149965 2015-10-09 12:49:50 -0700 REGRESSION: ASSERT (impl->isAtomic()) @ facebook.com 2015-10-13 09:04:01 -0700 1 1 1 Unclassified WebKit JavaScriptCore Other Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 ggaren ysuzuki commit-queue fpizlo ysuzuki oldest_to_newest 1131989 0 ggaren 2015-10-09 12:49:50 -0700 STEPS TO REPRODUCE: 1. Create a debug build 2. Visit Facebook.com 3. Wait about 5 seconds ASSERTION FAILED: impl->isAtomic() /Volumes/Big/ggaren/OpenSource/Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp(261) : bool JSC::DFG::ConstantFoldingPhase::foldConstants(JSC::DFG::BasicBlock *) 1 0x114645330 WTFCrash 2 0x113d2b395 JSC::DFG::ConstantFoldingPhase::foldConstants(JSC::DFG::BasicBlock*) 3 0x113d2a39a JSC::DFG::ConstantFoldingPhase::run() 4 0x113d2a215 bool JSC::DFG::runAndLog<JSC::DFG::ConstantFoldingPhase>(JSC::DFG::ConstantFoldingPhase&) 5 0x113d2a19e bool JSC::DFG::runPhase<JSC::DFG::ConstantFoldingPhase>(JSC::DFG::Graph&) 6 0x113d2a158 JSC::DFG::performConstantFolding(JSC::DFG::Graph&) 7 0x113ea1bd1 JSC::DFG::Plan::compileInThreadImpl(JSC::DFG::LongLivedState&) 8 0x113ea0cda JSC::DFG::Plan::compileInThread(JSC::DFG::LongLivedState&, JSC::DFG::ThreadData*) 9 0x113fa60d0 JSC::DFG::Worklist::runThread(JSC::DFG::ThreadData*) 10 0x113fa45c4 JSC::DFG::Worklist::threadFunction(void*) 11 0x1146b0419 WTF::createThread(void (*)(void*), void*, char const*)::$_0::operator()() const 12 0x1146b03ec std::__1::__function::__func<WTF::createThread(void (*)(void*), void*, char const*)::$_0, std::__1::allocator<WTF::createThread(void (*)(void*), void*, char const*)::$_0>, void ()>::operator()() 13 0x1140d91da std::__1::function<void ()>::operator()() const 14 0x1146af36e WTF::threadEntryPoint(void*) 15 0x1146b0cf8 WTF::wtfThreadEntryPoint(void*) 16 0x7fff8e3ba268 _pthread_body 17 0x7fff8e3ba1e5 _pthread_body 18 0x7fff8e3b841d thread_start 1131990 1 ggaren 2015-10-09 12:55:47 -0700 I debugged this a little. In the crashing case, the AbstractInterpreter executes CheckIdent and *does not* find a constant. Then, the DFGConstantFoldingPhase executes CheckIdent and *does* find a constant. The DFGConstantFoldingPhase constant is string equal to the uid expected by CheckIdent, but it is a plain string and not an atomic string. 1131994 2 fpizlo 2015-10-09 13:01:51 -0700 (In reply to comment #1) > I debugged this a little. > > In the crashing case, the AbstractInterpreter executes CheckIdent and *does > not* find a constant. Then, the DFGConstantFoldingPhase executes CheckIdent > and *does* find a constant. The DFGConstantFoldingPhase constant is string > equal to the uid expected by CheckIdent, but it is a plain string and not an > atomic string. It's more subtle than that. The constant folding phase code is assuming that it is running after m_interpreter.execute(). It's saying things like, "oh hey this has to be an atomic string because we already did StringIdentUse filtering". It's true that if you had run edge filtering first, then StringIdentUse would have filtered an abstract value containing a plain string to the empty abstract value (representing the fact that we would have always exited). And that's exactly what happens inside AbstractInterpreter - the executeEffects() method that has the CheckIdent case runs after edge filtering, so the AbstractInterpreter sees an empty AbstractValue because the StringIdentUse filtered the non-ident string to the empty value. The solution is to fix the constant folder to no longer assume that edge filtering already ran. If it sees a constant value, it should verify that the constant value is valid (i.e. would have passed edge filtering, i.e. would have been an atomic string). Probably just replacing: ASSERT(impl->isAtomic()); with: if (!impl->isAtomic()) break; would go a long way. 1132213 3 ysuzuki 2015-10-10 22:41:09 -0700 (In reply to comment #2) > (In reply to comment #1) > > I debugged this a little. > > > > In the crashing case, the AbstractInterpreter executes CheckIdent and *does > > not* find a constant. Then, the DFGConstantFoldingPhase executes CheckIdent > > and *does* find a constant. The DFGConstantFoldingPhase constant is string > > equal to the uid expected by CheckIdent, but it is a plain string and not an > > atomic string. > > It's more subtle than that. > > The constant folding phase code is assuming that it is running after > m_interpreter.execute(). It's saying things like, "oh hey this has to be an > atomic string because we already did StringIdentUse filtering". It's true > that if you had run edge filtering first, then StringIdentUse would have > filtered an abstract value containing a plain string to the empty abstract > value (representing the fact that we would have always exited). And that's > exactly what happens inside AbstractInterpreter - the executeEffects() > method that has the CheckIdent case runs after edge filtering, so the > AbstractInterpreter sees an empty AbstractValue because the StringIdentUse > filtered the non-ident string to the empty value. > > The solution is to fix the constant folder to no longer assume that edge > filtering already ran. If it sees a constant value, it should verify that > the constant value is valid (i.e. would have passed edge filtering, i.e. > would have been an atomic string). > > Probably just replacing: > > ASSERT(impl->isAtomic()); > > with: > > if (!impl->isAtomic()) > break; > > would go a long way. 1132324 4 ysuzuki 2015-10-12 09:37:59 -0700 Thanks. I'm now investigating to create the reproducible test cases (still did not succeed yet). 1132326 5 fpizlo 2015-10-12 09:46:35 -0700 (In reply to comment #4) > Thanks. I'm now investigating to create the reproducible test cases (still > did not succeed yet). This is the kind of bug where it's extremely valuable to land a fix, even if it does not have a test case. 1132337 6 ysuzuki 2015-10-12 10:09:34 -0700 (In reply to comment #5) > (In reply to comment #4) > > Thanks. I'm now investigating to create the reproducible test cases (still > > did not succeed yet). > > This is the kind of bug where it's extremely valuable to land a fix, even if > it does not have a test case. Thanks. OK, I'll upload the patch :) 1132357 7 262900 ysuzuki 2015-10-12 10:57:57 -0700 Created attachment 262900 Patch 1132361 8 262900 ysuzuki 2015-10-12 11:02:43 -0700 Comment on attachment 262900 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=262900&action=review Added comment :) > Source/JavaScriptCore/ChangeLog:15 > + in AI to the same in the constant folding phase. If my understanding is not correct, please point it :) In AI, we execute `executeEdges`. Finally, this executes AbstractValue::filter(with Use filter). And it makes the value empty if the value does not meet to the edge filter. So essentially, in AI, this change is not required. AI makes the constant value JSEmpty when it does not meet to the filter. I changed the code to keep it in sync with the code in the constant folding phase. In constant folding phase, we extract the constant value before executing AI's execute. So it means we may see the non-edge-filtered value. 