140033 2015-01-01 15:54:25 -0800 Crash in operationNewFunction when scrolling on Google+ 2015-01-06 13:51:54 -0800 1 1 1 Unclassified WebKit JavaScriptCore 312.x All All RESOLVED FIXED http://plus.google.com InRadar P2 Normal --- 140145 1 msaboff msaboff oldest_to_newest 1058363 0 msaboff 2015-01-01 15:54:25 -0800 From rdar://problem/19327455: To reproduce, open http://plus.google.com (logged in), scroll down to the bottom and up to the top again. Repeat this a couple of times (~10) and you'll get a crash. Here's the crash stack with ToT WebKit (r177633): Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.JavaScriptCore 0x0000000114aa2846 operationNewFunction + 86 1 ??? 0x000053c3be412de1 0 + 92100175670753 2 ??? 0x000053c3be5b8544 0 + 92100177397060 3 ??? 0x000053c3be32addf 0 + 92100174720479 4 ??? 0x000053c3bdd7de29 0 + 92100168769065 5 ??? 0x000053c3be3412ab 0 + 92100174811819 6 ??? 0x000053c3be3510b7 0 + 92100174876855 7 ??? 0x000053c3be5beb83 0 + 92100177423235 8 ??? 0x000053c3be2d2c0f 0 + 92100174359567 9 ??? 0x000053c3be3163bf 0 + 92100174635967 10 ??? 0x000053c3be297fe4 0 + 92100174118884 11 ??? 0x000053c3bdcc8c9a 0 + 92100168027290 12 ??? 0x000053c3be25f18a 0 + 92100173885834 13 ??? 0x000053c3be781384 0 + 92100179268484 14 ??? 0x000053c3bdc1538e 0 + 92100167291790 15 ??? 0x000053c3be66f0b3 0 + 92100178145459 16 com.apple.JavaScriptCore 0x0000000114da4068 vmEntryToJavaScript + 326 17 com.apple.JavaScriptCore 0x0000000114d163e9 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 169 18 com.apple.JavaScriptCore 0x000000011496d765 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 485 19 com.apple.JavaScriptCore 0x000000011496d56e JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 62 20 com.apple.JavaScriptCore 0x0000000114a9e31a JSC::boundFunctionCall(JSC::ExecState*) + 586 21 ??? 0x000053c3bdc01034 0 + 92100167209012 22 ??? 0x000053c3bdcd6a7f 0 + 92100168084095 23 ??? 0x000053c3bdc451b8 0 + 92100167487928 24 ??? 0x000053c3bdc4d2a2 0 + 92100167520930 25 ??? 0x000053c3bdc01a3a 0 + 92100167211578 26 ??? 0x000053c3bdc79fea 0 + 92100167704554 27 ??? 0x000053c3be62a8c8 0 + 92100177864904 28 com.apple.JavaScriptCore 0x0000000114da9938 llint_entry + 22208 29 ??? 0x000053c3fdc00440 0 + 92101240947776 30 com.apple.JavaScriptCore 0x0000000114da9938 llint_entry + 22208 31 com.apple.JavaScriptCore 0x0000000114da4068 vmEntryToJavaScript + 326 32 com.apple.JavaScriptCore 0x0000000114d163e9 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 169 33 com.apple.JavaScriptCore 0x000000011496d765 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 485 34 com.apple.JavaScriptCore 0x000000011496d56e JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 62 35 com.apple.JavaScriptCore 0x0000000114a9e31a JSC::boundFunctionCall(JSC::ExecState*) + 586 36 ??? 0x000053c3bdc01034 0 + 92100167209012 37 ??? 0x000053c3bdcd6a7f 0 + 92100168084095 38 ??? 0x000053c3be26c40d 0 + 92100173939725 39 ??? 