<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>13336</bug_id>
          
          <creation_ts>2007-04-11 15:14:58 -0700</creation_ts>
          <short_desc>REGRESSION (r20646): editing/execCommand/hilitecolor.html crashes under guardMalloc</short_desc>
          <delta_ts>2007-04-19 15:54:24 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>New Bugs</component>
          <version>523.x (Safari 3)</version>
          <rep_platform>Mac</rep_platform>
          <op_sys>OS X 10.4</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>Regression</keywords>
          <priority>P1</priority>
          <bug_severity>Major</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter>mitz</reporter>
          <assigned_to name="Nobody">webkit-unassigned</assigned_to>
          <cc>andrew</cc>
    
    <cc>hyatt</cc>
    
    <cc>justin.garcia</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>15002</commentid>
    <comment_count>0</comment_count>
    <who name="">mitz</who>
    <bug_when>2007-04-11 15:14:58 -0700</bug_when>
    <thetext>Backtrace:

Thread 0 Crashed:
0   com.apple.WebCore        	0x01522bf7 WebCore::TextRun::operator[](int) const + 19 (Font.h:61)
1   com.apple.WebCore        	0x011f591d WebCore::Font::canUseGlyphCache(WebCore::TextRun const&amp;) const + 89 (Font.cpp:527)
2   com.apple.WebCore        	0x011f6db6 WebCore::Font::selectionRectForText(WebCore::TextRun const&amp;, WebCore::TextStyle const&amp;, WebCore::IntPoint const&amp;, int, int, int) const + 58 (Font.cpp:660)
3   com.apple.WebCore        	0x01123796 WebCore::InlineTextBox::selectionRect(int, int, int, int) + 540 (InlineTextBox.cpp:130)
4   com.apple.WebCore        	0x0117b5a2 WebCore::RenderText::selectionRect() + 326 (RenderText.cpp:1050)
5   com.apple.WebCore        	0x01501b45 WebCore::RenderObject::SelectionInfo::SelectionInfo[in-charge](WebCore::RenderObject*) + 45 (RenderObject.h:815)
6   com.apple.WebCore        	0x01142f5c WebCore::RenderView::setSelection(WebCore::RenderObject*, int, WebCore::RenderObject*, int) + 398 (RenderView.cpp:295)
7   com.apple.WebCore        	0x0114404f WebCore::RenderView::clearSelection() + 49 (RenderView.cpp:423)
8   com.apple.WebCore        	0x011d6efd WebCore::SelectionController::nodeWillBeRemoved(WebCore::Node*) + 997 (SelectionController.cpp:196)
9   com.apple.WebCore        	0x010cb064 WebCore::Document::notifyBeforeNodeRemoval(WebCore::Node*) + 54 (Document.cpp:2278)
10  com.apple.WebCore        	0x010d4527 WebCore::dispatchChildRemovalEvents(WebCore::Node*, int&amp;) + 95 (ContainerNode.cpp:923)
11  com.apple.WebCore        	0x010d48d9 WebCore::willRemoveChild(WebCore::Node*) + 27 (ContainerNode.cpp:342)
12  com.apple.WebCore        	0x010d4c98 WebCore::ContainerNode::removeChild(WebCore::Node*, int&amp;) + 584 (ContainerNode.cpp:381)
13  com.apple.WebCore        	0x010d510b WebCore::ContainerNode::appendChild(WTF::PassRefPtr&lt;WebCore::Node&gt;, int&amp;) + 579 (ContainerNode.cpp:511)
14  com.apple.WebCore        	0x011e5cc2 WebCore::WrapContentsInDummySpanCommand::doApply() + 304 (WrapContentsInDummySpanCommand.cpp:50)
15  com.apple.WebCore        	0x011b8c6c WebCore::EditCommand::apply() + 384 (EditCommand.cpp:92)
16  com.apple.WebCore        	0x011aff37 WebCore::CompositeEditCommand::applyCommandToComposite(WTF::PassRefPtr&lt;WebCore::EditCommand&gt;) + 53 (CompositeEditCommand.cpp:97)
17  com.apple.WebCore        	0x011b142d WebCore::CompositeEditCommand::wrapContentsInDummySpan(WebCore::Element*) + 71 (CompositeEditCommand.cpp:243)
18  com.apple.WebCore        	0x011d9d0f WebCore::SplitTextNodeContainingElementCommand::doApply() + 299 (SplitTextNodeContainingElementCommand.cpp:53)
