<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>143521</bug_id>
          
          <creation_ts>2015-04-08 06:34:06 -0700</creation_ts>
          <short_desc>[GTK] Crash in DOMObjectCache when a wrapped object owned by the cache is unreffed by the user</short_desc>
          <delta_ts>2015-04-08 08:30:27 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>WebKitGTK</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>Unspecified</rep_platform>
          <op_sys>Unspecified</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>Gtk</keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Carlos Garcia Campos">cgarcia</reporter>
          <assigned_to name="Nobody">webkit-unassigned</assigned_to>
          <cc>gustavo</cc>
    
    <cc>mcrha</cc>
    
    <cc>mrobinson</cc>
    
    <cc>pnormand</cc>
    
    <cc>svillar</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>1083594</commentid>
    <comment_count>0</comment_count>
    <who name="Carlos Garcia Campos">cgarcia</who>
    <bug_when>2015-04-08 06:34:06 -0700</bug_when>
    <thetext>This is a case we claim to support, but it only works if the object has only one reference. In that case, when the user unrefs it, the weak ref notify callback removes the object from the cache. However, if the object has more than one ref, the cache doesn&apos;t know the user unreffed it, and when clearing the cache we try to remove more references that what the object actually has, causing a crash in g_object_unref. See the backtrace in bug #118788.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1083595</commentid>
    <comment_count>1</comment_count>
      <attachid>250347</attachid>
    <who name="Carlos Garcia Campos">cgarcia</who>
    <bug_when>2015-04-08 06:37:10 -0700</bug_when>
    <thetext>Created attachment 250347
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1083604</commentid>
    <comment_count>2</comment_count>
      <attachid>250347</attachid>
    <who name="Martin Robinson">mrobinson</who>
    <bug_when>2015-04-08 07:36:31 -0700</bug_when>
    <thetext>Comment on attachment 250347
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=250347&amp;action=review

&gt; Source/WebCore/ChangeLog:13
&gt; +        try to remove more references that what the object actually has,

Nit: that what -&gt; than what

&gt; Source/WebCore/bindings/gobject/DOMObjectCache.cpp:48
&gt; +        cacheReferences = std::min(static_cast&lt;unsigned&gt;(object-&gt;ref_count), cacheReferences);

It might be worth dropping a comment here explaining why cacheReferences might be incorrect at this point.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1083609</commentid>
    <comment_count>3</comment_count>
      <attachid>250347</attachid>
    <who name="Sergio Villar Senin">svillar</who>
    <bug_when>2015-04-08 07:50:59 -0700</bug_when>
    <thetext>Comment on attachment 250347
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=250347&amp;action=review

&gt;&gt; Source/WebCore/bindings/gobject/DOMObjectCache.cpp:48
&gt;&gt; +        cacheReferences = std::min(static_cast&lt;unsigned&gt;(object-&gt;ref_count), cacheReferences);
&gt; 
&gt; It might be worth dropping a comment here explaining why cacheReferences might be incorrect at this point.

Also, coulnd&apos;t we completely forget about cacheReferences and simply use GObject&apos;s ref_count ?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1083610</commentid>
    <comment_count>4</comment_count>
    <who name="Martin Robinson">mrobinson</who>
    <bug_when>2015-04-08 07:59:33 -0700</bug_when>
    <thetext>(In reply to comment #3)
 
&gt; Also, coulnd&apos;t we completely forget about cacheReferences and simply use
&gt; GObject&apos;s ref_count ?

I don&apos;t think we can, because if the user explicitly refs the object, we should not delete it.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1083615</commentid>
    <comment_count>5</comment_count>
    <who name="Carlos Garcia Campos">cgarcia</who>
    <bug_when>2015-04-08 08:19:12 -0700</bug_when>
    <thetext>(In reply to comment #4)
&gt; (In reply to comment #3)
&gt;  
&gt; &gt; Also, coulnd&apos;t we completely forget about cacheReferences and simply use
&gt; &gt; GObject&apos;s ref_count ?
&gt; 
&gt; I don&apos;t think we can, because if the user explicitly refs the object, we
&gt; should not delete it.

