<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>14899</bug_id>
          
          <creation_ts>2007-08-08 01:03:22 -0700</creation_ts>
          <short_desc>!d-&gt;m_view-&gt;needsLayout() in Frame::paint() (Causes assert)</short_desc>
          <delta_ts>2007-08-23 00:51:18 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>Layout and Rendering</component>
          <version>523.x (Safari 3)</version>
          <rep_platform>Mac</rep_platform>
          <op_sys>Other</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc>http://www.tuaw.com/photos/pixelmator-first-look/</bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>InRadar</keywords>
          <priority>P1</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter>mitz</reporter>
          <assigned_to name="Nobody">webkit-unassigned</assigned_to>
          <cc>ddkilzer</cc>
    
    <cc>dev+webkit</cc>
    
    <cc>koivisto</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>2848</commentid>
    <comment_count>0</comment_count>
    <who name="">mitz</who>
    <bug_when>2007-08-08 01:03:22 -0700</bug_when>
    <thetext>ASSERTION FAILED: d-&gt;m_view &amp;&amp; !d-&gt;m_view-&gt;needsLayout()
(WebCore/page/Frame.cpp:1383 void WebCore::Frame::paint(WebCore::GraphicsContext*, const WebCore::IntRect&amp;))

Backtrace:
0   com.apple.WebCore             	0x01a39948 WebCore::Frame::paint(WebCore::GraphicsContext*, WebCore::IntRect const&amp;) + 720 (Frame.cpp:1383)
1   com.apple.WebCore             	0x01a8d290 -[WebCoreFrameBridge drawRect:] + 372 (WebCoreFrameBridge.mm:425)
2   com.apple.WebKit              	0x001d375c -[WebHTMLView drawSingleRect:] + 1028
3   com.apple.WebKit              	0x001d3b84 -[WebHTMLView drawRect:] + 552
4   com.apple.AppKit              	0x95779178 -[NSView _drawRect:clip:] + 2892
5   com.apple.AppKit              	0x95778310 -[NSView _recursiveDisplayAllDirtyWithLockFocus:visRect:] + 860
6   com.apple.WebKit              	0x001ca168 -[WebHTMLView(WebPrivate) _recursiveDisplayAllDirtyWithLockFocus:visRect:] + 420
7   com.apple.CoreFoundation      	0x943b64fc CFArrayApplyFunction + 348
8   com.apple.AppKit              	0x957784c0 -[NSView _recursiveDisplayAllDirtyWithLockFocus:visRect:] + 1292
9   com.apple.CoreFoundation      	0x943b64fc CFArrayApplyFunction + 348
10  com.apple.AppKit              	0x957784c0 -[NSView _recursiveDisplayAllDirtyWithLockFocus:visRect:] + 1292
11  com.apple.CoreFoundation      	0x943b64fc CFArrayApplyFunction + 348
12  com.apple.AppKit              	0x957784c0 -[NSView _recursiveDisplayAllDirtyWithLockFocus:visRect:] + 1292
13  com.apple.CoreFoundation      	0x943b64fc CFArrayApplyFunction + 348
14  com.apple.AppKit              	0x957784c0 -[NSView _recursiveDisplayAllDirtyWithLockFocus:visRect:] + 1292
15  com.apple.CoreFoundation      	0x943b64fc CFArrayApplyFunction + 348
16  com.apple.AppKit              	0x957784c0 -[NSView _recursiveDisplayAllDirtyWithLockFocus:visRect:] + 1292
17  com.apple.CoreFoundation      	0x943b64fc CFArrayApplyFunction + 348
18  com.apple.AppKit              	0x957784c0 -[NSView _recursiveDisplayAllDirtyWithLockFocus:visRect:] + 1292
19  com.apple.AppKit              	0x95777284 -[NSView _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:] + 640
20  com.apple.AppKit              	0x95777ce8 -[NSView _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:] + 3300
21  com.apple.AppKit              	0x95777ce8 -[NSView _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:] + 3300
22  com.apple.AppKit              	0x9577680c -[NSThemeFrame _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:] + 264
23  com.apple.AppKit              	0x95775d10 -[NSView _displayRectIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:] + 2172
24  com.apple.AppKit              	0x95774cc4 -[NSWindow displayIfNeeded] + 188</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>2843</commentid>
    <comment_count>1</comment_count>
    <who name="">mitz</who>
    <bug_when>2007-08-08 01:09:27 -0700</bug_when>
    <thetext>I think it is generally preferred to use separate ASSERTs instead of a conjunction.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>2789</commentid>
    <comment_count>2</comment_count>
    <who name="Matt Lilek">dev+webkit</who>
    <bug_when>2007-08-08 18:21:32 -0700</bug_when>
    <thetext>You can reproduce this by starting the new iWeb with ToT WebKit and adding a HTML Snippet web widget thingy</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>2769</commentid>
    <comment_count>3</comment_count>
    <who name="">mitz</who>
    <bug_when>2007-08-09 01:51:06 -0700</bug_when>
    <thetext>(In reply to comment #2)
&gt; You can reproduce this by starting the new iWeb with ToT WebKit and adding a
&gt; HTML Snippet web widget thingy

