<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>142457</bug_id>
          
          <creation_ts>2015-03-08 12:09:08 -0700</creation_ts>
          <short_desc>[iOS] Sweep all collected objects on critical memory pressure</short_desc>
          <delta_ts>2015-03-11 14:34:41 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>JavaScriptCore</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>Unspecified</rep_platform>
          <op_sys>Unspecified</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc>http://jsfiddle.net/fvyw4ba0/3/</bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>InRadar</keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          <dependson>142595</dependson>
    
    <dependson>142593</dependson>
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Chris Dumez">cdumez</reporter>
          <assigned_to name="Chris Dumez">cdumez</assigned_to>
          <cc>barraclough</cc>
    
    <cc>commit-queue</cc>
    
    <cc>ggaren</cc>
    
    <cc>kling</cc>
    
    <cc>sam</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>1075390</commentid>
    <comment_count>0</comment_count>
    <who name="Chris Dumez">cdumez</who>
    <bug_when>2015-03-08 12:09:08 -0700</bug_when>
    <thetext>On memory pressure, we don&apos;t have much time to free-up memory. If we are not fast enough, the process can end up getting killed.

The mobile version of cnn.com constructs a lot of canvases that use up a lot of memory. On memory pressure, we were calling gcController().garbageCollectSoon(). However, the garbage collection was not triggering fast enough and the WebContent process would often end up being killed. If we call gcController().garbageCollectNow() on memory pressure instead, cnn.com no longer crashes as the canvases get collected in time. 


Radar: &lt;rdar://problem/20044440&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1075391</commentid>
    <comment_count>1</comment_count>
      <attachid>248193</attachid>
    <who name="Chris Dumez">cdumez</who>
    <bug_when>2015-03-08 12:11:55 -0700</bug_when>
    <thetext>Created attachment 248193
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1075392</commentid>
    <comment_count>2</comment_count>
      <attachid>248193</attachid>
    <who name="Chris Dumez">cdumez</who>
    <bug_when>2015-03-08 12:16:56 -0700</bug_when>
    <thetext>Comment on attachment 248193
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=248193&amp;action=review

&gt; Source/WebCore/platform/cocoa/MemoryPressureHandlerCocoa.mm:-84
&gt; -        gcController().garbageCollectSoon();

Maybe we could call garbageCollectSoon() on non-critical memory pressure still? This would decrease the likelihood of ending up under critical memory pressure.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1075395</commentid>
    <comment_count>3</comment_count>
      <attachid>248195</attachid>
    <who name="Chris Dumez">cdumez</who>
    <bug_when>2015-03-08 12:25:13 -0700</bug_when>
    <thetext>Created attachment 248195
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1075406</commentid>
    <comment_count>4</comment_count>
      <attachid>248195</attachid>
    <who name="Sam Weinig">sam</who>
    <bug_when>2015-03-08 13:37:20 -0700</bug_when>
    <thetext>Comment on attachment 248195
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=248195&amp;action=review

&gt; Source/WebCore/platform/cocoa/MemoryPressureHandlerCocoa.mm:88
&gt; -    if (isUnderMemoryPressure()) {
&gt; -        gcController().garbageCollectSoon();
&gt; -    } else {
&gt; -        // If we&apos;re not under memory pressure, that means we&apos;re here due to impending process suspension.
&gt; -        // Do a full GC since this is our last chance to run any code.
&gt; +    {
&gt;          ReliefLogger log(&quot;Collecting JavaScript garbage&quot;);
&gt; -        gcController().garbageCollectNow();
&gt; +        if (critical)
&gt; +            gcController().garbageCollectNow();
&gt; +        else
&gt; +            gcController().garbageCollectSoon();

It seems like you are changing the behavior of this code getting called when not under memory pressure (but rather &quot;due to impending process suspension&quot;), where it used to call garbageCollectNow() and now will call seemingly call garbageCollectSoon().  Is that intentional?  Does an call to this in that scenario always have the critical bit set?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1075409</commentid>
    <comment_count>5</comment_count>
      <attachid>248195</attachid>
    <who name="Chris Dumez">cdumez</who>
    <bug_when>2015-03-08 13:40:00 -0700</bug_when>
    <thetext>Comment on attachment 248195
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=248195&amp;action=review

&gt;&gt; Source/WebCore/platform/cocoa/MemoryPressureHandlerCocoa.mm:88
&gt;&gt; +            gcController().garbageCollectSoon();
&gt; 
&gt; It seems like you are changing the behavior of this code getting called when not under memory pressure (but rather &quot;due to impending process suspension&quot;), where it used to call garbageCollectNow() and now will call seemingly call garbageCollectSoon().  Is that intentional?  Does an call to this in that scenario always have the critical bit set?

No, I checked and on suspension we always set the critical flag to true.

From WebProcess.cpp:
void WebProcess::processWillSuspend()
{
    MemoryPressureHandler::singleton().releaseMemory(true);
...
}

true is for the critical argument.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1075411</commentid>
    <comment_count>6</comment_count>
    <who name="Chris Dumez">cdumez</who>
    <bug_when>2015-03-08 13:41:00 -0700</bug_when>
    <thetext>And setting the &quot;critical&quot; flag to true upon suspension makes sense as we want to free-up as much memory as possible in this case.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1075457</commentid>
    <comment_count>7</comment_count>
      <attachid>248195</attachid>
    <who name="Geoffrey Garen">ggaren</who>
    <bug_when>2015-03-08 16:01:45 -0700</bug_when>
    <thetext>Comment on attachment 248195
Patch

A few thoughts about this patch:

(1) Did anybody figure out why the JSC::Heap::reportExtraMemoryCost API was insufficient to collect the canvases at cnn.com?

(2) What is the normal GC timer period at cnn.com, and why is it insufficient to collect the canvases?

(3) It is preferable to fix (1) and/or (2) rather than respond to their failure after the fact in a low memory warning handler, since the low memory warning warning handler will have the negative side effect of dumping useful caches. 

(4) Is there any documented limit on the number of memory warnings we&apos;ll get, or the rate at which we&apos;ll get them?

In the past, I have seen cases where there was no limit, and so we hung the browser and also out-competed useful responses to memory warning that would have reclaimed memory more effectively than garbage collection. That was a terrible bug, and this patch might introduce a regression in those cases, along with a ticking time bomb that might go off any time the implementation details of memory warnings change.