0x000053c3bdcbe367 0 + 92100167983975 40 com.apple.JavaScriptCore 0x0000000114da4068 vmEntryToJavaScript + 326 41 com.apple.JavaScriptCore 0x0000000114d163e9 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 169 42 com.apple.JavaScriptCore 0x000000011496d765 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 485 43 com.apple.JavaScriptCore 0x000000011496d56e JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 62 44 com.apple.JavaScriptCore 0x0000000114a9e31a JSC::boundFunctionCall(JSC::ExecState*) + 586 45 ??? 0x000053c3bdc01034 0 + 92100167209012 46 ??? 0x000053c3bdcd6a7f 0 + 92100168084095 47 ??? 0x000053c3be650bdc 0 + 92100178021340 48 com.apple.JavaScriptCore 0x0000000114da99a3 llint_entry + 22315 49 com.apple.JavaScriptCore 0x0000000114da4068 vmEntryToJavaScript + 326 50 com.apple.JavaScriptCore 0x0000000114d163e9 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 169 51 com.apple.JavaScriptCore 0x000000011496d765 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 485 52 com.apple.JavaScriptCore 0x000000011496d56e JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 62 53 com.apple.JavaScriptCore 0x0000000114a9e31a JSC::boundFunctionCall(JSC::ExecState*) + 586 54 ??? 0x000053c3bdc01034 0 + 92100167209012 55 ??? 0x000053c3be7e34b2 0 + 92100179670194 56 ??? 0x000053c3be6cb80e 0 + 92100178524174 57 com.apple.JavaScriptCore 0x0000000114da4068 vmEntryToJavaScript + 326 58 com.apple.JavaScriptCore 0x0000000114d163e9 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 169 59 com.apple.JavaScriptCore 0x000000011496d765 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 485 60 com.apple.JavaScriptCore 0x000000011496d56e JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 62 61 com.apple.JavaScriptCore 0x0000000114a9e31a JSC::boundFunctionCall(JSC::ExecState*) + 586 62 ??? 0x000053c3bdc01034 0 + 92100167209012 63 ??? 0x000053c3be806c3f 0 + 92100179815487 64 ??? 0x000053c3bdc79fea 0 + 92100167704554 65 ??? 0x000053c3bdcc14ff 0 + 92100167996671 66 ??? 0x000053c3bddb4e61 0 + 92100168994401 67 ??? 0x000053c3bddc3e35 0 + 92100169055797 68 ??? 0x000053c3bdc84464 0 + 92100167746660 69 ??? 0x000053c3bddb63ef 0 + 92100168999919 70 com.apple.JavaScriptCore 0x0000000114da4068 vmEntryToJavaScript + 326 71 com.apple.JavaScriptCore 0x0000000114d163e9 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 169 72 com.apple.JavaScriptCore 0x000000011496d765 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 485 73 com.apple.JavaScriptCore 0x000000011496d56e JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 62 74 com.apple.JavaScriptCore 0x0000000114a9e31a JSC::boundFunctionCall(JSC::ExecState*) + 586 75 com.apple.JavaScriptCore 0x0000000114da4201 vmEntryToNative + 332 76 com.apple.JavaScriptCore 0x000000011496d7ac JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 556 77 com.apple.JavaScriptCore 0x0000000114b2541f JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, JSC::JSValue*) + 63 78 com.apple.WebCore 0x0000000115196f73 WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext*, WebCore::Event*) + 1027 79 com.apple.WebCore 0x0000000115196a1c WebCore::EventTarget::fireEventListeners(WebCore::Event*, WebCore::EventTargetData*, WTF::Vector<WebCore::RegisteredEventListener, 