<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>15848</bug_id>
          
          <creation_ts>2007-11-05 13:39:34 -0800</creation_ts>
          <short_desc>REGRESSION: Assertion failure viewing comments page on digg.com</short_desc>
          <delta_ts>2007-12-03 07:47:11 -0800</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>JavaScriptCore</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>Mac</rep_platform>
          <op_sys>OS X 10.4</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc>http://digg.com/</bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>HasReduction, InRadar, Regression</keywords>
          <priority>P1</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="David Kilzer (:ddkilzer)">ddkilzer</reporter>
          <assigned_to name="Darin Adler">darin</assigned_to>
          <cc>bdakin</cc>
    
    <cc>brkemper</cc>
    
    <cc>david.barto</cc>
    
    <cc>mitz</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>60329</commentid>
    <comment_count>0</comment_count>
    <who name="David Kilzer (:ddkilzer)">ddkilzer</who>
    <bug_when>2007-11-05 13:39:34 -0800</bug_when>
    <thetext>* SUMMARY
An assertion failure still occurs viewing a comments page on digg.com.

* STEPS TO REPRODUCE
1. Launch Safari/WebKit with a debug build of WebKit.
2. Go to URL:  http://digg.com/
3. Sign in.
4. Search for &quot;Leopard Windows bsod&quot;.
5. Click on the &quot;Comments&quot; link for the &quot;Remove the Windows BSOD icon in Leopard, make OS X a little less smug&quot; story.
6. Wait.  (Feel free to scroll around the page if it helps make the time pass.)

* RESULTS
WebKit crashes with an assertion failure.

* REGRESSION
This is a regression from Safari 3 on Leopard.

* NOTES
Console output:

ASSERTION FAILED: !HashTranslator::equal(KeyTraits::emptyValue(), key)
(./wtf/HashTable.h:426 Value* WTF::HashTable&lt;Key, Value, Extractor, HashFunctions, Traits, KeyTraits&gt;::lookup(const T&amp;) [with T = unsigned int, HashTranslator = WTF::IdentityHashTranslator&lt;unsigned int, std::pair&lt;unsigned int, int&gt;, WTF::IntHash&lt;unsigned int&gt; &gt;, Key = unsigned int, Value = std::pair&lt;unsigned int, int&gt;, Extractor = WTF::PairFirstExtractor&lt;std::pair&lt;unsigned int, int&gt; &gt;, HashFunctions = WTF::IntHash&lt;unsigned int&gt;, Traits = WTF::PairHashTraits&lt;WTF::HashTraits&lt;unsigned int&gt;, WTF::HashTraits&lt;int32_t&gt; &gt;, KeyTraits = WTF::HashTraits&lt;unsigned int&gt;])
Segmentation fault

Stack trace:

Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_INVALID_ADDRESS (0x0001) at 0xbbadbeef

