<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>136485</bug_id>
          
          <creation_ts>2014-09-03 09:53:06 -0700</creation_ts>
          <short_desc>Segmentation fault in WTF::RefPtr&lt;JSC::JITCode&gt;::get()</short_desc>
          <delta_ts>2014-09-04 17:57:41 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>JavaScriptCore</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>Unspecified</rep_platform>
          <op_sys>Unspecified</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords></keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Akos Kiss">akiss</reporter>
          <assigned_to name="Nobody">webkit-unassigned</assigned_to>
          <cc>commit-queue</cc>
    
    <cc>ggaren</cc>
    
    <cc>jbriance</cc>
    
    <cc>msaboff</cc>
    
    <cc>zan</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>1032911</commentid>
    <comment_count>0</comment_count>
    <who name="Akos Kiss">akiss</who>
    <bug_when>2014-09-03 09:53:06 -0700</bug_when>
    <thetext>When running jsc tests on EFL/ARM64, the test cyclic-prototypes.js fails with a segfault. The minimized test case reproducing the problem is:

var o1 = { p1: 1 };
var o2 = { p2: 2 };
o2.__proto__ = o1;
var o3 = { p3: 3 };
o3.__proto__ = o2;
o1.__proto__ = o3;

Debugging with gdb gives the following:

(gdb) run --useLLInt=false cp-min-009.js
Starting program: /home/akiss/devel/WebKit/WebKitBuild/Debug/bin/jsc --useLLInt=false cp-min.js
[Thread debugging using libthread_db enabled]
Using host libthread_db library &quot;/lib/aarch64-linux-gnu/libthread_db.so.1&quot;.
[New Thread 0x7fb4ca11d0 (LWP 5932)]

Program received signal SIGSEGV, Segmentation fault.
0x0000000000b31e88 in WTF::RefPtr&lt;JSC::JITCode&gt;::get (this=0x65756c6176f0)
    at /home/akiss/devel/WebKit/Source/WTF/wtf/RefPtr.h:57
57	        T* get() const { return m_ptr; }
(gdb) bt
#0  0x0000000000b31e88 in WTF::RefPtr&lt;JSC::JITCode&gt;::get (this=0x65756c6176f0)
    at /home/akiss/devel/WebKit/Source/WTF/wtf/RefPtr.h:57
#1  0x0000000000b2dbfc in JSC::CodeBlock::jitType (this=0x65756c617620)
    at /home/akiss/devel/WebKit/Source/JavaScriptCore/bytecode/CodeBlock.h:291
#2  0x0000000000bff480 in JSC::CodeBlock::hasCodeOrigins (this=0x65756c617620)
    at /home/akiss/devel/WebKit/Source/JavaScriptCore/bytecode/CodeBlock.h:561
#3  0x0000000000c0e3b8 in JSC::StackVisitor::readFrame (this=0x7fffffdd90, callFrame=0x12cb638)
    at /home/akiss/devel/WebKit/Source/JavaScriptCore/interpreter/StackVisitor.cpp:92
#4  0x0000000000c0e354 in JSC::StackVisitor::gotoNextFrame (this=0x7fffffdd90)
    at /home/akiss/devel/WebKit/Source/JavaScriptCore/interpreter/StackVisitor.cpp:68
#5  0x0000000000c09ec0 in JSC::StackVisitor::visit&lt;JSC::GetStackTraceFunctor&gt; (
    startFrame=0x7fffffe070, functor=...)
    at /home/akiss/devel/WebKit/Source/JavaScriptCore/interpreter/StackVisitor.h:132
#6  0x0000000000c085d4 in JSC::ExecState::iterate&lt;JSC::GetStackTraceFunctor&gt; (this=0x7fffffe070, 
    functor=...) at /home/akiss/devel/WebKit/Source/JavaScriptCore/interpreter/CallFrame.h:260
#7  0x0000000000c017b0 in JSC::Interpreter::getStackTrace (this=0x1932710, results=..., 
    maxStackSize=18446744073709551615)
    at /home/akiss/devel/WebKit/Source/JavaScriptCore/interpreter/Interpreter.cpp:604
#8  0x0000000000e5ea00 in JSC::VM::throwException (this=0x19227b0, exec=0x7fffffe070, error=...)
    at /home/akiss/devel/WebKit/Source/JavaScriptCore/runtime/VM.cpp:649
#9  0x0000000000e5ef10 in JSC::VM::throwException (this=0x19227b0, exec=0x7fffffe070, 
    error=0x7fb443fe10) at /home/akiss/devel/WebKit/Source/JavaScriptCore/runtime/VM.cpp:697
#10 0x0000000000d99010 in JSC::globalFuncProtoSetter (exec=0x7fffffe070)
    at /home/akiss/devel/WebKit/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp:805
#11 0x0000000000eabc60 in vmEntryToNative ()
#12 0x0000000000c0306c in JSC::Interpreter::executeCall (this=0x1932710, callFrame=0x7fffffe5d0, 
    function=0x7fb439fbf0, callType=JSC::CallTypeHost, callData=..., thisValue=..., args=...)