19  com.apple.WebCore        	0x011b8c6c WebCore::EditCommand::apply() + 384 (EditCommand.cpp:92)
20  com.apple.WebCore        	0x011aff37 WebCore::CompositeEditCommand::applyCommandToComposite(WTF::PassRefPtr&lt;WebCore::EditCommand&gt;) + 53 (CompositeEditCommand.cpp:97)
21  com.apple.WebCore        	0x011b12aa WebCore::CompositeEditCommand::splitTextNodeContainingElement(WebCore::Text*, int) + 78 (CompositeEditCommand.cpp:248)
22  com.apple.WebCore        	0x011a8ce0 WebCore::ApplyStyleCommand::splitTextElementAtStartIfNeeded(WebCore::Position const&amp;, WebCore::Position const&amp;) + 252 (ApplyStyleCommand.cpp:1062)
23  com.apple.WebCore        	0x011acff2 WebCore::ApplyStyleCommand::applyInlineStyle(WebCore::CSSMutableStyleDeclaration*) + 238 (ApplyStyleCommand.cpp:595)
24  com.apple.WebCore        	0x011aedc5 WebCore::ApplyStyleCommand::doApply() + 425 (ApplyStyleCommand.cpp:349)
25  com.apple.WebCore        	0x011b8c6c WebCore::EditCommand::apply() + 384 (EditCommand.cpp:92)
26  com.apple.WebCore        	0x011b8da0 WebCore::applyCommand(WTF::PassRefPtr&lt;WebCore::EditCommand&gt;) + 82 (EditCommand.cpp:227)
27  com.apple.WebCore        	0x01361ce3 WebCore::Editor::applyStyle(WebCore::CSSStyleDeclaration*, WebCore::EditAction) + 213 (Editor.cpp:616)
28  com.apple.WebCore        	0x011c2ba1 WebCore::(anonymous namespace)::execStyleChange(WebCore::Frame*, int, WebCore::String const&amp;) + 139 (JSEditor.cpp:156)
29  com.apple.WebCore        	0x011c2c64 WebCore::(anonymous namespace)::execBackColor(WebCore::Frame*, bool, WebCore::String const&amp;) + 38 (JSEditor.cpp:198)
30  com.apple.WebCore        	0x011c3d25 WebCore::JSEditor::execCommand(WebCore::String const&amp;, bool, WebCore::String const&amp;) + 133 (JSEditor.cpp:87)
31  com.apple.WebCore        	0x010c5812 WebCore::Document::execCommand(WebCore::String const&amp;, bool, WebCore::String const&amp;) + 56 (Document.cpp:2742)
32  com.apple.WebCore        	0x0122ba1b WebCore::JSDocumentPrototypeFunction::callAsFunction(KJS::ExecState*, KJS::JSObject*, KJS::List const&amp;) + 7693 (JSDocument.cpp:580)
33  com.apple.JavaScriptCore 	0x00403a4a KJS::JSObject::call(KJS::ExecState*, KJS::JSObject*, KJS::List const&amp;) + 210 (object.cpp:97)
34  com.apple.JavaScriptCore 	0x003fa998 KJS::FunctionCallDotNode::evaluate(KJS::ExecState*) + 944 (nodes.cpp:781)
35  com.apple.JavaScriptCore 	0x003f7b50 KJS::ExprStatementNode::execute(KJS::ExecState*) + 148 (nodes.cpp:1681)
36  com.apple.JavaScriptCore 	0x003f587e KJS::SourceElementsNode::execute(KJS::ExecState*) + 566 (nodes.cpp:2464)
37  com.apple.JavaScriptCore 	0x003f4080 KJS::BlockNode::execute(KJS::ExecState*) + 140 (nodes.cpp:1657)
38  com.apple.JavaScriptCore 	0x003ee939 KJS::Interpreter::evaluate(KJS::UString const&amp;, int, KJS::UChar const*, int, KJS::JSValue*) + 989 (interpreter.cpp:365)
39  com.apple.WebCore        	0x012465ff WebCore::KJSProxy::evaluate(WebCore::String const&amp;, int, WebCore::String const&amp;, WebCore::Node*) + 319 (kjs_proxy.cpp:78)
40  com.apple.WebCore        	0x01384405 WebCore::FrameLoader::executeScript(WebCore::String const&amp;, int, WebCore::Node*, WebCore::String const&amp;) + 99 (FrameLoader.cpp:686)
41  com.apple.WebCore        	0x0101ddda WebCore::HTMLTokenizer::scriptExecution(WebCore::DeprecatedString const&amp;, WebCore::HTMLTokenizer::State, WebCore::DeprecatedString, int) + 316 (HTMLTokenizer.cpp:502)
42  com.apple.WebCore        	0x01020595 WebCore::HTMLTokenizer::scriptHandler(WebCore::HTMLTokenizer::State) + 1449 (HTMLTokenizer.cpp:452)
43  com.apple.WebCore        	0x01020a8e WebCore::HTMLTokenizer::parseSpecial(WebCore::SegmentedString&amp;, WebCore::HTMLTokenizer::State) + 918 (HTMLTokenizer.cpp:310)