I&apos;d rather not reintroduce a well-known very bad performance pathology -- especially without clear evidence showing that no better solution is available.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1075463</commentid>
    <comment_count>8</comment_count>
    <who name="Chris Dumez">cdumez</who>
    <bug_when>2015-03-08 16:19:59 -0700</bug_when>
    <thetext>(In reply to comment #7)
&gt; Comment on attachment 248195 [details]
&gt; Patch
&gt; 
&gt; A few thoughts about this patch:
&gt; 
&gt; (1) Did anybody figure out why the JSC::Heap::reportExtraMemoryCost API was
&gt; insufficient to collect the canvases at cnn.com?
&gt; 
&gt; (2) What is the normal GC timer period at cnn.com, and why is it
&gt; insufficient to collect the canvases?
&gt; 
&gt; (3) It is preferable to fix (1) and/or (2) rather than respond to their
&gt; failure after the fact in a low memory warning handler, since the low memory
&gt; warning warning handler will have the negative side effect of dumping useful
&gt; caches. 
&gt; 
&gt; (4) Is there any documented limit on the number of memory warnings we&apos;ll
&gt; get, or the rate at which we&apos;ll get them?
&gt; 
&gt; In the past, I have seen cases where there was no limit, and so we hung the
&gt; browser and also out-competed useful responses to memory warning that would
&gt; have reclaimed memory more effectively than garbage collection. That was a
&gt; terrible bug, and this patch might introduce a regression in those cases,
&gt; along with a ticking time bomb that might go off any time the implementation
&gt; details of memory warnings change.
&gt; 
&gt; I&apos;d rather not reintroduce a well-known very bad performance pathology --
&gt; especially without clear evidence showing that no better solution is
&gt; available.

Ok, thanks for the feedback. I&apos;ll try to take a look at (1) and (2).</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1075481</commentid>
    <comment_count>9</comment_count>
    <who name="Chris Dumez">cdumez</who>
    <bug_when>2015-03-08 17:41:12 -0700</bug_when>
    <thetext>(In reply to comment #8)
&gt; (In reply to comment #7)
&gt; &gt; Comment on attachment 248195 [details]
&gt; &gt; Patch
&gt; &gt; 
&gt; &gt; A few thoughts about this patch:
&gt; &gt; 
&gt; &gt; (1) Did anybody figure out why the JSC::Heap::reportExtraMemoryCost API was
&gt; &gt; insufficient to collect the canvases at cnn.com?
&gt; &gt; 
&gt; &gt; (2) What is the normal GC timer period at cnn.com, and why is it
&gt; &gt; insufficient to collect the canvases?

I added some logging when loading cnn.com, I see:
Mar  8 17:34:44 Chris-iPhone com.apple.WebKit.WebContent[3342] &lt;Notice&gt;: CHRIS: 0x107f78c80 - Time since last gc: 2044.99 ms
Mar  8 17:34:49 Chris-iPhone com.apple.WebKit.WebContent[3342] &lt;Notice&gt;: CHRIS: 0x107f78c80 - Time since last gc: 4855.09 ms
Mar  8 17:34:50 Chris-iPhone com.apple.WebKit.WebContent[3342] &lt;Notice&gt;: CHRIS: 0x107f78c80 - Time since last gc: 918.94 ms
Mar  8 17:34:51 Chris-iPhone com.apple.WebKit.WebContent[3342] &lt;Notice&gt;: CHRIS: 0x107f78c80 - Time since last gc: 1246 ms
Mar  8 17:34:57 Chris-iPhone com.apple.WebKit.WebContent[3342] &lt;Notice&gt;: CHRIS: Memory pressure, critical: 1
Mar  8 17:35:01 Chris-iPhone MobileSafari[3339] &lt;Notice&gt;: CHRIS: WebProcess CRASH

As you can see, no gc is happening between 17:34:51 and the critical memory pressure signal at 17:34:57. The WebContent process killed is then killed at 17:35:01 and gc() still hasn&apos;t happened.

Here is the code I used to do the logging (please check I put the logging in the right place as I am not familiar with JSC): http://pastebin.com/VD06nEfv</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1075486</commentid>
    <comment_count>10</comment_count>
    <who name="Chris Dumez">cdumez</who>
    <bug_when>2015-03-08 17:48:53 -0700</bug_when>
    <thetext>I added logging in EdenGCCallback::doCollection() as well:
Mar  8 17:47:11 Chris-iPhone com.apple.WebKit.WebContent[4254] &lt;Notice&gt;: CHRIS: 0x107f78c80 - FullGCActivityCallback::doCollection()
Mar  8 17:47:12 Chris-iPhone com.apple.WebKit.WebContent[4254] &lt;Notice&gt;: CHRIS: 0x107fd8688 - EdenGCActivityCallback::doCollection()
Mar  8 17:47:13 Chris-iPhone com.apple.WebKit.WebContent[4254] &lt;Notice&gt;: CHRIS: 0x107f78c80 - FullGCActivityCallback::doCollection()
Mar  8 17:47:14 Chris-iPhone com.apple.WebKit.WebContent[4254] &lt;Notice&gt;: CHRIS: 0x107fd8688 - EdenGCActivityCallback::doCollection()
Mar  8 17:47:16 Chris-iPhone com.apple.WebKit.WebContent[4254] &lt;Notice&gt;: CHRIS: 0x107fd8688 - EdenGCActivityCallback::doCollection()
Mar  8 17:47:18 Chris-iPhone com.apple.WebKit.WebContent[4254] &lt;Notice&gt;: CHRIS: 0x107fd8688 - EdenGCActivityCallback::doCollection()
Mar  8 17:47:18 Chris-iPhone com.apple.WebKit.WebContent[4254] &lt;Notice&gt;: CHRIS: 0x107fd8688 - EdenGCActivityCallback::doCollection()
Mar  8 17:47:19 Chris-iPhone com.apple.WebKit.WebContent[4254] &lt;Notice&gt;: CHRIS: 0x107f78c80 - FullGCActivityCallback::doCollection()
Mar  8 17:47:19 Chris-iPhone com.apple.WebKit.WebContent[4254] &lt;Notice&gt;: CHRIS: 0x107fd8688 - EdenGCActivityCallback::doCollection()
Mar  8 17:47:23 Chris-iPhone com.apple.WebKit.WebContent[4254] &lt;Notice&gt;: CHRIS: 0x107fd8688 - EdenGCActivityCallback::doCollection()
Mar  8 17:47:24 Chris-iPhone com.apple.WebKit.WebContent[4254] &lt;Notice&gt;: CHRIS: 0x107fd8688 - EdenGCActivityCallback::doCollection()
Mar  8 17:47:26 Chris-iPhone com.apple.WebKit.WebContent[4254] &lt;Notice&gt;: CHRIS: Memory pressure, critical: 1
Mar  8 17:47:26 Chris-iPhone com.apple.WebKit.WebContent[4254] &lt;Notice&gt;: CHRIS: 0x107fd8688 - EdenGCActivityCallback::doCollection()
Mar  8 17:47:26 Chris-iPhone com.apple.WebKit.WebContent[4254] &lt;Notice&gt;: CHRIS: 0x107fd8688 - EdenGCActivityCallback::doCollection()
Mar  8 17:47:27 Chris-iPhone com.apple.WebKit.WebContent[4254] &lt;Notice&gt;: CHRIS: Memory pressure, critical: 1
Mar  8 17:47:27 Chris-iPhone com.apple.WebKit.WebContent[4254] &lt;Notice&gt;: CHRIS: 0x107fd8688 - EdenGCActivityCallback::doCollection()
Mar  8 17:47:28 Chris-iPhone MobileSafari[4251] &lt;Notice&gt;: CHRIS: WebProcess CRASH</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1075487</commentid>
    <comment_count>11</comment_count>
    <who name="Chris Dumez">cdumez</who>
    <bug_when>2015-03-08 18:03:53 -0700</bug_when>
    <thetext>Here is logging with the heap size before and after the call to collect:
http://pastebin.com/1tZ37uju