This is looks similar to https://bugs.webkit.org/show_bug.cgi?id=136391 , but now JSC::globalFuncProtoSetter gets further (fails &quot;only&quot; at throwing the exception because of the cyclic protos), does not bail out very early (at the iteration, as happened in the previous bug).

The problem is that the stack space allocated by the prologue of JSC::globalFuncProtoSetter for its temporaries (more precisely, the bottom 16 bytes of it) overlaps with CallerFrameAndPC set up by vmEntryToNative. And since globalFuncProtoSetter considers that stack space exclusively as its own, it overwrites it in some cases:

(gdb) disas JSC::globalFuncProtoSetter
Dump of assembler code for function JSC::globalFuncProtoSetter(JSC::ExecState*):
   0x0000000000d98e44 &lt;+0&gt;:	stp	x29, x30, [sp,#-128]!
   0x0000000000d98e48 &lt;+4&gt;:	mov	x29, sp
...
   0x0000000000d98fcc &lt;+392&gt;:	ldr	x0, [x29,#40]
   0x0000000000d98fd0 &lt;+396&gt;:	bl	0xb0895c &lt;JSC::ExecState::vm() const&gt;
   0x0000000000d98fd4 &lt;+400&gt;:	mov	x19, x0
   0x0000000000d98fd8 &lt;+404&gt;:	add	x0, x29, #0x70
   0x0000000000d98fdc &lt;+408&gt;:	adrp	x1, 0x12cb000
   0x0000000000d98fe0 &lt;+412&gt;:	add	x1, x1, #0x638
   0x0000000000d98fe4 &lt;+416&gt;:	bl	0xb02e40 &lt;WTF::ASCIILiteral::ASCIILiteral(char const*)&gt;

// the above instructions are part of the code compiled from:
//    exec-&gt;vm().throwException(exec, createError(exec, ASCIILiteral(&quot;cyclic __proto__ value&quot;)));

So, globalFuncProtoSetter allocates 128 bytes (0x80) on stack, and after the first two instructions sp+0 will contain the old fp, sp+8 will contain the return address, and the remaining area (64bit units at sp+16 .. sp+120) will be used for the temporaries. The problem is that vmEntryToNative has already set up exec starting at sp+120 (+0x70). So, the constructor of ASCIILiteral will just overwrite that field, but throwException will still rely on it.

So, the stack frame of globalFuncProtoSetter and the ExecState set up by vmEntryToNative needs to be separated. IMHO.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1032926</commentid>
    <comment_count>1</comment_count>
      <attachid>237560</attachid>
    <who name="Akos Kiss">akiss</who>
    <bug_when>2014-09-03 10:37:56 -0700</bug_when>
    <thetext>Created attachment 237560
WIP patch

This is a work in progress patch (at least the Changelog has not been prepared). I think that it may fix not only this bug but https://bugs.webkit.org/show_bug.cgi?id=132740 and https://bugs.webkit.org/show_bug.cgi?id=136436 as well. I believe that all these bugs should be treated together, since they seem to be releated (all of them are caused by relying on assumptions on how the call stack is laid out).

What it does:
- makeHostFunctionCall (both 32_64 and 64 versions) does not add sizeof(CallerFrameAndPC) to sp before the call to entry anymore (which made them rely on calling conventions to fill in caller frame, but also caused the overlap of the stack area of globalFuncProtoSetter with the caller frame).
- Reorganized makeHostFunctionCall (both 32_64 and 64 versions) a bit to be more alike (helps future maintenance).
- Moved the setting of the caller frame of execCallee from JSC::operationCallEval to JIT::compileCallEval (to satisfy what&apos;s written in a comment in JIT::compileOpCall, &quot;Caller always [...] Initializes [...] CallerFrame&quot;)
- Also changed compileCallEval (both 32_64 and 64 versions) not to rely on calling conventions and keep caller frame and stack of operationCallEval separate.