Can you check if d-&gt;m_view is 0 (which I think is harmless) or d-&gt;m_view-&gt;needsLayout() is true (just break up the ASSERT)?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>2766</commentid>
    <comment_count>4</comment_count>
    <who name="Matt Lilek">dev+webkit</who>
    <bug_when>2007-08-09 06:39:06 -0700</bug_when>
    <thetext>!d-&gt;m_view-&gt;needsLayout() is causing this to assert</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>2667</commentid>
    <comment_count>5</comment_count>
    <who name="David Kilzer (:ddkilzer)">ddkilzer</who>
    <bug_when>2007-08-10 04:37:32 -0700</bug_when>
    <thetext>&lt;rdar://problem/5400975&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>2034</commentid>
    <comment_count>6</comment_count>
    <who name="Matt Lilek">dev+webkit</who>
    <bug_when>2007-08-18 11:36:28 -0700</bug_when>
    <thetext>I&apos;m seeing this consistently when clicking through &lt;http://www.tuaw.com/photos/pixelmator-first-look/&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>2027</commentid>
    <comment_count>7</comment_count>
    <who name="David Kilzer (:ddkilzer)">ddkilzer</who>
    <bug_when>2007-08-18 13:51:17 -0700</bug_when>
    <thetext>I&apos;m seeing the same assertion clicking around NASCAR.com.  Haven&apos;t come up with a way to reproduce it, but clicking between the &quot;Races&quot; and &quot;Schedule&quot; links two or three times seems to do it.

Used a local debug build of WebKit r25142 with Safari 3 Public Beta v. 3.0.3 (522.12.1) on Mac OS X 10.4.10 (8R218).

Console output:

ASSERTION FAILED: d-&gt;m_view &amp;&amp; !d-&gt;m_view-&gt;needsLayout()
(/path/to/WebKit/WebCore/page/Frame.cpp:1394 void WebCore::Frame::paint(WebCore::GraphicsContext*, const WebCore::IntRect&amp;))
Segmentation fault

Stack trace:

Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_INVALID_ADDRESS (0x0001) at 0xbbadbeef

Thread 0 Crashed:
0   com.apple.WebCore              	0x010f3378 WebCore::Frame::paint(WebCore::GraphicsContext*, WebCore::IntRect const&amp;) + 788 (Frame.cpp:1394)
1   com.apple.WebCore              	0x01121608 -[WebCoreFrameBridge drawRect:] + 372 (WebCoreFrameBridge.mm:426)
2   com.apple.WebKit               	0x003525dc -[WebHTMLView drawSingleRect:] + 760 (WebHTMLView.mm:2820)
3   com.apple.WebKit               	0x00352a88 -[WebHTMLView drawRect:] + 540 (WebHTMLView.mm:2875)
4   com.apple.AppKit               	0x937e7858 -[NSView _drawRect:clip:] + 2128
5   com.apple.AppKit               	0x937e65fc -[NSView _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:] + 736
6   com.apple.WebKit               	0x003490fc -[WebHTMLView(WebPrivate) _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:] + 468 (WebHTMLView.mm:1060)
7   com.apple.AppKit               	0x937e69a8 -[NSView _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:] + 1676
8   com.apple.AppKit               	0x937e69a8 -[NSView _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:] + 1676
9   com.apple.AppKit               	0x937e69a8 -[NSView _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:] + 1676
10  com.apple.AppKit               	0x937e69a8 -[NSView _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:] + 1676
11  com.apple.AppKit               	0x937e69a8 -[NSView _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:] + 1676
12  com.apple.AppKit               	0x937e69a8 -[NSView _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:] + 1676
13  com.apple.AppKit               	0x937e69a8 -[NSView _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:] + 1676
14  com.apple.AppKit               	0x937e69a8 -[NSView _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:] + 1676
15  com.apple.AppKit               	0x93807044 -[NSThemeFrame _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:] + 192
16  com.apple.AppKit               	0x937e0054 -[NSView _displayRectIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:] + 384
17  com.apple.AppKit               	0x937d5348 -[NSView displayIfNeeded] + 248
18  com.apple.AppKit               	0x937d51b8 -[NSWindow displayIfNeeded] + 180
19  com.apple.Safari               	0x000133d4 0x1000 + 74708
20  com.apple.AppKit               	0x937d5064 _handleWindowNeedsDisplay + 200
21  com.apple.CoreFoundation       	0x907dd76c __CFRunLoopDoObservers + 352
22  com.apple.CoreFoundation       	0x907dda0c __CFRunLoopRun + 420
23  com.apple.CoreFoundation       	0x907dd4ac CFRunLoopRunSpecific + 268
24  com.apple.HIToolbox            	0x9329bb20 RunCurrentEventLoopInMode + 264
25  com.apple.HIToolbox            	0x9329b1b4 ReceiveNextEventCommon + 380
26  com.apple.HIToolbox            	0x9329b020 BlockUntilNextEventMatchingListInMode + 96
27  com.apple.AppKit               	0x937a1ae4 _DPSNextEvent + 384
28  com.apple.AppKit               	0x937a17a8 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 116
29  com.apple.Safari               	0x00006770 0x1000 + 22384
30  com.apple.AppKit               	0x9379dcec -[NSApplication run] + 472
31  com.apple.AppKit               	0x9388e87c NSApplicationMain + 452
32  com.apple.Safari               	0x0000244c 0x1000 + 5196
33  com.apple.Safari               	0x0004f1b0 0x1000 + 319920
</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>2024</commentid>
    <comment_count>8</comment_count>
    <who name="David Kilzer (:ddkilzer)">ddkilzer</who>
    <bug_when>2007-08-18 14:13:58 -0700</bug_when>
    <thetext>Races URL: http://www.nascar.com/races/cup/
Schedule URL: http://www.nascar.com/races/cup/2007/data/schedule.html
</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1918</commentid>
    <comment_count>9</comment_count>
      <attachid>16028</attachid>
    <who name="">mitz</who>
    <bug_when>2007-08-20 01:01:57 -0700</bug_when>
    <thetext>Created attachment 16028
Possible fix