Exactly, cacheReferences only keeps track of the references owned by the cache itself. In a normal case, we just drop our refs, but users can do weird things.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1083616</commentid>
    <comment_count>6</comment_count>
    <who name="Carlos Garcia Campos">cgarcia</who>
    <bug_when>2015-04-08 08:19:56 -0700</bug_when>
    <thetext>(In reply to comment #2)
&gt; Comment on attachment 250347 [details]
&gt; Patch
&gt; 
&gt; View in context:
&gt; https://bugs.webkit.org/attachment.cgi?id=250347&amp;action=review
&gt; 
&gt; &gt; Source/WebCore/ChangeLog:13
&gt; &gt; +        try to remove more references that what the object actually has,
&gt; 
&gt; Nit: that what -&gt; than what

I always doubt :-P
 
&gt; &gt; Source/WebCore/bindings/gobject/DOMObjectCache.cpp:48
&gt; &gt; +        cacheReferences = std::min(static_cast&lt;unsigned&gt;(object-&gt;ref_count), cacheReferences);
&gt; 
&gt; It might be worth dropping a comment here explaining why cacheReferences
&gt; might be incorrect at this point.

Sure!</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1083617</commentid>
    <comment_count>7</comment_count>
    <who name="Carlos Garcia Campos">cgarcia</who>
    <bug_when>2015-04-08 08:30:27 -0700</bug_when>
    <thetext>Committed r182537: &lt;http://trac.webkit.org/changeset/182537&gt;</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>250347</attachid>
            <date>2015-04-08 06:37:10 -0700</date>
            <delta_ts>2015-04-08 07:36:31 -0700</delta_ts>
            <desc>Patch</desc>
            <filename>wk-dom-cache-crash.diff</filename>
            <type>text/plain</type>
            <size>7230</size>
            <attacher name="Carlos Garcia Campos">cgarcia</attacher>
            