1ul, WTF::CrashOnOverflow>&) + 652 80 com.apple.WebCore 0x0000000115075e3f WebCore::EventTarget::fireEventListeners(WebCore::Event*) + 239 81 com.apple.WebCore 0x0000000115194405 WebCore::EventTarget::dispatchEvent(WTF::PassRefPtr<WebCore::Event>) + 85 82 com.apple.WebCore 0x0000000115194357 WebCore::XMLHttpRequestProgressEventThrottle::dispatchEvent(WTF::PassRefPtr<WebCore::Event>) + 199 83 com.apple.WebCore 0x0000000115194258 WebCore::XMLHttpRequestProgressEventThrottle::dispatchReadyStateChangeEvent(WTF::PassRefPtr<WebCore::Event>, WebCore::ProgressEventAction) + 56 84 com.apple.WebCore 0x0000000115194048 WebCore::XMLHttpRequest::callReadyStateChangeListener() + 168 85 com.apple.WebCore 0x00000001151ba420 WebCore::XMLHttpRequest::didFinishLoading(unsigned long, double) + 368 86 com.apple.WebCore 0x0000000115124c6a WebCore::CachedResource::checkNotify() + 170 87 com.apple.WebCore 0x000000011541ef53 WebCore::CachedRawResource::finishLoading(WebCore::SharedBuffer*) + 227 88 com.apple.WebCore 0x0000000115124b2c WebCore::SubresourceLoader::didFinishLoading(double) + 92 89 com.apple.WebKit 0x000000011431fbe0 WebKit::WebResourceLoader::didReceiveWebResourceLoaderMessage(IPC::Connection*, IPC::MessageDecoder&) + 652 90 com.apple.WebKit 0x00000001141b0d54 IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::MessageDecoder, std::__1::default_delete<IPC::MessageDecoder> >) + 94 91 com.apple.WebKit 0x00000001141b2eee IPC::Connection::dispatchOneMessage() + 114 92 com.apple.JavaScriptCore 0x0000000114e67902 WTF::RunLoop::performWork() + 850 93 com.apple.JavaScriptCore 0x0000000114e67e22 WTF::RunLoop::performWork(void*) + 34 94 com.apple.CoreFoundation 0x00007fff8eb5d681 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17 95 com.apple.CoreFoundation 0x00007fff8eb4f8dc __CFRunLoopDoSources0 + 476 96 com.apple.CoreFoundation 0x00007fff8eb4ee3f __CFRunLoopRun + 927 97 com.apple.CoreFoundation 0x00007fff8eb4e858 CFRunLoopRunSpecific + 296 98 com.apple.HIToolbox 0x00007fff9189b90f RunCurrentEventLoopInMode + 235 99 com.apple.HIToolbox 0x00007fff9189b68a ReceiveNextEventCommon + 431 100 com.apple.HIToolbox 0x00007fff9189b4cb _BlockUntilNextEventMatchingListInModeWithFilter + 71 101 com.apple.AppKit 0x00007fff98f1486d _DPSNextEvent + 964 102 com.apple.AppKit 0x00007fff98f14020 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 194 103 com.apple.AppKit 0x00007fff98f07ee3 -[NSApplication run] + 594 104 com.apple.AppKit 0x00007fff98ef3254 NSApplicationMain + 1832 105 libxpc.dylib 0x00007fff93d4def2 _xpc_objc_main + 793 106 libxpc.dylib 0x00007fff93d4fa9d xpc_main + 490 107 com.apple.WebKit.WebContent.Development 0x000000010d099620 0x10d098000 + 5664 108 libdyld.dylib 0x00007fff92f885c9 start + 1 1058364 1 msaboff 2015-01-01 16:07:37 -0800 Consider a function that creates another function that is never used. The DFG will dead code eliminate the creation of the inner function. If the scope register is DCE as well AND we OSR exit in the middle of the outer function to a path where we create the inner function, there won't be a valid scope needed to create the inner function and we crash. Since the DFG determined that the scope is dead, the inner function must have been proven dead. Therefore, we can fix this in the baseline generated code by checking the scope before creating the function. If the scope is undefined, return undefined instead of creating a new function. 