I am unable to reproduce the bug with the URLs given by Matt and Dave, but this patch fixes &lt;http://ynet.co.il&gt; for me. Could you guys see if it fixes your reproducible cases?

As for the patch itself, it maintains the behavior of copying the width and height attributes in the DOM from the &lt;embed&gt; to the enclosing &lt;object&gt;, just avoids doing it during layout. I don&apos;t know if the attribute copying is necessary in the first place (maybe it&apos;s a WinIE thing; Firefox doesn&apos;t do it).</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1900</commentid>
    <comment_count>10</comment_count>
    <who name="David Kilzer (:ddkilzer)">ddkilzer</who>
    <bug_when>2007-08-20 09:54:54 -0700</bug_when>
    <thetext>(In reply to comment #9)
&gt; Created an attachment (id=16028) [edit]
&gt; Possible fix
&gt; 
&gt; I am unable to reproduce the bug with the URLs given by Matt and Dave, but this
&gt; patch fixes &lt;http://ynet.co.il&gt; for me. Could you guys see if it fixes your
&gt; reproducible cases?

I&apos;m running with the patch now, but I had trouble reproducing the crash (without this patch) an hour after it happened on nascar.com.  Will keep trying!</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1892</commentid>
    <comment_count>11</comment_count>
    <who name="Matt Lilek">dev+webkit</who>
    <bug_when>2007-08-20 11:42:28 -0700</bug_when>
    <thetext>This patch seems to fix it for me.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1756</commentid>
    <comment_count>12</comment_count>
      <attachid>16065</attachid>
    <who name="">mitz</who>
    <bug_when>2007-08-21 14:46:53 -0700</bug_when>
    <thetext>Created attachment 16065
Fix one reproducible instance of the ASSERT

Includes a manual test.

Since the bug was reported before updateWidget could be called under layout() (r25128), I am not sure that the patch addresses the original bug, but it does fix a reproducible bug with the same symptom.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1755</commentid>
    <comment_count>13</comment_count>
      <attachid>16065</attachid>
    <who name="Darin Adler">darin</who>
    <bug_when>2007-08-21 14:51:43 -0700</bug_when>
    <thetext>Comment on attachment 16065
Fix one reproducible instance of the ASSERT

+    String width = getAttribute(widthAttr);
+    String height = getAttribute(heightAttr);

It&apos;d be slightly more efficient to use const AtomicString&amp; for these. This would avoid a little bit of reference count churn. If we changed setAttribute to take const AtomicString&amp; we could also save re-hashing the string values to make them Atomic again.

But that&apos;s very minor and I like the patch as-is.

r=me</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1642</commentid>
    <comment_count>14</comment_count>
    <who name="Andrew Wellington">andrew</who>
    <bug_when>2007-08-23 00:51:18 -0700</bug_when>
    <thetext>Landed in r25197</thetext>
  </long_desc>
      
          <attachment
              isobsolete="1"
              ispatch="1"
              isprivate="0"
          >
            <attachid>16028</attachid>
            <date>2007-08-20 01:01:57 -0700</date>
            <delta_ts>2007-08-21 14:46:53 -0700</delta_ts>
            <desc>Possible fix</desc>
            <filename>14899_r0.diff</filename>
            <type>text/plain</type>
            <size>3101</size>
            <attacher>mitz</attacher>
            
