145964 2015-06-14 17:11:52 -0700 REGRESSION (r182215): Reproducible crash at drawsvg.org due to reentrant layout 2015-06-15 15:02:42 -0700 1 1 1 Unclassified WebKit SVG 528+ (Nightly build) All All RESOLVED FIXED InRadar P2 Normal --- 1 darin darin commit-queue sabouhallawa simon.fraser zimmermann oldest_to_newest 1101869 0 darin 2015-06-14 17:11:52 -0700 REGRESSION (r182215): Reproducible crash at drawsvg.org due to reentrant layout 1101870 1 254864 darin 2015-06-14 17:14:54 -0700 Created attachment 254864 Patch 1101881 2 ap 2015-06-14 22:57:37 -0700 rdar://problem/21328402 1101930 3 simon.fraser 2015-06-15 08:20:42 -0700 Said and I discussed an alternative approach, which was to not have getBBox force layout when called from the event region code. 1101959 4 darin 2015-06-15 10:34:22 -0700 (In reply to comment #3) > Said and I discussed an alternative approach, which was to not have getBBox > force layout when called from the event region code. That also sounds OK. 1101962 5 simon.fraser 2015-06-15 10:39:53 -0700 Specifically, Element::boundsInRootViewSpace() should call svgElement.getBoundingBox(localRect, DisallowStyleUpdate). 1101966 6 darin 2015-06-15 10:48:57 -0700 OK. But what are the pros and cons of the two solutions? I believe my fix deals with other potential problems that could occur if a layout begins in a subframe and then affects the parent frame. I’d really like someone to review+ or review- this patch so we can get on with other things. 1101967 7 darin 2015-06-15 10:49:32 -0700 Do you prefer the boundsInRootViewSpace fix to this one? If so, please say so. 1101976 8 sabouhallawa 2015-06-15 11:20:46 -0700 I tried the attached patch and the bug is fixed. I am not sure what side effects can this patch cause since the ChangeLog does not include any explanation on why this fix should be correct. I tried calling svgElement.getBoundingBox(localRect, SVGLocatable::DisallowStyleUpdate) in Element::absoluteEventBounds but I got the following crash. #1 0x0000000111126c11 in WebCore::RenderLayerCompositor::requiresCompositingForScrollableFrame() const at /Volumes/Data/WebKit/OpenSource/Source/WebCore/rendering/RenderLayerCompositor.cpp:2451 #2 0x0000000111126864 in WebCore::RenderLayerCompositor::cacheAcceleratedCompositingFlags() at /Volumes/Data/WebKit/OpenSource/Source/WebCore/rendering/RenderLayerCompositor.cpp:345 #3 0x000000011018b5ad in WebCore::FrameView::updateCompositingLayersAfterLayout() at /Volumes/Data/WebKit/OpenSource/Source/WebCore/page/FrameView.cpp:781 #4 0x000000011018d4d0 in WebCore::FrameView::layout(bool) at /Volumes/Data/WebKit/OpenSource/Source/WebCore/page/FrameView.cpp:1387 #5 0x000000010fdd5797 in WebCore::Document::updateLayout() at /Volumes/Data/WebKit/OpenSource/Source/WebCore/dom/Document.cpp:1864 #6 0x000000010fdd927f in WebCore::Document::updateLayoutIgnorePendingStylesheets(WebCore::Document::RunPostLayoutTasks) at /Volumes/Data/WebKit/OpenSource/Source/WebCore/dom/Document.cpp:1896 #7 0x00000001116e0e09 in WebCore::SVGLocatable::getBBox(WebCore::SVGElement*, WebCore::SVGLocatable::StyleUpdateStrategy) at /Volumes/Data/WebKit/OpenSource/Source/WebCore/svg/SVGLocatable.cpp:68 #8 0x00000001116ccb58 in WebCore::SVGGraphicsElement::getBBox(WebCore::SVGLocatable::StyleUpdateStrategy) at /Volumes/Data/WebKit/OpenSource/Source/WebCore/svg/SVGGraphicsElement.cpp:161 #9 0x0000000110afa66f in WebCore::jsSVGGraphicsElementPrototypeFunctionGetBBox(JSC::ExecState*) at /Volumes/Data/WebKit/OpenSource/WebKitBuild/Debug/DerivedSources/WebCore/JSSVGGraphicsElement.cpp:290 I did what Simon suggested above and I got almost the same crash but from a nest FrameView::layout() call. Thread 1Queue : com.apple.main-thread (serial) #0 0x0000000118a50ab7 in ::WTFCrash() at /Volumes/Data/WebKit/OpenSource/Source/WTF/wtf/Assertions.cpp:321 #1 0x000000011bab1c11 in WebCore::RenderLayerCompositor::requiresCompositingForScrollableFrame() const at /Volumes/Data/WebKit/OpenSource/Source/WebCore/rendering/RenderLayerCompositor.cpp:2451 #2 0x000000011bab1864 in WebCore::RenderLayerCompositor::cacheAcceleratedCompositingFlags() at /Volumes/Data/WebKit/OpenSource/Source/WebCore/rendering/RenderLayerCompositor.cpp:345 #3 0x000000011ab165ad in WebCore::FrameView::updateCompositingLayersAfterLayout() at /Volumes/Data/WebKit/OpenSource/Source/WebCore/page/FrameView.cpp:781 #4 0x000000011ab184d0 in WebCore::FrameView::layout(bool) at /Volumes/Data/WebKit/OpenSource/Source/WebCore/page/FrameView.cpp:1387 #5 0x000000011bc6f381 in WebCore::RenderWidget::updateWidgetPosition() at /Volumes/Data/WebKit/OpenSource/Source/WebCore/rendering/RenderWidget.cpp:322 #6 0x000000011ab19dc4 in WebCore::FrameView::updateWidgetPositions() at /Volumes/Data/WebKit/OpenSource/Source/WebCore/page/FrameView.cpp:4720 #7 0x000000011ab18ee6 in WebCore::FrameView::performPostLayoutTasks() at /Volumes/Data/WebKit/OpenSource/Source/WebCore/page/FrameView.cpp:3012 #8 0x000000011ab179a4 in WebCore::FrameView::layout(bool) at /Volumes/Data/WebKit/OpenSource/Source/WebCore/page/FrameView.cpp:1205 #9 0x000000011ab29d79 in WebCore::FrameView::forceLayoutParentViewIfNeeded() at /Volumes/Data/WebKit/OpenSource/Source/WebCore/page/FrameView.cpp:1140 #10 0x000000011ab1826c in WebCore::FrameView::layout(bool) at /Volumes/Data/WebKit/OpenSource/Source/WebCore/page/FrameView.cpp:1335 #11 0x000000011a760787 in WebCore::Document::updateLayout() at /Volumes/Data/WebKit/OpenSource/Source/WebCore/dom/Document.cpp:1864 #12 0x000000011a76426f in WebCore::Document::updateLayoutIgnorePendingStylesheets(WebCore::Document::RunPostLayoutTasks) at /Volumes/Data/WebKit/OpenSource/Source/WebCore/dom/Document.cpp:1896 #13 0x000000011c06be09 in WebCore::SVGLocatable::getBBox(WebCore::SVGElement*, WebCore::SVGLocatable::StyleUpdateStrategy) at /Volumes/Data/WebKit/OpenSource/Source/WebCore/svg/SVGLocatable.cpp:68 #14 0x000000011c057b58 in WebCore::SVGGraphicsElement::getBBox(WebCore::SVGLocatable::StyleUpdateStrategy) at /Volumes/Data/WebKit/OpenSource/Source/WebCore/svg/SVGGraphicsElement.cpp:161 #15 0x000000011b48566f in WebCore::jsSVGGraphicsElementPrototypeFunctionGetBBox(JSC::ExecState*) at /Volumes/Data/WebKit/OpenSource/WebKitBuild/Debug/DerivedSources/WebCore/JSSVGGraphicsElement.cpp:290 I was looking at a different way to fix this bug. I think the real problem is in calling the SVG model function svgElement.getBoundingBox() from the layout code. It seems to me weird to call a high level function, like the SVG element bounding box, from the layout code. It is the cause of the layout reentry. And it is not consistent with the behavior of other elements during layout. 1101979 9 darin 2015-06-15 11:30:31 -0700 (In reply to comment #8) > I tried the attached patch and the bug is fixed. I am not sure what side > effects can this patch cause since the ChangeLog does not include any > explanation on why this fix should be correct. Sorry my ChangeLog wasn’t clear. The problem I fixed is that forceLayoutParentViewIfNeeded is called by FrameView::layout, not as part of layout but in the post-layout period. It’s not safe to reenter FrameView::layout on a different frame during this period for a variety of reasons. To me the getBoundingBox part seems to only be a part of the problem and to me it’s pretty clear this change gets to the root of the problem. Note that forceLayoutParentViewIfNeeded sounds like a general purpose function but is in fact only for SVG. > I was looking at a different way to fix this bug. I think the real problem > is in calling the SVG model function svgElement.getBoundingBox() from the > layout code. It seems to me weird to call a high level function, like the > SVG element bounding box, from the layout code. It is the cause of the > layout reentry. And it is not consistent with the behavior of other elements > during layout. Do we call getBoundingBox from layout code? I’m not sure what exactly “layout code” is. 1101980 10 simon.fraser 2015-06-15 11:33:16 -0700 I don't understand why the SVG is dirty, and does layout even though we've just done a updateLayoutIgnorePendingStylesheets(). 