137814 2014-10-17 02:16:25 -0700 crash when attempting to perform array iteration on a non-array with numeric keys not initialized 2014-10-27 22:48:47 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) Mac (Intel) OS X 10.9 RESOLVED FIXED InRadar P2 Major --- 1 claude.pache mark.lam commit-queue ggaren mark.lam oliver webkit-bug-importer oldest_to_newest 1042333 0 claude.pache 2014-10-17 02:16:25 -0700 The following JS code will crash WebKit. var b = Object.create(Array.iterator) for (var x of b) { console.log(x) } // boom The crash does not occur (and standard Array iteration is triggered) when some numeric key of the iterated object was initialized. var b = Object.create(Array.iterator) b[3] = 42 for (var x of b) { console.log(x) } // no crash 1042334 1 claude.pache 2014-10-17 02:18:17 -0700 (In reply to comment #0) > var b = Object.create(Array.iterator) Replace with: var b = Object.create(Array.prototype) 1042664 2 ap 2014-10-18 23:18:19 -0700 rdar://problem/17538114 1042665 3 240083 ap 2014-10-18 23:18:57 -0700 Created attachment 240083 test case (will crash on load) Same test as attachment, ready to run. 1043018 4 mark.lam 2014-10-20 17:16:32 -0700 Here's what I know so far: 1. The crash occurs in Specialized thunk code for array-iterator-next-value generated by arrayIteratorNextThunkGenerator(). 2. No DFG JIT is needed. But JIT'ting in general do need to be enabled because we need to generate the thunks. 3. It crashed because it's an expecting a non-zero butterfly pointer in the array object, but this is not true i.e. we've got NULL. 4. The classInfo of object being operated on (whose butterfly pointer is NULL) says that it is an ArrayIterator: (lldb) p *((JSObject*)$rdi)->structure()->classInfo() (const JSC::ClassInfo) $12 = { className = 0x0000000100a5ed86 "ArrayIterator" ... 5. The crashed code is executed because the object's iterationKind() is ArrayIterateValue. (lldb) p ((JSArrayIterator*)$rdi)->iterationKind() (JSC::ArrayIterationKind) $15 = ArrayIterateValue 6. The iterationKind we are generating the thunk of is ArrayIterateValue. 1043285 5 ggaren 2014-10-21 14:51:24 -0700 I suspect the problem here is that we just neglected to consider the case where an ArrayIterator is used to iterate a non-Array. One thing that can happen in that case is that the butterfly pointer can be NULL. 1043307 6 mark.lam 2014-10-21 16:53:09 -0700 More details: 7. If JSC_useJIT=false, we'll create an iterator JSFunction that points to JSArrayIterator's arrayIteratorNextValue() C++ function. If JSC_useJIT=true, we'll create an iterator JSFunction that uses the ArrayIteratorNextValueIntrinsic intrinsic thunk. The arrayIteratorNextValue() C++ function will first check to ensure the this object is a JSArrayIterator. The next step is to get the length property of the object. This ultimately results in a call to JSArray::getOwnPropertySlot() which special