It claims the heap size is ~60MB at the point it crashes. However, I can see there are ~380 MB of IOSurfaces at the point it crashes.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1075489</commentid>
    <comment_count>12</comment_count>
    <who name="Chris Dumez">cdumez</who>
    <bug_when>2015-03-08 18:16:20 -0700</bug_when>
    <thetext>(In reply to comment #11)
&gt; Here is logging with the heap size before and after the call to collect:
&gt; http://pastebin.com/1tZ37uju
&gt; 
&gt; It claims the heap size is ~60MB at the point it crashes. However, I can see
&gt; there are ~380 MB of IOSurfaces at the point it crashes.

We are correctly calling reportExtraMemoryCost(2700000) in HTMLCanvasElement::createImageBuffer() for each Canvas construction. That&apos;s about 2.57MB which is very close to the actual size of the IOSurfaces (2.61MB):
http://pastebin.com/x3Pj32vw</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1075493</commentid>
    <comment_count>13</comment_count>
    <who name="Chris Dumez">cdumez</who>
    <bug_when>2015-03-08 18:51:50 -0700</bug_when>
    <thetext>Additionally logging when HTMLCanvasElement are constructed / destroyed:
http://pastebin.com/JCVDgS0v</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1075495</commentid>
    <comment_count>14</comment_count>
    <who name="Chris Dumez">cdumez</who>
    <bug_when>2015-03-08 19:01:42 -0700</bug_when>
    <thetext>At the point of the crash, there are 157 alive HTMLCanvasElements.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1075532</commentid>
    <comment_count>15</comment_count>
    <who name="Geoffrey Garen">ggaren</who>
    <bug_when>2015-03-08 23:07:02 -0700</bug_when>
    <thetext>&gt; Here is the code I used to do the logging (please check I put the logging in
&gt; the right place as I am not familiar with JSC): http://pastebin.com/VD06nEfv

This patch will log full GCs triggered by the full GC timer. (And it looks like you&apos;ve got logging from the eden GC timer too, not included in this patch.)

One thing we&apos;ll miss here is synchronous GCs. You can catch those by logging inside Heap::collect. (Unfortunately, then you&apos;ll see double logging for every timer-based GC: one in the timer, and one in Heap::collect.)</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1075535</commentid>
    <comment_count>16</comment_count>
    <who name="Geoffrey Garen">ggaren</who>
    <bug_when>2015-03-08 23:32:31 -0700</bug_when>
    <thetext>&gt; At the point of the crash, there are 157 alive HTMLCanvasElements.

Crazy!

&gt; Mar  8 17:47:19 Chris-iPhone com.apple.WebKit.WebContent[4254] &lt;Notice&gt;: CHRIS: 0x107f78c80 - FullGCActivityCallback::doCollection()
&gt; ...
&gt; Mar  8 17:47:28 Chris-iPhone MobileSafari[4251] &lt;Notice&gt;: CHRIS: WebProcess CRASH

So, we&apos;re doing eden GCs at a rate of about 1 per second, but 9 seconds have passed since the last full GC.

A few thoughts about this:

(1) So many canvases surviving GC seems like a bug. It would be interesting to log the number of live canvases at the point of the last full collection, and to use the tool Andreas has for GC backtracing to discover why they survived. Same with the last eden collection.

(2) If there&apos;s some good reason for the canvases to survive -- something about the design of cnn.com that requires them to stay alive -- it might be a good idea to teach canvases to deallocate their IOSurfaces when they&apos;re not in the document and/or painting. This is probably not a substitute for fixing the GC issue, but it&apos;s probably desirable for those cases when a website&apos;s design simply requires keeping lots of canvases alive.

(3) Can you log how long the full GC timer was scheduled for at the time of the crash? We know it was at least 9 seconds, but we don&apos;t know how long it was. It seems like there might be a bug in that timer setting. 

(4) Currently, extra cost only hastens the next eden collection. Perhaps it should hasten the next eden collection and the next full collection, in case the large objects happen to survive eden collection at a pathologically high rate.

(5) Are these canvases actually surviving garbage collection, or have we just neglected to sweep them yet? Perhaps the low memory warning should eagerly run all outstanding destructors. The IncrementalSweeper can do this for us.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1075643</commentid>
    <comment_count>17</comment_count>
    <who name="Chris Dumez">cdumez</who>
    <bug_when>2015-03-09 10:27:54 -0700</bug_when>
    <thetext>(In reply to comment #15)
&gt; &gt; Here is the code I used to do the logging (please check I put the logging in
&gt; &gt; the right place as I am not familiar with JSC): http://pastebin.com/VD06nEfv
&gt; 
&gt; This patch will log full GCs triggered by the full GC timer. (And it looks
&gt; like you&apos;ve got logging from the eden GC timer too, not included in this
&gt; patch.)

All the logging I provided was WITHOUT my patch, just vanilla WebKit ToT.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1075645</commentid>
    <comment_count>18</comment_count>
    <who name="Chris Dumez">cdumez</who>
    <bug_when>2015-03-09 10:32:46 -0700</bug_when>
    <thetext>(In reply to comment #16)
&gt; &gt; At the point of the crash, there are 157 alive HTMLCanvasElements.
&gt; 
&gt; Crazy!