Thread 0 Crashed:
0   com.apple.JavaScriptCore 	0x00639768 std::pair&lt;unsigned, int&gt;* WTF::HashTable&lt;unsigned, std::pair&lt;unsigned, int&gt;, WTF::PairFirstExtractor&lt;std::pair&lt;unsigned, int&gt; &gt;, WTF::IntHash&lt;unsigned&gt;, WTF::PairHashTraits&lt;WTF::HashTraits&lt;unsigned&gt;, WTF::HashTraits&lt;int&gt; &gt;, WTF::HashTraits&lt;unsigned&gt; &gt;::lookup&lt;unsigned, WTF::IdentityHashTranslator&lt;unsigned, std::pair&lt;unsigned, int&gt;, WTF::IntHash&lt;unsigned&gt; &gt; &gt;(unsigned const&amp;) + 184 (HashTable.h:426)
1   com.apple.JavaScriptCore 	0x0063ccac WTF::HashTableIterator&lt;unsigned, std::pair&lt;unsigned, int&gt;, WTF::PairFirstExtractor&lt;std::pair&lt;unsigned, int&gt; &gt;, WTF::IntHash&lt;unsigned&gt;, WTF::PairHashTraits&lt;WTF::HashTraits&lt;unsigned&gt;, WTF::HashTraits&lt;int&gt; &gt;, WTF::HashTraits&lt;unsigned&gt; &gt; WTF::HashTable&lt;unsigned, std::pair&lt;unsigned, int&gt;, WTF::PairFirstExtractor&lt;std::pair&lt;unsigned, int&gt; &gt;, WTF::IntHash&lt;unsigned&gt;, WTF::PairHashTraits&lt;WTF::HashTraits&lt;unsigned&gt;, WTF::HashTraits&lt;int&gt; &gt;, WTF::HashTraits&lt;unsigned&gt; &gt;::find&lt;unsigned, WTF::IdentityHashTranslator&lt;unsigned, std::pair&lt;unsigned, int&gt;, WTF::IntHash&lt;unsigned&gt; &gt; &gt;(unsigned const&amp;) + 80 (HashTable.h:729)
2   com.apple.JavaScriptCore 	0x0063cd34 WTF::HashTable&lt;unsigned, std::pair&lt;unsigned, int&gt;, WTF::PairFirstExtractor&lt;std::pair&lt;unsigned, int&gt; &gt;, WTF::IntHash&lt;unsigned&gt;, WTF::PairHashTraits&lt;WTF::HashTraits&lt;unsigned&gt;, WTF::HashTraits&lt;int&gt; &gt;, WTF::HashTraits&lt;unsigned&gt; &gt;::find(unsigned const&amp;) + 52 (HashTable.h:314)
3   com.apple.JavaScriptCore 	0x0063cd84 WTF::HashMap&lt;unsigned, KJS::JSValue*, WTF::IntHash&lt;unsigned&gt;, WTF::HashTraits&lt;unsigned&gt;, WTF::HashTraits&lt;KJS::JSValue*&gt; &gt;::find(unsigned const&amp;) + 56 (HashMap.h:251)
4   com.apple.JavaScriptCore 	0x00664be0 KJS::ArrayInstance::inlineGetOwnPropertySlot(KJS::ExecState*, unsigned, KJS::PropertySlot&amp;) + 328 (array_instance.cpp:154)
5   com.apple.JavaScriptCore 	0x0059efbc KJS::ArrayInstance::getOwnPropertySlot(KJS::ExecState*, unsigned, KJS::PropertySlot&amp;) + 56 (array_instance.cpp:180)
6   com.apple.JavaScriptCore 	0x00578160 KJS::JSObject::getPropertySlot(KJS::ExecState*, unsigned, KJS::PropertySlot&amp;) + 88 (object.cpp:182)
7   com.apple.JavaScriptCore 	0x0059e6f0 KJS::JSObject::get(KJS::ExecState*, unsigned) const + 52 (object.cpp:171)
8   com.apple.JavaScriptCore 	0x005b23a0 KJS::BracketAccessorNode::evaluate(KJS::ExecState*) + 328 (nodes.cpp:583)
9   com.apple.JavaScriptCore 	0x005b1080 KJS::TypeOfValueNode::evaluate(KJS::ExecState*) + 84 (nodes.cpp:1322)
10  com.apple.JavaScriptCore 	0x005af1b0 KJS::EqualNode::evaluate(KJS::ExecState*) + 84 (nodes.cpp:1941)
11  com.apple.JavaScriptCore 	0x005ad520 KJS::IfNode::execute(KJS::ExecState*) + 204 (nodes.cpp:2736)
12  com.apple.JavaScriptCore 	0x0058a5b8 KJS::statementListExecute(WTF::Vector&lt;WTF::RefPtr&lt;KJS::StatementNode&gt;, (unsigned long)0&gt;&amp;, KJS::ExecState*) + 148 (nodes.cpp:2648)
13  com.apple.JavaScriptCore 	0x0058a7c8 KJS::BlockNode::execute(KJS::ExecState*) + 120 (nodes.cpp:2689)
14  com.apple.JavaScriptCore 	0x005ad674 KJS::IfNode::execute(KJS::ExecState*) + 544 (nodes.cpp:2749)
15  com.apple.JavaScriptCore 	0x0058a5b8 KJS::statementListExecute(WTF::Vector&lt;WTF::RefPtr&lt;KJS::StatementNode&gt;, (unsigned long)0&gt;&amp;, KJS::ExecState*) + 148 (nodes.cpp:2648)
16  com.apple.JavaScriptCore 	0x0058a7c8 KJS::BlockNode::execute(KJS::ExecState*) + 120 (nodes.cpp:2689)
17  com.apple.JavaScriptCore 	0x005a920c KJS::FunctionBodyNode::execute(KJS::ExecState*) + 68 (nodes.cpp:3607)