cases property "length" and sets the property to the return value of JSArray::length(). JSArray::length() calls JSObject::getArrayLength(). JSObject::getArrayLength() discovers that the object does not have any indexed properties yet, and returns a value of 0. In contrast, the ArrayIteratorNextValueIntrinsic thunk also checks if the object is a JSArrayIterator. Thereafter, it assumes that the iterated object has indexed properties and proceeds to grab the length from its butterfly. Since, the butterfly for an Object with no properties is 0, we crash. After I added a NULL check on the butterfly (and have the thunk take the slow path if the butterfly is NULL), the test case no longer crash. However, I need to parse the butterfly code some more to get a more comprehensive understanding of how the butterfly is shaped for JSObjects, JSArrays, and typed JSArrays. The NULL check I added averted the immediate crash, but the thunk is also making assumptions about the shape of the butterfly. I'll need to verify that those assumptions hold before I can conclude that this fix is appropriate. 1043533 7 mark.lam 2014-10-22 13:12:13 -0700 (In reply to comment #6) > 7. If JSC_useJIT=false, we'll create an iterator JSFunction that points to > JSArrayIterator's arrayIteratorNextValue() C++ function. > ... > The arrayIteratorNextValue() C++ function will first check to ensure the > this object is a JSArrayIterator. > The next step is to get the length property of the object. > ... > JSObject::getArrayLength() discovers that the object does not have any > indexed properties yet, and returns a value of 0. Correction: JSObject::getPropertySlot() fails to find the “length” property in the Object, and looks up the prototype chain. The next object in the chain is the ArrayPrototype. JSArray::length() is run on the ArrayPrototype, and returns 0. JSArray::getOwnPropertySlot() also ends up setting the 0 “length” property on the ArrayPrototype, not the Object we’re testing. 1044364 8 240513 mark.lam 2014-10-27 17:24:24 -0700 Created attachment 240513 the patch. 1044415 9 240513 ggaren 2014-10-27 22:25:35 -0700 Comment on attachment 240513 the patch. View in context: https://bugs.webkit.org/attachment.cgi?id=240513&action=review r=me > Source/JavaScriptCore/ChangeLog:12 > + may have been set on the iterated object. The thunk only check's the butterfly's check's => checks > Source/JavaScriptCore/jit/ThunkGenerators.cpp:1103 > + Jump nullButterfly = jit.branchPtr(SpecializedThunkJIT::Equal, SpecializedThunkJIT::regT2, TrustedImmPtr(0)); It's better to use branchTestPtr. Some of our assemblers will automatically optimize this to a test, and some won't. 1044417 10 240513 mark.lam 2014-10-27 22:27:18 -0700 Comment on attachment 240513 the patch. Cancelling commit. Will apply feedback and commit manually. 