              <data encoding="base64">SW5kZXg6IFdlYkNvcmUvaHRtbC9IVE1MRW1iZWRFbGVtZW50LmNwcAo9PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBX
ZWJDb3JlL2h0bWwvSFRNTEVtYmVkRWxlbWVudC5jcHAJKHJldmlzaW9uIDI1MTU2KQorKysgV2Vi
Q29yZS9odG1sL0hUTUxFbWJlZEVsZW1lbnQuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC0zMCw2ICsz
MCw3IEBACiAjaW5jbHVkZSAiRnJhbWUuaCIKICNpbmNsdWRlICJGcmFtZVZpZXcuaCIKICNpbmNs
dWRlICJIVE1MRG9jdW1lbnQuaCIKKyNpbmNsdWRlICJIVE1MT2JqZWN0RWxlbWVudC5oIgogI2lu
Y2x1ZGUgIkhUTUxOYW1lcy5oIgogI2luY2x1ZGUgIlJlbmRlclBhcnRPYmplY3QuaCIKIApAQCAt
MTczLDYgKzE3NCwyMCBAQCB2b2lkIEhUTUxFbWJlZEVsZW1lbnQ6Omluc2VydGVkSW50b0RvY3Vt
CiAgICAgICAgIGRvYy0+YWRkTmFtZWRJdGVtKG9sZE5hbWVBdHRyKTsKICAgICB9CiAKKyAgICBT
dHJpbmcgd2lkdGggPSBnZXRBdHRyaWJ1dGUod2lkdGhBdHRyKTsKKyAgICBTdHJpbmcgaGVpZ2h0
ID0gZ2V0QXR0cmlidXRlKGhlaWdodEF0dHIpOworICAgIGlmICghd2lkdGguaXNFbXB0eSgpIHx8
ICFoZWlnaHQuaXNFbXB0eSgpKSB7CisgICAgICAgIE5vZGUqIG4gPSBwYXJlbnQoKTsKKyAgICAg
ICAgd2hpbGUgKG4gJiYgIW4tPmhhc1RhZ05hbWUob2JqZWN0VGFnKSkKKyAgICAgICAgICAgIG4g
PSBuLT5wYXJlbnQoKTsKKyAgICAgICAgaWYgKG4pIHsKKyAgICAgICAgICAgIGlmICghd2lkdGgu
aXNFbXB0eSgpKQorICAgICAgICAgICAgICAgIHN0YXRpY19jYXN0PEhUTUxPYmplY3RFbGVtZW50
Kj4obiktPnNldEF0dHJpYnV0ZSh3aWR0aEF0dHIsIHdpZHRoKTsKKyAgICAgICAgICAgIGlmICgh
aGVpZ2h0LmlzRW1wdHkoKSkKKyAgICAgICAgICAgICAgICBzdGF0aWNfY2FzdDxIVE1MT2JqZWN0
RWxlbWVudCo+KG4pLT5zZXRBdHRyaWJ1dGUoaGVpZ2h0QXR0ciwgaGVpZ2h0KTsKKyAgICAgICAg
fQorICAgIH0KKwogICAgIEhUTUxQbHVnSW5FbGVtZW50OjppbnNlcnRlZEludG9Eb2N1bWVudCgp
OwogfQogCkBAIC0xODYsNiArMjAxLDE5IEBAIHZvaWQgSFRNTEVtYmVkRWxlbWVudDo6cmVtb3Zl
ZEZyb21Eb2N1bWUKICAgICBIVE1MUGx1Z0luRWxlbWVudDo6cmVtb3ZlZEZyb21Eb2N1bWVudCgp
OwogfQogCit2b2lkIEhUTUxFbWJlZEVsZW1lbnQ6OmF0dHJpYnV0ZUNoYW5nZWQoQXR0cmlidXRl
KiBhdHRyLCBib29sIHByZXNlcnZlRGVjbHMpCit7CisgICAgSFRNTFBsdWdJbkVsZW1lbnQ6OmF0
dHJpYnV0ZUNoYW5nZWQoYXR0ciwgcHJlc2VydmVEZWNscyk7CisKKyAgICBpZiAoKGF0dHItPm5h
bWUoKSA9PSB3aWR0aEF0dHIgfHwgYXR0ci0+bmFtZSgpID09IGhlaWdodEF0dHIpICYmICFhdHRy
LT5pc0VtcHR5KCkpIHsKKyAgICAgICAgTm9kZSogbiA9IHBhcmVudCgpOworICAgICAgICB3aGls
ZSAobiAmJiAhbi0+aGFzVGFnTmFtZShvYmplY3RUYWcpKQorICAgICAgICAgICAgbiA9IG4tPnBh
