<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>143088</bug_id>
          
          <creation_ts>2015-03-26 03:05:54 -0700</creation_ts>
          <short_desc>[WinCairo] Crash when closing window while video is loading</short_desc>
          <delta_ts>2015-04-01 11:00:01 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>WebCore Misc.</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>PC</rep_platform>
          <op_sys>Windows 7</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords></keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Mathieu Lafon">arcoun</reporter>
          <assigned_to name="Nobody">webkit-unassigned</assigned_to>
          <cc>achristensen</cc>
    
    <cc>andersca</cc>
    
    <cc>bfulgham</cc>
    
    <cc>commit-queue</cc>
    
    <cc>peavo</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>1080242</commentid>
    <comment_count>0</comment_count>
    <who name="Mathieu Lafon">arcoun</who>
    <bug_when>2015-03-26 03:05:54 -0700</bug_when>
    <thetext>A crash can be easily reproduced when closing a window or leaving a page while the video is still loading (not yet playing).

Test Url can be http://www.quirksmode.org/html5/tests/video.html

Reproduced with WebKit 601.1.24 which include recent related crash fixes:

- Bug 142578 - [WinCairo] Crash when leaving page while video is playing.
- Bug 141248 - [WinCairo] Crash when media player is destroyed.

Also reproduced using WinLauncher, exception analysis (WinDbg) below. Seems to be a double-free.


*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

FAULTING_IP: 
ntdll!RtlReportCriticalFailure+29
77043845 cc              int     3

EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 77043845 (ntdll!RtlReportCriticalFailure+0x00000029)
   ExceptionCode: 80000003 (Break instruction exception)
  ExceptionFlags: 00000000
NumberParameters: 3
   Parameter[0]: 00000000
   Parameter[1]: 84a30030
   Parameter[2]: 0012ecc9

CONTEXT:  00000000 -- (.cxr 0x0;r)
eax=00000000 ebx=00000000 ecx=76fa179f edx=0012ecc9 esi=04080000 edi=04086bb8
eip=77043845 esp=0012ef1c ebp=0012ef94 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
ntdll!RtlReportCriticalFailure+0x29:
77043845 cc              int     3

FAULTING_THREAD:  00000e04

PROCESS_NAME:  WinLauncher.exe

OVERLAPPED_MODULE: Address regions for &apos;rgb9rast&apos; and &apos;vm3dum.dll&apos; overlap

ERROR_CODE: (NTSTATUS) 0x80000003 - {EXCEPTION}  Breakpoint  A breakpoint has been reached.

EXCEPTION_CODE: (HRESULT) 0x80000003 (2147483651) - One or more arguments are invalid

EXCEPTION_PARAMETER1:  00000000

EXCEPTION_PARAMETER2:  84a30030

EXCEPTION_PARAMETER3:  0012ecc9

NTGLOBALFLAG:  0

APPLICATION_VERIFIER_FLAGS:  0

APP:  winlauncher.exe

ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) x86fre

LAST_CONTROL_TRANSFER:  from 770447a3 to 77043845

BUGCHECK_STR:  APPLICATION_FAULT_ACTIONABLE_HEAP_CORRUPTION_heap_failure_block_not_busy_DOUBLE_FREE