18  com.apple.JavaScriptCore 	0x00577550 KJS::FunctionImp::execute(KJS::ExecState*) + 96 (function.cpp:252)
19  com.apple.JavaScriptCore 	0x005b5df0 KJS::FunctionImp::callAsFunction(KJS::ExecState*, KJS::JSObject*, KJS::List const&amp;) + 464 (function.cpp:93)
20  com.apple.JavaScriptCore 	0x005a2178 KJS::JSObject::call(KJS::ExecState*, KJS::JSObject*, KJS::List const&amp;) + 304 (object.cpp:95)
21  com.apple.JavaScriptCore 	0x005c2d58 KJS::FunctionCallResolveNode::evaluate(KJS::ExecState*) + 824 (nodes.cpp:762)
22  com.apple.JavaScriptCore 	0x005ad77c KJS::ExprStatementNode::execute(KJS::ExecState*) + 204 (nodes.cpp:2713)
23  com.apple.JavaScriptCore 	0x0058a5b8 KJS::statementListExecute(WTF::Vector&lt;WTF::RefPtr&lt;KJS::StatementNode&gt;, (unsigned long)0&gt;&amp;, KJS::ExecState*) + 148 (nodes.cpp:2648)
24  com.apple.JavaScriptCore 	0x0058a7c8 KJS::BlockNode::execute(KJS::ExecState*) + 120 (nodes.cpp:2689)
25  com.apple.JavaScriptCore 	0x005a920c KJS::FunctionBodyNode::execute(KJS::ExecState*) + 68 (nodes.cpp:3607)
26  com.apple.JavaScriptCore 	0x005d1dac KJS::Interpreter::evaluate(KJS::UString const&amp;, int, KJS::UChar const*, int, KJS::JSValue*) + 920 (interpreter.cpp:366)
27  com.apple.WebCore        	0x015c84e4 WebCore::KJSProxy::evaluate(WebCore::String const&amp;, int, WebCore::String const&amp;) + 280 (kjs_proxy.cpp:87)
28  com.apple.WebCore        	0x011a8c00 WebCore::FrameLoader::executeScript(WebCore::String const&amp;, int, WebCore::String const&amp;) + 128 (FrameLoader.cpp:761)
29  com.apple.WebCore        	0x011a8cdc WebCore::FrameLoader::executeScript(WebCore::String const&amp;, bool) + 136 (FrameLoader.cpp:749)
30  com.apple.WebCore        	0x015ccb28 KJS::ScheduledAction::execute(KJS::Window*) + 1248 (kjs_window.cpp:1520)
31  com.apple.WebCore        	0x015ccc24 KJS::Window::timerFired(KJS::DOMWindowTimer*) + 104 (kjs_window.cpp:1638)
32  com.apple.WebCore        	0x015cce58 KJS::DOMWindowTimer::fired() + 72 (kjs_window.cpp:1912)
33  com.apple.WebCore        	0x01561444 WebCore::TimerBase::fireTimers(double, WTF::Vector&lt;WebCore::TimerBase*, (unsigned long)0&gt; const&amp;) + 244 (Timer.cpp:339)
34  com.apple.WebCore        	0x01561524 WebCore::TimerBase::sharedTimerFired() + 132 (Timer.cpp:359)
35  com.apple.WebCore        	0x0153ba38 WebCore::timerFired(__CFRunLoopTimer*, void*) + 140 (SharedTimerMac.cpp:85)
36  com.apple.CoreFoundation 	0x907f1578 __CFRunLoopDoTimer + 184
37  com.apple.CoreFoundation 	0x907ddef8 __CFRunLoopRun + 1680
38  com.apple.CoreFoundation 	0x907dd4ac CFRunLoopRunSpecific + 268
39  com.apple.HIToolbox      	0x93298b20 RunCurrentEventLoopInMode + 264
40  com.apple.HIToolbox      	0x932981b4 ReceiveNextEventCommon + 380
41  com.apple.HIToolbox      	0x93298020 BlockUntilNextEventMatchingListInMode + 96
42  com.apple.AppKit         	0x9379eae4 _DPSNextEvent + 384
43  com.apple.AppKit         	0x9379e7a8 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 116
44  com.apple.Safari         	0x00006770 0x1000 + 22384
45  com.apple.AppKit         	0x9379acec -[NSApplication run] + 472
46  com.apple.AppKit         	0x9388b87c NSApplicationMain + 452
47  com.apple.Safari         	0x0000244c 0x1000 + 5196
48  com.apple.Safari         	0x0004f1b0 0x1000 + 319920</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>60332</commentid>
    <comment_count>1</comment_count>
    <who name="David Kilzer (:ddkilzer)">ddkilzer</who>
    <bug_when>2007-11-05 13:42:24 -0800</bug_when>
    <thetext>(In reply to comment #0)
&gt; 4. Search for &quot;Leopard Windows bsod&quot;.
&gt; 5. Click on the &quot;Comments&quot; link for the &quot;Remove the Windows BSOD icon in
&gt; Leopard, make OS X a little less smug&quot; story.