1058365 2 243874 msaboff 2015-01-01 16:29:17 -0800 Created attachment 243874 Patch 1058383 3 243874 oliver 2015-01-01 18:20:24 -0800 Comment on attachment 243874 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=243874&action=review > Source/JavaScriptCore/ChangeLog:11 > + exit to a path where that funciton gets created, check the scope register value function > Source/JavaScriptCore/jit/JITOpcodes.cpp:1071 > + notUndefinedScope = branch64(NotEqual, regT0, TrustedImm64(JSValue::encode(jsUndefined()))); > + store64(TrustedImm64(JSValue::encode(jsUndefined())), Address(callFrameRegister, sizeof(Register) * dst)); > #else > emitLoadPayload(currentInstruction[2].u.operand, regT0); > + notUndefinedScope = branch32(NotEqual, tagFor(dst), TrustedImm32(JSValue::UndefinedTag)); > + emitStore(dst, jsUndefined()); > #endif i thought we have macro functions for checking and set undefined 1058384 4 243879 msaboff 2015-01-01 19:02:32 -0800 Created attachment 243879 Updated patch. > Comment on attachment 243874 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=243874&action=review > > > Source/JavaScriptCore/ChangeLog:11 > > + exit to a path where that funciton gets created, check the scope register value > > function Fixed. > > Source/JavaScriptCore/jit/JITOpcodes.cpp:1071 > > + notUndefinedScope = branch64(NotEqual, regT0, TrustedImm64(JSValue::encode(jsUndefined()))); > > + store64(TrustedImm64(JSValue::encode(jsUndefined())), Address(callFrameRegister, sizeof(Register) * dst)); > > #else > > emitLoadPayload(currentInstruction[2].u.operand, regT0); > > + notUndefinedScope = branch32(NotEqual, tagFor(dst), TrustedImm32(JSValue::UndefinedTag)); > > + emitStore(dst, jsUndefined()); > > #endif > > i thought we have macro functions for checking and set undefined I did find is / is not integer, but I couldn't find any "is undefined" macros. I made a fix to the 32 bit case after running JSC tests. 1058523 5 msaboff 2015-01-03 19:47:25 -0800 Committed r177871: <http://trac.webkit.org/changeset/177871> 1059071 6 243879 ggaren 2015-01-06 11:17:05 -0800 Comment on attachment 243879 Updated patch. This approach is pretty crazy, and likely wrong. Our engine is architected to produce the correct values upon OSR exit -- not to recover from incorrect values after OSR exit. You should rethink your solution, and figure out why the OSR exit machinery did not know that the scope register would be used at this point in the bytecode. 