Status:
- X86-64/EFL and X86-32/EFL passed all jsc tests correctly
- the ARM64/EFL test run is ongoing, but the test cases that previously caused problems (the cyclic proto test case included) have been tested manually and passed
- a Thumb2/EFL test run is also ongoing

Acknowledgements to Michael Saboff and Zan Dobersek, since this patch took &quot;inspiration&quot; from their patches.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1032928</commentid>
    <comment_count>2</comment_count>
    <who name="WebKit Commit Bot">commit-queue</who>
    <bug_when>2014-09-03 10:39:21 -0700</bug_when>
    <thetext>Attachment 237560 did not pass style-queue:


ERROR: Source/JavaScriptCore/jit/JITCall32_64.cpp:223:  Weird number of spaces at line-start.  Are you using a 4-space indent?  [whitespace/indent] [3]
Total errors found: 1 in 4 files


If any of these errors are false positives, please file a bug against check-webkit-style.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1032995</commentid>
    <comment_count>3</comment_count>
      <attachid>237560</attachid>
    <who name="Michael Saboff">msaboff</who>
    <bug_when>2014-09-03 13:26:04 -0700</bug_when>
    <thetext>Comment on attachment 237560
WIP patch

r-

This seems too complicated with stack pointer adjustments that seem a little arbitrary.

I&apos;m working on a patch that should resolve this and the issues in https://bugs.webkit.org/show_bug.cgi?id=136436.  Basically restore the stackPointer to the normal value before compileCallEval().  We know that there is enough space for outgoing register arguments, that is accounted for in stackPointerOffsetFor(m_codeBlock) for architectures that have stack based arguments.  What I&apos;m suggesting should be much simpler.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1033333</commentid>
    <comment_count>4</comment_count>
      <attachid>237654</attachid>
    <who name="Akos Kiss">akiss</who>
    <bug_when>2014-09-04 16:03:59 -0700</bug_when>
    <thetext>Created attachment 237654
Updated patch

Removed the changes that would have affected eval calls, since that has already been fixed in https://bugs.webkit.org/show_bug.cgi?id=136436 .</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1033371</commentid>
    <comment_count>5</comment_count>
      <attachid>237654</attachid>
    <who name="WebKit Commit Bot">commit-queue</who>
    <bug_when>2014-09-04 17:57:38 -0700</bug_when>
    <thetext>Comment on attachment 237654
Updated patch

Clearing flags on attachment: 237654

Committed r173298: &lt;http://trac.webkit.org/changeset/173298&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1033372</commentid>
    <comment_count>6</comment_count>
    <who name="WebKit Commit Bot">commit-queue</who>
    <bug_when>2014-09-04 17:57:41 -0700</bug_when>
    <thetext>All reviewed patches have been landed.  Closing bug.</thetext>
  </long_desc>
      
          <attachment
              isobsolete="1"
              ispatch="1"
              isprivate="0"
          >
            <attachid>237560</attachid>
            <date>2014-09-03 10:37:56 -0700</date>
            <delta_ts>2014-09-04 16:03:59 -0700</delta_ts>
            <desc>WIP patch</desc>
            <filename>big-native-call-refact-v3.patch</filename>
            <type>text/plain</type>
            <size>5145</size>
            <attacher name="Akos Kiss">akiss</attacher>
            