Direct link:

http://digg.com/apple/Remove_the_Windows_BSOD_icon_in_Leopard_make_OS_X_a_little_less_smug

</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>60335</commentid>
    <comment_count>2</comment_count>
    <who name="David Kilzer (:ddkilzer)">ddkilzer</who>
    <bug_when>2007-11-05 13:52:56 -0800</bug_when>
    <thetext>(In reply to comment #0)
&gt; * SUMMARY
&gt; An assertion failure still occurs viewing a comments page on digg.com.

See Bug 15747 Comment #5.

</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>62649</commentid>
    <comment_count>3</comment_count>
    <who name="David Kilzer (:ddkilzer)">ddkilzer</who>
    <bug_when>2007-11-28 22:30:37 -0800</bug_when>
    <thetext>&lt;rdar://problem/5619330&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>62991</commentid>
    <comment_count>4</comment_count>
    <who name="David Kilzer (:ddkilzer)">ddkilzer</who>
    <bug_when>2007-12-02 10:06:27 -0800</bug_when>
    <thetext>*** Bug 16155 has been marked as a duplicate of this bug. ***</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>62993</commentid>
    <comment_count>5</comment_count>
    <who name="David Kilzer (:ddkilzer)">ddkilzer</who>
    <bug_when>2007-12-02 10:06:52 -0800</bug_when>
    <thetext>*** Bug 16016 has been marked as a duplicate of this bug. ***</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>62995</commentid>
    <comment_count>6</comment_count>
    <who name="David Kilzer (:ddkilzer)">ddkilzer</who>
    <bug_when>2007-12-02 10:07:24 -0800</bug_when>
    <thetext>*** Bug 16031 has been marked as a duplicate of this bug. ***</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>63065</commentid>
    <comment_count>7</comment_count>
      <attachid>17661</attachid>
    <who name="">mitz</who>
    <bug_when>2007-12-02 20:18:57 -0800</bug_when>
    <thetext>Created attachment 17661
Reduction (will ASSERT)

The ASSERT is hit when accessing the 0th element of a sparse array. 0 is the empty value in the sparse array hash map so the assertion fails.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>63066</commentid>
    <comment_count>8</comment_count>
    <who name="">mitz</who>
    <bug_when>2007-12-02 20:34:11 -0800</bug_when>
    <thetext>The ASSERT was added in &lt;http://trac.webkit.org/projects/webkit/changeset/27196&gt; where a similar problem was fixed for timer IDs.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>63067</commentid>
    <comment_count>9</comment_count>
      <attachid>17662</attachid>
    <who name="">mitz</who>
    <bug_when>2007-12-02 20:40:46 -0800</bug_when>
    <thetext>Created attachment 17662
Reduction (will crash)

A version that crashes release builds.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>63085</commentid>
    <comment_count>10</comment_count>
    <who name="">mitz</who>
    <bug_when>2007-12-02 22:23:06 -0800</bug_when>
    <thetext>I noticed another HashMap in JavaScriptCore that might be prone to the same problem: the intIdentifierMap in npruntime.cpp. There might be more in WebCore.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>63086</commentid>
    <comment_count>11</comment_count>
      <attachid>17665</attachid>
    <who name="Darin Adler">darin</who>
    <bug_when>2007-12-02 22:30:19 -0800</bug_when>
    <thetext>Created attachment 17665
patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>63089</commentid>
    <comment_count>12</comment_count>
    <who name="Darin Adler">darin</who>
    <bug_when>2007-12-02 22:52:04 -0800</bug_when>
    <thetext>(In reply to comment #10)
&gt; I noticed another HashMap in JavaScriptCore that might be prone to the same
&gt; problem: the intIdentifierMap in npruntime.cpp. There might be more in WebCore.