44  com.apple.WebCore        	0x01022440 WebCore::HTMLTokenizer::parseTag(WebCore::SegmentedString&amp;, WebCore::HTMLTokenizer::State) + 5274 (HTMLTokenizer.cpp:1176)
45  com.apple.WebCore        	0x01022bf7 WebCore::HTMLTokenizer::write(WebCore::SegmentedString const&amp;, bool) + 1173 (HTMLTokenizer.cpp:1389)
46  com.apple.WebCore        	0x01378e95 WebCore::FrameLoader::write(char const*, int, bool) + 923 (FrameLoader.cpp:884)
47  com.apple.WebCore        	0x01378fc7 WebCore::FrameLoader::addData(char const*, int) + 275 (FrameLoader.cpp:1543)
48  com.apple.WebCore        	0x010d72f5 -[WebCoreFrameBridge addData:] + 163 (WebCoreFrameBridge.mm:291)
49  com.apple.WebCore        	0x010da6ac -[WebCoreFrameBridge receivedData:textEncodingName:] + 250 (WebCoreFrameBridge.mm:1477)
50  com.apple.WebKit         	0x002324d5 -[WebHTMLRepresentation receivedData:withDataSource:] + 199 (WebHTMLRepresentation.mm:175)
51  com.apple.WebKit         	0x0022dbdb -[WebDataSource(WebInternal) _receivedData:] + 89 (WebDataSource.mm:178)
52  com.apple.WebKit         	0x00294e93 WebFrameLoaderClient::committedLoad(WebCore::DocumentLoader*, char const*, int) + 127 (WebFrameLoaderClient.mm:645)
53  com.apple.WebCore        	0x01375d21 WebCore::FrameLoader::committedLoad(WebCore::DocumentLoader*, char const*, int) + 53 (FrameLoader.cpp:2956)
54  com.apple.WebCore        	0x013869e5 WebCore::DocumentLoader::commitLoad(char const*, int) + 87 (DocumentLoader.cpp:347)
55  com.apple.WebCore        	0x01386a3e WebCore::DocumentLoader::receivedData(char const*, int) + 76 (DocumentLoader.cpp:360)
56  com.apple.WebCore        	0x01375351 WebCore::FrameLoader::receivedData(char const*, int) + 41 (FrameLoader.cpp:1979)
57  com.apple.WebCore        	0x01388308 WebCore::MainResourceLoader::addData(char const*, int, bool) + 80 (MainResourceLoader.cpp:134)
58  com.apple.WebCore        	0x0138a43f WebCore::ResourceLoader::didReceiveData(char const*, int, long long, bool) + 83
59  com.apple.WebCore        	0x0138863d WebCore::MainResourceLoader::didReceiveData(char const*, int, long long, bool) + 281 (MainResourceLoader.cpp:289)
60  com.apple.WebCore        	0x0138a046 WebCore::ResourceLoader::didReceiveData(WebCore::ResourceHandle*, char const*, int, int) + 58
61  com.apple.WebCore        	0x01368d8c -[WebCoreResourceHandleAsDelegate connection:didReceiveData:lengthReceived:] + 172 (ResourceHandleMac.mm:352)
62  com.apple.Foundation     	0x92856afa -[NSURLConnection(NSURLConnectionInternal) _sendDidReceiveDataCallback] + 641
63  com.apple.Foundation     	0x92854ddb -[NSURLConnection(NSURLConnectionInternal) _sendCallbacks] + 686
64  com.apple.Foundation     	0x92854ab5 _sendCallbacks + 201
65  com.apple.CoreFoundation 	0x9082df92 CFRunLoopRunSpecific + 1213
66  com.apple.CoreFoundation 	0x9082dace CFRunLoopRunInMode + 61
67  com.apple.Foundation     	0x92825d3a -[NSRunLoop runMode:beforeDate:] + 182
68  DumpRenderTree           	0x0000a450 runTest + 1109 (DumpRenderTree.m:1400)
69  DumpRenderTree           	0x000065f5 dumpRenderTree + 2209 (DumpRenderTree.m:503)
70  DumpRenderTree           	0x0000685d main + 70 (DumpRenderTree.m:558)
71  DumpRenderTree           	0x00002482 _start + 216
72  DumpRenderTree           	0x000023a9 start + 41</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>14756</commentid>
    <comment_count>1</comment_count>
    <who name="Andrew Wellington">andrew</who>
    <bug_when>2007-04-15 04:08:52 -0700</bug_when>
    <thetext>This happens because WebCore::InlineTextBox assumes that its textObject() will not change the length of its text.