              <data encoding="base64">ZGlmZiAtLWdpdCBhL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9qaXQvSklUQ2FsbC5jcHAgYi9Tb3Vy
Y2UvSmF2YVNjcmlwdENvcmUvaml0L0pJVENhbGwuY3BwCmluZGV4IDZiM2JjOWEuLmVkMDJiMTEg
MTAwNjQ0Ci0tLSBhL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9qaXQvSklUQ2FsbC5jcHAKKysrIGIv
U291cmNlL0phdmFTY3JpcHRDb3JlL2ppdC9KSVRDYWxsLmNwcApAQCAtMTM1LDggKzEzNSwxMSBA
QCB2b2lkIEpJVDo6Y29tcGlsZUxvYWRWYXJhcmdzKEluc3RydWN0aW9uKiBpbnN0cnVjdGlvbikK
IAogdm9pZCBKSVQ6OmNvbXBpbGVDYWxsRXZhbChJbnN0cnVjdGlvbiogaW5zdHJ1Y3Rpb24pCiB7
CisgICAgc3RvcmU2NChjYWxsRnJhbWVSZWdpc3RlciwgQWRkcmVzcyhzdGFja1BvaW50ZXJSZWdp
c3RlciwgLXN0YXRpY19jYXN0PHB0cmRpZmZfdD4oc2l6ZW9mKENhbGxlckZyYW1lQW5kUEMpKSkp
OwogICAgIGFkZFB0cihUcnVzdGVkSW1tMzIoLXN0YXRpY19jYXN0PHB0cmRpZmZfdD4oc2l6ZW9m
KENhbGxlckZyYW1lQW5kUEMpKSksIHN0YWNrUG9pbnRlclJlZ2lzdGVyLCByZWdUMSk7CisgICAg
YWRkUHRyKFRydXN0ZWRJbW0zMigtc3RhdGljX2Nhc3Q8cHRyZGlmZl90PihzaXplb2YoQ2FsbGVy
RnJhbWVBbmRQQykpKSwgc3RhY2tQb2ludGVyUmVnaXN0ZXIpOwogICAgIGNhbGxPcGVyYXRpb25O
b0V4Y2VwdGlvbkNoZWNrKG9wZXJhdGlvbkNhbGxFdmFsLCByZWdUMSk7CisgICAgYWRkUHRyKFRy
dXN0ZWRJbW0zMihzdGF0aWNfY2FzdDxwdHJkaWZmX3Q+KHNpemVvZihDYWxsZXJGcmFtZUFuZFBD
KSkpLCBzdGFja1BvaW50ZXJSZWdpc3Rlcik7CiAKICAgICBKdW1wIG5vRXhjZXB0aW9uID0gZW1p
dEV4Y2VwdGlvbkNoZWNrKEludmVydGVkRXhjZXB0aW9uQ2hlY2spOwogICAgIGFkZFB0cihUcnVz
dGVkSW1tMzIoc3RhY2tQb2ludGVyT2Zmc2V0Rm9yKG1fY29kZUJsb2NrKSAqIHNpemVvZihSZWdp
c3RlcikpLCBjYWxsRnJhbWVSZWdpc3Rlciwgc3RhY2tQb2ludGVyUmVnaXN0ZXIpOyAgICAKZGlm
ZiAtLWdpdCBhL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9qaXQvSklUQ2FsbDMyXzY0LmNwcCBiL1Nv
dXJjZS9KYXZhU2NyaXB0Q29yZS9qaXQvSklUQ2FsbDMyXzY0LmNwcAppbmRleCBmNjc2MGE5Li45
ODljNGU4IDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvaml0L0pJVENhbGwzMl82
NC5jcHAKKysrIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL2ppdC9KSVRDYWxsMzJfNjQuY3BwCkBA
IC0yMTksOSArMjE5LDE3IEBAIHZvaWQgSklUOjpjb21waWxlTG9hZFZhcmFyZ3MoSW5zdHJ1Y3Rp
b24qIGluc3RydWN0aW9uKQogCiB2b2lkIEpJVDo6Y29tcGlsZUNhbGxFdmFsKEluc3RydWN0aW9u
KiBpbnN0cnVjdGlvbikKIHsKKyNpZiBOVU1CRVJfT0ZfQVJHVU1FTlRfUkVHSVNURVJTIDwgNAor
ICAgICAvLyBBZGQgc3RhY2sgc3BhY2UgZm9yIGFyZ3VtZW50cyBmb3IgYXJjaGl0ZWN0dXJlcyB0
aGF0IHBhc3MgbW9zdCAvIGFsbCBhcmdzIG9uIHRoZSBzdGFjaworICAgIGludDMyX3QgYWRkZWRT
dGFja1NwYWNlID0gKHNpemVvZihDYWxsZXJGcmFtZUFuZFBDKSArIHNpemVvZihHUFJSZWcpICog
MiArIHN0YWNrQWxpZ25tZW50Qnl0ZXMoKSAtIDEpICYgfihzdGFja0FsaWdubWVudEJ5dGVzKCkg
LSAxKTsKKyNlbHNlCisgICAgaW50MzJfdCBhZGRlZFN0YWNrU3BhY2UgPSBzaXplb2YoQ2FsbGVy
RnJhbWVBbmRQQyk7CisjZW5kaWYKKyAgICBzdG9yZTMyKGNhbGxGcmFtZVJlZ2lzdGVyLCBBZGRy
ZXNzKHN0YWNrUG9pbnRlclJlZ2lzdGVyLCAtc3RhdGljX2Nhc3Q8cHRyZGlmZl90PihzaXplb2Yo