The intIdentifierMap will have a worse problem, because you can&apos;t use either a 0 or -1. In the array case, it&apos;s just 0 -- there&apos;s no issue with -1. We should probably track that issue with a separate bug.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>63090</commentid>
    <comment_count>13</comment_count>
      <attachid>17666</attachid>
    <who name="">mitz</who>
    <bug_when>2007-12-02 22:54:13 -0800</bug_when>
    <thetext>Created attachment 17666
Different approach, without an extra branch

I started working on this before I saw Darin took the bug. This approach avoids extra work when accessing the array but initializing the empty values to -2 costs more than initializing to 0.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>63091</commentid>
    <comment_count>14</comment_count>
    <who name="Darin Adler">darin</who>
    <bug_when>2007-12-02 22:56:27 -0800</bug_when>
    <thetext>(In reply to comment #13)
&gt; Created an attachment (id=17666) [edit]
&gt; Different approach, without an extra branch
&gt; 
&gt; I started working on this before I saw Darin took the bug. This approach avoids
&gt; extra work when accessing the array but initializing the empty values to -2
&gt; costs more than initializing to 0.

It&apos;s the JavaScript language standard that makes FFFFFFFF special, not our implementation. We can&apos;t just change maxArrayIndex; FFFFFFFD and FFFFFFFE have to work as array indices, whereas FFFFFFFF can be treated as just another non-array property.

So I suspect this won&apos;t work. We&apos;d need a test case that sets a property with FFFFFFFE and checks the length of the array to demonstrate what&apos;s wrong with it.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>63093</commentid>
    <comment_count>15</comment_count>
    <who name="">mitz</who>
    <bug_when>2007-12-02 23:02:54 -0800</bug_when>
    <thetext>(In reply to comment #14)
&gt; So I suspect this won&apos;t work. We&apos;d need a test case that sets a property with
&gt; FFFFFFFE and checks the length of the array to demonstrate what&apos;s wrong with
&gt; it.

Yup, to make it work we&apos;d need to add an extra branch somewhere :-)</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>63094</commentid>
    <comment_count>16</comment_count>
      <attachid>17665</attachid>
    <who name="">mitz</who>
    <bug_when>2007-12-02 23:09:09 -0800</bug_when>
    <thetext>Comment on attachment 17665
patch

\ No newline at end of file
Please add a newline.

r=me</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>63140</commentid>
    <comment_count>17</comment_count>
    <who name="Darin Adler">darin</who>
    <bug_when>2007-12-03 07:47:11 -0800</bug_when>
    <thetext>Committed revision 28346.</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="0"
              isprivate="0"
          >
            <attachid>17661</attachid>
            <date>2007-12-02 20:18:57 -0800</date>
            <delta_ts>2007-12-02 20:18:57 -0800</delta_ts>
            <desc>Reduction (will ASSERT)</desc>
            <filename>15848 reduction.html</filename>
            <type>text/html</type>
            <size>82</size>
            <attacher>mitz</attacher>
            
              <data encoding="base64">PHNjcmlwdD4KICAgIHZhciBhcnJheSA9IG5ldyBBcnJheTsKICAgIGFycmF5WzUwMDAwXSA9IDA7
CiAgICBhcnJheVswXTsKPC9zY3JpcHQ+Cg==
</data>

          </attachment>
          <attachment
              isobsolete="0"
              ispatch="0"
              isprivate="0"
          >
            <attachid>17662</attachid>
            <date>2007-12-02 20:40:46 -0800</date>
            <delta_ts>2007-12-02 20:40:46 -0800</delta_ts>
            <desc>Reduction (will crash)</desc>
            <filename>15848 reduction.html</filename>
            <type>text/html</type>
            <size>86</size>
            <attacher>mitz</attacher>
            
              <data encoding="base64">PHNjcmlwdD4KICAgIHZhciBhcnJheSA9IG5ldyBBcnJheTsKICAgIGFycmF5WzUwMDAwXSA9IDEw
MDsKICAgIGFycmF5WzBdKys7Cjwvc2NyaXB0Pgo=
</data>