Over 500 are created so a good amount is getting destroyed by GC, just not enough or fast enough.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1075705</commentid>
    <comment_count>19</comment_count>
    <who name="Geoffrey Garen">ggaren</who>
    <bug_when>2015-03-09 12:17:58 -0700</bug_when>
    <thetext>Actually, it looks like the logs imply that canvas objects are being identified as garbage by GC, and just not swept promptly enough.

Let&apos;s do an experiment to force sweeping inside the low memory handler, and see if that helps.

It&apos;s seems like a problem that

(a) Eden collection does not start the incremental sweeper

(b) The incremental sweeper does not hasten itself after lots of extra cost has been reported.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1075719</commentid>
    <comment_count>20</comment_count>
    <who name="Chris Dumez">cdumez</who>
    <bug_when>2015-03-09 12:33:05 -0700</bug_when>
    <thetext>Crash reproduction case:
http://jsfiddle.net/fvyw4ba0/</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1075728</commentid>
    <comment_count>21</comment_count>
      <attachid>248195</attachid>
    <who name="Darin Adler">darin</who>
    <bug_when>2015-03-09 13:17:45 -0700</bug_when>
    <thetext>Comment on attachment 248195
Patch

OK.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1075775</commentid>
    <comment_count>22</comment_count>
    <who name="Chris Dumez">cdumez</who>
    <bug_when>2015-03-09 15:11:48 -0700</bug_when>
    <thetext>Geoff, is this the right way to trigger a full sweep on memory pressure?
http://pastebin.com/0Wjz8muv

If so, I&apos;m afraid it doesn&apos;t help. The jsfiddle demo is still crashing for me.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1075786</commentid>
    <comment_count>23</comment_count>
    <who name="Geoffrey Garen">ggaren</who>
    <bug_when>2015-03-09 15:43:06 -0700</bug_when>
    <thetext>&gt; Geoff, is this the right way to trigger a full sweep on memory pressure?
&gt; http://pastebin.com/0Wjz8muv

Yes, that&apos;s right.

&gt; If so, I&apos;m afraid it doesn&apos;t help. The jsfiddle demo is still crashing for
&gt; me.

I think this means that the real bug here is that eden collection doesn&apos;t register its finalizers with the sweeper.

Side note: I think it would be worthwhile to post your eager finalizer code as a stand-alone patch. It is a good thing to do -- just not for this test case.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1075797</commentid>
    <comment_count>24</comment_count>
    <who name="Chris Dumez">cdumez</who>
    <bug_when>2015-03-09 16:03:44 -0700</bug_when>
    <thetext>(In reply to comment #22)
&gt; Geoff, is this the right way to trigger a full sweep on memory pressure?
&gt; http://pastebin.com/0Wjz8muv
&gt; 
&gt; If so, I&apos;m afraid it doesn&apos;t help. The jsfiddle demo is still crashing for
&gt; me.

I was an async repro case: http://jsfiddle.net/fvyw4ba0/3/
Full sweep on memory pressure also doesn&apos;t seem to help in this case.

A gcController().garbageCollectNow() on memory pressure does prevent this reproduction case from crashing though.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1075822</commentid>
    <comment_count>25</comment_count>
      <attachid>248295</attachid>
    <who name="Chris Dumez">cdumez</who>
    <bug_when>2015-03-09 17:24:11 -0700</bug_when>
    <thetext>Created attachment 248295
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1075823</commentid>
    <comment_count>26</comment_count>
    <who name="Chris Dumez">cdumez</who>
    <bug_when>2015-03-09 17:24:59 -0700</bug_when>
    <thetext>This is not enough to fix the crash on cnn.com but this is a step in the right direction.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1075891</commentid>
    <comment_count>27</comment_count>
      <attachid>248295</attachid>
    <who name="Geoffrey Garen">ggaren</who>
    <bug_when>2015-03-09 21:49:20 -0700</bug_when>
    <thetext>Comment on attachment 248295
Patch

r=me</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1075896</commentid>
    <comment_count>28</comment_count>
      <attachid>248295</attachid>
    <who name="WebKit Commit Bot">commit-queue</who>
    <bug_when>2015-03-09 22:33:18 -0700</bug_when>
    <thetext>Comment on attachment 248295
Patch

Clearing flags on attachment: 248295

Committed r181310: &lt;http://trac.webkit.org/changeset/181310&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1075897</commentid>
    <comment_count>29</comment_count>
    <who name="WebKit Commit Bot">commit-queue</who>
    <bug_when>2015-03-09 22:33:22 -0700</bug_when>
    <thetext>All reviewed patches have been landed.  Closing bug.</thetext>
  </long_desc>
      
          <attachment
              isobsolete="1"
              ispatch="1"
              isprivate="0"
          >
            <attachid>248193</attachid>
            <date>2015-03-08 12:11:55 -0700</date>
            <delta_ts>2015-03-08 12:25:08 -0700</delta_ts>
            <desc>Patch</desc>
            <filename>bug-142457-20150308121136.patch</filename>
            <type>text/plain</type>
            <size>2369</size>
            <attacher name="Chris Dumez">cdumez</attacher>
            