1132401 9 262900 ggaren 2015-10-12 11:55:25 -0700 Comment on attachment 262900 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=262900&action=review >> Source/JavaScriptCore/ChangeLog:15 >> + in AI to the same in the constant folding phase. > > If my understanding is not correct, please point it :) > > In AI, we execute `executeEdges`. Finally, this executes AbstractValue::filter(with Use filter). And it makes the value empty if the value does not meet to the edge filter. > So essentially, in AI, this change is not required. AI makes the constant value JSEmpty when it does not meet to the filter. > I changed the code to keep it in sync with the code in the constant folding phase. > In constant folding phase, we extract the constant value before executing AI's execute. So it means we may see the non-edge-filtered value. I think your explanation in this ChangeLog is correct -- and indeed, if I only apply the constant folding change, and not the AI change, facebook.com stops crashing. > Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:2307 > case CheckIdent: { > AbstractValue& value = forNode(node->child1()); > UniquedStringImpl* uid = node->uidOperand(); > - ASSERT(uid->isSymbol() ? !(value.m_type & ~SpecSymbol) : !(value.m_type & ~SpecStringIdent)); // Edge filtering should have already ensured this. > + const UniquedStringImpl* constantUid = nullptr; > > JSValue childConstant = value.value(); > if (childConstant) { > if (uid->isSymbol()) { > - ASSERT(childConstant.isSymbol()); > - if (asSymbol(childConstant)->privateName().uid() == uid) { > - m_state.setFoundConstants(true); > - break; > - } > + if (childConstant.isSymbol()) > + constantUid = asSymbol(childConstant)->privateName().uid(); > } else { > - ASSERT(childConstant.isString()); > - if (asString(childConstant)->tryGetValueImpl() == uid) { > - m_state.setFoundConstants(true); > - break; > + if (childConstant.isString()) { > + if (const auto* impl = asString(childConstant)->tryGetValueImpl()) { > + // Edge filtering requires that a value here should be StringIdent. > + // However, a constant value propagated in DFG is not filtered. > + // So here, we check the propagated value is actually an atomic string. > + // And if it's not, we just ignore. > + if (impl->isAtomic()) > + constantUid = static_cast<const UniquedStringImpl*>(impl); > + } > } > } > } > > + if (uid == constantUid) { > + m_state.setFoundConstants(true); > + break; > + } I'm not sure about this change. Consistency is nice. But it's a bit confusing to have handling here for conditions that can never arise. I think this patch might be better if you just make the change to the constant folding phase. I wonder what Phil thinks. > Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp:265 > + // And if it's not, we just ignore. > + if (impl->isAtomic()) > + constantUid = static_cast<const UniquedStringImpl*>(impl); Is it possible to test this? I think all we need is an inferred constant that is not an identifier in program text. Something like this: function get(object, descriptor) { return object[descriptor.propertyName]; } noInline(get); var propertyName = String("propertyName" + (new Date).getSeconds()); function Descriptor () { } Descriptor.prototype.propertyName = propertyName; var object = { propertyName: 0 }; var descriptor = new Descriptor; for (var i = 0; i < 100000; ++i) get(object, descriptor); 1132421 10 fpizlo 2015-10-12 12:08:38 -0700 > > Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:2307 > > case CheckIdent: { > > AbstractValue& value = forNode(node->child1()); > > UniquedStringImpl* uid = node->uidOperand(); > > - ASSERT(uid->isSymbol() ? !(value.m_type & ~SpecSymbol) : !