cmVudCgpOworICAgICAgICBpZiAobikKKyAgICAgICAgICAgIHN0YXRpY19jYXN0PEhUTUxPYmpl
Y3RFbGVtZW50Kj4obiktPnNldEF0dHJpYnV0ZShhdHRyLT5uYW1lKCksIGF0dHItPnZhbHVlKCkp
OworICAgIH0KK30KKwogYm9vbCBIVE1MRW1iZWRFbGVtZW50Ojppc1VSTEF0dHJpYnV0ZShBdHRy
aWJ1dGUgKmF0dHIpIGNvbnN0CiB7CiAgICAgcmV0dXJuIGF0dHItPm5hbWUoKSA9PSBzcmNBdHRy
OwpJbmRleDogV2ViQ29yZS9odG1sL0hUTUxFbWJlZEVsZW1lbnQuaAo9PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBX
ZWJDb3JlL2h0bWwvSFRNTEVtYmVkRWxlbWVudC5oCShyZXZpc2lvbiAyNTE1NikKKysrIFdlYkNv
cmUvaHRtbC9IVE1MRW1iZWRFbGVtZW50LmgJKHdvcmtpbmcgY29weSkKQEAgLTUyLDYgKzUyLDcg
QEAgcHVibGljOgogICAgIHZpcnR1YWwgUmVuZGVyT2JqZWN0KiBjcmVhdGVSZW5kZXJlcihSZW5k
ZXJBcmVuYSosIFJlbmRlclN0eWxlKik7CiAgICAgdmlydHVhbCB2b2lkIGluc2VydGVkSW50b0Rv
Y3VtZW50KCk7CiAgICAgdmlydHVhbCB2b2lkIHJlbW92ZWRGcm9tRG9jdW1lbnQoKTsKKyAgICB2
aXJ0dWFsIHZvaWQgYXR0cmlidXRlQ2hhbmdlZChBdHRyaWJ1dGUqLCBib29sIHByZXNlcnZlRGVj
bHMgPSBmYWxzZSk7CiAgICAgCiAgICAgdmlydHVhbCBib29sIGlzVVJMQXR0cmlidXRlKEF0dHJp
YnV0ZSopIGNvbnN0OwogCkluZGV4OiBXZWJDb3JlL3JlbmRlcmluZy9SZW5kZXJQYXJ0T2JqZWN0
LmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09Ci0tLSBXZWJDb3JlL3JlbmRlcmluZy9SZW5kZXJQYXJ0T2JqZWN0LmNw
cAkocmV2aXNpb24gMjUxNTYpCisrKyBXZWJDb3JlL3JlbmRlcmluZy9SZW5kZXJQYXJ0T2JqZWN0
LmNwcAkod29ya2luZyBjb3B5KQpAQCAtMTMxLDEyICsxMzEsNiBAQCB2b2lkIFJlbmRlclBhcnRP
YmplY3Q6OnVwZGF0ZVdpZGdldChib29sCiAgICAgICBIVE1MRWxlbWVudCAqZW1iZWRPck9iamVj
dDsKICAgICAgIGlmIChlbWJlZCkgewogICAgICAgICAgIGVtYmVkT3JPYmplY3QgPSAoSFRNTEVs
ZW1lbnQgKillbWJlZDsKLSAgICAgICAgICBTdHJpbmcgYXR0cmlidXRlID0gZW1iZWRPck9iamVj
dC0+Z2V0QXR0cmlidXRlKHdpZHRoQXR0cik7Ci0gICAgICAgICAgaWYgKCFhdHRyaWJ1dGUuaXNF
bXB0eSgpKQotICAgICAgICAgICAgICBvLT5zZXRBdHRyaWJ1dGUod2lkdGhBdHRyLCBhdHRyaWJ1
dGUpOwotICAgICAgICAgIGF0dHJpYnV0ZSA9IGVtYmVkT3JPYmplY3QtPmdldEF0dHJpYnV0ZSho
ZWlnaHRBdHRyKTsKLSAgICAgICAgICBpZiAoIWF0dHJpYnV0ZS5pc0VtcHR5KCkpCi0gICAgICAg
ICAgICAgIG8tPnNldEF0dHJpYnV0ZShoZWlnaHRBdHRyLCBhdHRyaWJ1dGUpOwogICAgICAgICAg
IHVybCA9IGVtYmVkLT51cmw7CiAgICAgICAgICAgc2VydmljZVR5cGUgPSBlbWJlZC0+bV9zZXJ2
aWNlVHlwZTsKICAgICAgIH0gZWxzZQo=
</data>