1101984 11 darin 2015-06-15 11:40:42 -0700 (In reply to comment #10) > I don't understand why the SVG is dirty, and does layout even though we've > just done a updateLayoutIgnorePendingStylesheets(). I think we did updateLayoutIgnorePendingStylesheets on a different frame. There are two frames involved. 1101985 12 darin 2015-06-15 11:41:07 -0700 But if you like you can do further analysis to look for another fix. I spent a few hours on this over the weekend but I don’t have more time for it now. 1101987 13 darin 2015-06-15 11:52:31 -0700 Hmm wait I seem to remember the functions call updateLayout unconditionally. So the layout reentrancy assertion at least will fire even if nothing is dirty. 1102005 14 darin 2015-06-15 12:32:30 -0700 A lot of this has to do with having multiple frames. FrameView::layout returns immediately if isInLayout is true, but it’s not in this case. 1102016 15 simon.fraser 2015-06-15 13:17:49 -0700 I chatted with Said, and we think your fix is the way to to. 1102017 16 254864 simon.fraser 2015-06-15 13:18:46 -0700 Comment on attachment 254864 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=254864&action=review > Source/WebCore/page/FrameView.cpp:1136 > + ownerRenderer->view().frameView().scheduleRelayout(); I hope this doesn't cause problems like trying to paint before we've laid out. 1102036 17 darin 2015-06-15 14:11:40 -0700 (In reply to comment #16) > I hope this doesn't cause problems like trying to paint before we've laid > out. It does open the window for the possibility that we might paint twice in cases like this. 1102056 18 254864 commit-queue 2015-06-15 15:02:37 -0700 Comment on attachment 254864 Patch Clearing flags on attachment: 254864 Committed r185567: <http://trac.webkit.org/changeset/185567> 1102057 19 commit-queue 2015-06-15 15:02:42 -0700 All reviewed patches have been landed. Closing bug. 254864 2015-06-14 17:14:54 -0700 2015-06-15 15:02:37 -0700 Patch bug-145964-20150614171421.patch text/plain 4488 darin U3VidmVyc2lvbiBSZXZpc2lvbjogMTg1NTQ2CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggYWRlY2M5YjEzNzE0ZGFl ODJiNTA2YTdhMzBjMTAwNWQ2ZjJlNTlhMC4uMmI1NmE5YWE5NGQxZjJhN2FhNTc5MzcwNWNmNTFh NDg1MDU0ZGIyOCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE2IEBACisyMDE1LTA2LTE0ICBEYXJp biBBZGxlciAgPGRhcmluQGFwcGxlLmNvbT4KKworICAgICAgICBSRUdSRVNTSU9OIChyMTgyMjE1 KTogUmVwcm9kdWNpYmxlIGNyYXNoIGF0IGRyYXdzdmcub3JnIGR1ZSB0byByZWVudHJhbnQgbGF5 b3V0CisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNDU5 NjQKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBUZXN0 OiBzdmcvYXMtb2JqZWN0L211dGF0ZS1vbi1sb2FkLmh0bWwKKworICAgICAgICAqIHBhZ2UvRnJh bWVWaWV3LmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OkZyYW1lVmlldzo6Zm9yY2VMYXlvdXRQYXJl