(value.m_type & ~SpecStringIdent)); // Edge filtering should have already ensured this. > > + const UniquedStringImpl* constantUid = nullptr; > > > > JSValue childConstant = value.value(); > > if (childConstant) { > > if (uid->isSymbol()) { > > - ASSERT(childConstant.isSymbol()); > > - if (asSymbol(childConstant)->privateName().uid() == uid) { > > - m_state.setFoundConstants(true); > > - break; > > - } > > + if (childConstant.isSymbol()) > > + constantUid = asSymbol(childConstant)->privateName().uid(); > > } else { > > - ASSERT(childConstant.isString()); > > - if (asString(childConstant)->tryGetValueImpl() == uid) { > > - m_state.setFoundConstants(true); > > - break; > > + if (childConstant.isString()) { > > + if (const auto* impl = asString(childConstant)->tryGetValueImpl()) { > > + // Edge filtering requires that a value here should be StringIdent. > > + // However, a constant value propagated in DFG is not filtered. > > + // So here, we check the propagated value is actually an atomic string. > > + // And if it's not, we just ignore. > > + if (impl->isAtomic()) > > + constantUid = static_cast<const UniquedStringImpl*>(impl); > > + } > > } > > } > > } > > > > + if (uid == constantUid) { > > + m_state.setFoundConstants(true); > > + break; > > + } > > I'm not sure about this change. Consistency is nice. But it's a bit > confusing to have handling here for conditions that can never arise. > > I think this patch might be better if you just make the change to the > constant folding phase. > > I wonder what Phil thinks. I agree. In AbstractInterpreter::executeEffects(), we know that we have already executed executeEdges(), and so it is correct (and preferable) to assert that the state is as it should be after edges are executed. In ConstantFoldingPhase, for this particular node, we are not calling m_interpreter.execute(). Therefore, we are replacing all of the logic in both executeEdges() and executeEffects(). So, we cannot assume that executeEdges() has run. It makes no sense to have consistency between code that is replacing execute() and code that loves in executeEffects(). If you're replacing execute(), then you are guaranteed that executeEdges() has not been called. If you're implementing executeEffect(), then you are guaranteed that executeEdges() has been called. The code must not look the same! 1132658 11 262900 ggaren 2015-10-12 19:04:32 -0700 Comment on attachment 262900 Patch OK, please rework this patch to remove the changes to the constant folding phase, and to add a test if possible. 1132672 12 fpizlo 2015-10-12 19:24:03 -0700 (In reply to comment #11) > Comment on attachment 262900 [details] > Patch > > OK, please rework this patch to remove the changes to the constant folding > phase, and to add a test if possible. *remove the changes to the abstract interpreter. The changes to constant folding are the necessary ones. 1132709 13 ysuzuki 2015-10-12 23:56:04 -0700 (In reply to comment #12) > (In reply to comment #11) > > Comment on attachment 262900 [details] > > Patch > > > > OK, please rework this patch to remove the changes to the constant folding > > phase, and to add a test if possible. > > *remove the changes to the abstract interpreter. The changes to constant > folding are the necessary ones. Thanks. OK, I'll drop AI part in the above patch :) 1132767 14 262900 ysuzuki 2015-10-13 07:57:37 -0700 Comment on attachment 262900 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=262900&action=review >> Source/JavaScriptCore/dfg/DFGConstantFoldingPhase.cpp:265 >> + constantUid = static_cast<const UniquedStringImpl*>(impl); > > Is it possible to test this? I think all we need is an inferred constant that is not an identifier in program text. Something like this: > > function get(object, descriptor) > { > return object[descriptor.propertyName]; > } > > noInline(get); > > var propertyName = String("propertyName" + (new Date).getSeconds()); > > function Descriptor () { } > Descriptor.prototype.propertyName = propertyName; > > var object = { propertyName: 0 }; > var descriptor = new Descriptor; > > for (var i = 0; i < 100000; ++i) > get(object, descriptor); In the above case, we extract the constant value from descriptor.propertyName. So it becomes JSConstant (And it becomes atomic string because when using it in object[expr], it attempt to atomize the given string). Hm, in the meantime, I'll just upload the revised patch... 