              <data encoding="base64">U3VidmVyc2lvbiBSZXZpc2lvbjogMTgxMjQ1CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D
aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggMWNiMzI5Yzg1YzRmNTZj
M2YxOWZmODIyZTc3ZTM1ODg5ODM5OGFkZi4uYWIwNzA0ZjVkNGNlZDc0YjZhZDhlZmRhNmU2ODJk
NTJjYjg1YTk3ZSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv
dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDI2IEBACisyMDE1LTAzLTA4ICBDaHJp
cyBEdW1leiAgPGNkdW1lekBhcHBsZS5jb20+CisKKyAgICAgICAgW2lPU10gSHVycnkgSlMgZ2Fy
YmFnZSBjb2xsZWN0aW9uIG9uIG1lbW9yeSBwcmVzc3VyZQorICAgICAgICBodHRwczovL2J1Z3Mu
d2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTQyNDU3CisgICAgICAgIDxyZGFyOi8vcHJvYmxl
bS8yMDA0NDQ0MD4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAg
ICAgICBPbiBtZW1vcnkgcHJlc3N1cmUsIHdlIGRvbid0IGhhdmUgbXVjaCB0aW1lIHRvIGZyZWUt
dXAgbWVtb3J5LiBJZiB3ZSBhcmUgbm90IGZhc3QKKyAgICAgICAgZW5vdWdoLCB0aGUgcHJvY2Vz
cyBjYW4gZW5kIHVwIGdldHRpbmcga2lsbGVkLgorCisgICAgICAgIFRoZSBtb2JpbGUgdmVyc2lv
biBvZiBjbm4uY29tIGNvbnN0cnVjdHMgYSBsb3Qgb2YgY2FudmFzZXMgdGhhdCB1c2UgdXAgYSBs
b3Qgb2YKKyAgICAgICAgbWVtb3J5LiBPbiBtZW1vcnkgcHJlc3N1cmUsIHdlIHdlcmUgY2FsbGlu
ZyBnY0NvbnRyb2xsZXIoKS5nYXJiYWdlQ29sbGVjdFNvb24oKS4KKyAgICAgICAgSG93ZXZlciwg
dGhlIGdhcmJhZ2UgY29sbGVjdGlvbiB3YXMgbm90IHRyaWdnZXJpbmcgZmFzdCBlbm91Z2ggYW5k
IHRoZSBXZWJDb250ZW50CisgICAgICAgIHByb2Nlc3Mgd291bGQgb2Z0ZW4gZW5kIHVwIGJlaW5n
IGtpbGxlZC4KKworICAgICAgICBUaGlzIHBhdGNoIHVwZGF0ZXMgdGhlIG1lbW9yeSBwcmVzc3Vy
ZSBoYW5kbGVyIGluc3RlYWQgdG8gY2FsbAorICAgICAgICBnY0NvbnRyb2xsZXIoKS5nYXJiYWdl
Q29sbGVjdE5vdygpIGluc3RlYWQgb24gbWVtb3J5IHByZXNzdXJlLiBBcyBhIHJlc3VsdCwgY25u
LmNvbQorICAgICAgICBubyBsb25nZXIgY3Jhc2hlcyBhcyB0aGUgY2FudmFzZXMgZ2V0IGNvbGxl
Y3RlZCBpbiB0aW1lLgorCisgICAgICAgICogcGxhdGZvcm0vY29jb2EvTWVtb3J5UHJlc3N1cmVI
YW5kbGVyQ29jb2EubW06CisgICAgICAgIChXZWJDb3JlOjpNZW1vcnlQcmVzc3VyZUhhbmRsZXI6
OnBsYXRmb3JtUmVsZWFzZU1lbW9yeSk6CisKIDIwMTUtMDMtMDggIFNpbW9uIEZyYXNlciAgPHNp
bW9uLmZyYXNlckBhcHBsZS5jb20+CiAKICAgICAgICAgSW4gUmVuZGVyTGF5ZXJDb21wb3NpdG9y
LCB0cmFjayBsYXllciBib3VuZHMgYW5kIHRoZSBoYXZlQ29tcHV0ZWRCb3VuZHMgZmxhZyB0b2dl
dGhlciBpbiBhIHN0cnVjdApkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvcGxhdGZvcm0vY29j
b2EvTWVtb3J5UHJlc3N1cmVIYW5kbGVyQ29jb2EubW0gYi9Tb3VyY2UvV2ViQ29yZS9wbGF0Zm9y
bS9jb2NvYS9NZW1vcnlQcmVzc3VyZUhhbmRsZXJDb2NvYS5tbQppbmRleCAxNzg1OGM0NGUzNjYy
YTFlZDIyYTU4ODc2MGM0N2JiMDY0ZTgzZDFlLi4xMDg3ZDY0OGMxZjBlMmRkZmM1NmMzM2MzOGM4
Y2Y4ODg3NWJlZmQ5IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9jb2NvYS9N
ZW1vcnlQcmVzc3VyZUhhbmRsZXJDb2NvYS5tbQorKysgYi9Tb3VyY2UvV2ViQ29yZS9wbGF0Zm9y
bS9jb2NvYS9NZW1vcnlQcmVzc3VyZUhhbmRsZXJDb2NvYS5tbQpAQCAtODAsMTEgKzgwLDcgQEAg
dm9pZCBNZW1vcnlQcmVzc3VyZUhhbmRsZXI6OnBsYXRmb3JtUmVsZWFzZU1lbW9yeShib29sIGNy
aXRpY2FsKQogI2VuZGlmCiAKICNpZiBQTEFURk9STShJT1MpCi0gICAgaWYgKGlzVW5kZXJNZW1v
cnlQcmVzc3VyZSgpKSB7Ci0gICAgICAgIGdjQ29udHJvbGxlcigpLmdhcmJhZ2VDb2xsZWN0U29v
bigpOwotICAgIH0gZWxzZSB7Ci0gICAgICAgIC8vIElmIHdlJ3JlIG5vdCB1bmRlciBtZW1vcnkg
cHJlc3N1cmUsIHRoYXQgbWVhbnMgd2UncmUgaGVyZSBkdWUgdG8gaW1wZW5kaW5nIHByb2Nlc3Mg
c3VzcGVuc2lvbi4KLSAgICAgICAgLy8gRG8gYSBmdWxsIEdDIHNpbmNlIHRoaXMgaXMgb3VyIGxh
c3QgY2hhbmNlIHRvIHJ1biBhbnkgY29kZS4KKyAgICB7CiAgICAgICAgIFJlbGllZkxvZ2dlciBs
b2coIkNvbGxlY3RpbmcgSmF2YVNjcmlwdCBnYXJiYWdlIik7CiAgICAgICAgIGdjQ29udHJvbGxl
cigpLmdhcmJhZ2VDb2xsZWN0Tm93KCk7CiAgICAgfQo=
</data>

          </attachment>
          <attachment
              isobsolete="1"
              ispatch="1"
              isprivate="0"
          >
            <attachid>248195</attachid>
            <date>2015-03-08 12:25:13 -0700</date>
            <delta_ts>2015-03-09 17:24:07 -0700</delta_ts>
            <desc>Patch</desc>
            <filename>bug-142457-20150308122453.patch</filename>
            <type>text/plain</type>
            <size>2544</size>
            <attacher name="Chris Dumez">cdumez</attacher>
            