PRIMARY_PROBLEM_CLASS:  ACTIONABLE_HEAP_CORRUPTION_heap_failure_block_not_busy

DEFAULT_BUCKET_ID:  ACTIONABLE_HEAP_CORRUPTION_heap_failure_block_not_busy

STACK_TEXT:  
7705ce10 76ffddff ntdll!RtlFreeHeap+0x64
7705ce14 75a8c3d4 kernel32!HeapFree+0x14
7705ce18 62d24c1a d3d9!MemFree+0x1b
7705ce1c 62d39e7e d3d9!CEnum::Release+0xe6
7705ce20 6817314d evr!CMonitorArray9::TerminateDisplaySystem+0x1c
7705ce24 68173691 evr!CMFVideoPresenter::~CMFVideoPresenter+0x8f
7705ce28 68172fda evr!CUnknown::NonDelegatingRelease+0x23
7705ce2c 68162d3e evr!CBaseAllocator::Release+0x11
7705ce30 76c14977 oleaut32!VariantClear+0xb9
7705ce34 76aeb8fa ole32!PropVariantClearWorker+0x72
7705ce38 76af3d88 ole32!PropVariantClear+0xf
7705ce3c 624d54e5 mf!MFCreateMP3MediaSink+0x397a
7705ce40 624d8d4f mf!MFCreateTopology+0x254
7705ce44 624d73b2 mf!MFCreateTopologyNode+0x1a15
7705ce48 624d88e6 mf!MFCreateTopologyNode+0x2f49
7705ce4c 624d5228 mf!MFCreateMP3MediaSink+0x36bd
7705ce50 01db690b webkit!WebCore::MediaPlayerPrivateMediaFoundation::~MediaPlayerPrivateMediaFoundation+0x7b
7705ce54 01c427f6 webkit!WebCore::MediaPlayer::~MediaPlayer+0x86
7705ce58 0164c3d5 webkit!WebCore::HTMLMediaElement::clearMediaPlayer+0x25
7705ce5c 0164c275 webkit!WebCore::HTMLMediaElement::userCancelledLoad+0x25
7705ce60 015d7671 webkit!WebCore::Document::prepareForDestruction+0xa1
7705ce64 01a8b276 webkit!WebCore::Frame::createView+0x36
7705ce68 014c80d2 webkit!WebFrameLoaderClient::transitionToCommittedForNewPage+0xb2
7705ce6c 01571bcc webkit!WebCore::FrameLoader::transitionToCommitted+0x1ac
7705ce70 01570295 webkit!WebCore::FrameLoader::commitProvisionalLoad+0x165
7705ce74 01568c9c webkit!WebCore::DocumentLoader::commitLoad+0x3c
7705ce78 01569a6c webkit!WebCore::DocumentLoader::dataReceived+0x7c
7705ce7c 01bad690 webkit!WebCore::CachedRawResource::notifyClientsDataWasReceived+0x40
7705ce80 01bacdfd webkit!WebCore::CachedRawResource::addDataBuffer+0x8d
7705ce84 01b9a639 webkit!WebCore::SubresourceLoader::didReceiveDataOrBuffer+0x89
7705ce88 01b9a210 webkit!WebCore::SubresourceLoader::didReceiveData+0x20
7705ce8c 01565147 webkit!WebCore::ResourceLoader::didReceiveData+0x17


STACK_COMMAND:  .ecxr ; kb ; dps 7705ce10 ; kb

FOLLOWUP_IP: 
EVR!CMonitorArray9::TerminateDisplaySystem+1c
6817314d 832600          and     dword ptr [esi],0

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  evr!CMonitorArray9::TerminateDisplaySystem+1c

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: EVR

IMAGE_NAME:  EVR.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  4ce7b86c

FAILURE_BUCKET_ID:  ACTIONABLE_HEAP_CORRUPTION_heap_failure_block_not_busy_80000003_EVR.dll!CMonitorArray9::TerminateDisplaySystem

BUCKET_ID:  APPLICATION_FAULT_ACTIONABLE_HEAP_CORRUPTION_heap_failure_block_not_busy_DOUBLE_FREE_evr!CMonitorArray9::TerminateDisplaySystem+1c

ANALYSIS_SOURCE:  UM

FAILURE_ID_HASH_STRING:  um:actionable_heap_corruption_heap_failure_block_not_busy_80000003_evr.dll!cmonitorarray9::terminatedisplaysystem

FAILURE_ID_HASH:  {5042ab70-5cbd-dae5-520a-04daa1b8d317}

Followup: MachineOwner
---------</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1080332</commentid>
    <comment_count>1</comment_count>
    <who name="Alex Christensen">achristensen</who>
    <bug_when>2015-03-26 10:55:21 -0700</bug_when>
    <thetext>What svn revision was this seen on?  Can it be reproduced after r181805?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1080572</commentid>
    <comment_count>2</comment_count>
    <who name="Mathieu Lafon">arcoun</who>
    <bug_when>2015-03-27 02:32:54 -0700</bug_when>
    <thetext>I am using the Safari-601.1.24 tag (r181960) which include the r181805 fix.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1080647</commentid>
    <comment_count>3</comment_count>
    <who name="Alex Christensen">achristensen</who>
    <bug_when>2015-03-27 10:34:57 -0700</bug_when>
    <thetext>It looks like MediaPlayerPrivateMediaFoundation::createSession should also be protected by a mutex kind of like https://bugs.webkit.org/show_bug.cgi?id=142578
Could you upload a patch?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1081000</commentid>
    <comment_count>4</comment_count>
    <who name="">peavo</who>
    <bug_when>2015-03-29 04:24:20 -0700</bug_when>
    <thetext>I&apos;m having a little trouble reproducing this one, which OS are you on? I&apos;m testing WinLauncher 32-bit on Win7.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1081179</commentid>
    <comment_count>5</comment_count>
    <who name="Mathieu Lafon">arcoun</who>
    <bug_when>2015-03-30 09:16:15 -0700</bug_when>
    <thetext>After additional testing, here are some complementary informations:

- The crash is triggered by ~MediaPlayerPrivateMediaFoundation when releasing m_topology (IMFTopology)

- The crash occurs on a Win7 VM with mf.dll 12.0.7601.17514

- The crash does not occur on an other Win7 VM with mf.dll 12.0.7601.18741 but m_topology is not set in MediaPlayerPrivateMediaFoundation destructor in that case (video is still loading).

I&apos;m going to do some more testing to better understand if m_toppology should be set but this seems to be related to MediaFoundation version.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1081294</commentid>
    <comment_count>6</comment_count>
      <attachid>249760</attachid>
    <who name="">peavo</who>
    <bug_when>2015-03-30 14:17:07 -0700</bug_when>
    <thetext>Created attachment 249760
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1081296</commentid>
    <comment_count>7</comment_count>
    <who name="">peavo</who>
    <bug_when>2015-03-30 14:21:08 -0700</bug_when>
    <thetext>(In reply to comment #5)
&gt; After additional testing, here are some complementary informations:
&gt; 
&gt; - The crash is triggered by ~MediaPlayerPrivateMediaFoundation when
&gt; releasing m_topology (IMFTopology)
&gt; 
&gt; - The crash occurs on a Win7 VM with mf.dll 12.0.7601.17514
&gt; 
&gt; - The crash does not occur on an other Win7 VM with mf.dll 12.0.7601.18741
&gt; but m_topology is not set in MediaPlayerPrivateMediaFoundation destructor in
&gt; that case (video is still loading).
&gt; 
&gt; I&apos;m going to do some more testing to better understand if m_toppology should
&gt; be set but this seems to be related to MediaFoundation version.

Could you try the uploaded patch?
I&apos;m not sure this will fix your problem, but I believe it fixes a potential crash if a call on the main thread made by a worker thread is invoked after the media player is destroyed.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1081300</commentid>
    <comment_count>8</comment_count>
    <who name="Alex Christensen">achristensen</who>
    <bug_when>2015-03-30 14:29:53 -0700</bug_when>
    <thetext>This looks good to me.  Anders, what do you think?  Are there other places where callOnMainThread(std::function&lt;void()&gt;) could cause similar crashes in WebKit?  Is this how things like this are fixed?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1081322</commentid>
    <comment_count>9</comment_count>
      <attachid>249760</attachid>
    <who name="Mark Lam">mark.lam</who>
    <bug_when>2015-03-30 15:06:21 -0700</bug_when>
    <thetext>Comment on attachment 249760
Patch

r=me</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1081356</commentid>
    <comment_count>10</comment_count>
      <attachid>249760</attachid>
    <who name="WebKit Commit Bot">commit-queue</who>
    <bug_when>2015-03-30 16:02:39 -0700</bug_when>
    <thetext>Comment on attachment 249760
Patch

Clearing flags on attachment: 249760

Committed r182160: &lt;http://trac.webkit.org/changeset/182160&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1081357</commentid>
    <comment_count>11</comment_count>
    <who name="WebKit Commit Bot">commit-queue</who>
    <bug_when>2015-03-30 16:02:44 -0700</bug_when>
    <thetext>All reviewed patches have been landed.  Closing bug.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1081567</commentid>
    <comment_count>12</comment_count>
    <who name="Alexey Proskuryakov">ap</who>
    <bug_when>2015-03-30 22:27:55 -0700</bug_when>
    <thetext>This may have broken accessibility/aria-hidden-hides-all-elements.html on Windows.

https://webkit-test-results.appspot.com/dashboards/flakiness_dashboard.html#showAllRuns=true&amp;tests=accessibility%2Faria-hidden-hides-all-elements.html</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1081608</commentid>
    <comment_count>13</comment_count>
    <who name="Mathieu Lafon">arcoun</who>
    <bug_when>2015-03-31 04:08:31 -0700</bug_when>
    <thetext>This patch does not resolve the problem I am experiencing. I still get a crash.