SplitTextNodeContainingElementCommand violates this by calling splitTextNode() which eventually will hit CharacterData::deleteData, chopping some data off the textObject()&apos;s text as it does the split.

We need to watch for this change and update the m_len value as appropriate.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>14685</commentid>
    <comment_count>2</comment_count>
    <who name="">mitz</who>
    <bug_when>2007-04-16 01:24:08 -0700</bug_when>
    <thetext>I think the problem is calling selectionRect() on a renderer that needs layout (and has dirty line boxes). I don&apos;t like the idea of requiring setTextWithOffset to clean up dirty boxes. That&apos;s what layout is for.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>14113</commentid>
    <comment_count>3</comment_count>
      <attachid>14089</attachid>
    <who name="">mitz</who>
    <bug_when>2007-04-19 07:50:30 -0700</bug_when>
    <thetext>Created attachment 14089
Avoid calling selectionRect and selectionGapRects on dirty renderers

No layout test regressions.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>13955</commentid>
    <comment_count>4</comment_count>
    <who name="Andrew Wellington">andrew</who>
    <bug_when>2007-04-19 15:54:24 -0700</bug_when>
    <thetext>Landed in 20959</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>14089</attachid>
            <date>2007-04-19 07:50:30 -0700</date>
            <delta_ts>2007-04-19 09:29:08 -0700</delta_ts>
            <desc>Avoid calling selectionRect and selectionGapRects on dirty renderers</desc>
            <filename>13336_r1.patch</filename>
            <type>text/plain</type>
            <size>3952</size>
            <attacher>mitz</attacher>
            
              <data encoding="base64">SW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9n
CShyZXZpc2lvbiAyMDk0OSkKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA
IC0xLDMgKzEsMjYgQEAKKzIwMDctMDQtMTkgIE1pdHogUGV0dGVsICA8bWl0ekB3ZWJraXQub3Jn
PgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIC0gZml4
IGh0dHA6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTEzMzM2CisgICAgICAgICAg
UkVHUkVTU0lPTiAocjIwNjQ2KTogZWRpdGluZy9leGVjQ29tbWFuZC9oaWxpdGVjb2xvci5odG1s
IGNyYXNoZXMgdW5kZXIgZ3VhcmRNYWxsb2MKKworICAgICAgICBBdm9pZCBjYWxsaW5nIHNlbGVj
dGlvblJlY3QoKSBhbmQgc2VsZWN0aW9uR2FwUmVjdHMoKSBvbiBhIHJlbmRlcmVyIHRoYXQgbmVl