              <data encoding="base64">ZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZyBiL1NvdXJjZS9XZWJDb3JlL0No
YW5nZUxvZwppbmRleCA2NGEwNmNmLi5kZjU4ODg1IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29y
ZS9DaGFuZ2VMb2cKKysrIGIvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMjEg
QEAKKzIwMTUtMDQtMDggIENhcmxvcyBHYXJjaWEgQ2FtcG9zICA8Y2dhcmNpYUBpZ2FsaWEuY29t
PgorCisgICAgICAgIFtHVEtdIENyYXNoIGluIERPTU9iamVjdENhY2hlIHdoZW4gYSB3cmFwcGVk
IG9iamVjdCBvd25lZCBieSB0aGUgY2FjaGUgaXMgdW5yZWZmZWQgYnkgdGhlIHVzZXIKKyAgICAg
ICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE0MzUyMQorCisgICAg
ICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIFRoaXMgaXMgYSBjYXNl
IHdlIGNsYWltIHRvIHN1cHBvcnQsIGJ1dCBpdCBvbmx5IHdvcmtzIGlmIHRoZQorICAgICAgICBv
YmplY3QgaGFzIG9ubHkgb25lIHJlZmVyZW5jZS4gSW4gdGhhdCBjYXNlLCB3aGVuIHRoZSB1c2Vy
IHVucmVmcworICAgICAgICBpdCwgdGhlIHdlYWsgcmVmIG5vdGlmeSBjYWxsYmFjayByZW1vdmVz
IHRoZSBvYmplY3QgZnJvbSB0aGUKKyAgICAgICAgY2FjaGUuIEhvd2V2ZXIsIGlmIHRoZSBvYmpl
Y3QgaGFzIG1vcmUgdGhhbiBvbmUgcmVmLCB0aGUgY2FjaGUKKyAgICAgICAgZG9lc24ndCBrbm93
IHRoZSB1c2VyIHVucmVmZmVkIGl0LCBhbmQgd2hlbiBjbGVhcmluZyB0aGUgY2FjaGUgd2UKKyAg
ICAgICAgdHJ5IHRvIHJlbW92ZSBtb3JlIHJlZmVyZW5jZXMgdGhhdCB3aGF0IHRoZSBvYmplY3Qg
YWN0dWFsbHkgaGFzLAorICAgICAgICBjYXVzaW5nIGEgY3Jhc2ggaW4gZ19vYmplY3RfdW5yZWYu
CisKKyAgICAgICAgKiBiaW5kaW5ncy9nb2JqZWN0L0RPTU9iamVjdENhY2hlLmNwcDoKKyAgICAg
ICAgKFdlYktpdDo6RE9NT2JqZWN0Q2FjaGVEYXRhOjpjbGVhck9iamVjdCk6CisKIDIwMTUtMDQt
MDggIFBoaWxpcHBlIE5vcm1hbmQgIDxwbm9ybWFuZEBpZ2FsaWEuY29tPgogCiAgICAgICAgIFtH
U3RyZWFtZXJdIGNvbXByZXNzIHByb3BlcnR5IGZvciB0aGUgSFRUUCBzb3VyY2UgZWxlbWVudApk
aWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvYmluZGluZ3MvZ29iamVjdC9ET01PYmplY3RDYWNo
ZS5jcHAgYi9Tb3VyY2UvV2ViQ29yZS9iaW5kaW5ncy9nb2JqZWN0L0RPTU9iamVjdENhY2hlLmNw
cAppbmRleCA0NzEwNzY4Li40Y2RlMmM3IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9iaW5k
aW5ncy9nb2JqZWN0L0RPTU9iamVjdENhY2hlLmNwcAorKysgYi9Tb3VyY2UvV2ViQ29yZS9iaW5k
aW5ncy9nb2JqZWN0L0RPTU9iamVjdENhY2hlLmNwcApAQCAtNDMsNyArNDMsOSBAQCBzdHJ1Y3Qg