Regarding my comment on the VM with mf.dll 12.0.7601.18741, m_topology is also set but there is no crash when ~MediaPlayerPrivateMediaFoundation release it.

So this bug is surely related to a bug in MediaFoundation which has been fixed in the latest versions.

I let you decide if the status should be modified (INVALID?).</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1081634</commentid>
    <comment_count>14</comment_count>
    <who name="Mathieu Lafon">arcoun</who>
    <bug_when>2015-03-31 07:39:14 -0700</bug_when>
    <thetext>Not sure this is related to MediaFoundation, mf.dll or a Windows update. After installing every updates available in Windows update, I still have the same crash...</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1081699</commentid>
    <comment_count>15</comment_count>
    <who name="Alex Christensen">achristensen</who>
    <bug_when>2015-03-31 11:18:47 -0700</bug_when>
    <thetext>(In reply to comment #12)
&gt; This may have broken accessibility/aria-hidden-hides-all-elements.html on
&gt; Windows.
&gt; 
&gt; https://webkit-test-results.appspot.com/dashboards/flakiness_dashboard.
&gt; html#showAllRuns=true&amp;tests=accessibility%2Faria-hidden-hides-all-elements.
&gt; html

There is no way this caused that test failure.  The AppleWin port doesn&apos;t even compile this code.

(In reply to comment #14)
&gt; Not sure this is related to MediaFoundation, mf.dll or a Windows update. After installing every updates available in Windows update, I still have the same crash...

It&apos;s possible we&apos;re still not handling MediaFoundation correctly.  Try to reproduce that crash, file another bug, debug it, and upload a patch :)</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1081739</commentid>
    <comment_count>16</comment_count>
    <who name="">peavo</who>
    <bug_when>2015-03-31 12:30:24 -0700</bug_when>
    <thetext>(In reply to comment #14)
&gt; Not sure this is related to MediaFoundation, mf.dll or a Windows update.
&gt; After installing every updates available in Windows update, I still have the
&gt; same crash...

Could you try to apply the following patch?
It seems to be recommended to release all MF objects before MFShutdown is called.

Index: MediaPlayerPrivateMediaFoundation.cpp
===================================================================
--- MediaPlayerPrivateMediaFoundation.cpp       (revisjon 182189)
+++ MediaPlayerPrivateMediaFoundation.cpp       (arbeidskopi)
@@ -293,6 +293,13 @@

 bool MediaPlayerPrivateMediaFoundation::endSession()
 {
+    // Release all MF objects before MFShutdown is called.
+    m_sourceResolver = nullptr;
+    m_mediaSource = nullptr;
+    m_topology = nullptr;
+    m_sourcePD = nullptr;
+    m_videoDisplay = nullptr;
+
     if (m_mediaSession) {
         m_mediaSession-&gt;Shutdown();
         m_mediaSession = nullptr;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1081994</commentid>
    <comment_count>17</comment_count>
    <who name="Mathieu Lafon">arcoun</who>
    <bug_when>2015-04-01 07:22:51 -0700</bug_when>
    <thetext>(In reply to comment #15)
&gt; It&apos;s possible we&apos;re still not handling MediaFoundation correctly.  Try to
&gt; reproduce that crash, file another bug, debug it, and upload a patch :)

Why file another bug? I still easily reproduce this same bug, with the same stack trace and using the same condition. Nothing has been resolved here so the status should not be RESOLVED/FIXED.

(In reply to comment #16)
&gt; Could you try to apply the following patch?
&gt; It seems to be recommended to release all MF objects before MFShutdown is
&gt; called.

No, still got a crash... Now during m_mediaSession-&gt;Shutdown but this might be because this is where the problematic object is completely released.

--

I only reproduce this in a VMWare VM, this might be related to the VMWare video driver or tools. Anyone has the same configuration?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1082003</commentid>
    <comment_count>18</comment_count>
    <who name="Mathieu Lafon">arcoun</who>
    <bug_when>2015-04-01 08:29:05 -0700</bug_when>
    <thetext>This seems to be directly due to the VMWare SVGA driver.