bnRWaWV3SWZOZWVkZWQpOiBEb24ndCBkbyBhIHN5bmNocm9ub3VzIGxheW91dCBoZXJlLAorICAg ICAgICBiZWNhdXNlIGl0IGNhbiBsZWFkIGluZGlyZWN0bHkgdG8gdW53YW50ZWQgbGF5b3V0IHJl ZW50cmFuY3kuIEluc3RlYWQgc2NoZWR1bGUgYSBsYXlvdXQuCisKIDIwMTUtMDYtMTMgIENocmlz IER1bWV6ICA8Y2R1bWV6QGFwcGxlLmNvbT4KIAogICAgICAgICBbV0syXSBBUEk6Ok5hdmlnYXRp b24gb2JqZWN0cyBhcmUgbGVha2VkIG9uIGhpc3RvcnkgbmF2aWdhdGlvbiB0byBIaXN0b3J5SXRl bXMgaW4gUGFnZUNhY2hlCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9wYWdlL0ZyYW1lVmll dy5jcHAgYi9Tb3VyY2UvV2ViQ29yZS9wYWdlL0ZyYW1lVmlldy5jcHAKaW5kZXggMmE4OTg4MDJi Nzc3N2Q4MzgwNTYxMWQ5OGYxYjgyM2I0Y2ExYTZmOS4uYWJjNjNiZmM4NTU1YWMzZGM3ZjFmM2Nh MTU0MzNkZDQyZjc3ZGJjMyAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvcGFnZS9GcmFtZVZp ZXcuY3BwCisrKyBiL1NvdXJjZS9XZWJDb3JlL3BhZ2UvRnJhbWVWaWV3LmNwcApAQCAtMTEzMSwx MyArMTEzMSw5IEBAIGlubGluZSB2b2lkIEZyYW1lVmlldzo6Zm9yY2VMYXlvdXRQYXJlbnRWaWV3 SWZOZWVkZWQoKQogICAgIC8vIEZyYW1lVmlldyBmb3IgYSBsYXlvdXQuIEFmdGVyIHRoYXQgdGhl IFJlbmRlckVtYmVkZGVkT2JqZWN0IChvd25lclJlbmRlcmVyKSBjYXJyaWVzIHRoZQogICAgIC8v IGNvcnJlY3Qgc2l6ZSwgd2hpY2ggUmVuZGVyU1ZHUm9vdDo6Y29tcHV0ZVJlcGxhY2VkTG9naWNh bFdpZHRoL0hlaWdodCByZWx5IG9uLCB3aGVuIGxheWluZwogICAgIC8vIG91dCBmb3IgdGhlIGZp cnN0IHRpbWUsIG9yIHdoZW4gdGhlIFJlbmRlclNWR1Jvb3Qgc2l6ZSBoYXMgY2hhbmdlZCBkeW5h bWljYWxseSAoZWcuIHZpYSA8c2NyaXB0PikuCi0gICAgUmVmPEZyYW1lVmlldz4gZnJhbWVWaWV3 KG93bmVyUmVuZGVyZXItPnZpZXcoKS5mcmFtZVZpZXcoKSk7CiAKLSAgICAvLyBNYXJrIHRoZSBv d25lciByZW5kZXJlciBhcyBuZWVkaW5nIGxheW91dC4KICAgICBvd25lclJlbmRlcmVyLT5zZXRO ZWVkc0xheW91dEFuZFByZWZXaWR0aHNSZWNhbGMoKTsKLQotICAgIC8vIFN5bmNocm9ub3VzbHkg ZW50ZXIgbGF5b3V0LCB0byBsYXlvdXQgdGhlIHZpZXcgY29udGFpbmluZyB0aGUgaG9zdCBvYmpl Y3QvZW1iZWQvaWZyYW1lLgotICAgIGZyYW1lVmlldy0+bGF5b3V0KCk7CisgICAgb3duZXJSZW5k ZXJlci0+dmlldygpLmZyYW1lVmlldygpLnNjaGVkdWxlUmVsYXlvdXQoKTsKIH0KIAogdm9pZCBG cmFtZVZpZXc6OmxheW91dChib29sIGFsbG93U3VidHJlZSkKZGlmZiAtLWdpdCBhL0xheW91dFRl c3RzL0NoYW5nZUxvZyBiL0xheW91dFRlc3RzL0NoYW5nZUxvZwppbmRleCBjNmYxZWFjODBmOGFk NTM2YmQ5NWI4MDVmMDM4ZmIzMzE2NTU1YTNlLi5hMzFiZGEzODI2YjQ2MjQ2MWY4ZGE1MTVmZTI0 MjJlZWMwMDg2NDM3IDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKKysrIGIvTGF5 b3V0VGVzdHMvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTQgQEAKKzIwMTUtMDYtMTQgIERhcmluIEFk bGVyICA8ZGFyaW5AYXBwbGUuY29tPgorCisgICAgICAgIFJFR1JFU1NJT04gKHIxODIyMTUpOiBS ZXByb2R1Y2libGUgY3Jhc2ggYXQgZHJhd3N2Zy5vcmcgZHVlIHRvIHJlZW50cmFudCBsYXlvdXQK KyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE0NTk2NAor CisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgICogc3ZnL2Fz LW9iamVjdC9tdXRhdGUtb24tbG9hZC1leHBlY3RlZC5odG1sOiBBZGRlZC4KKyAgICAgICAgKiBz dmcvYXMtb2JqZWN0L211dGF0ZS1vbi1sb2FkLmh0bWw6IEFkZGVkLgorICAgICAgICAqIHN2Zy9h