1044427 11 mark.lam 2014-10-27 22:48:24 -0700 Thanks for the review. Feedback has been applied, and the fix has ben landed in r175243: <http://trac.webkit.org/r175243>. 240083 2014-10-18 23:18:57 -0700 2014-10-18 23:18:57 -0700 test case (will crash on load) array.html text/html 110 ap PHNjcmlwdD4KICAgIHZhciBiID0gT2JqZWN0LmNyZWF0ZShBcnJheS5wcm90b3R5cGUpCiAgICBm b3IgKHZhciB4IG9mIGIpIHsgY29uc29sZS5sb2coeCkgfSAvLyBib29tCjwvc2NyaXB0Pgo= 240513 2014-10-27 17:24:24 -0700 2014-10-27 22:48:47 -0700 the patch. bug-137814.patch text/plain 12917 mark.lam SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTc1MjM0KQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDI0IEBA CisyMDE0LTEwLTI3ICBNYXJrIExhbSAgPG1hcmsubGFtQGFwcGxlLmNvbT4KKworICAgICAgICBD cmFzaCB3aGVuIGF0dGVtcHRpbmcgdG8gcGVyZm9ybSBhcnJheSBpdGVyYXRpb24gb24gYSBub24t YXJyYXkgd2l0aCBudW1lcmljIGtleXMgbm90IGluaXRpYWxpemVkLgorICAgICAgICA8aHR0cHM6 Ly93ZWJraXQub3JnL2IvMTM3ODE0PgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09Q UyEpLgorCisgICAgICAgIFRoZSBhcnJheUl0ZXJhdG9yTmV4dFRodW5rR2VuZXJhdG9yKCkgdGh1 bmsgd2FzIG5vdCBjaGVja2luZyBmb3IgdGhlIGNhc2Ugd2hlcmUKKyAgICAgICAgdGhlIGJ1dHRl cmZseSBtYXkgYmUgTlVMTC4gIFRoaXMgd2FzIHRoZSBzb3VyY2Ugb2YgdGhlIGNyYXNoLCBhbmQg aXMgbm93IGZpeGVkLgorCisgICAgICAgIEluIGFkZGl0aW9uLCBpdCBpcyBhbHNvIG5vdCBjaGVj a2luZyBmb3IgdGhlIGNhc2Ugd2hlcmUgYSBwcm9wZXJ0eSBuYW1lZCAibGVuZ3RoIgorICAgICAg ICBtYXkgaGF2ZSBiZWVuIHNldCBvbiB0aGUgaXRlcmF0ZWQgb2JqZWN0LiAgVGhlIHRodW5rIG9u bHkgY2hlY2sncyB0aGUgYnV0dGVyZmx5J3MKKyAgICAgICAgcHVibGljTGVuZ3RoIGZvciBpdHMg aXRlcmF0aW9uIG9wZXJhdGlvbi4gIEFycmF5IG9iamVjdHMgd2lsbCB3b3JrIGZpbmUgd2l0aCB0 aGlzCisgICAgICAgIGJlY2F1c2UgaXQgYWx3YXlzIHVwZGF0ZXMgaXRzIGJ1dHRlcmZseSdzIHB1 YmxpY0xlbmd0aCB3aGVuIGl0cyBsZW5ndGggY2hhbmdlcy4KKyAgICAgICAgSW4gdGhlIGNhc2Ug b2YgaXRlcmFibGUgbm9uLUFycmF5IG9iamVjdHMsIHRoZSAibGVuZ3RoIiBwcm9wZXJ0eSB3aWxs IHJlcXVpcmUgYQorICAgICAgICBsb29rIHVwIG91dHNpZGUgb2YgdGhlIHNjb3BlIG9mIHRoaXMg dGh1bmsuICBUaGUgZml4IGlzIHNpbXBseSB0byBsaW1pdCB0aGUgZmFzdAorICAgICAgICBjYXNl IGNoZWNrcyBpbiB0aGlzIHRodW5rIHRvIEFycmF5IG9iamVjdHMuCisKKyAgICAgICAgKiBqaXQv VGh1bmtHZW5lcmF0b3JzLmNwcDoKKyAgICAgICAgKEpTQzo6YXJyYXlJdGVyYXRvck5leHRUaHVu a0dlbmVyYXRvcik6CisKIDIwMTQtMTAtMjUgIEJyaWFuIEouIEJ1cmcgIDxidXJnQGNzLndhc2hp bmd0b24uZWR1PgogCiAgICAgICAgIFdlYiBJbnNwZWN0b3I6IHRpbWVsaW5lcyBzaG91bGQgbm90 IGNvdW50IHRpbWUgZWxhcHNlZCB3aGlsZSBwYXVzZWQgaW4gdGhlIGRlYnVnZ2VyCkluZGV4OiBT b3VyY2UvSmF2YVNjcmlwdENvcmUvaml0L1RodW5rR2VuZXJhdG9ycy5jcHAKPT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQot LS0gU291cmNlL0phdmFTY3JpcHRDb3JlL2ppdC9UaHVua0dlbmVyYXRvcnMuY3BwCShyZXZpc2lv biAxNzUyMzApCisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvaml0L1RodW5rR2VuZXJhdG9ycy5j cHAJKHdvcmtpbmcgY29weSkKQEAgLTExMDAsMTAgKzExMDAsMTIgQEAgc3RhdGljIE1hY3JvQXNz ZW1ibGVyQ29kZVJlZiBhcnJheUl0ZXJhdAogICAgIC8vIFB1bGwgb3V0IHRoZSBidXR0ZXJmbHkg ZnJvbSBpdGVyYXRlZE9iamVjdAogICAgIGppdC5sb2FkOChBZGRyZXNzKFNwZWNpYWxpemVkVGh1 bmtKSVQ6OnJlZ1QwLCBKU0NlbGw6OmluZGV4aW5nVHlwZU9mZnNldCgpKSwgU3BlY2lhbGl6ZWRU