- I&apos;ve got the same crash (in winsat.exe, exactly same stack trace) when testing the Windows Experience Index

- If I remove the VMWare SVGA driver, no crash in winsat.exe or WebKit.

- If I reinstall the VMWare SVGA driver, winsat.exe and WebKit both crash.

I think it can be closed as INVALID and related to 3rdparty drivers.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1082050</commentid>
    <comment_count>19</comment_count>
    <who name="Alex Christensen">achristensen</who>
    <bug_when>2015-04-01 11:00:01 -0700</bug_when>
    <thetext>This investigation led us to fix a problem that needed to be fixed, but I believe your specific problem is indeed a problem with 3rd party drivers.  If you find that there is indeed code in WebKit that does something wrong with MediaFoundation that causes a crash, please file another bug.  Thanks!</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>249760</attachid>
            <date>2015-03-30 14:17:07 -0700</date>
            <delta_ts>2015-03-30 16:02:39 -0700</delta_ts>
            <desc>Patch</desc>
            <filename>bug-143088-20150330231615.patch</filename>
            <type>text/plain</type>
            <size>4050</size>
            <attacher>peavo</attacher>
            
              <data encoding="base64">SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi
Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDE4MjE1MikKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n
ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDIzIEBACisyMDE1LTAzLTMwICBQZXIgQXJu
ZSBWb2xsYW4gIDxwZWF2b0BvdXRsb29rLmNvbT4KKworICAgICAgICBbV2luQ2Fpcm9dIENyYXNo
IHdoZW4gY2xvc2luZyB3aW5kb3cgd2hpbGUgdmlkZW8gaXMgbG9hZGluZworICAgICAgICBodHRw
czovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTQzMDg4CisKKyAgICAgICAgUmV2
aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgV2hlbiB0aGUgbWVkaWEgcGxheWVy
IGlzIGRlc3Ryb3llZCwgd2UgaGF2ZSB0byBjYW5jZWwgcG9zc2libGUgY2FsbHMgb24gdGhlCisg
ICAgICAgIG1haW4gdGhyZWFkIG1hZGUgYnkgYSB3b3JrZXIgdGhyZWFkLiBPdGhlcndpc2UgdGhl
IGRlc3Ryb3llZCBtZWRpYSBwbGF5ZXIKKyAgICAgICAgd2lsbCBiZSBhY2Nlc3NlZCB3aGVuIHBl
cmZvcm1pbmcgdGhlIGNhbGwuCisKKyAgICAgICAgKiBwbGF0Zm9ybS9ncmFwaGljcy93aW4vTWVk
aWFQbGF5ZXJQcml2YXRlTWVkaWFGb3VuZGF0aW9uLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6Ok1l