ZHMKKyAgICAgICAgbGF5b3V0LgorCisgICAgICAgICogcmVuZGVyaW5nL1JlbmRlckJsb2NrLmNw
cDoKKyAgICAgICAgKFdlYkNvcmU6OlJlbmRlckJsb2NrOjpzZWxlY3Rpb25HYXBSZWN0cyk6Cisg
ICAgICAgICogcmVuZGVyaW5nL1JlbmRlckJsb2NrLmg6CisgICAgICAgIChXZWJDb3JlOjpSZW5k
ZXJCbG9jazo6QmxvY2tTZWxlY3Rpb25JbmZvOjpCbG9ja1NlbGVjdGlvbkluZm8pOgorICAgICAg
ICAqIHJlbmRlcmluZy9SZW5kZXJMaXN0TWFya2VyLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OlJl
bmRlckxpc3RNYXJrZXI6OnNlbGVjdGlvblJlY3QpOgorICAgICAgICAqIHJlbmRlcmluZy9SZW5k
ZXJPYmplY3QuaDoKKyAgICAgICAgKFdlYkNvcmU6OlJlbmRlck9iamVjdDo6U2VsZWN0aW9uSW5m
bzo6U2VsZWN0aW9uSW5mbyk6CisgICAgICAgICogcmVuZGVyaW5nL1JlbmRlclJlcGxhY2VkLmNw
cDoKKyAgICAgICAgKFdlYkNvcmU6OlJlbmRlclJlcGxhY2VkOjpzZWxlY3Rpb25SZWN0KToKKyAg
ICAgICAgKiByZW5kZXJpbmcvUmVuZGVyVGV4dC5jcHA6CisgICAgICAgIChXZWJDb3JlOjpSZW5k
ZXJUZXh0OjpzZWxlY3Rpb25SZWN0KToKKwogMjAwNy0wNC0xOSAgU2FtIFdlaW5pZyAgPHNhbUB3
ZWJraXQub3JnPgogCiAgICAgICAgIFJldmlld2VkIGJ5IERhcmluLgpJbmRleDogV2ViQ29yZS9y
ZW5kZXJpbmcvUmVuZGVyQmxvY2suY3BwCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvcmVuZGVyaW5n
L1JlbmRlckJsb2NrLmNwcAkocmV2aXNpb24gMjA5NDQpCisrKyBXZWJDb3JlL3JlbmRlcmluZy9S
ZW5kZXJCbG9jay5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTE2MjQsNiArMTYyNCw4IEBAIGJvb2wg
UmVuZGVyQmxvY2s6OmlzU2VsZWN0aW9uUm9vdCgpIGNvbnMKIAogR2FwUmVjdHMgUmVuZGVyQmxv
Y2s6OnNlbGVjdGlvbkdhcFJlY3RzKCkKIHsKKyAgICBBU1NFUlQoIW5lZWRzTGF5b3V0KCkpOwor
CiAgICAgaWYgKCFzaG91bGRQYWludFNlbGVjdGlvbkdhcHMoKSkKICAgICAgICAgcmV0dXJuIEdh
cFJlY3RzKCk7CiAKSW5kZXg6IFdlYkNvcmUvcmVuZGVyaW5nL1JlbmRlckJsb2NrLmgKPT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PQotLS0gV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyQmxvY2suaAkocmV2aXNpb24gMjA5NDQp
CisrKyBXZWJDb3JlL3JlbmRlcmluZy9SZW5kZXJCbG9jay5oCSh3b3JraW5nIGNvcHkpCkBAIC0y
NDAsNyArMjQwLDcgQEAgcHVibGljOgogCiAgICAgICAgIEJsb2NrU2VsZWN0aW9uSW5mbyhSZW5k
ZXJCbG9jayogYikKICAgICAgICAgICAgIDogbV9ibG9jayhiKQotICAgICAgICAgICAgLCBtX3Jl
Y3RzKGItPnNlbGVjdGlvbkdhcFJlY3RzKCkpCisgICAgICAgICAgICAsIG1fcmVjdHMoYi0+bmVl
ZHNMYXlvdXQoKSA/IEdhcFJlY3RzKCkgOiBiLT5zZWxlY3Rpb25HYXBSZWN0cygpKQogICAgICAg
ICAgICAgLCBtX3N0YXRlKGItPnNlbGVjdGlvblN0YXRlKCkpCiAgICAgICAgIHsgCiAgICAgICAg
IH0KSW5kZXg6IFdlYkNvcmUvcmVuZGVyaW5nL1JlbmRlckxpc3RNYXJrZXIuY3BwCj09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT0KLS0tIFdlYkNvcmUvcmVuZGVyaW5nL1JlbmRlckxpc3RNYXJrZXIuY3BwCShyZXZpc2lvbiAy