              <data encoding="base64">U3VidmVyc2lvbiBSZXZpc2lvbjogMTgxMjQ1CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D
aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggMWNiMzI5Yzg1YzRmNTZj
M2YxOWZmODIyZTc3ZTM1ODg5ODM5OGFkZi4uOTUyNzNmMzMyNGZiYWU1ZTFiNTIwYzY0NDI1MmQx
YzIyNDM4MmViNSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv
dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDI2IEBACisyMDE1LTAzLTA4ICBDaHJp
cyBEdW1leiAgPGNkdW1lekBhcHBsZS5jb20+CisKKyAgICAgICAgW2lPU10gSHVycnkgSlMgZ2Fy
YmFnZSBjb2xsZWN0aW9uIG9uIGNyaXRpY2FsIG1lbW9yeSBwcmVzc3VyZQorICAgICAgICBodHRw
czovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTQyNDU3CisgICAgICAgIDxyZGFy
Oi8vcHJvYmxlbS8yMDA0NDQ0MD4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMh
KS4KKworICAgICAgICBPbiBjcml0aWNhbCBtZW1vcnkgcHJlc3N1cmUsIHdlIGRvbid0IGhhdmUg
bXVjaCB0aW1lIHRvIGZyZWUtdXAgbWVtb3J5LiBJZiB3ZSBhcmUKKyAgICAgICAgbm90IGZhc3Qg
ZW5vdWdoLCB0aGUgcHJvY2VzcyBjYW4gZW5kIHVwIGdldHRpbmcga2lsbGVkLgorCisgICAgICAg
IFRoZSBtb2JpbGUgdmVyc2lvbiBvZiBjbm4uY29tIGNvbnN0cnVjdHMgYSBsb3Qgb2YgY2FudmFz
ZXMgdGhhdCB1c2UgdXAgYSBsb3Qgb2YKKyAgICAgICAgbWVtb3J5LiBPbiBtZW1vcnkgcHJlc3N1
cmUsIHdlIHdlcmUgY2FsbGluZyBnY0NvbnRyb2xsZXIoKS5nYXJiYWdlQ29sbGVjdFNvb24oKS4K
KyAgICAgICAgSG93ZXZlciwgdGhlIGdhcmJhZ2UgY29sbGVjdGlvbiB3YXMgbm90IHRyaWdnZXJp
bmcgZmFzdCBlbm91Z2ggYW5kIHRoZSBXZWJDb250ZW50CisgICAgICAgIHByb2Nlc3Mgd291bGQg
b2Z0ZW4gZW5kIHVwIGJlaW5nIGtpbGxlZC4KKworICAgICAgICBUaGlzIHBhdGNoIHVwZGF0ZXMg
dGhlIG1lbW9yeSBwcmVzc3VyZSBoYW5kbGVyIGluc3RlYWQgdG8gY2FsbAorICAgICAgICBnY0Nv
bnRyb2xsZXIoKS5nYXJiYWdlQ29sbGVjdE5vdygpIGluc3RlYWQgb24gY3JpdGljYWwgbWVtb3J5
IHByZXNzdXJlLiBBcyBhIHJlc3VsdCwKKyAgICAgICAgY25uLmNvbSBubyBsb25nZXIgY3Jhc2hl
cyBhcyB0aGUgY2FudmFzZXMgZ2V0IGNvbGxlY3RlZCBpbiB0aW1lLgorCisgICAgICAgICogcGxh
dGZvcm0vY29jb2EvTWVtb3J5UHJlc3N1cmVIYW5kbGVyQ29jb2EubW06CisgICAgICAgIChXZWJD
b3JlOjpNZW1vcnlQcmVzc3VyZUhhbmRsZXI6OnBsYXRmb3JtUmVsZWFzZU1lbW9yeSk6CisKIDIw
MTUtMDMtMDggIFNpbW9uIEZyYXNlciAgPHNpbW9uLmZyYXNlckBhcHBsZS5jb20+CiAKICAgICAg
ICAgSW4gUmVuZGVyTGF5ZXJDb21wb3NpdG9yLCB0cmFjayBsYXllciBib3VuZHMgYW5kIHRoZSBo
YXZlQ29tcHV0ZWRCb3VuZHMgZmxhZyB0b2dldGhlciBpbiBhIHN0cnVjdApkaWZmIC0tZ2l0IGEv
U291cmNlL1dlYkNvcmUvcGxhdGZvcm0vY29jb2EvTWVtb3J5UHJlc3N1cmVIYW5kbGVyQ29jb2Eu
bW0gYi9Tb3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9jb2NvYS9NZW1vcnlQcmVzc3VyZUhhbmRsZXJD
b2NvYS5tbQppbmRleCAxNzg1OGM0NGUzNjYyYTFlZDIyYTU4ODc2MGM0N2JiMDY0ZTgzZDFlLi42
OWFkYjkwMzU1M2EyN2ExYjAyYzdjZjcwMzgxNmM3ZjFiOGZhODM4IDEwMDY0NAotLS0gYS9Tb3Vy
Y2UvV2ViQ29yZS9wbGF0Zm9ybS9jb2NvYS9NZW1vcnlQcmVzc3VyZUhhbmRsZXJDb2NvYS5tbQor
KysgYi9Tb3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9jb2NvYS9NZW1vcnlQcmVzc3VyZUhhbmRsZXJD
b2NvYS5tbQpAQCAtODAsMTMgKzgwLDEyIEBAIHZvaWQgTWVtb3J5UHJlc3N1cmVIYW5kbGVyOjpw
bGF0Zm9ybVJlbGVhc2VNZW1vcnkoYm9vbCBjcml0aWNhbCkKICNlbmRpZgogCiAjaWYgUExBVEZP
Uk0oSU9TKQotICAgIGlmIChpc1VuZGVyTWVtb3J5UHJlc3N1cmUoKSkgewotICAgICAgICBnY0Nv
bnRyb2xsZXIoKS5nYXJiYWdlQ29sbGVjdFNvb24oKTsKLSAgICB9IGVsc2UgewotICAgICAgICAv
LyBJZiB3ZSdyZSBub3QgdW5kZXIgbWVtb3J5IHByZXNzdXJlLCB0aGF0IG1lYW5zIHdlJ3JlIGhl
cmUgZHVlIHRvIGltcGVuZGluZyBwcm9jZXNzIHN1c3BlbnNpb24uCi0gICAgICAgIC8vIERvIGEg
ZnVsbCBHQyBzaW5jZSB0aGlzIGlzIG91ciBsYXN0IGNoYW5jZSB0byBydW4gYW55IGNvZGUuCisg
ICAgewogICAgICAgICBSZWxpZWZMb2dnZXIgbG9nKCJDb2xsZWN0aW5nIEphdmFTY3JpcHQgZ2Fy
YmFnZSIpOwotICAgICAgICBnY0NvbnRyb2xsZXIoKS5nYXJiYWdlQ29sbGVjdE5vdygpOworICAg
ICAgICBpZiAoY3JpdGljYWwpCisgICAgICAgICAgICBnY0NvbnRyb2xsZXIoKS5nYXJiYWdlQ29s
bGVjdE5vdygpOworICAgICAgICBlbHNlCisgICAgICAgICAgICBnY0NvbnRyb2xsZXIoKS5nYXJi
YWdlQ29sbGVjdFNvb24oKTsKICAgICB9CiAjZW5kaWYKIH0K
</data>