1132768 15 262987 ysuzuki 2015-10-13 07:59:33 -0700 Created attachment 262987 Patch 1132769 16 262987 ggaren 2015-10-13 08:07:21 -0700 Comment on attachment 262987 Patch r=me By the way, considering optimization: (1) I wonder how Facebook produces this constant string that is somehow not an identifier. Usually, we try to make constant strings identifiers. (2) I believe we *could* optimize this case to notice that the two strings, though not pointer equal, are character equal, and do the constant folding anyway. Probably not a big deal, but I thought I would share the idea. 1132770 17 ysuzuki 2015-10-13 08:17:10 -0700 (In reply to comment #16) > Comment on attachment 262987 [details] > Patch > > r=me > > By the way, considering optimization: > > (1) I wonder how Facebook produces this constant string that is somehow not > an identifier. Usually, we try to make constant strings identifiers. > > (2) I believe we *could* optimize this case to notice that the two strings, > though not pointer equal, are character equal, and do the constant folding > anyway. > > Probably not a big deal, but I thought I would share the idea. It looks interesting. Do you have any static HTML data to reproduce this? This is because I still cannot reproduce this assertion failure... Opening facebook.com with my account (localized: JP) in GTK+ port MiniBrowser (Maybe it's different part). But the assertion does not fire... I think this is due to the fact that I did not use facebook so much... (there are only few contents) 1132775 18 262987 commit-queue 2015-10-13 09:03:57 -0700 Comment on attachment 262987 Patch Clearing flags on attachment: 262987 Committed r190991: <http://trac.webkit.org/changeset/190991> 1132776 19 commit-queue 2015-10-13 09:04:01 -0700 All reviewed patches have been landed. Closing bug. 262900 2015-10-12 10:57:57 -0700 2015-10-13 07:59:30 -0700 Patch bug-149965-20151013025721.patch text/plain 5874 ysuzuki U3VidmVyc2lvbiBSZXZpc2lvbjogMTkwODU0CmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlw dENvcmUvQ2hhbmdlTG9nIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwppbmRleCBj MTU2OWY2NzlmNWE1NzZhOTU0OTlkM2QwYjA2ZGM3ZDI2NGE0ZmZhLi43NzMxMjIwN2E2YTNjMWRl MjExMTAyNWM0NTQ4ODI1ZmU0MTllYTgzIDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENv cmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKQEAgLTEs MyArMSwyNCBAQAorMjAxNS0xMC0xMiAgWXVzdWtlIFN1enVraSAgPHV0YXRhbmUudGVhQGdtYWls LmNvbT4KKworICAgICAgICBSRUdSRVNTSU9OOiBBU1NFUlQgKGltcGwtPmlzQXRvbWljKCkpIEAg ZmFjZWJvb2suY29tCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNn aT9pZD0xNDk5NjUKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAg ICAgICBFZGdlIGZpbHRlcmluZyBmb3IgQ2hlY2tJZGVudCBlbnN1cmVzIHRoYXQgYSBnaXZlbiB2 YWx1ZSBpcyBlaXRoZXIgU3ltYm9sIG9yIFN0cmluZ0lkZW50LgorICAgICAgICBIb3dldmVyLCB0 aGlzIGZpbHRlcmluZyBpcyBub3QgYXBwbGllZCB0byBDaGVja0lkZW50IHdoZW4gcHJvcGFnYXRp bmcgYSBjb25zdGFudCB2YWx1ZSBpbgorICAgICAgICB0aGUgY29uc3RhbnQgZm9sZGluZyBwaGFz ZS4gQXMgYSByZXN1bHQsIGl0IGlzIG5vdCBndWFyYW50ZWVlZCB0aGF0IGEgY29uc3RhbnQgdmFs dWUKKyAgICAgICAgcHJvcGFnYXRlZCBpbiBjb25zdGFudCBmb2xkaW5nIGlzIFN5bWJvbCBvciBT dHJpbmdJZGVudC4KKworICAgICAgICBBSSBndWFyYW50ZWVzIHRoaXMgYnkgZXhlY3V0ZUVkZ2Vz LiBTbyBlc3NlbnRpYWxseSBubyBjaGFuZ2UgaXMgcmVxdWlyZWQgZm9yIEFJLgorICAgICAgICBC dXQgdG8ga2VlcCB0aGUgQUkgY29kZSBpbiBzeW5jIHdpdGggdGhlIGNvbnN0YW50IGZvbGRpbmcg cGhhc2UsIHdlIGFsc28gY2hhbmdlIHRoZSBjb2RlCisgICAgICAgIGluIEFJIHRvIHRoZSBzYW1l IGluIHRoZSBjb25zdGFudCBmb2xkaW5nIHBoYXNlLgorCisgICAgICAgICogZGZnL0RGR0Fic3Ry