RE9NT2JqZWN0Q2FjaGVEYXRhIHsKICAgICB7CiAgICAgICAgIEFTU0VSVChvYmplY3QpOwogICAg
ICAgICBBU1NFUlQoY2FjaGVSZWZlcmVuY2VzID49IDEpOworICAgICAgICBBU1NFUlQob2JqZWN0
LT5yZWZfY291bnQgPj0gMSk7CiAKKyAgICAgICAgY2FjaGVSZWZlcmVuY2VzID0gc3RkOjptaW4o
c3RhdGljX2Nhc3Q8dW5zaWduZWQ+KG9iamVjdC0+cmVmX2NvdW50KSwgY2FjaGVSZWZlcmVuY2Vz
KTsKICAgICAgICAgR1JlZlB0cjxHT2JqZWN0PiBwcm90ZWN0KG9iamVjdCk7CiAgICAgICAgIGRv
IHsKICAgICAgICAgICAgIGdfb2JqZWN0X3VucmVmKG9iamVjdCk7CmRpZmYgLS1naXQgYS9Ub29s
cy9DaGFuZ2VMb2cgYi9Ub29scy9DaGFuZ2VMb2cKaW5kZXggOTRmZTIwNy4uODQxOGVhZCAxMDA2
NDQKLS0tIGEvVG9vbHMvQ2hhbmdlTG9nCisrKyBiL1Rvb2xzL0NoYW5nZUxvZwpAQCAtMSwzICsx
LDIyIEBACisyMDE1LTA0LTA4ICBDYXJsb3MgR2FyY2lhIENhbXBvcyAgPGNnYXJjaWFAaWdhbGlh
LmNvbT4KKworICAgICAgICBbR1RLXSBDcmFzaCBpbiBET01PYmplY3RDYWNoZSB3aGVuIGEgd3Jh
cHBlZCBvYmplY3Qgb3duZWQgYnkgdGhlIGNhY2hlIGlzIHVucmVmZmVkIGJ5IHRoZSB1c2VyCisg
ICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNDM1MjEKKwor
ICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBBZGQgYSB3YXkg
dG8gZGV0ZWN0IHVuZXhwZWN0ZWQgd2ViIHByb2Nlc3MgY3Jhc2hlcyB0byBXZWJWaWV3VGVzdCwK
KyAgICAgICAgYW5kIGEgdGVzdCBjYXNlIHRvIHRlc3RET01DYWNoZSB0byB0cmlnZ2VyIHRoZSBj
cmFzaC4KKworICAgICAgICAqIFRlc3RXZWJLaXRBUEkvVGVzdHMvV2ViS2l0Mkd0ay9ET01Ob2Rl
VGVzdC5jcHA6CisgICAgICAgIChXZWJLaXRET01Ob2RlVGVzdDo6dGVzdERPTUNhY2hlKToKKyAg
ICAgICAgKiBUZXN0V2ViS2l0QVBJL1Rlc3RzL1dlYktpdDJHdGsvVGVzdFdlYkV4dGVuc2lvbnMu
Y3BwOgorICAgICAgICAodGVzdFdlYktpdFdlYlZpZXdQcm9jZXNzQ3Jhc2hlZCk6CisgICAgICAg
ICogVGVzdFdlYktpdEFQSS9ndGsvV2ViS2l0Mkd0ay9XZWJWaWV3VGVzdC5jcHA6CisgICAgICAg
IChXZWJWaWV3VGVzdDo6V2ViVmlld1Rlc3QpOgorICAgICAgICAoV2ViVmlld1Rlc3Q6OndlYlBy
b2Nlc3NDcmFzaGVkKToKKyAgICAgICAgKiBUZXN0V2ViS2l0QVBJL2d0ay9XZWJLaXQyR3RrL1dl
YlZpZXdUZXN0Lmg6CisKIDIwMTUtMDQtMDcgIEFsZXhleSBQcm9za3VyeWFrb3YgIDxhcEBhcHBs
ZS5jb20+CiAKICAgICAgICAgUGFnZVZpc2liaWxpdHlTdGF0ZVdpdGhXaW5kb3dDaGFuZ2VzIHNo
b3VsZCBvbmx5IGJlIGVuYWJsZWQgb24gWW9zZW1pdGUKZGlmZiAtLWdpdCBhL1Rvb2xzL1Rlc3RX
ZWJLaXRBUEkvVGVzdHMvV2ViS2l0Mkd0ay9ET01Ob2RlVGVzdC5jcHAgYi9Ub29scy9UZXN0V2Vi