MDk0NCkKKysrIFdlYkNvcmUvcmVuZGVyaW5nL1JlbmRlckxpc3RNYXJrZXIuY3BwCSh3b3JraW5n
IGNvcHkpCkBAIC04NTksNiArODU5LDggQEAgdm9pZCBSZW5kZXJMaXN0TWFya2VyOjpzZXRTZWxl
Y3Rpb25TdGF0ZQogCiBJbnRSZWN0IFJlbmRlckxpc3RNYXJrZXI6OnNlbGVjdGlvblJlY3QoKQog
eworICAgIEFTU0VSVCghbmVlZHNMYXlvdXQoKSk7CisKICAgICBpZiAoc2VsZWN0aW9uU3RhdGUo
KSA9PSBTZWxlY3Rpb25Ob25lIHx8ICFpbmxpbmVCb3hXcmFwcGVyKCkpCiAgICAgICAgIHJldHVy
biBJbnRSZWN0KCk7CiAKSW5kZXg6IFdlYkNvcmUvcmVuZGVyaW5nL1JlbmRlck9iamVjdC5oCj09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT0KLS0tIFdlYkNvcmUvcmVuZGVyaW5nL1JlbmRlck9iamVjdC5oCShyZXZpc2lvbiAy
MDk0NCkKKysrIFdlYkNvcmUvcmVuZGVyaW5nL1JlbmRlck9iamVjdC5oCSh3b3JraW5nIGNvcHkp
CkBAIC04MTEsNyArODExLDcgQEAgcHVibGljOgogCiAgICAgICAgIFNlbGVjdGlvbkluZm8oUmVu
ZGVyT2JqZWN0KiBvKQogICAgICAgICAgICAgOiBtX29iamVjdChvKQotICAgICAgICAgICAgLCBt
X3JlY3Qoby0+c2VsZWN0aW9uUmVjdCgpKQorICAgICAgICAgICAgLCBtX3JlY3Qoby0+bmVlZHNM
YXlvdXQoKSA/IEludFJlY3QoKSA6IG8tPnNlbGVjdGlvblJlY3QoKSkKICAgICAgICAgICAgICwg
bV9zdGF0ZShvLT5zZWxlY3Rpb25TdGF0ZSgpKQogICAgICAgICB7CiAgICAgICAgIH0KSW5kZXg6
IFdlYkNvcmUvcmVuZGVyaW5nL1JlbmRlclJlcGxhY2VkLmNwcAo9PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBXZWJD
b3JlL3JlbmRlcmluZy9SZW5kZXJSZXBsYWNlZC5jcHAJKHJldmlzaW9uIDIwOTQ0KQorKysgV2Vi
Q29yZS9yZW5kZXJpbmcvUmVuZGVyUmVwbGFjZWQuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC0xNDgs
NiArMTQ4LDggQEAgVmlzaWJsZVBvc2l0aW9uIFJlbmRlclJlcGxhY2VkOjpwb3NpdGlvbgogCiBJ
bnRSZWN0IFJlbmRlclJlcGxhY2VkOjpzZWxlY3Rpb25SZWN0KCkKIHsKKyAgICBBU1NFUlQoIW5l
ZWRzTGF5b3V0KCkpOworCiAgICAgaWYgKCFpc1NlbGVjdGVkKCkpCiAgICAgICAgIHJldHVybiBJ
bnRSZWN0KCk7CiAgICAgaWYgKCFtX2lubGluZUJveFdyYXBwZXIpCkluZGV4OiBXZWJDb3JlL3Jl
bmRlcmluZy9SZW5kZXJUZXh0LmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBXZWJDb3JlL3JlbmRlcmluZy9S
ZW5kZXJUZXh0LmNwcAkocmV2aXNpb24gMjA5NDQpCisrKyBXZWJDb3JlL3JlbmRlcmluZy9SZW5k
ZXJUZXh0LmNwcAkod29ya2luZyBjb3B5KQpAQCAtMTAyMSw2ICsxMDIxLDggQEAgSW50UmVjdCBS
ZW5kZXJUZXh0OjphYnNvbHV0ZUNsaXBwZWRPdmVyZgogCiBJbnRSZWN0IFJlbmRlclRleHQ6OnNl
bGVjdGlvblJlY3QoKQogeworICAgIEFTU0VSVCghbmVlZHNMYXlvdXQoKSk7CisKICAgICBJbnRS
ZWN0IHJlY3Q7CiAgICAgaWYgKHNlbGVjdGlvblN0YXRlKCkgPT0gU2VsZWN0aW9uTm9uZSkKICAg
ICAgICAgcmV0dXJuIHJlY3Q7Cg==
</data>
<flag name="review"
          id="5696"
          type_id="1"
          status="+"
          setter="darin"
    />
          </attachment>
      

    </bug>

</bugzilla>