YWN0SW50ZXJwcmV0ZXJJbmxpbmVzLmg6CisgICAgICAgIChKU0M6OkRGRzo6QWJzdHJhY3RJbnRl cnByZXRlcjxBYnN0cmFjdFN0YXRlVHlwZT46OmV4ZWN1dGVFZmZlY3RzKToKKyAgICAgICAgKiBk ZmcvREZHQ29uc3RhbnRGb2xkaW5nUGhhc2UuY3BwOgorICAgICAgICAoSlNDOjpERkc6OkNvbnN0 YW50Rm9sZGluZ1BoYXNlOjpmb2xkQ29uc3RhbnRzKToKKwogMjAxNS0xMC0xMSAgWXVzdWtlIFN1 enVraSAgPHV0YXRhbmUudGVhQGdtYWlsLmNvbT4KIAogICAgICAgICBFUzYgY2xhc3NlczogV2hl biBhIGNsYXNzIGV4dGVuZHMgQiwgc3VwZXIoKSBpbnZva2VzIEIucHJvdG90eXBlLmNvbnN0cnVj dG9yKCkgaW5zdGVhZCBvZiBCKCkKZGlmZiAtLWdpdCBhL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9k ZmcvREZHQWJzdHJhY3RJbnRlcnByZXRlcklubGluZXMuaCBiL1NvdXJjZS9KYXZhU2NyaXB0Q29y ZS9kZmcvREZHQWJzdHJhY3RJbnRlcnByZXRlcklubGluZXMuaAppbmRleCA2OTE4M2Y3OWQxM2Vl MDAyNDk1ZmVmODA4YTg4MTkwZjc5ODFkMWEzLi5lYTI0Y2RjNzI4YTA2MWQzYjE5MTA0MDNlODBl YjI3YTZkMTE5YzFkIDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR0Fi c3RyYWN0SW50ZXJwcmV0ZXJJbmxpbmVzLmgKKysrIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL2Rm Zy9ERkdBYnN0cmFjdEludGVycHJldGVySW5saW5lcy5oCkBAIC0yMjgwLDI1ICsyMjgwLDMyIEBA CiAgICAgY2FzZSBDaGVja0lkZW50OiB7CiAgICAgICAgIEFic3RyYWN0VmFsdWUmIHZhbHVlID0g Zm9yTm9kZShub2RlLT5jaGlsZDEoKSk7CiAgICAgICAgIFVuaXF1ZWRTdHJpbmdJbXBsKiB1aWQg PSBub2RlLT51aWRPcGVyYW5kKCk7Ci0gICAgICAgIEFTU0VSVCh1aWQtPmlzU3ltYm9sKCkgPyAh KHZhbHVlLm1fdHlwZSAmIH5TcGVjU3ltYm9sKSA6ICEodmFsdWUubV90eXBlICYgflNwZWNTdHJp bmdJZGVudCkpOyAvLyBFZGdlIGZpbHRlcmluZyBzaG91bGQgaGF2ZSBhbHJlYWR5IGVuc3VyZWQg dGhpcy4KKyAgICAgICAgY29uc3QgVW5pcXVlZFN0cmluZ0ltcGwqIGNvbnN0YW50VWlkID0gbnVs bHB0cjsKIAogICAgICAgICBKU1ZhbHVlIGNoaWxkQ29uc3RhbnQgPSB2YWx1ZS52YWx1ZSgpOwog ICAgICAgICBpZiAoY2hpbGRDb25zdGFudCkgewogICAgICAgICAgICAgaWYgKHVpZC0+aXNTeW1i b2woKSkgewotICAgICAgICAgICAgICAgIEFTU0VSVChjaGlsZENvbnN0YW50LmlzU3ltYm9sKCkp OwotICAgICAgICAgICAgICAgIGlmIChhc1N5bWJvbChjaGlsZENvbnN0YW50KS0+cHJpdmF0ZU5h bWUoKS51aWQoKSA9PSB1aWQpIHsKLSAgICAgICAgICAgICAgICAgICAgbV9zdGF0ZS5zZXRGb3Vu ZENvbnN0YW50cyh0cnVlKTsKLSAgICAgICAgICAgICAgICAgICAgYnJlYWs7Ci0gICAgICAgICAg ICAgICAgfQorICAgICAgICAgICAgICAgIGlmIChjaGlsZENvbnN0YW50LmlzU3ltYm9sKCkpCisg ICAgICAgICAgICAgICAgICAgIGNvbnN0YW50VWlkID0gYXNTeW1ib2woY2hpbGRDb25zdGFudCkt PnByaXZhdGVOYW1lKCkudWlkKCk7CiAgICAgICAgICAgICB9IGVsc2UgewotICAgICAgICAgICAg ICAgIEFTU0VSVChjaGlsZENvbnN0YW50LmlzU3RyaW5nKCkpOwotICAgICAgICAgICAgICAgIGlm IChhc1N0cmluZyhjaGlsZENvbnN0YW50KS0+dHJ5R2V0VmFsdWVJbXBsKCkgPT0gdWlkKSB7Ci0g ICAgICAgICAgICAgICAgICAgIG1fc3RhdGUuc2V0Rm91bmRDb25zdGFudHModHJ1ZSk7Ci0gICAg ICAgICAgICAgICAgICAgIGJyZWFrOworICAgICAgICAgICAgICAgIGlmIChjaGlsZENvbnN0YW50 LmlzU3RyaW5nKCkpIHsKKyAgICAgICAgICAgICAgICAgICAgaWYgKGNvbnN0IGF1dG8qIGltcGwg PSBhc1N0cmluZyhjaGlsZENvbnN0YW50KS0+dHJ5R2V0VmFsdWVJbXBsKCkpIHsKKyAgICAgICAg ICAgICAgICAgICAgICAgIC8vIEVkZ2UgZmlsdGVyaW5nIHJlcXVpcmVzIHRoYXQgYSB2YWx1ZSBo ZXJlIHNob3VsZCBiZSBTdHJpbmdJZGVudC4KKyAgICAgICAgICAgICAgICAgICAgICAgIC8vIEhv d2V2ZXIsIGEgY29uc3RhbnQgdmFsdWUgcHJvcGFnYXRlZCBpbiBERkcgaXMgbm90IGZpbHRlcmVk LgorICAgICAgICAgICAgICAgICAgICAgICAgLy8gU28gaGVyZSwgd2UgY2hlY2sgdGhlIHByb3Bh Z2F0ZWQgdmFsdWUgaXMgYWN0dWFsbHkgYW4gYXRvbWljIHN0cmluZy4KKyAgICAgICAgICAgICAg ICAgICAgICAgIC8vIEFuZCBpZiBpdCdzIG5vdCwgd2UganVzdCBpZ25vcmUuCisgICAgICAgICAg ICAgICAgICAgICAgICBpZiAoaW1wbC0+aXNBdG9taWMoKSkKKyAgICAgICAgICAgICAgICAgICAg ICAgICAgICBjb25zdGFudFVpZCA9IHN0YXRpY19jYXN0PGNvbnN0IFVuaXF1ZWRTdHJpbmdJbXBs Kj4oaW1wbCk7CisgICAgICAgICAgICAgICAgICAgIH0KICAgICAgICAgICAgICAgICB9CiAgICAg ICAgICAgICB9CiAgICAgICAgIH0KIAorICAgICAgICBpZiAodWlkID09IGNvbnN0YW50VWlkKSB7 CisgICAgICAgICAgICBtX3N0YXRlLnNldEZvdW5kQ29uc3RhbnRzKHRydWUpOworICAgICAgICAg ICAgYnJlYWs7CisgICAgICAgIH0KKwogICAgICAgICBmaWx0ZXIodmFsdWUsIHVpZC0+aXNTeW1i b2woKSA/IFNwZWNTeW1ib2wgOiBTcGVjU3RyaW5nSWRlbnQpOwogICAgICAgICBicmVhazsKICAg ICB9CmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR0NvbnN0YW50Rm9s ZGluZ1BoYXNlLmNwcCBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9kZmcvREZHQ29uc3RhbnRGb2xk aW5nUGhhc2UuY3BwCmluZGV4IDVjODM2MDM5MmY2MThiNmUwMTRmM2VkMDU3ZTg0YWYxMDVlNTZl MWMuLjNhNTZlMzViNzMyMjQyYjQxMzE3NDQzNjE0NzIxZDY5MDY5ZWRmYzkgMTAwNjQ0Ci0tLSBh L1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9kZmcvREZHQ29uc3RhbnRGb2xkaW5nUGhhc2UuY3BwCisr KyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9kZmcvREZHQ29uc3RhbnRGb2xkaW5nUGhhc2UuY3Bw CkBAIC0yNDcsMTkgKzI0NywyMiBAQCBjbGFzcyBDb25zdGFudEZvbGRpbmdQaGFzZSA6IHB1Ymxp YyBQaGFzZSB7CiAKICAgICAgICAgICAgIGNhc2UgQ2hlY2tJZGVudDogewogICAgICAgICAgICAg ICAgIFVuaXF1ZWRTdHJpbmdJbXBsKiB1aWQgPSBub2RlLT51aWRPcGVyYW5kKCk7Ci0gICAgICAg ICAgICAgICAgSlNWYWx1ZSBjaGlsZENvbnN0YW50ID0gbV9zdGF0ZS5mb3JOb2RlKG5vZGUtPmNo aWxkMSgpKS52YWx1ZSgpOwogICAgICAgICAgICAgICAgIGNvbnN0IFVuaXF1ZWRTdHJpbmdJbXBs KiBjb25zdGFudFVpZCA9IG51bGxwdHI7CisKKyAgICAgICAgICAgICAgICBKU1ZhbHVlIGNoaWxk Q29uc3RhbnQgPSBtX3N0YXRlLmZvck5vZGUobm9kZS0+Y2hpbGQxKCkpLnZhbHVlKCk7CiAgICAg ICAgICAgICAgICAgaWYgKGNoaWxkQ29uc3RhbnQpIHsKICAgICAgICAgICAgICAgICAgICAgaWYg KHVpZC0+aXNTeW1ib2woKSkgewogICAgICAgICAgICAgICAgICAgICAgICAgaWYgKGNoaWxkQ29u c3RhbnQuaXNTeW1ib2woKSkKICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjb25zdGFudFVp ZCA9IGFzU3ltYm9sKGNoaWxkQ29uc3RhbnQpLT5wcml2YXRlTmFtZSgpLnVpZCgpOwogICAgICAg ICAgICAgICAgICAgICB9IGVsc2UgewogICAgICAgICAgICAgICAgICAgICAgICAgaWYgKGNoaWxk Q29uc3RhbnQuaXNTdHJpbmcoKSkgewotICAgICAgICAgICAgICAgICAgICAgICAgICAgIC8vIFNp bmNlIHdlIGFscmVhZHkgZmlsdGVyZWQgdGhlIHZhbHVlIHdpdGggU3RyaW5nSWRlbnRVc2UsCi0g ICAgICAgICAgICAgICAgICAgICAgICAgICAgLy8gdGhlIGhlbGQgaW1wbCBpcyBhbHdheXMgYXRv bWljLgogICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlmIChjb25zdCBhdXRvKiBpbXBsID0g YXNTdHJpbmcoY2hpbGRDb25zdGFudCktPnRyeUdldFZhbHVlSW1wbCgpKSB7Ci0gICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIEFTU0VSVChpbXBsLT5pc0F0b21pYygpKTsKLSAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgY29uc3RhbnRVaWQgPSBzdGF0aWNfY2FzdDxjb25zdCBV bmlxdWVkU3RyaW5nSW1wbCo+KGltcGwpOworICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAvLyBFZGdlIGZpbHRlcmluZyByZXF1aXJlcyB0aGF0IGEgdmFsdWUgaGVyZSBzaG91bGQgYmUg U3RyaW5nSWRlbnQuCisgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC8vIEhvd2V2ZXIs IGEgY29uc3RhbnQgdmFsdWUgcHJvcGFnYXRlZCBpbiBERkcgaXMgbm90IGZpbHRlcmVkLgorICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAvLyBTbyBoZXJlLCB3ZSBjaGVjayB0aGUgcHJv cGFnYXRlZCB2YWx1ZSBpcyBhY3R1YWxseSBhbiBhdG9taWMgc3RyaW5nLgorICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAvLyBBbmQgaWYgaXQncyBub3QsIHdlIGp1c3QgaWdub3JlLgor ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpZiAoaW1wbC0+aXNBdG9taWMoKSkKKyAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGNvbnN0YW50VWlkID0gc3RhdGljX2Nh c3Q8Y29uc3QgVW5pcXVlZFN0cmluZ0ltcGwqPihpbXBsKTsKICAgICAgICAgICAgICAgICAgICAg ICAgICAgICB9CiAgICAgICAgICAgICAgICAgICAgICAgICB9CiAgICAgICAgICAgICAgICAgICAg IH0K 262987 2015-10-13 07:59:33 -0700 2015-10-13 09:03:57 -0700 Patch bug-149965-20151013235857.patch text/plain 3181 ysuzuki U3VidmVyc2lvbiBSZXZpc2lvbjogMTkwODU0CmRpZmYgLS1naXQgYS9Tb3VyY2UvSmF2YVNjcmlw dENvcmUvQ2hhbmdlTG9nIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwppbmRleCBj MTU2OWY2NzlmNWE1NzZhOTU0OTlkM2QwYjA2ZGM3ZDI2NGE0ZmZhLi5mMDVjYjI4MDEzZGIyNmQx YTcyYjNkMjg3MWY5ZTViZjI4ZTFjZTc1IDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNjcmlwdENv cmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKQEAgLTEs MyArMSwxOCBAQAorMjAxNS0xMC0xMyAgWXVzdWtlIFN1enVraSAgPHV0YXRhbmUudGVhQGdtYWls LmNvbT4KKworICAgICAgICBSRUdSRVNTSU9OOiBBU1NFUlQgKGltcGwtPmlzQXRvbWljKCkpIEAg ZmFjZWJvb2suY29tCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNn aT9pZD0xNDk5NjUKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAg ICAgICBFZGdlIGZpbHRlcmluZyBmb3IgQ2hlY2tJZGVudCBlbnN1cmVzIHRoYXQgYSBnaXZlbiB2 YWx1ZSBpcyBlaXRoZXIgU3ltYm9sIG9yIFN0cmluZ0lkZW50LgorICAgICAgICBIb3dldmVyLCB0 aGlzIGZpbHRlcmluZyBpcyBub3QgYXBwbGllZCB0byBDaGVja0lkZW50IHdoZW4gcHJvcGFnYXRp bmcgYSBjb25zdGFudCB2YWx1ZSBpbgorICAgICAgICB0aGUgY29uc3RhbnQgZm9sZGluZyBwaGFz ZS4gQXMgYSByZXN1bHQsIGl0IGlzIG5vdCBndWFyYW50ZWVlZCB0aGF0IGEgY29uc3RhbnQgdmFs dWUKKyAgICAgICAgcHJvcGFnYXRlZCBpbiBjb25zdGFudCBmb2xkaW5nIGlzIFN5bWJvbCBvciBT dHJpbmdJZGVudC4KKworICAgICAgICAqIGRmZy9ERkdDb25zdGFudEZvbGRpbmdQaGFzZS5jcHA6 CisgICAgICAgIChKU0M6OkRGRzo6Q29uc3RhbnRGb2xkaW5nUGhhc2U6OmZvbGRDb25zdGFudHMp OgorCiAyMDE1LTEwLTExICBZdXN1a2UgU3V6dWtpICA8dXRhdGFuZS50ZWFAZ21haWwuY29tPgog CiAgICAgICAgIEVTNiBjbGFzc2VzOiBXaGVuIGEgY2xhc3MgZXh0ZW5kcyBCLCBzdXBlcigpIGlu dm9rZXMgQi5wcm90b3R5cGUuY29uc3RydWN0b3IoKSBpbnN0ZWFkIG9mIEIoKQpkaWZmIC0tZ2l0 IGEvU291cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9ERkdDb25zdGFudEZvbGRpbmdQaGFzZS5jcHAg Yi9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR0NvbnN0YW50Rm9sZGluZ1BoYXNlLmNwcApp bmRleCA1YzgzNjAzOTJmNjE4YjZlMDE0ZjNlZDA1N2U4NGFmMTA1ZTU2ZTFjLi4zYTU2ZTM1Yjcz MjI0MmI0MTMxNzQ0MzYxNDcyMWQ2OTA2OWVkZmM5IDEwMDY0NAotLS0gYS9Tb3VyY2UvSmF2YVNj cmlwdENvcmUvZGZnL0RGR0NvbnN0YW50Rm9sZGluZ1BoYXNlLmNwcAorKysgYi9Tb3VyY2UvSmF2 YVNjcmlwdENvcmUvZGZnL0RGR0NvbnN0YW50Rm9sZGluZ1BoYXNlLmNwcApAQCAtMjQ3LDE5ICsy NDcsMjIgQEAgY2xhc3MgQ29uc3RhbnRGb2xkaW5nUGhhc2UgOiBwdWJsaWMgUGhhc2UgewogCiAg ICAgICAgICAgICBjYXNlIENoZWNrSWRlbnQ6IHsKICAgICAgICAgICAgICAgICBVbmlxdWVkU3Ry aW5nSW1wbCogdWlkID0gbm9kZS0+dWlkT3BlcmFuZCgpOwotICAgICAgICAgICAgICAgIEpTVmFs dWUgY2hpbGRDb25zdGFudCA9IG1fc3RhdGUuZm9yTm9kZShub2RlLT5jaGlsZDEoKSkudmFsdWUo KTsKICAgICAgICAgICAgICAgICBjb25zdCBVbmlxdWVkU3RyaW5nSW1wbCogY29uc3RhbnRVaWQg PSBudWxscHRyOworCisgICAgICAgICAgICAgICAgSlNWYWx1ZSBjaGlsZENvbnN0YW50ID0gbV9z dGF0ZS5mb3JOb2RlKG5vZGUtPmNoaWxkMSgpKS52YWx1ZSgpOwogICAgICAgICAgICAgICAgIGlm IChjaGlsZENvbnN0YW50KSB7CiAgICAgICAgICAgICAgICAgICAgIGlmICh1aWQtPmlzU3ltYm9s KCkpIHsKICAgICAgICAgICAgICAgICAgICAgICAgIGlmIChjaGlsZENvbnN0YW50LmlzU3ltYm9s KCkpCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgY29uc3RhbnRVaWQgPSBhc1N5bWJvbChj aGlsZENvbnN0YW50KS0+cHJpdmF0ZU5hbWUoKS51aWQoKTsKICAgICAgICAgICAgICAgICAgICAg fSBlbHNlIHsKICAgICAgICAgICAgICAgICAgICAgICAgIGlmIChjaGlsZENvbnN0YW50LmlzU3Ry aW5nKCkpIHsKLSAgICAgICAgICAgICAgICAgICAgICAgICAgICAvLyBTaW5jZSB3ZSBhbHJlYWR5 IGZpbHRlcmVkIHRoZSB2YWx1ZSB3aXRoIFN0cmluZ0lkZW50VXNlLAotICAgICAgICAgICAgICAg ICAgICAgICAgICAgIC8vIHRoZSBoZWxkIGltcGwgaXMgYWx3YXlzIGF0b21pYy4KICAgICAgICAg ICAgICAgICAgICAgICAgICAgICBpZiAoY29uc3QgYXV0byogaW1wbCA9IGFzU3RyaW5nKGNoaWxk Q29uc3RhbnQpLT50cnlHZXRWYWx1ZUltcGwoKSkgewotICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICBBU1NFUlQoaW1wbC0+aXNBdG9taWMoKSk7Ci0gICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIGNvbnN0YW50VWlkID0gc3RhdGljX2Nhc3Q8Y29uc3QgVW5pcXVlZFN0cmluZ0lt cGwqPihpbXBsKTsKKyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLy8gRWRnZSBmaWx0 ZXJpbmcgcmVxdWlyZXMgdGhhdCBhIHZhbHVlIGhlcmUgc2hvdWxkIGJlIFN0cmluZ0lkZW50Lgor ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAvLyBIb3dldmVyLCBhIGNvbnN0YW50IHZh bHVlIHByb3BhZ2F0ZWQgaW4gREZHIGlzIG5vdCBmaWx0ZXJlZC4KKyAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgLy8gU28gaGVyZSwgd2UgY2hlY2sgdGhlIHByb3BhZ2F0ZWQgdmFsdWUg aXMgYWN0dWFsbHkgYW4gYXRvbWljIHN0cmluZy4KKyAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgLy8gQW5kIGlmIGl0J3Mgbm90LCB3ZSBqdXN0IGlnbm9yZS4KKyAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgaWYgKGltcGwtPmlzQXRvbWljKCkpCisgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICBjb25zdGFudFVpZCA9IHN0YXRpY19jYXN0PGNvbnN0IFVuaXF1 ZWRTdHJpbmdJbXBsKj4oaW1wbCk7CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfQogICAg ICAgICAgICAgICAgICAgICAgICAgfQogICAgICAgICAgICAgICAgICAgICB9Cg==