243874 2015-01-01 16:29:17 -0800 2015-01-01 19:02:32 -0800 Patch 140033.patch text/plain 4777 msaboff SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTc3ODUxKQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE5IEBA CisyMDE1LTAxLTAxICBNaWNoYWVsIFNhYm9mZiAgPG1zYWJvZmZAYXBwbGUuY29tPgorCisgICAg ICAgIENyYXNoIGluIG9wZXJhdGlvbk5ld0Z1bmN0aW9uIHdoZW4gc2Nyb2xsaW5nIG9uIEdvb2ds ZSsKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE0MDAz MworCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIEluIERG RyBjb2RlLCB0aGUgc2NvcGUgcmVnaXN0ZXIgY2FuIGJlIGVsaW1pbmF0ZWQgYmVjYXVzZSBhbGwg dXNlcyBoYXZlIGJlZW4KKyAgICAgICAgZGVhZCBjb2RlIGVsaW1pbmF0ZWQuICBJbiB0aGUgY2Fz ZSB3aGVyZSBvbmUgb2YgdGhlIHVzZXMgd2FzIGNyZWF0aW5nIGEgZnVuY3Rpb24KKyAgICAgICAg dGhhdCBpcyBuZXZlciB1c2VkLCB0aGUgYmFzZWxpbmUgY29kZSB3aWxsIHN0aWxsIGNyZWF0ZSB0 aGUgZnVuY3Rpb24uICBJZiB3ZSBPU1IKKyAgICAgICAgZXhpdCB0byBhIHBhdGggd2hlcmUgdGhh dCBmdW5jaXRvbiBnZXRzIGNyZWF0ZWQsIGNoZWNrIHRoZSBzY29wZSByZWdpc3RlciB2YWx1ZQor ICAgICAgICBhbmQgc2V0IHRoZSBuZXcsIGJ1dCBkZWFkLCBmdW5jdGlvbiB0byB1bmRlZmluZWQg aW5zdGVhZCBvZiBjcmVhdGluZyBhIG5ldyBmdW5jdGlvbi4KKworICAgICAgICAqIGppdC9KSVRP cGNvZGVzLmNwcDoKKyAgICAgICAgKEpTQzo6SklUOjplbWl0X29wX25ld19mdW5jX2V4cCk6CisK IDIwMTUtMDEtMDEgIEplZmYgTWlsbGVyICA8amVmZm1AYXBwbGUuY29tPgogCiAgICAgICAgIFVw ZGF0ZSB1c2VyLXZpc2libGUgY29weXJpZ2h0IHN0cmluZ3MgdG8gaW5jbHVkZSAyMDE1CkluZGV4 OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUvaml0L0pJVE9wY29kZXMuY3BwCj09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0t IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9qaXQvSklUT3Bjb2Rlcy5jcHAJKHJldmlzaW9uIDE3Nzg1 MSkKKysrIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9qaXQvSklUT3Bjb2Rlcy5jcHAJKHdvcmtpbmcg Y29weSkKQEAgLTEwNTgsMTQgKzEwNTgsMjQgQEAgdm9pZCBKSVQ6OmVtaXRfb3BfbmV3X2Z1bmMo SW5zdHJ1Y3Rpb24qIAogCiB2b2lkIEpJVDo6ZW1pdF9vcF9uZXdfZnVuY19leHAoSW5zdHJ1Y3Rp b24qIGN1cnJlbnRJbnN0cnVjdGlvbikKIHsKKyAgICBKdW1wIG5vdFVuZGVmaW5lZFNjb3BlOwog ICAgIGludCBkc3QgPSBjdXJyZW50SW5zdHJ1Y3Rpb25bMV0udS5vcGVyYW5kOwogI2lmIFVTRShK U1ZBTFVFNjQpCiAgICAgZW1pdEdldFZpcnR1YWxSZWdpc3RlcihjdXJyZW50SW5zdHJ1Y3Rpb25b Ml0udS5vcGVyYW5kLCByZWdUMCk7CisgICAgbm90VW5kZWZpbmVkU2NvcGUgPSBicmFuY2g2NChO b3RFcXVhbCwgcmVnVDAsIFRydXN0ZWRJbW02NChKU1ZhbHVlOjplbmNvZGUoanNVbmRlZmluZWQo KSkpKTsKKyAgICBzdG9yZTY0KFRydXN0ZWRJbW02NChKU1ZhbHVlOjplbmNvZGUoanNVbmRlZmlu ZWQoKSkpLCBBZGRyZXNzKGNhbGxGcmFtZVJlZ2lzdGVyLCBzaXplb2YoUmVnaXN0ZXIpICogZHN0 KSk7CiAjZWxzZQogICAgIGVtaXRMb2FkUGF5bG9hZChjdXJyZW50SW5zdHJ1Y3Rpb25bMl0udS5v cGVyYW5kLCByZWdUMCk7CisgICAgbm90VW5kZWZpbmVkU2NvcGUgPSBicmFuY2gzMihOb3RFcXVh bCwgdGFnRm9yKGRzdCksIFRydXN0ZWRJbW0zMihKU1ZhbHVlOjpVbmRlZmluZWRUYWcpKTsKKyAg ICBlbWl0U3RvcmUoZHN0LCBqc1VuZGVmaW5lZCgpKTsKICNlbmRpZgorCisgICAgSnVtcCBkb25l ID0ganVtcCgpOworICAgIG5vdFVuZGVmaW5lZFNjb3BlLmxpbmsodGhpcyk7CisKICAgICBGdW5j dGlvbkV4ZWN1dGFibGUqIGZ1bmNFeHByID0gbV9jb2RlQmxvY2stPmZ1bmN0aW9uRXhwcihjdXJy ZW50SW5zdHJ1Y3Rpb25bM10udS5vcGVyYW5kKTsKICAgICBjYWxsT3BlcmF0aW9uKG9wZXJhdGlv bk5ld0Z1bmN0aW9uLCBkc3QsIHJlZ1QwLCBmdW5jRXhwcik7CisgICAgZG9uZS5saW5rKHRoaXMp OwogfQogCiB2b2lkIEpJVDo6ZW1pdF9vcF9uZXdfYXJyYXkoSW5zdHJ1Y3Rpb24qIGN1cnJlbnRJ bnN0cnVjdGlvbikKSW5kZXg6IExheW91dFRlc3RzL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBM YXlvdXRUZXN0cy9DaGFuZ2VMb2cJKHJldmlzaW9uIDE3Nzg1MSkKKysrIExheW91dFRlc3RzL0No