          </attachment>
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>16065</attachid>
            <date>2007-08-21 14:46:53 -0700</date>
            <delta_ts>2007-08-21 14:51:43 -0700</delta_ts>
            <desc>Fix one reproducible instance of the ASSERT</desc>
            <filename>14899_r1.diff</filename>
            <type>text/plain</type>
            <size>5765</size>
            <attacher>mitz</attacher>
            
              <data encoding="base64">SW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9n
CShyZXZpc2lvbiAyNTE3NCkKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA
IC0xLDMgKzEsMjQgQEAKKzIwMDctMDgtMjIgIE1pdHogUGV0dGVsICA8bWl0ekB3ZWJraXQub3Jn
PgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIC0gZml4
IGh0dHA6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE0ODk5CisgICAgICAgICAg
IWQtPm1fdmlldy0+bmVlZHNMYXlvdXQoKSBpbiBGcmFtZTo6cGFpbnQoKSAoQ2F1c2VzIGFzc2Vy
dCkKKworICAgICAgICBXZWJLaXQgY29waWVzIHRoZSB3aWR0aCBhbmQgaGVpZ2h0IGF0dHJpYnV0
ZXMgb2YgYW4gPGVtYmVkPiB0byBpdHMKKyAgICAgICAgbmVhcmVzdCA8b2JqZWN0PiBhbmNlc3Rv
ci4gVGhpcyB1c2VkIHRvIGJlIGRvbmUgaW4gdXBkYXRlV2lkZ2V0KCksIGJ1dAorICAgICAgICB0
aGF0IGNvdWxkIGxlYWQgdG8gdGhlIGRvY3VtZW50IGJlaW5nIGRpcnR5IHJpZ2h0IGFmdGVyIGxh
eW91dCBhbmQKKyAgICAgICAgYmVmb3JlIHBhaW50aW5nLiBUaGUgcGF0Y2ggbW92ZXMgdGhlIGNv
cHlpbmcgb2YgdGhlIGF0dHJpYnV0ZXMgdG8gd2hlbgorICAgICAgICB0aGUgPGVtYmVkPiBpcyBp
bnNlcnRlZCBpbnRvIHRoZSBkb2N1bWVudCBvciBpdHMgYXR0cmlidXRlcyBjaGFuZ2UuCisKKyAg
ICAgICAgKiBodG1sL0hUTUxFbWJlZEVsZW1lbnQuY3BwOgorICAgICAgICAoV2ViQ29yZTo6SFRN
TEVtYmVkRWxlbWVudDo6aW5zZXJ0ZWRJbnRvRG9jdW1lbnQpOgorICAgICAgICAoV2ViQ29yZTo6
SFRNTEVtYmVkRWxlbWVudDo6YXR0cmlidXRlQ2hhbmdlZCk6CisgICAgICAgICogaHRtbC9IVE1M
RW1iZWRFbGVtZW50Lmg6CisgICAgICAgICogbWFudWFsLXRlc3RzL2J1Z3ppbGxhLTE0ODk5Lmh0
bWw6IEFkZGVkLgorICAgICAgICAqIHJlbmRlcmluZy9SZW5kZXJQYXJ0T2JqZWN0LmNwcDoKKyAg
ICAgICAgKFdlYkNvcmU6OlJlbmRlclBhcnRPYmplY3Q6OnVwZGF0ZVdpZGdldCk6CisKIDIwMDct
MDgtMjEgIEFkZWxlIFBldGVyc29uICA8YWRlbGVAYXBwbGUuY29tPgogCiAgICAgICAgIEJ1aWxk
IGZpeCBmb3IgcmVsZWFzZSBidWlsZC4KSW5kZXg6IFdlYkNvcmUvaHRtbC9IVE1MRW1iZWRFbGVt
ZW50LmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09Ci0tLSBXZWJDb3JlL2h0bWwvSFRNTEVtYmVkRWxlbWVudC5jcHAJ
KHJldmlzaW9uIDI1MTc0KQorKysgV2ViQ29yZS9odG1sL0hUTUxFbWJlZEVsZW1lbnQuY3BwCSh3
b3JraW5nIGNvcHkpCkBAIC0zMCw2ICszMCw3IEBACiAjaW5jbHVkZSAiRnJhbWUuaCIKICNpbmNs
dWRlICJGcmFtZVZpZXcuaCIKICNpbmNsdWRlICJIVE1MRG9jdW1lbnQuaCIKKyNpbmNsdWRlICJI
VE1MT2JqZWN0RWxlbWVudC5oIgogI2luY2x1ZGUgIkhUTUxOYW1lcy5oIgogI2luY2x1ZGUgIlJl
bmRlclBhcnRPYmplY3QuaCIKIApAQCAtMTczLDYgKzE3NCwyMCBAQCB2b2lkIEhUTUxFbWJlZEVs
ZW1lbnQ6Omluc2VydGVkSW50b0RvY3VtCiAgICAgICAgIGRvYy0+YWRkTmFtZWRJdGVtKG9sZE5h
bWVBdHRyKTsKICAgICB9CiAKKyAgICBTdHJpbmcgd2lkdGggPSBnZXRBdHRyaWJ1dGUod2lkdGhB