S2l0QVBJL1Rlc3RzL1dlYktpdDJHdGsvRE9NTm9kZVRlc3QuY3BwCmluZGV4IDMxMTU3OTcuLmM4
MzM5YzUgMTAwNjQ0Ci0tLSBhL1Rvb2xzL1Rlc3RXZWJLaXRBUEkvVGVzdHMvV2ViS2l0Mkd0ay9E
T01Ob2RlVGVzdC5jcHAKKysrIGIvVG9vbHMvVGVzdFdlYktpdEFQSS9UZXN0cy9XZWJLaXQyR3Rr
L0RPTU5vZGVUZXN0LmNwcApAQCAtMjMxLDYgKzIzMSwxMiBAQCBwcml2YXRlOgogICAgICAgICBn
X2Fzc2VydChXRUJLSVRfRE9NX0lTX0hUTUxfUEFSQUdSQVBIX0VMRU1FTlQocDIuZ2V0KCkpKTsK
ICAgICAgICAgYXNzZXJ0T2JqZWN0SXNEZWxldGVkV2hlblRlc3RGaW5pc2hlcyhHX09CSkVDVChw
Mi5nZXQoKSkpOwogCisgICAgICAgIC8vIE1hbnVhbGx5IGhhbmRsaW5nIGEgRE9NIG9iamVjdCBv
d25lZCBieSB0aGUgY2FjaGUgc2hvdWxkbid0IGNyYXNoIHdoZW4gdGhlIGNhY2hlIGhhcyBtb3Jl
IHRoYW4gb25lIHJlZmVyZW5jZS4KKyAgICAgICAgR1JlZlB0cjxXZWJLaXRET01FbGVtZW50PiBw
MyA9IGFkb3B0R1JlZih3ZWJraXRfZG9tX2RvY3VtZW50X2NyZWF0ZV9lbGVtZW50KGRvY3VtZW50
LCAiUCIsIG51bGxwdHIpKTsKKyAgICAgICAgZ19hc3NlcnQoV0VCS0lUX0RPTV9JU19IVE1MX1BB
UkFHUkFQSF9FTEVNRU5UKHAzLmdldCgpKSk7CisgICAgICAgIGFzc2VydE9iamVjdElzRGVsZXRl
ZFdoZW5UZXN0RmluaXNoZXMoR19PQkpFQ1QocDMuZ2V0KCkpKTsKKyAgICAgICAgd2Via2l0X2Rv
bV9ub2RlX2FwcGVuZF9jaGlsZChXRUJLSVRfRE9NX05PREUoZGl2KSwgV0VCS0lUX0RPTV9OT0RF
KHAzLmdldCgpKSwgbnVsbHB0cik7CisKICAgICAgICAgLy8gRE9NIG9iamVjdHMgcmVtb3ZlZCBm
cm9tIHRoZSBkb2N1bWVudCBhcmUgYWxzbyBjb3JyZWN0bHkgaGFuZGxlZCBieSB0aGUgY2FjaGUu
CiAgICAgICAgIFdlYktpdERPTUVsZW1lbnQqIGEgPSB3ZWJraXRfZG9tX2RvY3VtZW50X2NyZWF0
ZV9lbGVtZW50KGRvY3VtZW50LCAiQSIsIG51bGxwdHIpOwogICAgICAgICBnX2Fzc2VydChXRUJL
SVRfRE9NX0lTX0VMRU1FTlQoYSkpOwpkaWZmIC0tZ2l0IGEvVG9vbHMvVGVzdFdlYktpdEFQSS9U
ZXN0cy9XZWJLaXQyR3RrL1Rlc3RXZWJFeHRlbnNpb25zLmNwcCBiL1Rvb2xzL1Rlc3RXZWJLaXRB
UEkvVGVzdHMvV2ViS2l0Mkd0ay9UZXN0V2ViRXh0ZW5zaW9ucy5jcHAKaW5kZXggNzkxMTNiMS4u
NGEwOTRkMCAxMDA2NDQKLS0tIGEvVG9vbHMvVGVzdFdlYktpdEFQSS9UZXN0cy9XZWJLaXQyR3Rr
L1Rlc3RXZWJFeHRlbnNpb25zLmNwcAorKysgYi9Ub29scy9UZXN0V2ViS2l0QVBJL1Rlc3RzL1dl
YktpdDJHdGsvVGVzdFdlYkV4dGVuc2lvbnMuY3BwCkBAIC04OCw5ICs4OCwxMSBAQCBzdGF0aWMg
dm9pZCB0ZXN0V2ViS2l0V2ViVmlld1Byb2Nlc3NDcmFzaGVkKFdlYlZpZXdUZXN0KiB0ZXN0LCBn
Y29uc3Rwb2ludGVyKQogICAgIHRlc3QtPmxvYWRIdG1sKCI8aHRtbD48L2h0bWw+IiwgMCk7CiAg