YW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE4IEBACisyMDE1LTAxLTAxICBNaWNo YWVsIFNhYm9mZiAgPG1zYWJvZmZAYXBwbGUuY29tPgorCisgICAgICAgIENyYXNoIGluIG9wZXJh dGlvbk5ld0Z1bmN0aW9uIHdoZW4gc2Nyb2xsaW5nIG9uIEdvb2dsZSsKKyAgICAgICAgaHR0cHM6 Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE0MDAzMworCisgICAgICAgIFJldmll d2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIE5ldyByZWdlcnNzaW9uIHRlc3QuCisK KyAgICAgICAgKiBqcy9yZWdyZXNzLTE0MDAzMy1leHBlY3RlZC50eHQ6IEFkZGVkLgorICAgICAg ICAqIGpzL3JlZ3Jlc3MtMTQwMDMzLmh0bWw6IEFkZGVkLgorICAgICAgICAqIGpzL3NjcmlwdC10 ZXN0cy9yZWdyZXNzLTE0MDAzMy5qczogQWRkZWQuCisgICAgICAgICgudW51c2VkKToKKyAgICAg ICAgKGRlZmluZUFEZWFkRnVuY3Rpb24pOgorCiAyMDE1LTAxLTAxICBBbGV4ZXkgUHJvc2t1cnlh a292ICA8YXBAYXBwbGUuY29tPgogCiAgICAgICAgIGh0dHAvdGVzdHMveG1saHR0cHJlcXVlc3Qv c2VuZC1vbi1hYm9ydC5odG1sIGlzIGZsYWt5IGluIGRlYnVnIGJ1aWxkcwpJbmRleDogTGF5b3V0 VGVzdHMvanMvcmVncmVzcy0xNDAwMzMtZXhwZWN0ZWQudHh0Cj09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExheW91 dFRlc3RzL2pzL3JlZ3Jlc3MtMTQwMDMzLWV4cGVjdGVkLnR4dAkocmV2aXNpb24gMCkKKysrIExh eW91dFRlc3RzL2pzL3JlZ3Jlc3MtMTQwMDMzLWV4cGVjdGVkLnR4dAkod29ya2luZyBjb3B5KQpA QCAtMCwwICsxLDkgQEAKK1JlZ3Jlc3Npb24gdGVzdCBmb3IgaHR0cHM6Ly93ZWJraXQub3JnL2Iv MTQwMDMzLiBUaGlzIHRlc3Qgc2hvdWxkIHJ1biB3aXRob3V0IGNyYXNoaW5nLgorCitPbiBzdWNj ZXNzLCB5b3Ugd2lsbCBzZWUgYSBzZXJpZXMgb2YgIlBBU1MiIG1lc3NhZ2VzLCBmb2xsb3dlZCBi eSAiVEVTVCBDT01QTEVURSIuCisKKworUEFTUyBzdWNjZXNzZnVsbHlQYXJzZWQgaXMgdHJ1ZQor CitURVNUIENPTVBMRVRFCisKSW5kZXg6IExheW91dFRlc3RzL2pzL3JlZ3Jlc3MtMTQwMDMzLmh0 bWwKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvanMvcmVncmVzcy0xNDAwMzMuaHRtbAkocmV2 aXNpb24gMCkKKysrIExheW91dFRlc3RzL2pzL3JlZ3Jlc3MtMTQwMDMzLmh0bWwJKHdvcmtpbmcg Y29weSkKQEAgLTAsMCArMSwxMCBAQAorPCFET0NUWVBFIEhUTUwgUFVCTElDICItLy9JRVRGLy9E VEQgSFRNTC8vRU4iPgorPGh0bWw+Cis8aGVhZD4KKzxzY3JpcHQgc3JjPSIuLi9yZXNvdXJjZXMv anMtdGVzdC1wcmUuanMiPjwvc2NyaXB0PgorPC9oZWFkPgorPGJvZHk+Cis8c2NyaXB0IHNyYz0i c2NyaXB0LXRlc3RzL3JlZ3Jlc3MtMTQwMDMzLmpzIj48L3NjcmlwdD4KKzxzY3JpcHQgc3JjPSIu Li9yZXNvdXJjZXMvanMtdGVzdC1wb3N0LmpzIj48L3NjcmlwdD4KKzwvYm9keT4KKzwvaHRtbD4K SW5kZXg6IExheW91dFRlc3RzL2pzL3NjcmlwdC10ZXN0cy9yZWdyZXNzLTE0MDAzMy5qcwo9PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9qcy9zY3JpcHQtdGVzdHMvcmVncmVzcy0xNDAwMzMuanMJ KHJldmlzaW9uIDApCisrKyBMYXlvdXRUZXN0cy9qcy9zY3JpcHQtdGVzdHMvcmVncmVzcy0xNDAw MzMuanMJKHdvcmtpbmcgY29weSkKQEAgLTAsMCArMSwyMyBAQAorZGVzY3JpcHRpb24oCisiUmVn cmVzc2lvbiB0ZXN0IGZvciBodHRwczovL3dlYmtpdC5vcmcvYi8xNDAwMzMuIFRoaXMgdGVzdCBz aG91bGQgcnVuIHdpdGhvdXQgY3Jhc2hpbmcuIgorKTsKKworZnVuY3Rpb24gZGVmaW5lQURlYWRG dW5jdGlvbih4LCB5KQoreworICAgIHZhciB1OworICAgIHZhciBhID0gdTsKKyAgICB2YXIgYiA9 IHg7CisKKyAgICBpZiAoeCA+IDE1MDApCisgICAgICAgIGIgLT0geTsKKworICAgIHZhciB1bnVz ZWQgPSBmdW5jdGlvbigpIHsKKyAgICAgICAgcmV0dXJuIDQyOworICAgIH0KKworICAgIHJldHVy biBiOworfQorCit2YXIgcmVzdWx0ID0gMDsKK2ZvciAodmFyIGkgPSAxOyBpIDwgMjAwMDsgaSsr KQorICAgIHJlc3VsdCArPSBkZWZpbmVBRGVhZEZ1bmN0aW9uKGksICIgIik7Cg== 243879 2015-01-01 19:02:32 -0800 2015-01-03 14:34:43 -0800 Updated patch. 