dHRyKTsKKyAgICBTdHJpbmcgaGVpZ2h0ID0gZ2V0QXR0cmlidXRlKGhlaWdodEF0dHIpOworICAg
IGlmICghd2lkdGguaXNFbXB0eSgpIHx8ICFoZWlnaHQuaXNFbXB0eSgpKSB7CisgICAgICAgIE5v
ZGUqIG4gPSBwYXJlbnQoKTsKKyAgICAgICAgd2hpbGUgKG4gJiYgIW4tPmhhc1RhZ05hbWUob2Jq
ZWN0VGFnKSkKKyAgICAgICAgICAgIG4gPSBuLT5wYXJlbnQoKTsKKyAgICAgICAgaWYgKG4pIHsK
KyAgICAgICAgICAgIGlmICghd2lkdGguaXNFbXB0eSgpKQorICAgICAgICAgICAgICAgIHN0YXRp
Y19jYXN0PEhUTUxPYmplY3RFbGVtZW50Kj4obiktPnNldEF0dHJpYnV0ZSh3aWR0aEF0dHIsIHdp
ZHRoKTsKKyAgICAgICAgICAgIGlmICghaGVpZ2h0LmlzRW1wdHkoKSkKKyAgICAgICAgICAgICAg
ICBzdGF0aWNfY2FzdDxIVE1MT2JqZWN0RWxlbWVudCo+KG4pLT5zZXRBdHRyaWJ1dGUoaGVpZ2h0
QXR0ciwgaGVpZ2h0KTsKKyAgICAgICAgfQorICAgIH0KKwogICAgIEhUTUxQbHVnSW5FbGVtZW50
OjppbnNlcnRlZEludG9Eb2N1bWVudCgpOwogfQogCkBAIC0xODYsNiArMjAxLDE5IEBAIHZvaWQg
SFRNTEVtYmVkRWxlbWVudDo6cmVtb3ZlZEZyb21Eb2N1bWUKICAgICBIVE1MUGx1Z0luRWxlbWVu
dDo6cmVtb3ZlZEZyb21Eb2N1bWVudCgpOwogfQogCit2b2lkIEhUTUxFbWJlZEVsZW1lbnQ6OmF0
dHJpYnV0ZUNoYW5nZWQoQXR0cmlidXRlKiBhdHRyLCBib29sIHByZXNlcnZlRGVjbHMpCit7Cisg
ICAgSFRNTFBsdWdJbkVsZW1lbnQ6OmF0dHJpYnV0ZUNoYW5nZWQoYXR0ciwgcHJlc2VydmVEZWNs
cyk7CisKKyAgICBpZiAoKGF0dHItPm5hbWUoKSA9PSB3aWR0aEF0dHIgfHwgYXR0ci0+bmFtZSgp
ID09IGhlaWdodEF0dHIpICYmICFhdHRyLT5pc0VtcHR5KCkpIHsKKyAgICAgICAgTm9kZSogbiA9
IHBhcmVudCgpOworICAgICAgICB3aGlsZSAobiAmJiAhbi0+aGFzVGFnTmFtZShvYmplY3RUYWcp
KQorICAgICAgICAgICAgbiA9IG4tPnBhcmVudCgpOworICAgICAgICBpZiAobikKKyAgICAgICAg
ICAgIHN0YXRpY19jYXN0PEhUTUxPYmplY3RFbGVtZW50Kj4obiktPnNldEF0dHJpYnV0ZShhdHRy
LT5uYW1lKCksIGF0dHItPnZhbHVlKCkpOworICAgIH0KK30KKwogYm9vbCBIVE1MRW1iZWRFbGVt
ZW50Ojppc1VSTEF0dHJpYnV0ZShBdHRyaWJ1dGUgKmF0dHIpIGNvbnN0CiB7CiAgICAgcmV0dXJu
IGF0dHItPm5hbWUoKSA9PSBzcmNBdHRyOwpJbmRleDogV2ViQ29yZS9odG1sL0hUTUxFbWJlZEVs
ZW1lbnQuaAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09Ci0tLSBXZWJDb3JlL2h0bWwvSFRNTEVtYmVkRWxlbWVudC5oCShy
ZXZpc2lvbiAyNTE3NCkKKysrIFdlYkNvcmUvaHRtbC9IVE1MRW1iZWRFbGVtZW50LmgJKHdvcmtp
bmcgY29weSkKQEAgLTUyLDYgKzUyLDcgQEAgcHVibGljOgogICAgIHZpcnR1YWwgUmVuZGVyT2Jq
ZWN0KiBjcmVhdGVSZW5kZXJlcihSZW5kZXJBcmVuYSosIFJlbmRlclN0eWxlKik7CiAgICAgdmly
dHVhbCB2b2lkIGluc2VydGVkSW50b0RvY3VtZW50KCk7CiAgICAgdmlydHVhbCB2b2lkIHJlbW92
ZWRGcm9tRG9jdW1lbnQoKTsKKyAgICB2aXJ0dWFsIHZvaWQgYXR0cmlidXRlQ2hhbmdlZChBdHRy
aWJ1dGUqLCBib29sIHByZXNlcnZlRGVjbHMgPSBmYWxzZSk7CiAgICAgCiAgICAgdmlydHVhbCBi
b29sIGlzVVJMQXR0cmlidXRlKEF0dHJpYnV0ZSopIGNvbnN0OwogCkluZGV4OiBXZWJDb3JlL21h
bnVhbC10ZXN0cy9idWd6aWxsYS0xNDg5OS5odG1sCj09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvbWFu
dWFsLXRlc3RzL2J1Z3ppbGxhLTE0ODk5Lmh0bWwJKHJldmlzaW9uIDApCisrKyBXZWJDb3JlL21h
bnVhbC10ZXN0cy9idWd6aWxsYS0xNDg5OS5odG1sCShyZXZpc2lvbiAwKQpAQCAtMCwwICsxLDMz
IEBACis8IURPQ1RZUEUgSFRNTCBQVUJMSUMgIi0vL1czQy8vRFREIEhUTUwgNC4wMS8vRU4iCisg
ICAgICAgICJodHRwOi8vd3d3LnczLm9yZy9UUi9odG1sNC9zdHJpY3QuZHRkIj4KKzxodG1sIGxh