Q2FsbGVyRnJhbWVBbmRQQykpKSk7CiAgICAgYWRkUHRyKFRydXN0ZWRJbW0zMigtc3RhdGljX2Nh
c3Q8cHRyZGlmZl90PihzaXplb2YoQ2FsbGVyRnJhbWVBbmRQQykpKSwgc3RhY2tQb2ludGVyUmVn
aXN0ZXIsIHJlZ1QxKTsKLQorICAgIGFkZFB0cihUcnVzdGVkSW1tMzIoLXN0YXRpY19jYXN0PHB0
cmRpZmZfdD4oYWRkZWRTdGFja1NwYWNlKSksIHN0YWNrUG9pbnRlclJlZ2lzdGVyKTsKICAgICBj
YWxsT3BlcmF0aW9uTm9FeGNlcHRpb25DaGVjayhvcGVyYXRpb25DYWxsRXZhbCwgcmVnVDEpOwor
ICAgIGFkZFB0cihUcnVzdGVkSW1tMzIoc3RhdGljX2Nhc3Q8cHRyZGlmZl90PihhZGRlZFN0YWNr
U3BhY2UpKSwgc3RhY2tQb2ludGVyUmVnaXN0ZXIpOwogCiAgICAgSnVtcCBub0V4Y2VwdGlvbiA9
IGVtaXRFeGNlcHRpb25DaGVjayhJbnZlcnRlZEV4Y2VwdGlvbkNoZWNrKTsKICAgICBhZGRQdHIo
VHJ1c3RlZEltbTMyKHN0YWNrUG9pbnRlck9mZnNldEZvcihtX2NvZGVCbG9jaykgKiBzaXplb2Yo
UmVnaXN0ZXIpKSwgY2FsbEZyYW1lUmVnaXN0ZXIsIHN0YWNrUG9pbnRlclJlZ2lzdGVyKTsKZGlm
ZiAtLWdpdCBhL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9qaXQvSklUT3BlcmF0aW9ucy5jcHAgYi9T
b3VyY2UvSmF2YVNjcmlwdENvcmUvaml0L0pJVE9wZXJhdGlvbnMuY3BwCmluZGV4IDhhY2VhODUu
LjQzNzk0NDUgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9qaXQvSklUT3BlcmF0
aW9ucy5jcHAKKysrIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL2ppdC9KSVRPcGVyYXRpb25zLmNw
cApAQCAtNjEyLDcgKzYxMiw2IEBAIEVuY29kZWRKU1ZhbHVlIEpJVF9PUEVSQVRJT04gb3BlcmF0
aW9uQ2FsbEV2YWwoRXhlY1N0YXRlKiBleGVjLCBFeGVjU3RhdGUqIGV4ZWNDCiAKICAgICBleGVj
Q2FsbGVlLT5zZXRTY29wZShleGVjLT5zY29wZSgpKTsKICAgICBleGVjQ2FsbGVlLT5zZXRDb2Rl
QmxvY2soMCk7Ci0gICAgZXhlY0NhbGxlZS0+c2V0Q2FsbGVyRnJhbWUoZXhlYyk7CiAKICAgICBp
ZiAoIWlzSG9zdEZ1bmN0aW9uKGV4ZWNDYWxsZWUtPmNhbGxlZUFzVmFsdWUoKSwgZ2xvYmFsRnVu
Y0V2YWwpKQogICAgICAgICByZXR1cm4gSlNWYWx1ZTo6ZW5jb2RlKEpTVmFsdWUoKSk7CmRpZmYg
LS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvbGxpbnQvTG93TGV2ZWxJbnRlcnByZXRlcjMy
XzY0LmFzbSBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9sbGludC9Mb3dMZXZlbEludGVycHJldGVy
MzJfNjQuYXNtCmluZGV4IGQyZDk0ZTkuLjAxZjg3MTYgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9KYXZh
U2NyaXB0Q29yZS9sbGludC9Mb3dMZXZlbEludGVycHJldGVyMzJfNjQuYXNtCisrKyBiL1NvdXJj
ZS9KYXZhU2NyaXB0Q29yZS9sbGludC9Mb3dMZXZlbEludGVycHJldGVyMzJfNjQuYXNtCkBAIC0z
NzIsMjQgKzM3MiwxOCBAQCBtYWNybyBtYWtlSG9zdEZ1bmN0aW9uQ2FsbChlbnRyeSwgdGVtcDEs
IHRlbXAyKQogICAgICAgICBtb3ZlIHNwLCBhMAogICAgICAgICBzdG9yZXAgbHIsIFB0clNpemVb
c3BdCiAgICAgICAgIGNsb29wQ2FsbE5hdGl2ZSB0ZW1wMQorICAgIGVsc2lmIFg4NiBvciBYODZf
V0lOCisgICAgICAgICMgUHV0IGNhbGxlZSBmcmFtZSBwb2ludGVyIG9uIHN0YWNrIGFzIGFyZzAs
IGFsc28gcHV0IGl0IGluIGVjeCBmb3IgImZhc3RjYWxsIiB0YXJnZXRzCisgICAgICAgIG1vdmUg
MCwgdGVtcDIKKyAgICAgICAgbW92ZSB0ZW1wMiwgNFtzcF0gIyBwdXQgMCBpbiBSZXR1cm5QQwor
ICAgICAgICBtb3ZlIHNwLCB0MiAjIHQyIGlzIGVjeAorICAgICAgICBwdXNoIHRlbXAyICMgUHVz