aHVua0pJVDo6cmVnVDMpOwogICAgIGppdC5sb2FkUHRyKEFkZHJlc3MoU3BlY2lhbGl6ZWRUaHVu a0pJVDo6cmVnVDAsIEpTT2JqZWN0OjpidXR0ZXJmbHlPZmZzZXQoKSksIFNwZWNpYWxpemVkVGh1 bmtKSVQ6OnJlZ1QyKTsKKyAgICBKdW1wIG51bGxCdXR0ZXJmbHkgPSBqaXQuYnJhbmNoUHRyKFNw ZWNpYWxpemVkVGh1bmtKSVQ6OkVxdWFsLCBTcGVjaWFsaXplZFRodW5rSklUOjpyZWdUMiwgVHJ1 c3RlZEltbVB0cigwKSk7CiAgICAgCi0gICAgaml0LmFuZDMyKFRydXN0ZWRJbW0zMihJbmRleGlu Z1NoYXBlTWFzayksIFNwZWNpYWxpemVkVGh1bmtKSVQ6OnJlZ1QzKTsKLQogICAgIEp1bXAgbm90 RG9uZSA9IGppdC5icmFuY2gzMihTcGVjaWFsaXplZFRodW5rSklUOjpCZWxvdywgU3BlY2lhbGl6 ZWRUaHVua0pJVDo6cmVnVDEsIEFkZHJlc3MoU3BlY2lhbGl6ZWRUaHVua0pJVDo6cmVnVDIsIEJ1 dHRlcmZseTo6b2Zmc2V0T2ZQdWJsaWNMZW5ndGgoKSkpOworCisgICAgbnVsbEJ1dHRlcmZseS5s aW5rKCZqaXQpOworCiAgICAgLy8gUmV0dXJuIHRoZSB0ZXJtaW5hdGlvbiBzaWduYWwgdG8gaW5k aWNhdGUgdGhhdCB3ZSd2ZSBmaW5pc2hlZAogICAgIGppdC5tb3ZlKFRydXN0ZWRJbW1QdHIodm0t Pml0ZXJhdGlvblRlcm1pbmF0b3IuZ2V0KCkpLCBTcGVjaWFsaXplZFRodW5rSklUOjpyZWdUMCk7 CiAgICAgaml0LnJldHVybkpTQ2VsbChTcGVjaWFsaXplZFRodW5rSklUOjpyZWdUMCk7CkBAIC0x MTIyLDggKzExMjQsOCBAQCBzdGF0aWMgTWFjcm9Bc3NlbWJsZXJDb2RlUmVmIGFycmF5SXRlcmF0 CiAgICAgaml0LmFwcGVuZEZhaWx1cmUoaml0LmJyYW5jaDMyKFNwZWNpYWxpemVkVGh1bmtKSVQ6 OkFib3ZlT3JFcXVhbCwgU3BlY2lhbGl6ZWRUaHVua0pJVDo6cmVnVDEsIEFkZHJlc3MoU3BlY2lh bGl6ZWRUaHVua0pJVDo6cmVnVDIsIEJ1dHRlcmZseTo6b2Zmc2V0T2ZWZWN0b3JMZW5ndGgoKSkp KTsKICAgICAKICAgICAvLyBTbyBub3cgd2UgcGVyZm9ybSBpbmxpbmUgbG9hZHMgZm9yIGludDMy LCB2YWx1ZS91bmRlY2lkZWQsIGFuZCBkb3VibGUgc3RvcmFnZQotICAgIEp1bXAgdW5kZWNpZGVk U3RvcmFnZSA9IGppdC5icmFuY2gzMihTcGVjaWFsaXplZFRodW5rSklUOjpFcXVhbCwgU3BlY2lh bGl6ZWRUaHVua0pJVDo6cmVnVDMsIFRydXN0ZWRJbW0zMihVbmRlY2lkZWRTaGFwZSkpOwotICAg IEp1bXAgbm90Q29udGlndW91c1N0b3JhZ2UgPSBqaXQuYnJhbmNoMzIoU3BlY2lhbGl6ZWRUaHVu a0pJVDo6Tm90RXF1YWwsIFNwZWNpYWxpemVkVGh1bmtKSVQ6OnJlZ1QzLCBUcnVzdGVkSW1tMzIo Q29udGlndW91c1NoYXBlKSk7CisgICAgSnVtcCB1bmRlY2lkZWRTdG9yYWdlID0gaml0LmJyYW5j aDMyKFNwZWNpYWxpemVkVGh1bmtKSVQ6OkVxdWFsLCBTcGVjaWFsaXplZFRodW5rSklUOjpyZWdU MywgVHJ1c3RlZEltbTMyKEFycmF5V2l0aFVuZGVjaWRlZCkpOworICAgIEp1bXAgbm90Q29udGln dW91c1N0b3JhZ2UgPSBqaXQuYnJhbmNoMzIoU3BlY2lhbGl6ZWRUaHVua0pJVDo6Tm90RXF1YWws IFNwZWNpYWxpemVkVGh1bmtKSVQ6OnJlZ1QzLCBUcnVzdGVkSW1tMzIoQXJyYXlXaXRoQ29udGln dW91cykpOwogICAgIAogICAgIHVuZGVjaWRlZFN0b3JhZ2UubGluaygmaml0KTsKICAgICAKQEAg LTExNTEsMTQgKzExNTMsMTQgQEAgc3RhdGljIE1hY3JvQXNzZW1ibGVyQ29kZVJlZiBhcnJheUl0 ZXJhdAogI2VuZGlmCiAgICAgbm90Q29udGlndW91c1N0b3JhZ2UubGluaygmaml0KTsKICAgICAK LSAgICBKdW1wIG5vdEludDMyU3RvcmFnZSA9IGppdC5icmFuY2gzMihTcGVjaWFsaXplZFRodW5r SklUOjpOb3RFcXVhbCwgU3BlY2lhbGl6ZWRUaHVua0pJVDo6cmVnVDMsIFRydXN0ZWRJbW0zMihJ bnQzMlNoYXBlKSk7CisgICAgSnVtcCBub3RJbnQzMlN0b3JhZ2UgPSBqaXQuYnJhbmNoMzIoU3Bl Y2lhbGl6ZWRUaHVua0pJVDo6Tm90RXF1YWwsIFNwZWNpYWxpemVkVGh1bmtKSVQ6OnJlZ1QzLCBU cnVzdGVkSW1tMzIoQXJyYXlXaXRoSW50MzIpKTsKICAgICBqaXQubG9hZFB0cihBZGRyZXNzKFNw ZWNpYWxpemVkVGh1bmtKSVQ6OnJlZ1QwLCBKU09iamVjdDo6YnV0dGVyZmx5T2Zmc2V0KCkpLCBT