140033-2.patch text/plain 4805 msaboff SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291 cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTc3ODUxKQorKysgU291cmNl L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE5IEBA CisyMDE1LTAxLTAxICBNaWNoYWVsIFNhYm9mZiAgPG1zYWJvZmZAYXBwbGUuY29tPgorCisgICAg ICAgIENyYXNoIGluIG9wZXJhdGlvbk5ld0Z1bmN0aW9uIHdoZW4gc2Nyb2xsaW5nIG9uIEdvb2ds ZSsKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE0MDAz MworCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIEluIERG RyBjb2RlLCB0aGUgc2NvcGUgcmVnaXN0ZXIgY2FuIGJlIGVsaW1pbmF0ZWQgYmVjYXVzZSBhbGwg dXNlcyBoYXZlIGJlZW4KKyAgICAgICAgZGVhZCBjb2RlIGVsaW1pbmF0ZWQuICBJbiB0aGUgY2Fz ZSB3aGVyZSBvbmUgb2YgdGhlIHVzZXMgd2FzIGNyZWF0aW5nIGEgZnVuY3Rpb24KKyAgICAgICAg dGhhdCBpcyBuZXZlciB1c2VkLCB0aGUgYmFzZWxpbmUgY29kZSB3aWxsIHN0aWxsIGNyZWF0ZSB0 aGUgZnVuY3Rpb24uICBJZiB3ZSBPU1IKKyAgICAgICAgZXhpdCB0byBhIHBhdGggd2hlcmUgdGhh dCBmdW5jdGlvbiBnZXRzIGNyZWF0ZWQsIGNoZWNrIHRoZSBzY29wZSByZWdpc3RlciB2YWx1ZQor ICAgICAgICBhbmQgc2V0IHRoZSBuZXcsIGJ1dCBkZWFkLCBmdW5jdGlvbiB0byB1bmRlZmluZWQg aW5zdGVhZCBvZiBjcmVhdGluZyBhIG5ldyBmdW5jdGlvbi4KKworICAgICAgICAqIGppdC9KSVRP cGNvZGVzLmNwcDoKKyAgICAgICAgKEpTQzo6SklUOjplbWl0X29wX25ld19mdW5jX2V4cCk6CisK IDIwMTUtMDEtMDEgIEplZmYgTWlsbGVyICA8amVmZm1AYXBwbGUuY29tPgogCiAgICAgICAgIFVw ZGF0ZSB1c2VyLXZpc2libGUgY29weXJpZ2h0IHN0cmluZ3MgdG8gaW5jbHVkZSAyMDE1CkluZGV4 OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUvaml0L0pJVE9wY29kZXMuY3BwCj09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0t IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9qaXQvSklUT3Bjb2Rlcy5jcHAJKHJldmlzaW9uIDE3Nzg1 MSkKKysrIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9qaXQvSklUT3Bjb2Rlcy5jcHAJKHdvcmtpbmcg Y29weSkKQEAgLTEwNTgsMTQgKzEwNTgsMjQgQEAgdm9pZCBKSVQ6OmVtaXRfb3BfbmV3X2Z1bmMo SW5zdHJ1Y3Rpb24qIAogCiB2b2lkIEpJVDo6ZW1pdF9vcF9uZXdfZnVuY19leHAoSW5zdHJ1Y3Rp b24qIGN1cnJlbnRJbnN0cnVjdGlvbikKIHsKKyAgICBKdW1wIG5vdFVuZGVmaW5lZFNjb3BlOwog ICAgIGludCBkc3QgPSBjdXJyZW50SW5zdHJ1Y3Rpb25bMV0udS5vcGVyYW5kOwogI2lmIFVTRShK U1ZBTFVFNjQpCiAgICAgZW1pdEdldFZpcnR1YWxSZWdpc3RlcihjdXJyZW50SW5zdHJ1Y3Rpb25b Ml0udS5vcGVyYW5kLCByZWdUMCk7CisgICAgbm90VW5kZWZpbmVkU2NvcGUgPSBicmFuY2g2NChO b3RFcXVhbCwgcmVnVDAsIFRydXN0ZWRJbW02NChKU1ZhbHVlOjplbmNvZGUoanNVbmRlZmluZWQo KSkpKTsKKyAgICBzdG9yZTY0KFRydXN0ZWRJbW02NChKU1ZhbHVlOjplbmNvZGUoanNVbmRlZmlu ZWQoKSkpLCBBZGRyZXNzKGNhbGxGcmFtZVJlZ2lzdGVyLCBzaXplb2YoUmVnaXN0ZXIpICogZHN0 KSk7CiAjZWxzZQogICAgIGVtaXRMb2FkUGF5bG9hZChjdXJyZW50SW5zdHJ1Y3Rpb25bMl0udS5v cGVyYW5kLCByZWdUMCk7CisgICAgbm90VW5kZWZpbmVkU2NvcGUgPSBicmFuY2gzMihOb3RFcXVh bCwgdGFnRm9yKGN1cnJlbnRJbnN0cnVjdGlvblsyXS51Lm9wZXJhbmQpLCBUcnVzdGVkSW1tMzIo SlNWYWx1ZTo6VW5kZWZpbmVkVGFnKSk7CisgICAgZW1pdFN0b3JlKGRzdCwganNVbmRlZmluZWQo KSk7CiAjZW5kaWYKKworICAgIEp1bXAgZG9uZSA9IGp1bXAoKTsKKyAgICBub3RVbmRlZmluZWRT Y29wZS5saW5rKHRoaXMpOworCiAgICAgRnVuY3Rpb25FeGVjdXRhYmxlKiBmdW5jRXhwciA9IG1f Y29kZUJsb2NrLT5mdW5jdGlvbkV4cHIoY3VycmVudEluc3RydWN0aW9uWzNdLnUub3BlcmFuZCk7 CiAgICAgY2FsbE9wZXJhdGlvbihvcGVyYXRpb25OZXdGdW5jdGlvbiwgZHN0LCByZWdUMCwgZnVu Y0V4cHIpOworICAgIGRvbmUubGluayh0aGlzKTsKIH0KIAogdm9pZCBKSVQ6OmVtaXRfb3BfbmV3 