          </attachment>
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>248295</attachid>
            <date>2015-03-09 17:24:11 -0700</date>
            <delta_ts>2015-03-09 22:33:18 -0700</delta_ts>
            <desc>Patch</desc>
            <filename>bug-142457-20150309172348.patch</filename>
            <type>text/plain</type>
            <size>4476</size>
            <attacher name="Chris Dumez">cdumez</attacher>
            
              <data encoding="base64">U3VidmVyc2lvbiBSZXZpc2lvbjogMTgxMjcwCmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlw
dENvcmUvQ2hhbmdlTG9nIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwppbmRleCA0
ZjY0MDhlMGJkMTc2OWMyMzk3MmZiMDVlYzFiNTg2NzJjMTcwMDk1Li42MDE3ZWQxN2QwZWE3M2Iy
YTQ0ZjYzY2VkMzYxOGM5N2QxMmYzNTQ3IDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENv
cmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKQEAgLTEs
MyArMSwxOSBAQAorMjAxNS0wMy0wOSAgQ2hyaXMgRHVtZXogIDxjZHVtZXpAYXBwbGUuY29tPgor
CisgICAgICAgIFtpT1NdIFN3ZWVwIGFsbCBjb2xsZWN0ZWQgb2JqZWN0cyBvbiBjcml0aWNhbCBt
ZW1vcnkgcHJlc3N1cmUKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcu
Y2dpP2lkPTE0MjQ1NworICAgICAgICA8cmRhcjovL3Byb2JsZW0vMjAwNDQ0NDA+CisKKyAgICAg
ICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgQWxsIGZ1bGxTd2VlcCgp
IEFQSSB0byBJbmNyZW1lbnRhbFN3ZWVwZXIgc28gdGhhdCB3ZSBjYW4gY2FsbCBpdCBpbiB0aGUK
KyAgICAgICAgbWVtb3J5IHByZXNzdXJlIGhhbmRsZXIuCisKKyAgICAgICAgKiBoZWFwL0luY3Jl
bWVudGFsU3dlZXBlci5jcHA6CisgICAgICAgIChKU0M6OkluY3JlbWVudGFsU3dlZXBlcjo6ZnVs
bFN3ZWVwKToKKyAgICAgICAgKiBoZWFwL0luY3JlbWVudGFsU3dlZXBlci5oOgorICAgICAgICAo
SlNDOjpJbmNyZW1lbnRhbFN3ZWVwZXI6Omhhc1dvcmspOgorCiAyMDE1LTAzLTA4ICBBbmRyZWFz
IEtsaW5nICA8YWtsaW5nQGFwcGxlLmNvbT4KIAogICAgICAgICBKSVRUaHVua3Mga2VlcHMgZmlu
YWxpemVkIFdlYWtzIGFyb3VuZCwgcGlubmluZyBXZWFrQmxvY2tzLgpkaWZmIC0tZ2l0IGEvU291
cmNlL1dlYkNvcmUvQ2hhbmdlTG9nIGIvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCmluZGV4IDJl
NjUyYWYzZmU1Nzk3ZTRmNjllZmYzYzVmMjRiNjMyMjlhYjllZTkuLjEwNmI5ZDdhOGI3Y2NmNzk1
ZTUxYzhjZTJiZGVjZDQ3MzRlNWZiZDMgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL0NoYW5n
ZUxvZworKysgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKQEAgLTEsMyArMSwxNyBAQAorMjAx
NS0wMy0wOSAgQ2hyaXMgRHVtZXogIDxjZHVtZXpAYXBwbGUuY29tPgorCisgICAgICAgIFtpT1Nd
IFN3ZWVwIGFsbCBjb2xsZWN0ZWQgb2JqZWN0cyBvbiBjcml0aWNhbCBtZW1vcnkgcHJlc3N1cmUK
KyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE0MjQ1Nwor
ICAgICAgICA8cmRhcjovL3Byb2JsZW0vMjAwNDQ0NDA+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkg
Tk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgRG8gYSBmdWxsIHN3ZWVwIG9mIG9iamVjdHMgbWFy
a2VkIGZvciBkZXN0cnVjdGlvbiBvbiBjcml0aWNhbCBtZW1vcnkKKyAgICAgICAgcHJlc3N1cmUg
dG8gZnJlZSB1cCBtZW1vcnkuCisKKyAgICAgICAgKiBwbGF0Zm9ybS9jb2NvYS9NZW1vcnlQcmVz
c3VyZUhhbmRsZXJDb2NvYS5tbToKKyAgICAgICAgKFdlYkNvcmU6Ok1lbW9yeVByZXNzdXJlSGFu
ZGxlcjo6cGxhdGZvcm1SZWxlYXNlTWVtb3J5KToKKwogMjAxNS0wMy0wOSAgUm9nZXIgRm9uZyAg
PHJvZ2VyX2ZvbmdAYXBwbGUuY29tPgogCiAgICAgICAgIFVucmV2aWV3ZWQuIFJlLWFkZCBDU1Mg
cHJvcGVydHkgdGhhdCB3YXMgdW5pbnRlbnRpb25hbGx5IHJlbW92ZWQgaW4gcjE4MDg5MwpkaWZm
IC0tZ2l0IGEvU291cmNlL0phdmFTY3JpcHRDb3JlL2hlYXAvSW5jcmVtZW50YWxTd2VlcGVyLmNw
cCBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9oZWFwL0luY3JlbWVudGFsU3dlZXBlci5jcHAKaW5k
ZXggZGExNTEzN2RkNWI3NzlmZTc5Y2U0ZDIyOTVmYTRlZjM5OWU3MDJkMC4uNDgwOWY2MmEzY2Q2
MWU1ZjNhMWNjNzU4MDBjYjM1ZmI1NGQzOWNjNCAxMDA2NDQKLS0tIGEvU291cmNlL0phdmFTY3Jp
cHRDb3JlL2hlYXAvSW5jcmVtZW50YWxTd2VlcGVyLmNwcAorKysgYi9Tb3VyY2UvSmF2YVNjcmlw
