB0aGUg
a2lkcy4KLSAgICBpZiAoZm9ybSkKLSAgICAgICAgZm9ybS0+c2V0UHJlc2VydmVBY3Jvc3NSZW1v
dmUodHJ1ZSk7CisgICAgaWYgKG1fY3VycmVudEZvcm1FbGVtZW50KQorICAgICAgICBtX2N1cnJl
bnRGb3JtRWxlbWVudC0+c2V0UHJlc2VydmVBY3Jvc3NSZW1vdmUodHJ1ZSk7CiAgICAgaWYgKGlz
QmxvY2tTdGlsbEluVHJlZSkKICAgICAgICAgYmxvY2tFbGVtLT5wYXJlbnROb2RlKCktPnJlbW92
ZUNoaWxkKGJsb2NrRWxlbSwgZWMpOwogCkBAIC0xMTU4LDggKzExNTQsOCBAQCB2b2lkIEhUTUxQ
YXJzZXI6OmhhbmRsZVJlc2lkdWFsU3R5bGVDbG9zCiAgICAgcmVvcGVuUmVzaWR1YWxTdHlsZVRh
Z3MocmVzaWR1YWxTdHlsZVN0YWNrLCAwKTsgLy8gRklYTUU6IERlYWwgd2l0aCBzdHJheSB0YWJs
ZSBjb250ZW50IHNvbWUgZGF5CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgLy8gaWYgaXQgYmVjb21lcyBuZWNlc3NhcnkgdG8gZG8gc28uCiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCi0gICAgaWYg
KGZvcm0pCi0gICAgICAgIGZvcm0tPnNldFByZXNlcnZlQWNyb3NzUmVtb3ZlKGZhbHNlKTsKKyAg
ICBpZiAobV9jdXJyZW50Rm9ybUVsZW1lbnQpCisgICAgICAgIG1fY3VycmVudEZvcm1FbGVtZW50
LT5zZXRQcmVzZXJ2ZUFjcm9zc1JlbW92ZShmYWxzZSk7CiB9CiAKIHZvaWQgSFRNTFBhcnNlcjo6
cmVvcGVuUmVzaWR1YWxTdHlsZVRhZ3MoSFRNTFN0YWNrRWxlbSogZWxlbSwgTm9kZSogbWFsZm9y
bWVkVGFibGVQYXJlbnQpCkBAIC0xMjUzLDExICsxMjQ5LDExIEBAIHZvaWQgSFRNTFBhcnNlcjo6
cG9wQmxvY2soY29uc3QgQXRvbWljU3QKICAgICAgICAgICAgIH0KICAgICAgICAgfQogICAgICAg
ICBlbHNlIHsKLSAgICAgICAgICAgIGlmIChmb3JtICYmIGVsZW0tPnRhZ05hbWUgPT0gZm9ybVRh
ZykKKyAgICAgICAgICAgIGlmIChtX2N1cnJlbnRGb3JtRWxlbWVudCAmJiBlbGVtLT50YWdOYW1l
ID09IGZvcm1UYWcpCiAgICAgICAgICAgICAgICAgLy8gQSA8Zm9ybT4gaXMgYmVpbmcgY2xvc2Vk
IHByZW1hdHVyZWx5IChhbmQgdGhpcyBpcwogICAgICAgICAgICAgICAgIC8vIG1hbGZvcm1lZCBI
VE1MKS4gIFNldCBhbiBhdHRyaWJ1dGUgb24gdGhlIGZvcm0gdG8gY2xlYXIgb3V0IGl0cwogICAg
ICAgICAgICAgICAgIC8vIGJvdHRvbSBtYXJnaW4uCi0gICAgICAgICAgICAgICAgZm9ybS0+c2V0
TWFsZm9ybWVkKHRydWUpOworICAgICAgICAgICAgICAgIG1fY3VycmVudEZvcm1FbGVtZW50LT5z