ZGlhUGxheWVyUHJpdmF0ZU1lZGlhRm91bmRhdGlvbjo6fk1lZGlhUGxheWVyUHJpdmF0ZU1lZGlh
Rm91bmRhdGlvbik6CisgICAgICAgIChXZWJDb3JlOjpNZWRpYVBsYXllclByaXZhdGVNZWRpYUZv
dW5kYXRpb246OmVuZENyZWF0ZWRNZWRpYVNvdXJjZSk6CisgICAgICAgIChXZWJDb3JlOjpNZWRp
YVBsYXllclByaXZhdGVNZWRpYUZvdW5kYXRpb246OmVuZEdldEV2ZW50KToKKyAgICAgICAgKFdl
YkNvcmU6Ok1lZGlhUGxheWVyUHJpdmF0ZU1lZGlhRm91bmRhdGlvbjo6b25Ub3BvbG9neVNldCk6
CisgICAgICAgIChXZWJDb3JlOjpNZWRpYVBsYXllclByaXZhdGVNZWRpYUZvdW5kYXRpb246Om9u
Q3JlYXRlZE1lZGlhU291cmNlQ2FsbGJhY2spOgorICAgICAgICAoV2ViQ29yZTo6TWVkaWFQbGF5
ZXJQcml2YXRlTWVkaWFGb3VuZGF0aW9uOjpvblRvcG9sb2d5U2V0Q2FsbGJhY2spOgorICAgICAg
ICAqIHBsYXRmb3JtL2dyYXBoaWNzL3dpbi9NZWRpYVBsYXllclByaXZhdGVNZWRpYUZvdW5kYXRp
b24uaDoKKwogMjAxNS0wMy0zMCAgQW50dGkgS29pdmlzdG8gIDxhbnR0aUBhcHBsZS5jb20+CiAK
ICAgICAgICAgRG9uJ3QgY2FjaGUgcmVzb3VyY2VzIHRoYXQgYXJlIHZlcnkgdW5saWtlbHkgdG8g
YmUgcmV1c2VkCkluZGV4OiBTb3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9ncmFwaGljcy93aW4vTWVk
aWFQbGF5ZXJQcml2YXRlTWVkaWFGb3VuZGF0aW9uLmNwcAo9PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2Uv
V2ViQ29yZS9wbGF0Zm9ybS9ncmFwaGljcy93aW4vTWVkaWFQbGF5ZXJQcml2YXRlTWVkaWFGb3Vu
ZGF0aW9uLmNwcAkocmV2aXNpb24gMTgyMDU3KQorKysgU291cmNlL1dlYkNvcmUvcGxhdGZvcm0v
Z3JhcGhpY3Mvd2luL01lZGlhUGxheWVyUHJpdmF0ZU1lZGlhRm91bmRhdGlvbi5jcHAJKHdvcmtp
bmcgY29weSkKQEAgLTc4LDYgKzc4LDggQEAgTWVkaWFQbGF5ZXJQcml2YXRlTWVkaWFGb3VuZGF0
aW9uOjp+TWVkaQogICAgIG5vdGlmeURlbGV0ZWQoKTsKICAgICBkZXN0cm95VmlkZW9XaW5kb3co
KTsKICAgICBlbmRTZXNzaW9uKCk7CisgICAgY2FuY2VsQ2FsbE9uTWFpblRocmVhZChvblRvcG9s
b2d5U2V0Q2FsbGJhY2ssIHRoaXMpOworICAgIGNhbmNlbENhbGxPbk1haW5UaHJlYWQob25DcmVh
dGVkTWVkaWFTb3VyY2VDYWxsYmFjaywgdGhpcyk7CiB9CiAKIHZvaWQgTWVkaWFQbGF5ZXJQcml2
YXRlTWVkaWFGb3VuZGF0aW9uOjpyZWdpc3Rlck1lZGlhRW5naW5lKE1lZGlhRW5naW5lUmVnaXN0
cmFyIHJlZ2lzdHJhcikKQEAgLTM0MCw5ICszNDIsNyBAQCBib29sIE1lZGlhUGxheWVyUHJpdmF0
ZU1lZGlhRm91bmRhdGlvbjo6CiAgICAgaHIgPSBhc3luY1Jlc3VsdC0+R2V0U3RhdHVzKCk7CiAg
ICAgbV9sb2FkaW5nUHJvZ3Jlc3MgPSBTVUNDRUVERUQoaHIpOwogCi0gICAgY2FsbE9uTWFpblRo
cmVhZChbdGhpc10gewotICAgICAgICBvbkNyZWF0ZWRNZWRpYVNvdXJjZSgpOwotICAgIH0pOwor
ICAgIGNhbGxPbk1haW5UaHJlYWQob25DcmVhdGVkTWVkaWFTb3VyY2VDYWxsYmFjaywgdGhpcyk7
CiAKICAgICByZXR1cm4gdHJ1ZTsKIH0KQEAgLTM2Nyw5ICszNjcsNyBAQCBib29sIE1lZGlhUGxh