aCBkdW1teSBhcmcxCisgICAgICAgIHB1c2ggdDIKKyAgICAgICAgY2FsbCB0ZW1wMQorICAgICAg
ICBhZGRwIDgsIHNwCiAgICAgZWxzZQotICAgICAgICBpZiBYODYgb3IgWDg2X1dJTgotICAgICAg
ICAgICAgIyBQdXQgY2FsbGVlIGZyYW1lIHBvaW50ZXIgb24gc3RhY2sgYXMgYXJnMCwgYWxzbyBw
dXQgaXQgaW4gZWN4IGZvciAiZmFzdGNhbGwiIHRhcmdldHMKLSAgICAgICAgICAgIG1vdmUgMCwg
dGVtcDIKLSAgICAgICAgICAgIG1vdmUgdGVtcDIsIDRbc3BdICMgcHV0IDAgaW4gUmV0dXJuUEMK
LSAgICAgICAgICAgIG1vdmUgc3AsIHQyICMgdDIgaXMgZWN4Ci0gICAgICAgICAgICBwdXNoIHRl
bXAyICMgUHVzaCBkdW1teSBhcmcxCi0gICAgICAgICAgICBwdXNoIHQyCi0gICAgICAgIGVsc2UK
LSAgICAgICAgICAgIG1vdmUgc3AsIGEwCi0gICAgICAgICAgICBhZGRwIENhbGxlckZyYW1lQW5k
UENTaXplLCBzcAotICAgICAgICBlbmQKKyAgICAgICAgbW92ZSBzcCwgYTAKICAgICAgICAgY2Fs
bCB0ZW1wMQotICAgICAgICBpZiBYODYgb3IgWDg2X1dJTgotICAgICAgICAgICAgYWRkcCA4LCBz
cAotICAgICAgICBlbHNlCi0gICAgICAgICAgICBzdWJwIENhbGxlckZyYW1lQW5kUENTaXplLCBz
cAotICAgICAgICBlbmQKICAgICBlbmQKIGVuZAogCmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNj
cmlwdENvcmUvbGxpbnQvTG93TGV2ZWxJbnRlcnByZXRlcjY0LmFzbSBiL1NvdXJjZS9KYXZhU2Ny
aXB0Q29yZS9sbGludC9Mb3dMZXZlbEludGVycHJldGVyNjQuYXNtCmluZGV4IDliYTMwNTkuLmYw
YzAzNjQgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9sbGludC9Mb3dMZXZlbElu
dGVycHJldGVyNjQuYXNtCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9sbGludC9Mb3dMZXZl
bEludGVycHJldGVyNjQuYXNtCkBAIC0zMDQsNiArMzA0LDcgQEAgZW5kCiAKIG1hY3JvIG1ha2VI
b3N0RnVuY3Rpb25DYWxsKGVudHJ5LCB0ZW1wKQogICAgIG1vdmUgZW50cnksIHRlbXAKKyAgICBz
dG9yZXAgY2ZyLCBbc3BdCiAgICAgaWYgWDg2XzY0CiAgICAgICAgIG1vdmUgc3AsIHQ0CiAgICAg
ZWxzaWYgWDg2XzY0X1dJTgpAQCAtMzExLDcgKzMxMiw2IEBAIG1hY3JvIG1ha2VIb3N0RnVuY3Rp
b25DYWxsKGVudHJ5LCB0ZW1wKQogICAgIGVsc2lmIEFSTTY0IG9yIENfTE9PUAogICAgICAgICBt
b3ZlIHNwLCBhMAogICAgIGVuZAotICAgIHN0b3JlcCBjZnIsIFtzcF0KICAgICBpZiBDX0xPT1AK
ICAgICAgICAgc3RvcmVwIGxyLCA4W3NwXQogICAgICAgICBjbG9vcENhbGxOYXRpdmUgdGVtcApA
QCAtMzIxLDkgKzMyMSw3IEBAIG1hY3JvIG1ha2VIb3N0RnVuY3Rpb25DYWxsKGVudHJ5LCB0ZW1w
KQogICAgICAgICBjYWxsIHRlbXAKICAgICAgICAgYWRkcCAzMiwgc3AKICAgICBlbHNlCi0gICAg
ICAgIGFkZHAgMTYsIHNwCiAgICAgICAgIGNhbGwgdGVtcAotICAgICAgICBzdWJwIDE2LCBzcAog
ICAgIGVuZAogZW5kCiAK
</data>
<flag name="review"
          id="262288"
          type_id="1"
          status="-"
          setter="msaboff"
    />
          </attachment>
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>237654</attachid>
            <date>2014-09-04 16:03:59 -0700</date>
            <delta_ts>2014-09-04 17:57:37 -0700</delta_ts>
            <desc>Updated patch</desc>
            <filename>llint-v2.patch</filename>
            <type>text/plain</type>
            <size>3194</size>
            <attacher name="Akos Kiss">akiss</attacher>
            