dENvcmUvaGVhcC9JbmNyZW1lbnRhbFN3ZWVwZXIuY3BwCkBAIC02MCw2ICs2MCwxMiBAQCB2b2lk
IEluY3JlbWVudGFsU3dlZXBlcjo6Y2FuY2VsVGltZXIoKQogICAgIENGUnVuTG9vcFRpbWVyU2V0
TmV4dEZpcmVEYXRlKG1fdGltZXIuZ2V0KCksIENGQWJzb2x1dGVUaW1lR2V0Q3VycmVudCgpICsg
c19kZWNhZGUpOwogfQogCit2b2lkIEluY3JlbWVudGFsU3dlZXBlcjo6ZnVsbFN3ZWVwKCkKK3sK
KyAgICB3aGlsZSAoaGFzV29yaygpKQorICAgICAgICBkb1dvcmsoKTsKK30KKwogdm9pZCBJbmNy
ZW1lbnRhbFN3ZWVwZXI6OmRvV29yaygpCiB7CiAgICAgZG9Td2VlcChXVEY6Om1vbm90b25pY2Fs
bHlJbmNyZWFzaW5nVGltZSgpKTsKZGlmZiAtLWdpdCBhL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9o
ZWFwL0luY3JlbWVudGFsU3dlZXBlci5oIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL2hlYXAvSW5j
cmVtZW50YWxTd2VlcGVyLmgKaW5kZXggYWY4MjZjNGIzYWNjY2JmMGEzMjNhMmQzNGQ0OTZiMDQ5
YWVhZjVmNi4uMTk5Zjk0ODBmZGEwYjY5YzFmNjRkZDEwMjNlNjFmM2YyNjNkODJkNiAxMDA2NDQK
LS0tIGEvU291cmNlL0phdmFTY3JpcHRDb3JlL2hlYXAvSW5jcmVtZW50YWxTd2VlcGVyLmgKKysr
IGIvU291cmNlL0phdmFTY3JpcHRDb3JlL2hlYXAvSW5jcmVtZW50YWxTd2VlcGVyLmgKQEAgLTM4
LDYgKzM4LDcgQEAgY2xhc3MgSW5jcmVtZW50YWxTd2VlcGVyIDogcHVibGljIEhlYXBUaW1lciB7
CiBwdWJsaWM6CiAjaWYgVVNFKENGKQogICAgIEpTX0VYUE9SVF9QUklWQVRFIEluY3JlbWVudGFs
U3dlZXBlcihIZWFwKiwgQ0ZSdW5Mb29wUmVmKTsKKyAgICBKU19FWFBPUlRfUFJJVkFURSB2b2lk
IGZ1bGxTd2VlcCgpOwogI2Vsc2UKICAgICBleHBsaWNpdCBJbmNyZW1lbnRhbFN3ZWVwZXIoVk0q
KTsKICNlbmRpZgpAQCAtNTIsNiArNTMsNyBAQCBwcml2YXRlOgogICAgIHZvaWQgZG9Td2VlcChk
b3VibGUgc3RhcnRUaW1lKTsKICAgICB2b2lkIHNjaGVkdWxlVGltZXIoKTsKICAgICB2b2lkIGNh
bmNlbFRpbWVyKCk7CisgICAgYm9vbCBoYXNXb3JrKCkgY29uc3QgeyByZXR1cm4gIW1fYmxvY2tz
VG9Td2VlcC5pc0VtcHR5KCk7IH0KICAgICAKICAgICB1bnNpZ25lZCBtX2N1cnJlbnRCbG9ja1Rv
U3dlZXBJbmRleDsKICAgICBWZWN0b3I8TWFya2VkQmxvY2sqPiYgbV9ibG9ja3NUb1N3ZWVwOwpk
aWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvcGxhdGZvcm0vY29jb2EvTWVtb3J5UHJlc3N1cmVI
YW5kbGVyQ29jb2EubW0gYi9Tb3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9jb2NvYS9NZW1vcnlQcmVz
c3VyZUhhbmRsZXJDb2NvYS5tbQppbmRleCAxNzg1OGM0NGUzNjYyYTFlZDIyYTU4ODc2MGM0N2Ji
MDY0ZTgzZDFlLi4xZWUzYjhmMDQyYzcxNDJiYmZmNTBiNjhkNjUyM2FjMjU5ZTA1Mjk5IDEwMDY0
NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9jb2NvYS9NZW1vcnlQcmVzc3VyZUhhbmRs
ZXJDb2NvYS5tbQorKysgYi9Tb3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9jb2NvYS9NZW1vcnlQcmVz
c3VyZUhhbmRsZXJDb2NvYS5tbQpAQCAtMjksMTAgKzI5LDEyIEBACiAjaW1wb3J0ICJEaXNwYXRj
aFNQSS5oIgogI2ltcG9ydCAiSU9TdXJmYWNlUG9vbC5oIgogI2ltcG9ydCAiR0NDb250cm9sbGVy
LmgiCisjaW1wb3J0ICJKU0RPTVdpbmRvdy5oIgogI2ltcG9ydCAiSlNET01XaW5kb3dCYXNlLmgi
CiAjaW1wb3J0ICJMYXllclBvb2wuaCIKICNpbXBvcnQgIkxvZ2dpbmcuaCIKICNpbXBvcnQgIldl
YkNvcmVTeXN0ZW1JbnRlcmZhY2UuaCIKKyNpbXBvcnQgPEphdmFTY3JpcHRDb3JlL0luY3JlbWVu
dGFsU3dlZXBlci5oPgogI2ltcG9ydCA8bWFjaC9tYWNoLmg+CiAjaW1wb3J0IDxtYWNoL3Rhc2tf
aW5mby5oPgogI2ltcG9ydCA8bWFsbG9jL21hbGxvYy5oPgpAQCAtODgsNiArOTAsMTMgQEAgdm9p
ZCBNZW1vcnlQcmVzc3VyZUhhbmRsZXI6OnBsYXRmb3JtUmVsZWFzZU1lbW9yeShib29sIGNyaXRp
Y2FsKQogICAgICAgICBSZWxpZWZMb2dnZXIgbG9nKCJDb2xsZWN0aW5nIEphdmFTY3JpcHQgZ2Fy
YmFnZSIpOwogICAgICAgICBnY0NvbnRyb2xsZXIoKS5nYXJiYWdlQ29sbGVjdE5vdygpOwogICAg
IH0KKworICAgIC8vIERvIGEgZnVsbCBzd2VlcCBvZiBjb2xsZWN0ZWQgb2JqZWN0cy4KKyAgICB7
CisgICAgICAgIFJlbGllZkxvZ2dlciBsb2coIkZ1bGwgSmF2YVNjcmlwdCBnYXJiYWdlIHN3ZWVw
Iik7CisgICAgICAgIEpTQzo6SlNMb2NrSG9sZGVyIGxvY2soSlNET01XaW5kb3c6OmNvbW1vblZN
KCkpOworICAgICAgICBKU0RPTVdpbmRvdzo6Y29tbW9uVk0oKS5oZWFwLnN3ZWVwZXIoKS0+ZnVs
bFN3ZWVwKCk7CisgICAgfQogI2VuZGlmCiB9CiAK
</data>

          </attachment>
      

    </bug>

</bugzilla>