cGVjaWFsaXplZFRodW5rSklUOjpyZWdUMik7CiAgICAgaml0LmxvYWQzMihCYXNlSW5kZXgoU3Bl Y2lhbGl6ZWRUaHVua0pJVDo6cmVnVDIsIFNwZWNpYWxpemVkVGh1bmtKSVQ6OnJlZ1QxLCBTcGVj aWFsaXplZFRodW5rSklUOjpUaW1lc0VpZ2h0LCBKU1ZhbHVlOjpvZmZzZXRPZlBheWxvYWQoKSks IFNwZWNpYWxpemVkVGh1bmtKSVQ6OnJlZ1QwKTsKICAgICBqaXQuYWRkMzIoVHJ1c3RlZEltbTMy KDEpLCBBZGRyZXNzKFNwZWNpYWxpemVkVGh1bmtKSVQ6OnJlZ1Q0LCBKU0FycmF5SXRlcmF0b3I6 Om9mZnNldE9mTmV4dEluZGV4KCkpKTsKICAgICBqaXQucmV0dXJuSW50MzIoU3BlY2lhbGl6ZWRU aHVua0pJVDo6cmVnVDApOwogICAgIG5vdEludDMyU3RvcmFnZS5saW5rKCZqaXQpOwogICAgIAot ICAgIGppdC5hcHBlbmRGYWlsdXJlKGppdC5icmFuY2gzMihTcGVjaWFsaXplZFRodW5rSklUOjpO b3RFcXVhbCwgU3BlY2lhbGl6ZWRUaHVua0pJVDo6cmVnVDMsIFRydXN0ZWRJbW0zMihEb3VibGVT aGFwZSkpKTsKKyAgICBqaXQuYXBwZW5kRmFpbHVyZShqaXQuYnJhbmNoMzIoU3BlY2lhbGl6ZWRU aHVua0pJVDo6Tm90RXF1YWwsIFNwZWNpYWxpemVkVGh1bmtKSVQ6OnJlZ1QzLCBUcnVzdGVkSW1t MzIoQXJyYXlXaXRoRG91YmxlKSkpOwogICAgIGppdC5sb2FkUHRyKEFkZHJlc3MoU3BlY2lhbGl6 ZWRUaHVua0pJVDo6cmVnVDAsIEpTT2JqZWN0OjpidXR0ZXJmbHlPZmZzZXQoKSksIFNwZWNpYWxp emVkVGh1bmtKSVQ6OnJlZ1QyKTsKICAgICBqaXQubG9hZERvdWJsZShCYXNlSW5kZXgoU3BlY2lh bGl6ZWRUaHVua0pJVDo6cmVnVDIsIFNwZWNpYWxpemVkVGh1bmtKSVQ6OnJlZ1QxLCBTcGVjaWFs aXplZFRodW5rSklUOjpUaW1lc0VpZ2h0KSwgU3BlY2lhbGl6ZWRUaHVua0pJVDo6ZnBSZWdUMCk7 CiAgICAgaml0LmFkZDMyKFRydXN0ZWRJbW0zMigxKSwgQWRkcmVzcyhTcGVjaWFsaXplZFRodW5r SklUOjpyZWdUNCwgSlNBcnJheUl0ZXJhdG9yOjpvZmZzZXRPZk5leHRJbmRleCgpKSk7CkluZGV4 OiBMYXlvdXRUZXN0cy9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvQ2hhbmdl TG9nCShyZXZpc2lvbiAxNzUyMzQpCisrKyBMYXlvdXRUZXN0cy9DaGFuZ2VMb2cJKHdvcmtpbmcg Y29weSkKQEAgLTEsMyArMSwzMSBAQAorMjAxNC0xMC0yNyAgTWFyayBMYW0gIDxtYXJrLmxhbUBh cHBsZS5jb20+CisKKyAgICAgICAgQ3Jhc2ggd2hlbiBhdHRlbXB0aW5nIHRvIHBlcmZvcm0gYXJy YXkgaXRlcmF0aW9uIG9uIGEgbm9uLWFycmF5IHdpdGggbnVtZXJpYyBrZXlzIG5vdCBpbml0aWFs aXplZC4KKyAgICAgICAgPGh0dHBzOi8vd2Via2l0Lm9yZy9iLzEzNzgxND4KKworICAgICAgICBS ZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICAqIGpzL2FycmF5LWxlbmd0aC1z aG9ydGVuaW5nLWV4cGVjdGVkLnR4dDogQWRkZWQuCisgICAgICAgICoganMvYXJyYXktbGVuZ3Ro LXNob3J0ZW5pbmcuaHRtbDogQWRkZWQuCisgICAgICAgICoganMvZm9yLW9mLWNyYXNoLWV4cGVj dGVkLnR4dDogQWRkZWQuCisgICAgICAgICoganMvZm9yLW9mLWNyYXNoLmh0bWw6IEFkZGVkLgor ICAgICAgICAqIGpzL3NjcmlwdC10ZXN0cy9hcnJheS1sZW5ndGgtc2hvcnRlbmluZy5qczogQWRk ZWQuCisgICAgICAgICh0ZXN0TGVuZ3RoU2hvcnRlbmluZyk6CisgICAgICAgIChkZW5zZUludDMy RWxlbWVudHMpOgorICAgICAgICAoZGVuc2VEb3VibGVFbGVtZW50cyk6CisgICAgICAgIChkZW5z ZU9iamVjdEVsZW1lbnRzKToKKyAgICAgICAgKGhvbGV5SW50MzJFbGVtZW50cyk6CisgICAgICAg IChob2xleURvdWJsZUVsZW1lbnRzKToKKyAgICAgICAgKGhvbGV5T2JqZWN0RWxlbWVudHMpOgor ICAgICAgICAoYXJyYXlTdG9yYWdlSW50MzJFbGVtZW50cyk6CisgICAgICAgIChhcnJheVN0b3Jh Z2VEb3VibGVFbGVtZW50cyk6CisgICAgICAgIChhcnJheVN0b3JhZ2VPYmplY3RFbGVtZW50cyk6 CisgICAgICAgIChzcGFyc2VJbnQzMkVsZW1lbnRzKToKKyAgICAgICAgKHNwYXJzZURvdWJsZUVs ZW1lbnRzKToKKyAgICAgICAgKHNwYXJzZU9iamVjdEVsZW1lbnRzKToKKyAgICAgICAgKiBqcy9z Y3JpcHQtdGVzdHMvZm9yLW9mLWNyYXNoLmpzOiBBZGRlZC4KKyAgICAgICAgKGZvbyk6CisKIDIw