ICAgdGVzdC0+d2FpdFVudGlsTG9hZEZpbmlzaGVkKCk7CiAKLSAgICBnX3NpZ25hbF9jb25uZWN0
KHRlc3QtPm1fd2ViVmlldywgIndlYi1wcm9jZXNzLWNyYXNoZWQiLAorICAgIGdfc2lnbmFsX2Nv
bm5lY3RfYWZ0ZXIodGVzdC0+bV93ZWJWaWV3LCAid2ViLXByb2Nlc3MtY3Jhc2hlZCIsCiAgICAg
ICAgIEdfQ0FMTEJBQ0sod2ViUHJvY2Vzc0NyYXNoZWRDYWxsYmFjayksIHRlc3QpOwogCisgICAg
dGVzdC0+bV9leHBlY3RlZFdlYlByb2Nlc3NDcmFzaCA9IHRydWU7CisKICAgICBHVW5pcXVlUHRy
PGNoYXI+IGV4dGVuc2lvbkJ1c05hbWUoZ19zdHJkdXBfcHJpbnRmKCJvcmcud2Via2l0Lmd0ay5X
ZWJFeHRlbnNpb25UZXN0JXUiLCBUZXN0OjpzX3dlYkV4dGVuc2lvbklEKSk7CiAgICAgR1JlZlB0
cjxHREJ1c1Byb3h5PiBwcm94eSA9IGFkb3B0R1JlZihidXMtPmNyZWF0ZVByb3h5KGV4dGVuc2lv
bkJ1c05hbWUuZ2V0KCksCiAgICAgICAgICIvb3JnL3dlYmtpdC9ndGsvV2ViRXh0ZW5zaW9uVGVz
dCIsICJvcmcud2Via2l0Lmd0ay5XZWJFeHRlbnNpb25UZXN0IiwgdGVzdC0+bV9tYWluTG9vcCkp
OwpAQCAtMTAzLDYgKzEwNSw3IEBAIHN0YXRpYyB2b2lkIHRlc3RXZWJLaXRXZWJWaWV3UHJvY2Vz
c0NyYXNoZWQoV2ViVmlld1Rlc3QqIHRlc3QsIGdjb25zdHBvaW50ZXIpCiAgICAgICAgIC0xLCAw
LCAwKSk7CiAgICAgZ19hc3NlcnQoIXJlc3VsdCk7CiAgICAgZ19tYWluX2xvb3BfcnVuKHRlc3Qt
Pm1fbWFpbkxvb3ApOworICAgIHRlc3QtPm1fZXhwZWN0ZWRXZWJQcm9jZXNzQ3Jhc2ggPSBmYWxz
ZTsKIH0KIAogc3RhdGljIHZvaWQgdGVzdFdlYkV4dGVuc2lvbldpbmRvd09iamVjdENsZWFyZWQo
V2ViVmlld1Rlc3QqIHRlc3QsIGdjb25zdHBvaW50ZXIpCmRpZmYgLS1naXQgYS9Ub29scy9UZXN0
V2ViS2l0QVBJL2d0ay9XZWJLaXQyR3RrL1dlYlZpZXdUZXN0LmNwcCBiL1Rvb2xzL1Rlc3RXZWJL
aXRBUEkvZ3RrL1dlYktpdDJHdGsvV2ViVmlld1Rlc3QuY3BwCmluZGV4IGIwMzI5ZmUuLmVlMTdl
ZjAgMTAwNjQ0Ci0tLSBhL1Rvb2xzL1Rlc3RXZWJLaXRBUEkvZ3RrL1dlYktpdDJHdGsvV2ViVmll
d1Rlc3QuY3BwCisrKyBiL1Rvb2xzL1Rlc3RXZWJLaXRBUEkvZ3RrL1dlYktpdDJHdGsvV2ViVmll
d1Rlc3QuY3BwCkBAIC0zMSw4ICszMSwxMCBAQCBXZWJWaWV3VGVzdDo6V2ViVmlld1Rlc3QoV2Vi
S2l0VXNlckNvbnRlbnRNYW5hZ2VyKiB1c2VyQ29udGVudE1hbmFnZXIpCiAgICAgLCBtX2phdmFz
Y3JpcHRSZXN1bHQobnVsbHB0cikKICAgICAsIG1fcmVzb3VyY2VEYXRhU2l6ZSgwKQogICAgICwg
bV9zdXJmYWNlKG51bGxwdHIpCisgICAgLCBtX2V4cGVjdGVkV2ViUHJvY2Vzc0NyYXNoKGZhbHNl
KQogewogICAgIGFzc2VydE9iamVjdElzRGVsZXRlZFdoZW5UZXN0RmluaXNoZXMoR19PQkpFQ1Qo
bV93ZWJWaWV3KSk7CisgICAgZ19zaWduYWxfY29ubmVjdChtX3dlYlZpZXcsICJ3ZWItcHJvY2Vz