              <data encoding="base64">ZGlmZiAtLWdpdCBhL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cgYi9Tb3VyY2UvSmF2
YVNjcmlwdENvcmUvQ2hhbmdlTG9nCmluZGV4IDVmZTQ5MzYuLmNkNmViNDIgMTAwNjQ0Ci0tLSBh
L1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKKysrIGIvU291cmNlL0phdmFTY3JpcHRD
b3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDIwIEBACisyMDE0LTA5LTA0ICBBa29zIEtpc3MgIDxh
a2lzc0BpbmYudS1zemVnZWQuaHU+CisKKyAgICAgICAgRW5zdXJlIHRoYXQgdGhlIGNhbGwgZnJh
bWUgc2V0IHVwIGJ5IHZtRW50cnlUb05hdGl2ZSBkb2VzIG5vdCBvdmVybGFwIHdpdGggdGhlIHN0
YWNrIG9mIHRoZSBjYWxsZWUKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19i
dWcuY2dpP2lkPTEzNjQ4NQorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgor
CisgICAgICAgIENoYW5nZWQgbWFrZUhvc3RGdW5jdGlvbkNhbGwgdG8ga2VlcCB0aGUgc3RhY2sg
cG9pbnRlciBhYm92ZSB0aGUgY2FsbAorICAgICAgICBmcmFtZSBzZXQgdXAgYnkgZG9WTUVudHJ5
LiBUaHVzIHRoZSBjYWxsZWUgd2lsbC9jYW4gbm90IG92ZXJyaWRlIHRoZSB0b3AKKyAgICAgICAg
b2YgdGhlIGNhbGwgZnJhbWUuCisKKyAgICAgICAgUmVmYWN0b3JlZCB0aGUgdHdvICgzMl82NCBh
bmQgNjQpIHZlcnNpb25zIG9mIG1ha2VIb3N0RnVuY3Rpb25DYWxsIHRvIGJlCisgICAgICAgIG1v
cmUgYWxpa2UgdG8gaGVscCBmdXR1cmUgbWFpbnRlbmFuY2UuCisKKyAgICAgICAgKiBsbGludC9M
b3dMZXZlbEludGVycHJldGVyMzJfNjQuYXNtOgorICAgICAgICAqIGxsaW50L0xvd0xldmVsSW50
ZXJwcmV0ZXI2NC5hc206CisKIDIwMTQtMDktMDIgIEJyaWFuIEouIEJ1cmcgIDxidXJnQGNzLndh
c2hpbmd0b24uZWR1PgogCiAgICAgICAgIExlZ2FjeVByb2ZpbGVyOiByZW1vdmUgcmVkdW5kYW50
IFByb2ZpbGVOb2RlIG1lbWJlcnMgYW5kIG90aGVyIGNsZWFudXAKZGlmZiAtLWdpdCBhL1NvdXJj
ZS9KYXZhU2NyaXB0Q29yZS9sbGludC9Mb3dMZXZlbEludGVycHJldGVyMzJfNjQuYXNtIGIvU291
cmNlL0phdmFTY3JpcHRDb3JlL2xsaW50L0xvd0xldmVsSW50ZXJwcmV0ZXIzMl82NC5hc20KaW5k
ZXggZDJkOTRlOS4uMDFmODcxNiAxMDA2NDQKLS0tIGEvU291cmNlL0phdmFTY3JpcHRDb3JlL2xs
aW50L0xvd0xldmVsSW50ZXJwcmV0ZXIzMl82NC5hc20KKysrIGIvU291cmNlL0phdmFTY3JpcHRD
b3JlL2xsaW50L0xvd0xldmVsSW50ZXJwcmV0ZXIzMl82NC5hc20KQEAgLTM3MiwyNCArMzcyLDE4
IEBAIG1hY3JvIG1ha2VIb3N0RnVuY3Rpb25DYWxsKGVudHJ5LCB0ZW1wMSwgdGVtcDIpCiAgICAg
ICAgIG1vdmUgc3AsIGEwCiAgICAgICAgIHN0b3JlcCBsciwgUHRyU2l6ZVtzcF0KICAgICAgICAg
Y2xvb3BDYWxsTmF0aXZlIHRlbXAxCisgICAgZWxzaWYgWDg2IG9yIFg4Nl9XSU4KKyAgICAgICAg
IyBQdXQgY2FsbGVlIGZyYW1lIHBvaW50ZXIgb24gc3RhY2sgYXMgYXJnMCwgYWxzbyBwdXQgaXQg
aW4gZWN4IGZvciAiZmFzdGNhbGwiIHRhcmdldHMKKyAgICAgICAgbW92ZSAwLCB0ZW1wMgorICAg