MTQtMTAtMjcgIEFsZXhleSBQcm9za3VyeWFrb3YgIDxhcEBhcHBsZS5jb20+CiAKICAgICAgICAg aHR0cC90ZXN0cy9jb29raWVzL3RoaXJkLXBhcnR5LWNvb2tpZS1yZWxheGluZy5odG1sIGlzIGZs YWt5IG9uIGJvdHMKSW5kZXg6IExheW91dFRlc3RzL2pzL2FycmF5LWxlbmd0aC1zaG9ydGVuaW5n LWV4cGVjdGVkLnR4dAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9qcy9hcnJheS1sZW5ndGgt c2hvcnRlbmluZy1leHBlY3RlZC50eHQJKHJldmlzaW9uIDApCisrKyBMYXlvdXRUZXN0cy9qcy9h cnJheS1sZW5ndGgtc2hvcnRlbmluZy1leHBlY3RlZC50eHQJKHdvcmtpbmcgY29weSkKQEAgLTAs MCArMSwzMyBAQAorVGVzdHMgYXJyYXkgbGVuZ3RoIHNob3J0ZW5pbmcuCisKK09uIHN1Y2Nlc3Ms IHlvdSB3aWxsIHNlZSBhIHNlcmllcyBvZiAiUEFTUyIgbWVzc2FnZXMsIGZvbGxvd2VkIGJ5ICJU RVNUIENPTVBMRVRFIi4KKworCitQQVNTIGNvdW50IGlzIDEKK1BBU1MgY291bnQgaXMgMQorUEFT UyBjb3VudCBpcyAxCitQQVNTIGNvdW50IGlzIDEKK1BBU1MgY291bnQgaXMgMQorUEFTUyBjb3Vu dCBpcyAxCitQQVNTIGNvdW50IGlzIDEKK1BBU1MgY291bnQgaXMgMQorUEFTUyBjb3VudCBpcyAx CitQQVNTIGNvdW50IGlzIDEKK1BBU1MgY291bnQgaXMgMQorUEFTUyBjb3VudCBpcyAxCitQQVNT IGNvdW50IGlzIDEKK1BBU1MgY291bnQgaXMgMQorUEFTUyBjb3VudCBpcyAxCitQQVNTIGNvdW50 IGlzIDEKK1BBU1MgY291bnQgaXMgMQorUEFTUyBjb3VudCBpcyAxCitQQVNTIGNvdW50IGlzIDEK K1BBU1MgY291bnQgaXMgMQorUEFTUyBjb3VudCBpcyAxCitQQVNTIGNvdW50IGlzIDEKK1BBU1Mg Y291bnQgaXMgMQorUEFTUyBjb3VudCBpcyAxCitQQVNTIHN1Y2Nlc3NmdWxseVBhcnNlZCBpcyB0 cnVlCisKK1RFU1QgQ09NUExFVEUKKwpJbmRleDogTGF5b3V0VGVzdHMvanMvYXJyYXktbGVuZ3Ro LXNob3J0ZW5pbmcuaHRtbAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9qcy9hcnJheS1sZW5n dGgtc2hvcnRlbmluZy5odG1sCShyZXZpc2lvbiAwKQorKysgTGF5b3V0VGVzdHMvanMvYXJyYXkt bGVuZ3RoLXNob3J0ZW5pbmcuaHRtbAkod29ya2luZyBjb3B5KQpAQCAtMCwwICsxLDEwIEBACis8 IURPQ1RZUEUgSFRNTCBQVUJMSUMgIi0vL0lFVEYvL0RURCBIVE1MLy9FTiI+Cis8aHRtbD4KKzxo ZWFkPgorPHNjcmlwdCBzcmM9Ii4uL3Jlc291cmNlcy9qcy10ZXN0LXByZS5qcyI+PC9zY3JpcHQ+ Cis8L2hlYWQ+Cis8Ym9keT4KKzxzY3JpcHQgc3JjPSJzY3JpcHQtdGVzdHMvYXJyYXktbGVuZ3Ro LXNob3J0ZW5pbmcuanMiPjwvc2NyaXB0PgorPHNjcmlwdCBzcmM9Ii4uL3Jlc291cmNlcy9qcy10 ZXN0LXBvc3QuanMiPjwvc2NyaXB0PgorPC9ib2R5PgorPC9odG1sPgpJbmRleDogTGF5b3V0VGVz dHMvanMvZm9yLW9mLWNyYXNoLWV4cGVjdGVkLnR4dAo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0 cy9qcy9mb3Itb2YtY3Jhc2gtZXhwZWN0ZWQudHh0CShyZXZpc2lvbiAwKQorKysgTGF5b3V0VGVz dHMvanMvZm9yLW9mLWNyYXNoLWV4cGVjdGVkLnR4dAkod29ya2luZyBjb3B5KQpAQCAtMCwwICsx LDkgQEAKK1Rlc3RzIHRoYXQgZm9yLW9mIGl0ZXJhdGlvbiBkb2VzIG5vdCBjcmFzaGVzLgorCitP biBzdWNjZXNzLCB5b3Ugd2lsbCBzZWUgYSBzZXJpZXMgb2YgIlBBU1MiIG1lc3NhZ2VzLCBmb2xs b3dlZCBieSAiVEVTVCBDT01QTEVURSIuCisKKworUEFTUyBzdWNjZXNzZnVsbHlQYXJzZWQgaXMg dHJ1ZQorCitURVNUIENPTVBMRVRFCisKSW5kZXg6IExheW91dFRlc3RzL2pzL2Zvci1vZi1jcmFz aC5odG1sCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT0KLS0tIExheW91dFRlc3RzL2pzL2Zvci1vZi1jcmFzaC5odG1sCShy ZXZpc2lvbiAwKQorKysgTGF5b3V0VGVzdHMvanMvZm9yLW9mLWNyYXNoLmh0bWwJKHdvcmtpbmcg Y29weSkKQEAgLTAsMCArMSwxMCBAQAorPCFET0NUWVBFIEhUTUwgUFVCTElDICItLy9JRVRGLy9E VEQgSFRNTC8vRU4iPgorPGh0bWw+Cis8aGVhZD4KKzxzY3JpcHQgc3JjPSIuLi9yZXNvdXJjZXMv