X2FycmF5KEluc3RydWN0aW9uKiBjdXJyZW50SW5zdHJ1Y3Rpb24pCkluZGV4OiBMYXlvdXRUZXN0 cy9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCShyZXZpc2lv biAxNzc4NTEpCisrKyBMYXlvdXRUZXN0cy9DaGFuZ2VMb2cJKHdvcmtpbmcgY29weSkKQEAgLTEs MyArMSwxOCBAQAorMjAxNS0wMS0wMSAgTWljaGFlbCBTYWJvZmYgIDxtc2Fib2ZmQGFwcGxlLmNv bT4KKworICAgICAgICBDcmFzaCBpbiBvcGVyYXRpb25OZXdGdW5jdGlvbiB3aGVuIHNjcm9sbGlu ZyBvbiBHb29nbGUrCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNn aT9pZD0xNDAwMzMKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAg ICAgICBOZXcgcmVnZXJzc2lvbiB0ZXN0LgorCisgICAgICAgICoganMvcmVncmVzcy0xNDAwMzMt ZXhwZWN0ZWQudHh0OiBBZGRlZC4KKyAgICAgICAgKiBqcy9yZWdyZXNzLTE0MDAzMy5odG1sOiBB ZGRlZC4KKyAgICAgICAgKiBqcy9zY3JpcHQtdGVzdHMvcmVncmVzcy0xNDAwMzMuanM6IEFkZGVk LgorICAgICAgICAoLnVudXNlZCk6CisgICAgICAgIChkZWZpbmVBRGVhZEZ1bmN0aW9uKToKKwog MjAxNS0wMS0wMSAgQWxleGV5IFByb3NrdXJ5YWtvdiAgPGFwQGFwcGxlLmNvbT4KIAogICAgICAg ICBodHRwL3Rlc3RzL3htbGh0dHByZXF1ZXN0L3NlbmQtb24tYWJvcnQuaHRtbCBpcyBmbGFreSBp biBkZWJ1ZyBidWlsZHMKSW5kZXg6IExheW91dFRlc3RzL2pzL3JlZ3Jlc3MtMTQwMDMzLWV4cGVj dGVkLnR4dAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9qcy9yZWdyZXNzLTE0MDAzMy1leHBl Y3RlZC50eHQJKHJldmlzaW9uIDApCisrKyBMYXlvdXRUZXN0cy9qcy9yZWdyZXNzLTE0MDAzMy1l eHBlY3RlZC50eHQJKHdvcmtpbmcgY29weSkKQEAgLTAsMCArMSw5IEBACitSZWdyZXNzaW9uIHRl c3QgZm9yIGh0dHBzOi8vd2Via2l0Lm9yZy9iLzE0MDAzMy4gVGhpcyB0ZXN0IHNob3VsZCBydW4g d2l0aG91dCBjcmFzaGluZy4KKworT24gc3VjY2VzcywgeW91IHdpbGwgc2VlIGEgc2VyaWVzIG9m ICJQQVNTIiBtZXNzYWdlcywgZm9sbG93ZWQgYnkgIlRFU1QgQ09NUExFVEUiLgorCisKK1BBU1Mg c3VjY2Vzc2Z1bGx5UGFyc2VkIGlzIHRydWUKKworVEVTVCBDT01QTEVURQorCkluZGV4OiBMYXlv dXRUZXN0cy9qcy9yZWdyZXNzLTE0MDAzMy5odG1sCj09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExheW91dFRlc3Rz L2pzL3JlZ3Jlc3MtMTQwMDMzLmh0bWwJKHJldmlzaW9uIDApCisrKyBMYXlvdXRUZXN0cy9qcy9y ZWdyZXNzLTE0MDAzMy5odG1sCSh3b3JraW5nIGNvcHkpCkBAIC0wLDAgKzEsMTAgQEAKKzwhRE9D VFlQRSBIVE1MIFBVQkxJQyAiLS8vSUVURi8vRFREIEhUTUwvL0VOIj4KKzxodG1sPgorPGhlYWQ+ Cis8c2NyaXB0IHNyYz0iLi4vcmVzb3VyY2VzL2pzLXRlc3QtcHJlLmpzIj48L3NjcmlwdD4KKzwv aGVhZD4KKzxib2R5PgorPHNjcmlwdCBzcmM9InNjcmlwdC10ZXN0cy9yZWdyZXNzLTE0MDAzMy5q cyI+PC9zY3JpcHQ+Cis8c2NyaXB0IHNyYz0iLi4vcmVzb3VyY2VzL2pzLXRlc3QtcG9zdC5qcyI+ PC9zY3JpcHQ+Cis8L2JvZHk+Cis8L2h0bWw+CkluZGV4OiBMYXlvdXRUZXN0cy9qcy9zY3JpcHQt dGVzdHMvcmVncmVzcy0xNDAwMzMuanMKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvanMvc2Ny aXB0LXRlc3RzL3JlZ3Jlc3MtMTQwMDMzLmpzCShyZXZpc2lvbiAwKQorKysgTGF5b3V0VGVzdHMv anMvc2NyaXB0LXRlc3RzL3JlZ3Jlc3MtMTQwMDMzLmpzCSh3b3JraW5nIGNvcHkpCkBAIC0wLDAg KzEsMjMgQEAKK2Rlc2NyaXB0aW9uKAorIlJlZ3Jlc3Npb24gdGVzdCBmb3IgaHR0cHM6Ly93ZWJr aXQub3JnL2IvMTQwMDMzLiBUaGlzIHRlc3Qgc2hvdWxkIHJ1biB3aXRob3V0IGNyYXNoaW5nLiIK Kyk7CisKK2Z1bmN0aW9uIGRlZmluZUFEZWFkRnVuY3Rpb24oeCwgeSkKK3sKKyAgICB2YXIgdTsK KyAgICB2YXIgYSA9IHU7CisgICAgdmFyIGIgPSB4OworCisgICAgaWYgKHggPiAxNTAwKQorICAg ICAgICBiIC09IHk7CisKKyAgICB2YXIgdW51c2VkID0gZnVuY3Rpb24oKSB7CisgICAgICAgIHJl dHVybiA0MjsKKyAgICB9CisKKyAgICByZXR1cm4gYjsKK30KKwordmFyIHJlc3VsdCA9IDA7Citm b3IgKHZhciBpID0gMTsgaSA8IDIwMDA7IGkrKykKKyAgICByZXN1bHQgKz0gZGVmaW5lQURlYWRG dW5jdGlvbihpLCAiICIpOwo=