ICAgICBtb3ZlIHRlbXAyLCA0W3NwXSAjIHB1dCAwIGluIFJldHVyblBDCisgICAgICAgIG1vdmUg
c3AsIHQyICMgdDIgaXMgZWN4CisgICAgICAgIHB1c2ggdGVtcDIgIyBQdXNoIGR1bW15IGFyZzEK
KyAgICAgICAgcHVzaCB0MgorICAgICAgICBjYWxsIHRlbXAxCisgICAgICAgIGFkZHAgOCwgc3AK
ICAgICBlbHNlCi0gICAgICAgIGlmIFg4NiBvciBYODZfV0lOCi0gICAgICAgICAgICAjIFB1dCBj
YWxsZWUgZnJhbWUgcG9pbnRlciBvbiBzdGFjayBhcyBhcmcwLCBhbHNvIHB1dCBpdCBpbiBlY3gg
Zm9yICJmYXN0Y2FsbCIgdGFyZ2V0cwotICAgICAgICAgICAgbW92ZSAwLCB0ZW1wMgotICAgICAg
ICAgICAgbW92ZSB0ZW1wMiwgNFtzcF0gIyBwdXQgMCBpbiBSZXR1cm5QQwotICAgICAgICAgICAg
bW92ZSBzcCwgdDIgIyB0MiBpcyBlY3gKLSAgICAgICAgICAgIHB1c2ggdGVtcDIgIyBQdXNoIGR1
bW15IGFyZzEKLSAgICAgICAgICAgIHB1c2ggdDIKLSAgICAgICAgZWxzZQotICAgICAgICAgICAg
bW92ZSBzcCwgYTAKLSAgICAgICAgICAgIGFkZHAgQ2FsbGVyRnJhbWVBbmRQQ1NpemUsIHNwCi0g
ICAgICAgIGVuZAorICAgICAgICBtb3ZlIHNwLCBhMAogICAgICAgICBjYWxsIHRlbXAxCi0gICAg
ICAgIGlmIFg4NiBvciBYODZfV0lOCi0gICAgICAgICAgICBhZGRwIDgsIHNwCi0gICAgICAgIGVs
c2UKLSAgICAgICAgICAgIHN1YnAgQ2FsbGVyRnJhbWVBbmRQQ1NpemUsIHNwCi0gICAgICAgIGVu
ZAogICAgIGVuZAogZW5kCiAKZGlmZiAtLWdpdCBhL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9sbGlu
dC9Mb3dMZXZlbEludGVycHJldGVyNjQuYXNtIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL2xsaW50
L0xvd0xldmVsSW50ZXJwcmV0ZXI2NC5hc20KaW5kZXggOWJhMzA1OS4uZjBjMDM2NCAxMDA2NDQK
LS0tIGEvU291cmNlL0phdmFTY3JpcHRDb3JlL2xsaW50L0xvd0xldmVsSW50ZXJwcmV0ZXI2NC5h
c20KKysrIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL2xsaW50L0xvd0xldmVsSW50ZXJwcmV0ZXI2
NC5hc20KQEAgLTMwNCw2ICszMDQsNyBAQCBlbmQKIAogbWFjcm8gbWFrZUhvc3RGdW5jdGlvbkNh
bGwoZW50cnksIHRlbXApCiAgICAgbW92ZSBlbnRyeSwgdGVtcAorICAgIHN0b3JlcCBjZnIsIFtz
cF0KICAgICBpZiBYODZfNjQKICAgICAgICAgbW92ZSBzcCwgdDQKICAgICBlbHNpZiBYODZfNjRf
V0lOCkBAIC0zMTEsNyArMzEyLDYgQEAgbWFjcm8gbWFrZUhvc3RGdW5jdGlvbkNhbGwoZW50cnks
IHRlbXApCiAgICAgZWxzaWYgQVJNNjQgb3IgQ19MT09QCiAgICAgICAgIG1vdmUgc3AsIGEwCiAg
ICAgZW5kCi0gICAgc3RvcmVwIGNmciwgW3NwXQogICAgIGlmIENfTE9PUAogICAgICAgICBzdG9y
ZXAgbHIsIDhbc3BdCiAgICAgICAgIGNsb29wQ2FsbE5hdGl2ZSB0ZW1wCkBAIC0zMjEsOSArMzIx
LDcgQEAgbWFjcm8gbWFrZUhvc3RGdW5jdGlvbkNhbGwoZW50cnksIHRlbXApCiAgICAgICAgIGNh
bGwgdGVtcAogICAgICAgICBhZGRwIDMyLCBzcAogICAgIGVsc2UKLSAgICAgICAgYWRkcCAxNiwg
c3AKICAgICAgICAgY2FsbCB0ZW1wCi0gICAgICAgIHN1YnAgMTYsIHNwCiAgICAgZW5kCiBlbmQK
IAo=
</data>

          </attachment>
      

    </bug>

</bugzilla>