anMtdGVzdC1wcmUuanMiPjwvc2NyaXB0PgorPC9oZWFkPgorPGJvZHk+Cis8c2NyaXB0IHNyYz0i c2NyaXB0LXRlc3RzL2Zvci1vZi1jcmFzaC5qcyI+PC9zY3JpcHQ+Cis8c2NyaXB0IHNyYz0iLi4v cmVzb3VyY2VzL2pzLXRlc3QtcG9zdC5qcyI+PC9zY3JpcHQ+Cis8L2JvZHk+Cis8L2h0bWw+Cklu ZGV4OiBMYXlvdXRUZXN0cy9qcy9zY3JpcHQtdGVzdHMvYXJyYXktbGVuZ3RoLXNob3J0ZW5pbmcu anMKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvanMvc2NyaXB0LXRlc3RzL2FycmF5LWxlbmd0 aC1zaG9ydGVuaW5nLmpzCShyZXZpc2lvbiAwKQorKysgTGF5b3V0VGVzdHMvanMvc2NyaXB0LXRl c3RzL2FycmF5LWxlbmd0aC1zaG9ydGVuaW5nLmpzCSh3b3JraW5nIGNvcHkpCkBAIC0wLDAgKzEs MTI2IEBACitkZXNjcmlwdGlvbigKKyJUZXN0cyBhcnJheSBsZW5ndGggc2hvcnRlbmluZy4iCisp OworCit2YXIgY291bnQ7CisKK2Z1bmN0aW9uIHRlc3RMZW5ndGhTaG9ydGVuaW5nKGFycmF5KSB7 CisgICAgYXJyYXkubGVuZ3RoID0gMTsKKyAgICBjb3VudCA9IDA7CisgICAgZm9yICh2YXIgeCBv ZiBhcnJheSkgeworICAgICAgICBjb3VudCsrOworICAgIH0KKworICAgIHNob3VsZEJlKCJjb3Vu dCIsICIxIik7Cit9CisKK3ZhciBhcnI7CisKKy8vIFRlc3QgT2JqZWN0cyB3aXRoIGRlbnNlbHkg cGFja2VkIGluZGV4ZWQgcHJvcGVydGllczoKK2Z1bmN0aW9uIGRlbnNlSW50MzJFbGVtZW50cyhh cnIpIHsKKyAgICBhcnJbMF0gPSAxOworICAgIGFyclsxXSA9IDI7CisgICAgcmV0dXJuIGFycjsK K30KK3Rlc3RMZW5ndGhTaG9ydGVuaW5nKGRlbnNlSW50MzJFbGVtZW50cyhPYmplY3QuY3JlYXRl KEFycmF5LnByb3RvdHlwZSkpKTsKK3Rlc3RMZW5ndGhTaG9ydGVuaW5nKGRlbnNlSW50MzJFbGVt ZW50cyhbXSkpOworCitmdW5jdGlvbiBkZW5zZURvdWJsZUVsZW1lbnRzKGFycikgeworICAgIGFy clswXSA9IDEuNTsKKyAgICBhcnJbMV0gPSAyLjU7CisgICAgcmV0dXJuIGFycjsKK30KK3Rlc3RM ZW5ndGhTaG9ydGVuaW5nKGRlbnNlRG91YmxlRWxlbWVudHMoT2JqZWN0LmNyZWF0ZShBcnJheS5w cm90b3R5cGUpKSk7Cit0ZXN0TGVuZ3RoU2hvcnRlbmluZyhkZW5zZURvdWJsZUVsZW1lbnRzKFtd KSk7CisKK2Z1bmN0aW9uIGRlbnNlT2JqZWN0RWxlbWVudHMoYXJyKSB7CisgICAgYXJyWzBdID0g e307CisgICAgYXJyWzFdID0ge307CisgICAgcmV0dXJuIGFycjsKK30KK3Rlc3RMZW5ndGhTaG9y dGVuaW5nKGRlbnNlT2JqZWN0RWxlbWVudHMoT2JqZWN0LmNyZWF0ZShBcnJheS5wcm90b3R5cGUp KSk7Cit0ZXN0TGVuZ3RoU2hvcnRlbmluZyhkZW5zZU9iamVjdEVsZW1lbnRzKFtdKSk7CisKKy8v IFRlc3QgT2JqZWN0cyB3aXRoIGhvbGUteSBpbmRleGVkIHByb3BlcnRpZXM6CitmdW5jdGlvbiBo b2xleUludDMyRWxlbWVudHMoYXJyKSB7CisgICAgYXJyWzBdID0gMTsKKyAgICBhcnJbMV0gPSAy OworICAgIGFycls0XSA9IDQ7CisgICAgcmV0dXJuIGFycjsKK30KK3Rlc3RMZW5ndGhTaG9ydGVu aW5nKGhvbGV5SW50MzJFbGVtZW50cyhPYmplY3QuY3JlYXRlKEFycmF5LnByb3RvdHlwZSkpKTsK K3Rlc3RMZW5ndGhTaG9ydGVuaW5nKGhvbGV5SW50MzJFbGVtZW50cyhbXSkpOworCitmdW5jdGlv biBob2xleURvdWJsZUVsZW1lbnRzKGFycikgeworICAgIGFyclswXSA9IDEuNTsKKyAgICBhcnJb MV0gPSAyLjU7CisgICAgYXJyWzRdID0gNC41OworICAgIHJldHVybiBhcnI7Cit9Cit0ZXN0TGVu Z3RoU2hvcnRlbmluZyhob2xleURvdWJsZUVsZW1lbnRzKE9iamVjdC5jcmVhdGUoQXJyYXkucHJv dG90eXBlKSkpOwordGVzdExlbmd0aFNob3J0ZW5pbmcoaG9sZXlEb3VibGVFbGVtZW50cyhbXSkp OworCitmdW5jdGlvbiBob2xleU9iamVjdEVsZW1lbnRzKGFycikgeworICAgIGFyclswXSA9IHt9 OworICAgIGFyclsxXSA9IHt9OworICAgIGFycls0XSA9IHt9OworICAgIHJldHVybiBhcnI7Cit9 Cit0ZXN0TGVuZ3RoU2hvcnRlbmluZyhob2xleU9iamVjdEVsZW1lbnRzKE9iamVjdC5jcmVhdGUo QXJyYXkucHJvdG90eXBlKSkpOwordGVzdExlbmd0aFNob3J0ZW5pbmcoaG9sZXlPYmplY3RFbGVt ZW50cyhbXSkpOworCisvLyBUZXN0IE9iamVjdHMgd2l0aCBBcnJheVN0b3JhZ2UgaW5kZXhlZCBw