cy1vYmplY3QvcmVzb3VyY2VzL2VtYmVkZGVkLW11dGF0ZXMtb24tbG9hZC5zdmc6IEFkZGVkLgor CiAyMDE1LTA2LTEzICBDaHJpcyBGbGVpemFjaCAgPGNmbGVpemFjaEBhcHBsZS5jb20+CiAKICAg ICAgICAgQVg6IFdlYktpdCBleHBvc2VzIGFsbCBSdWJ5IFRleHQgYXMgVW5rbm93biAoSmFwYW5l c2UgRVBVQiBhY2Nlc3NpYmlsaXR5IGJsb2NrZXIpCmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9z dmcvYXMtb2JqZWN0L211dGF0ZS1vbi1sb2FkLWV4cGVjdGVkLmh0bWwgYi9MYXlvdXRUZXN0cy9z dmcvYXMtb2JqZWN0L211dGF0ZS1vbi1sb2FkLWV4cGVjdGVkLmh0bWwKbmV3IGZpbGUgbW9kZSAx MDA2NDQKaW5kZXggMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMC4uY2E2 NmI0NjI2YjA3MjQ1ZWVmMDA5MWZkMmQxNDg3OGRjNzVkMmU4OQotLS0gL2Rldi9udWxsCisrKyBi L0xheW91dFRlc3RzL3N2Zy9hcy1vYmplY3QvbXV0YXRlLW9uLWxvYWQtZXhwZWN0ZWQuaHRtbApA QCAtMCwwICsxLDQgQEAKKzxzdmcgdmlld2JveD0iMCAwIDY2IDIyMCIgd2lkdGg9IjY2cHgiPgor PHJlY3Qgd2lkdGg9IjYiIGhlaWdodD0iMCIgeD0iMCIgeT0iMCIvPgorPHJlY3Qgd2lkdGg9IjU0 IiBoZWlnaHQ9IjIwNiIgeD0iNiIgeT0iMjAiLz4KKzwvc3ZnPgpkaWZmIC0tZ2l0IGEvTGF5b3V0 VGVzdHMvc3ZnL2FzLW9iamVjdC9tdXRhdGUtb24tbG9hZC5odG1sIGIvTGF5b3V0VGVzdHMvc3Zn L2FzLW9iamVjdC9tdXRhdGUtb24tbG9hZC5odG1sCm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4 IDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAuLjE2ZTliMTkxYjdmZjRk ZDMwODE3NDNkZDhkZGE0OTczOThkYWI5NzcKLS0tIC9kZXYvbnVsbAorKysgYi9MYXlvdXRUZXN0 cy9zdmcvYXMtb2JqZWN0L211dGF0ZS1vbi1sb2FkLmh0bWwKQEAgLTAsMCArMSBAQAorPGVtYmVk IHR5cGU9ImltYWdlL3N2Zyt4bWwiIHdpZHRoPSI2NnB4IiBzcmM9InJlc291cmNlcy9lbWJlZGRl ZC1tdXRhdGVzLW9uLWxvYWQuc3ZnIi8+DQpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvc3ZnL2Fz LW9iamVjdC9yZXNvdXJjZXMvZW1iZWRkZWQtbXV0YXRlcy1vbi1sb2FkLnN2ZyBiL0xheW91dFRl c3RzL3N2Zy9hcy1vYmplY3QvcmVzb3VyY2VzL2VtYmVkZGVkLW11dGF0ZXMtb24tbG9hZC5zdmcK bmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMC4uNzE0OTVmZjAzM2RjNDQ5NjZmOWMwY2VhNWJiZDNmNmNiNjg1NjEwNgotLS0g L2Rldi9udWxsCisrKyBiL0xheW91dFRlc3RzL3N2Zy9hcy1vYmplY3QvcmVzb3VyY2VzL2VtYmVk ZGVkLW11dGF0ZXMtb24tbG9hZC5zdmcKQEAgLTAsMCArMSwxNSBAQAorPD94bWwgdmVyc2lvbj0i MS4wIiBlbmNvZGluZz0iVVRGLTgiIHN0YW5kYWxvbmU9Im5vIj8+Cis8c3ZnIHhtbG5zPSJodHRw Oi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgb25sb2FkPSJydW5UZXN0KCkiIHZpZXdCb3g9IjAgMCA2 NiAyMjAiIHdpZHRoPSIxMDAlIiBoZWlnaHQ9IjEwMCUiPgorPHNjcmlwdCB0eXBlPSJ0ZXh0L2Vj bWFzY3JpcHQiPjwhW0NEQVRBWworCisgICAgZnVuY3Rpb24gcnVuVGVzdCgpIHsKKyAgICAgICAg ZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoImEiKS5zZXRBdHRyaWJ1dGUoImhlaWdodCIsICIwIik7 CisgICAgICAgIGRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCJiIikuYWRkRXZlbnRMaXN0ZW5lcigi bW91c2V3aGVlbCIsZnVuY3Rpb24oKSB7fSk7CisgICAgfQorCitdXT48L3NjcmlwdD4KKworICAg IDxyZWN0IGlkPSJhIiB3aWR0aD0iNiIgeD0iMCIvPgorICAgIDxyZWN0IGlkPSJiIiB3aWR0aD0i NTQiIGhlaWdodD0iMjA2IiB4PSI2IiB5PSIyMCIvPgorCis8L3N2Zz4K