eWVyUHJpdmF0ZU1lZGlhRm91bmRhdGlvbjo6CiAKICAgICBzd2l0Y2ggKG1lZGlhRXZlbnRUeXBl
KSB7CiAgICAgY2FzZSBNRVNlc3Npb25Ub3BvbG9neVNldDoKLSAgICAgICAgY2FsbE9uTWFpblRo
cmVhZChbdGhpc10gewotICAgICAgICAgICAgb25Ub3BvbG9neVNldCgpOwotICAgICAgICB9KTsK
KyAgICAgICAgY2FsbE9uTWFpblRocmVhZChvblRvcG9sb2d5U2V0Q2FsbGJhY2ssIHRoaXMpOwog
ICAgICAgICBicmVhazsKIAogICAgIGNhc2UgTUVTZXNzaW9uQ2xvc2VkOgpAQCAtNjQ1LDYgKzY0
MywxOCBAQCB2b2lkIE1lZGlhUGxheWVyUHJpdmF0ZU1lZGlhRm91bmRhdGlvbjo6CiAgICAgbV9w
bGF5ZXItPnBsYXliYWNrU3RhdGVDaGFuZ2VkKCk7CiB9CiAKK3ZvaWQgTWVkaWFQbGF5ZXJQcml2
YXRlTWVkaWFGb3VuZGF0aW9uOjpvbkNyZWF0ZWRNZWRpYVNvdXJjZUNhbGxiYWNrKHZvaWQqIGNv
bnRleHQpCit7CisgICAgTWVkaWFQbGF5ZXJQcml2YXRlTWVkaWFGb3VuZGF0aW9uKiBtZWRpYVBs
YXllciA9IHN0YXRpY19jYXN0PE1lZGlhUGxheWVyUHJpdmF0ZU1lZGlhRm91bmRhdGlvbio+KGNv
bnRleHQpOworICAgIG1lZGlhUGxheWVyLT5vbkNyZWF0ZWRNZWRpYVNvdXJjZSgpOworfQorCit2
b2lkIE1lZGlhUGxheWVyUHJpdmF0ZU1lZGlhRm91bmRhdGlvbjo6b25Ub3BvbG9neVNldENhbGxi
YWNrKHZvaWQqIGNvbnRleHQpCit7CisgICAgTWVkaWFQbGF5ZXJQcml2YXRlTWVkaWFGb3VuZGF0
aW9uKiBtZWRpYVBsYXllciA9IHN0YXRpY19jYXN0PE1lZGlhUGxheWVyUHJpdmF0ZU1lZGlhRm91
bmRhdGlvbio+KGNvbnRleHQpOworICAgIG1lZGlhUGxheWVyLT5vblRvcG9sb2d5U2V0KCk7Cit9
CisKIE1lZGlhUGxheWVyUHJpdmF0ZU1lZGlhRm91bmRhdGlvbjo6QXN5bmNDYWxsYmFjazo6QXN5
bmNDYWxsYmFjayhNZWRpYVBsYXllclByaXZhdGVNZWRpYUZvdW5kYXRpb24qIG1lZGlhUGxheWVy
LCBib29sIGV2ZW50KQogICAgIDogbV9yZWZDb3VudCgwKQogICAgICwgbV9tZWRpYVBsYXllciht
ZWRpYVBsYXllcikKSW5kZXg6IFNvdXJjZS9XZWJDb3JlL3BsYXRmb3JtL2dyYXBoaWNzL3dpbi9N
ZWRpYVBsYXllclByaXZhdGVNZWRpYUZvdW5kYXRpb24uaAo9PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2Uv
V2ViQ29yZS9wbGF0Zm9ybS9ncmFwaGljcy93aW4vTWVkaWFQbGF5ZXJQcml2YXRlTWVkaWFGb3Vu
ZGF0aW9uLmgJKHJldmlzaW9uIDE4MjA1NykKKysrIFNvdXJjZS9XZWJDb3JlL3BsYXRmb3JtL2dy
YXBoaWNzL3dpbi9NZWRpYVBsYXllclByaXZhdGVNZWRpYUZvdW5kYXRpb24uaAkod29ya2luZyBj
b3B5KQpAQCAtMTEwLDYgKzExMCw4IEBAIHByaXZhdGU6CiAKICAgICB2b2lkIG9uQ3JlYXRlZE1l
ZGlhU291cmNlKCk7CiAgICAgdm9pZCBvblRvcG9sb2d5U2V0KCk7CisgICAgc3RhdGljIHZvaWQg
b25DcmVhdGVkTWVkaWFTb3VyY2VDYWxsYmFjayh2b2lkKiBjb250ZXh0KTsKKyAgICBzdGF0aWMg
dm9pZCBvblRvcG9sb2d5U2V0Q2FsbGJhY2sodm9pZCogY29udGV4dCk7CiAKICAgICBMUENXU1RS
IHJlZ2lzdGVyVmlkZW9XaW5kb3dDbGFzcygpOwogICAgIHZvaWQgY3JlYXRlVmlkZW9XaW5kb3co
KTsK
</data>

          </attachment>
      

    </bug>

</bugzilla>