ZXRNYWxmb3JtZWQodHJ1ZSk7CiAKICAgICAgICAgICAgIC8vIFNjaGVkdWxlIHRoaXMgdGFnIGZv
ciByZW9wZW5pbmcKICAgICAgICAgICAgIC8vIGFmdGVyIHdlIGNvbXBsZXRlIHRoZSBjbG9zZSBv
ZiB0aGlzIGVudGlyZSBibG9jay4KQEAgLTEzNjQsNyArMTM2MCw3IEBAIFBhc3NSZWZQdHI8Tm9k
ZT4gSFRNTFBhcnNlcjo6aGFuZGxlSXNpbmQKIAogICAgIE5hbWVkTWFwcGVkQXR0ck1hcCogYXR0
cnMgPSB0LT5hdHRycy5nZXQoKTsKIAotICAgIFJlZlB0cjxIVE1MSXNJbmRleEVsZW1lbnQ+IGlz
SW5kZXggPSBuZXcgSFRNTElzSW5kZXhFbGVtZW50KGRvY3VtZW50LCBmb3JtKTsKKyAgICBSZWZQ
dHI8SFRNTElzSW5kZXhFbGVtZW50PiBpc0luZGV4ID0gbmV3IEhUTUxJc0luZGV4RWxlbWVudChk
b2N1bWVudCwgbV9jdXJyZW50Rm9ybUVsZW1lbnQuZ2V0KCkpOwogICAgIGlzSW5kZXgtPnNldEF0
dHJpYnV0ZU1hcChhdHRycyk7CiAgICAgaXNJbmRleC0+c2V0QXR0cmlidXRlKHR5cGVBdHRyLCAi
a2h0bWxfaXNpbmRleCIpOwogCkluZGV4OiBXZWJDb3JlL2h0bWwvSFRNTFBhcnNlci5oCj09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT0KLS0tIFdlYkNvcmUvaHRtbC9IVE1MUGFyc2VyLmgJKHJldmlzaW9uIDIwOTcxKQorKysg
V2ViQ29yZS9odG1sL0hUTUxQYXJzZXIuaAkod29ya2luZyBjb3B5KQpAQCAtMTM3LDggKzEzNyw4
IEBAIHByaXZhdGU6CiAKICAgICBIVE1MU3RhY2tFbGVtKiBibG9ja1N0YWNrOwogCi0gICAgSFRN
TEZvcm1FbGVtZW50KiBmb3JtOyAvLyBjdXJyZW50bHkgYWN0aXZlIGZvcm0KLSAgICBIVE1MTWFw
RWxlbWVudCogbV9jdXJyZW50TWFwRWxlbWVudDsgLy8gY3VycmVudCBtYXAKKyAgICBSZWZQdHI8
SFRNTEZvcm1FbGVtZW50PiBtX2N1cnJlbnRGb3JtRWxlbWVudDsgLy8gY3VycmVudGx5IGFjdGl2
ZSBmb3JtCisgICAgUmVmUHRyPEhUTUxNYXBFbGVtZW50PiBtX2N1cnJlbnRNYXBFbGVtZW50OyAv
LyBjdXJyZW50IG1hcAogICAgIEhUTUxIZWFkRWxlbWVudCogaGVhZDsgLy8gaGVhZCBlbGVtZW50
OyBuZWVkZWQgZm9yIEhUTUwgd2hpY2ggZGVmaW5lcyA8YmFzZT4gYWZ0ZXIgPC9oZWFkPgogICAg
IFJlZlB0cjxOb2RlPiBtX2lzaW5kZXhFbGVtZW50OyAvLyBhIHBvc3NpYmxlIDxpc2luZGV4PiBl
bGVtZW50IGluIHRoZSBoZWFkCiAK
</data>
<flag name="review"
          id="5712"
          type_id="1"
          status="+"
          setter="darin"
    />
          </attachment>
      

    </bug>

</bugzilla>