cm9wZXJ0aWVzOgorZnVuY3Rpb24gYXJyYXlTdG9yYWdlSW50MzJFbGVtZW50cyhhcnIpIHsKKyAg ICBhcnJbMF0gPSAxOworICAgIGFyclsxXSA9IDI7CisgICAgYXJyLnVuc2hpZnQoMTAwKTsgLy8g Rm9yY2UgY29udmVyc2lvbiB0byB1c2luZyBBcnJheVN0b3JhZ2UuCisgICAgcmV0dXJuIGFycjsK K30KK3Rlc3RMZW5ndGhTaG9ydGVuaW5nKGFycmF5U3RvcmFnZUludDMyRWxlbWVudHMoT2JqZWN0 LmNyZWF0ZShBcnJheS5wcm90b3R5cGUpKSk7Cit0ZXN0TGVuZ3RoU2hvcnRlbmluZyhhcnJheVN0 b3JhZ2VJbnQzMkVsZW1lbnRzKFtdKSk7CisKK2Z1bmN0aW9uIGFycmF5U3RvcmFnZURvdWJsZUVs ZW1lbnRzKGFycikgeworICAgIGFyclswXSA9IDEuNTsKKyAgICBhcnJbMV0gPSAyLjU7CisgICAg YXJyLnVuc2hpZnQoMTAwLjUpOyAvLyBGb3JjZSBjb252ZXJzaW9uIHRvIHVzaW5nIEFycmF5U3Rv cmFnZS4KKyAgICByZXR1cm4gYXJyOworfQordGVzdExlbmd0aFNob3J0ZW5pbmcoYXJyYXlTdG9y YWdlRG91YmxlRWxlbWVudHMoT2JqZWN0LmNyZWF0ZShBcnJheS5wcm90b3R5cGUpKSk7Cit0ZXN0 TGVuZ3RoU2hvcnRlbmluZyhhcnJheVN0b3JhZ2VEb3VibGVFbGVtZW50cyhbXSkpOworCitmdW5j dGlvbiBhcnJheVN0b3JhZ2VPYmplY3RFbGVtZW50cyhhcnIpIHsKKyAgICBhcnJbMF0gPSB7fTsK KyAgICBhcnJbMV0gPSB7fTsKKyAgICBhcnIudW5zaGlmdCh7fSk7IC8vIEZvcmNlIGNvbnZlcnNp b24gdG8gdXNpbmcgQXJyYXlTdG9yYWdlLgorICAgIHJldHVybiBhcnI7Cit9Cit0ZXN0TGVuZ3Ro U2hvcnRlbmluZyhhcnJheVN0b3JhZ2VPYmplY3RFbGVtZW50cyhPYmplY3QuY3JlYXRlKEFycmF5 LnByb3RvdHlwZSkpKTsKK3Rlc3RMZW5ndGhTaG9ydGVuaW5nKGFycmF5U3RvcmFnZU9iamVjdEVs ZW1lbnRzKFtdKSk7CisKKy8vIFRlc3QgT2JqZWN0cyB3aXRoIHNwYXJzZSBpbmRleGVkIHByb3Bl cnRpZXM6CitmdW5jdGlvbiBzcGFyc2VJbnQzMkVsZW1lbnRzKGFycikgeworICAgIGFyclswXSA9 IDE7CisgICAgYXJyWzFdID0gMjsKKyAgICBhcnJbMTAwMDAwXSA9IDEwMDsKKyAgICByZXR1cm4g YXJyOworfQordGVzdExlbmd0aFNob3J0ZW5pbmcoc3BhcnNlSW50MzJFbGVtZW50cyhPYmplY3Qu Y3JlYXRlKEFycmF5LnByb3RvdHlwZSkpKTsKK3Rlc3RMZW5ndGhTaG9ydGVuaW5nKHNwYXJzZUlu dDMyRWxlbWVudHMoW10pKTsKKworZnVuY3Rpb24gc3BhcnNlRG91YmxlRWxlbWVudHMoYXJyKSB7 CisgICAgYXJyWzBdID0gMS41OworICAgIGFyclsxXSA9IDIuNTsKKyAgICBhcnJbMTAwMDAwXSA9 IDEwMC41OworICAgIHJldHVybiBhcnI7Cit9Cit0ZXN0TGVuZ3RoU2hvcnRlbmluZyhzcGFyc2VE b3VibGVFbGVtZW50cyhPYmplY3QuY3JlYXRlKEFycmF5LnByb3RvdHlwZSkpKTsKK3Rlc3RMZW5n dGhTaG9ydGVuaW5nKHNwYXJzZURvdWJsZUVsZW1lbnRzKFtdKSk7CisKK2Z1bmN0aW9uIHNwYXJz ZU9iamVjdEVsZW1lbnRzKGFycikgeworICAgIGFyclswXSA9IHt9OworICAgIGFyclsxXSA9IHt9 OworICAgIGFyclsxMDAwMDBdID0ge307CisgICAgcmV0dXJuIGFycjsKK30KK3Rlc3RMZW5ndGhT aG9ydGVuaW5nKHNwYXJzZU9iamVjdEVsZW1lbnRzKE9iamVjdC5jcmVhdGUoQXJyYXkucHJvdG90 eXBlKSkpOwordGVzdExlbmd0aFNob3J0ZW5pbmcoc3BhcnNlT2JqZWN0RWxlbWVudHMoW10pKTsK SW5kZXg6IExheW91dFRlc3RzL2pzL3NjcmlwdC10ZXN0cy9mb3Itb2YtY3Jhc2guanMKPT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PQotLS0gTGF5b3V0VGVzdHMvanMvc2NyaXB0LXRlc3RzL2Zvci1vZi1jcmFzaC5qcwkocmV2 aXNpb24gMCkKKysrIExheW91dFRlc3RzL2pzL3NjcmlwdC10ZXN0cy9mb3Itb2YtY3Jhc2guanMJ KHdvcmtpbmcgY29weSkKQEAgLTAsMCArMSwxMCBAQAorZGVzY3JpcHRpb24oCisiVGVzdHMgdGhh dCBmb3Itb2YgaXRlcmF0aW9uIGRvZXMgbm90IGNyYXNoZXMuIgorKTsKKworZnVuY3Rpb24gZm9v KCkgeworICAgIHZhciBvID0gT2JqZWN0LmNyZWF0ZShBcnJheS5wcm90b3R5cGUpOworICAgIGZv ciAodmFyIHggb2YgbykgeworICAgIH0KK30KK2ZvbygpOwo=