bmc9ImVuIj4KKzxoZWFkPgorICAgIDxzY3JpcHQ+CisgICAgICAgIGZ1bmN0aW9uIHRlc3QoKQor
ICAgICAgICB7CisgICAgICAgICAgICBkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgieiIpLnN0eWxl
LmRpc3BsYXk9J2Jsb2NrJzsKKyAgICAgICAgICAgIG9wZW4oImRhdGE6dGV4dC9odG1sLFNVQ0NF
U1MiKTsKKyAgICAgICAgfQorICAgIDwvc2NyaXB0PgorPC9oZWFkPgorPGJvZHk+CisgICAgPHA+
PGI+QlVHIElEOjwvYj4gPGEgaHJlZj0iaHR0cDovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5j
Z2k/aWQ9MTQ4OTkiPkJ1Z3ppbGxhIGJ1ZyAxNDg5OTwvYT4gIWQtPm1fdmlldy0+bmVlZHNMYXlv
dXQoKSBpbiBGcmFtZTo6cGFpbnQoKSAoQ2F1c2VzIGFzc2VydCk8L3A+CisgICAgCisgICAgPHAg
aWQ9InRlc3QiIHN0eWxlPSJiYWNrZ3JvdW5kLWNvbG9yOnNreWJsdWU7IHBhZGRpbmc6M3B4OyI+
PGI+U1RFUFMgVE8gVEVTVDo8L2I+IAorICAgIE1ha2Ugc3VyZSB5b3UgYXJlIHVzaW5nIGEgZGVi
dWcgYnVpbGQgb2YgdGhlIFdlYiBLaXQgZnJhbWV3b3JrLiBDbGljayB0aGUgVGVzdCBidXR0b24g
YmVsb3cuCisgICAgPC9wPgorICAgIAorICAgIDxwIGlkPSJzdWNjZXNzIiBzdHlsZT0iYmFja2dy
b3VuZC1jb2xvcjpwYWxlZ3JlZW47IHBhZGRpbmc6M3B4OyI+PGI+VEVTVCBQQVNTOjwvYj4gCisg
ICAgQSBuZXcgd2luZG93IHdpbGwgb3Blbi4KKyAgICA8L3A+CisgICAgCisgICAgPHAgaWQ9ImZh
aWx1cmUiIHN0eWxlPSJiYWNrZ3JvdW5kLWNvbG9yOiNGRjMzMDA7IHBhZGRpbmc6M3B4OyI+PGI+
VEVTVCBGQUlMOjwvYj4gIAorICAgIEFuIGFzc2VydGlvbiBmYWlsdXJlIHdpbGwgb2NjdXIuCisg
ICAgPC9wPgorICAgIDxidXR0b24gb25jbGljaz0idGVzdCgpIj5UZXN0PC9idXR0b24+CisgICAg
PGRpdiBpZD0ieiIgc3R5bGU9ImRpc3BsYXk6IG5vbmU7Ij4KKyAgICAgICAgPG9iamVjdD4KKyAg
ICAgICAgICAgIDxlbWJlZCB3aWR0aD0iNDAiIHNyYz0icmVzb3VyY2VzL29yYW5nZS5tb3YiIGNv
bnRyb2xsZXI9ImZhbHNlIj4KKyAgICAgICAgPC9vYmplY3Q+CisgICAgPC9kaXY+Cis8L2JvZHk+
CkluZGV4OiBXZWJDb3JlL3JlbmRlcmluZy9SZW5kZXJQYXJ0T2JqZWN0LmNwcAo9PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
Ci0tLSBXZWJDb3JlL3JlbmRlcmluZy9SZW5kZXJQYXJ0T2JqZWN0LmNwcAkocmV2aXNpb24gMjUx
NzQpCisrKyBXZWJDb3JlL3JlbmRlcmluZy9SZW5kZXJQYXJ0T2JqZWN0LmNwcAkod29ya2luZyBj
b3B5KQpAQCAtMTMxLDEyICsxMzEsNiBAQCB2b2lkIFJlbmRlclBhcnRPYmplY3Q6OnVwZGF0ZVdp
ZGdldChib29sCiAgICAgICBIVE1MRWxlbWVudCAqZW1iZWRPck9iamVjdDsKICAgICAgIGlmIChl
bWJlZCkgewogICAgICAgICAgIGVtYmVkT3JPYmplY3QgPSAoSFRNTEVsZW1lbnQgKillbWJlZDsK
LSAgICAgICAgICBTdHJpbmcgYXR0cmlidXRlID0gZW1iZWRPck9iamVjdC0+Z2V0QXR0cmlidXRl
KHdpZHRoQXR0cik7Ci0gICAgICAgICAgaWYgKCFhdHRyaWJ1dGUuaXNFbXB0eSgpKQotICAgICAg
ICAgICAgICBvLT5zZXRBdHRyaWJ1dGUod2lkdGhBdHRyLCBhdHRyaWJ1dGUpOwotICAgICAgICAg
IGF0dHJpYnV0ZSA9IGVtYmVkT3JPYmplY3QtPmdldEF0dHJpYnV0ZShoZWlnaHRBdHRyKTsKLSAg
ICAgICAgICBpZiAoIWF0dHJpYnV0ZS5pc0VtcHR5KCkpCi0gICAgICAgICAgICAgIG8tPnNldEF0
dHJpYnV0ZShoZWlnaHRBdHRyLCBhdHRyaWJ1dGUpOwogICAgICAgICAgIHVybCA9IGVtYmVkLT51
cmw7CiAgICAgICAgICAgc2VydmljZVR5cGUgPSBlbWJlZC0+bV9zZXJ2aWNlVHlwZTsKICAgICAg
IH0gZWxzZQo=
</data>
<flag name="review"
          id="6741"
          type_id="1"
          status="+"
          setter="darin"
    />
          </attachment>
      

    </bug>

</bugzilla>