cy1jcmFzaGVkIiwgR19DQUxMQkFDSyhXZWJWaWV3VGVzdDo6d2ViUHJvY2Vzc0NyYXNoZWQpLCB0
aGlzKTsKIH0KIAogV2ViVmlld1Rlc3Q6On5XZWJWaWV3VGVzdCgpCkBAIC00Nyw2ICs0OSwxNiBA
QCBXZWJWaWV3VGVzdDo6fldlYlZpZXdUZXN0KCkKICAgICBnX21haW5fbG9vcF91bnJlZihtX21h
aW5Mb29wKTsKIH0KIAorZ2Jvb2xlYW4gV2ViVmlld1Rlc3Q6OndlYlByb2Nlc3NDcmFzaGVkKFdl
YktpdFdlYlZpZXcqLCBXZWJWaWV3VGVzdCogdGVzdCkKK3sKKyAgICBpZiAodGVzdC0+bV9leHBl
Y3RlZFdlYlByb2Nlc3NDcmFzaCkgeworICAgICAgICB0ZXN0LT5tX2V4cGVjdGVkV2ViUHJvY2Vz
c0NyYXNoID0gZmFsc2U7CisgICAgICAgIHJldHVybiBGQUxTRTsKKyAgICB9CisgICAgZ19hc3Nl
cnRfbm90X3JlYWNoZWQoKTsKKyAgICByZXR1cm4gVFJVRTsKK30KKwogdm9pZCBXZWJWaWV3VGVz
dDo6bG9hZFVSSShjb25zdCBjaGFyKiB1cmkpCiB7CiAgICAgbV9hY3RpdmVVUkkgPSB1cmk7CmRp
ZmYgLS1naXQgYS9Ub29scy9UZXN0V2ViS2l0QVBJL2d0ay9XZWJLaXQyR3RrL1dlYlZpZXdUZXN0
LmggYi9Ub29scy9UZXN0V2ViS2l0QVBJL2d0ay9XZWJLaXQyR3RrL1dlYlZpZXdUZXN0LmgKaW5k
ZXggNjA5ODVlMC4uM2Y5OWQyMSAxMDA2NDQKLS0tIGEvVG9vbHMvVGVzdFdlYktpdEFQSS9ndGsv
V2ViS2l0Mkd0ay9XZWJWaWV3VGVzdC5oCisrKyBiL1Rvb2xzL1Rlc3RXZWJLaXRBUEkvZ3RrL1dl
YktpdDJHdGsvV2ViVmlld1Rlc3QuaApAQCAtNzgsNiArNzgsOCBAQCBwdWJsaWM6CiAgICAgLy8g
aW4gb3VyIGNvbnN0cnVjdG9yLCBiZWZvcmUgYSBkZXJpdmVkIGNsYXNzJ3MgdnRhYmxlIGlzIHJl
YWR5LgogICAgIHZvaWQgaW5pdGlhbGl6ZVdlYkV4dGVuc2lvbnMoKSBvdmVycmlkZSBmaW5hbCB7
IFRlc3Q6OmluaXRpYWxpemVXZWJFeHRlbnNpb25zKCk7IH0KIAorICAgIHN0YXRpYyBnYm9vbGVh
biB3ZWJQcm9jZXNzQ3Jhc2hlZChXZWJLaXRXZWJWaWV3KiwgV2ViVmlld1Rlc3QqKTsKKwogICAg
IFdlYktpdFdlYlZpZXcqIG1fd2ViVmlldzsKICAgICBHTWFpbkxvb3AqIG1fbWFpbkxvb3A7CiAg
ICAgQ1N0cmluZyBtX2FjdGl2ZVVSSTsKQEAgLTg4LDYgKzkwLDcgQEAgcHVibGljOgogICAgIEdV
bmlxdWVQdHI8Y2hhcj4gbV9yZXNvdXJjZURhdGE7CiAgICAgc2l6ZV90IG1fcmVzb3VyY2VEYXRh
U2l6ZTsKICAgICBjYWlyb19zdXJmYWNlX3QqIG1fc3VyZmFjZTsKKyAgICBib29sIG1fZXhwZWN0
ZWRXZWJQcm9jZXNzQ3Jhc2g7CiAKIHByaXZhdGU6CiAgICAgdm9pZCBkb01vdXNlQnV0dG9uRXZl
bnQoR2RrRXZlbnRUeXBlLCBpbnQsIGludCwgdW5zaWduZWQsIHVuc2lnbmVkKTsK
</data>
<flag name="review"
          id="275143"
          type_id="1"
          status="+"
          setter="mrobinson"
    />
          </attachment>
      

    </bug>

</bugzilla>