          </attachment>
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>17665</attachid>
            <date>2007-12-02 22:30:19 -0800</date>
            <delta_ts>2007-12-02 23:09:09 -0800</delta_ts>
            <desc>patch</desc>
            <filename>SparseArrayPatch.txt</filename>
            <type>text/plain</type>
            <size>5270</size>
            <attacher name="Darin Adler">darin</attacher>
            
              <data encoding="base64">SW5kZXg6IEphdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBKYXZhU2NyaXB0
Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDI4MzI3KQorKysgSmF2YVNjcmlwdENvcmUvQ2hhbmdl
TG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTcgQEAKKzIwMDctMTItMDIgIERhcmluIEFk
bGVyICA8ZGFyaW5AYXBwbGUuY29tPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09Q
UyEpLgorCisgICAgICAgIC0gZml4IGh0dHA6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dp
P2lkPTE1ODQ4CisgICAgICAgICAgPHJkYXI6Ly9wcm9ibGVtLzU2MTkzMzA+IFJFR1JFU1NJT046
IEFzc2VydGlvbiBmYWlsdXJlIHZpZXdpbmcgY29tbWVudHMgcGFnZSBvbiBkaWdnLmNvbQorCisg
ICAgICAgIFRlc3Q6IGZhc3QvanMvc3BhcnNlLWFycmF5Lmh0bWwKKworICAgICAgICAqIGtqcy9h
cnJheV9pbnN0YW5jZS5jcHA6CisgICAgICAgIChLSlM6OkFycmF5SW5zdGFuY2U6OmlubGluZUdl
dE93blByb3BlcnR5U2xvdCk6IENoZWNrIHNwYXJzZSBhcnJheSBjdXRvZmYgYmVmb3JlIGxvb2tp
bmcKKyAgICAgICAgaW4gaGFzaCBtYXAuIENhbid0IGF2b2lkIHRoZSBicmFuY2ggYmVjYXVzZSB3
ZSBjYW4ndCBsb29rIGZvciAwIGluIHRoZSBoYXNoLgorICAgICAgICAoS0pTOjpBcnJheUluc3Rh
bmNlOjpkZWxldGVQcm9wZXJ0eSk6IERpdHRvLgorCiAyMDA3LTEyLTAxICBBbHAgVG9rZXIgIDxh
bHBAYXRva2VyLmNvbT4KIAogICAgICAgICBSZXZpZXdlZCBieSBBZGFtIFJvYmVuLgpJbmRleDog
SmF2YVNjcmlwdENvcmUva2pzL2FycmF5X2luc3RhbmNlLmNwcAo9PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBKYXZh
U2NyaXB0Q29yZS9ranMvYXJyYXlfaW5zdGFuY2UuY3BwCShyZXZpc2lvbiAyODMyNikKKysrIEph
dmFTY3JpcHRDb3JlL2tqcy9hcnJheV9pbnN0YW5jZS5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTE1
MSwxMCArMTUxLDEyIEBAIEFMV0FZU19JTkxJTkUgYm9vbCBBcnJheUluc3RhbmNlOjppbmxpbmUK
ICAgICAgICAgICAgIHJldHVybiB0cnVlOwogICAgICAgICB9CiAgICAgfSBlbHNlIGlmIChTcGFy
c2VBcnJheVZhbHVlTWFwKiBtYXAgPSBzdG9yYWdlLT5tX3NwYXJzZVZhbHVlTWFwKSB7Ci0gICAg
ICAgIFNwYXJzZUFycmF5VmFsdWVNYXA6Oml0ZXJhdG9yIGl0ID0gbWFwLT5maW5kKGkpOwotICAg
ICAgICBpZiAoaXQgIT0gbWFwLT5lbmQoKSkgewotICAgICAgICAgICAgc2xvdC5zZXRWYWx1ZVNs
b3QodGhpcywgJml0LT5zZWNvbmQpOwotICAgICAgICAgICAgcmV0dXJuIHRydWU7CisgICAgICAg
IGlmIChpID49IHNwYXJzZUFycmF5Q3V0b2ZmKSB7CisgICAgICAgICAgICBTcGFyc2VBcnJheVZh
bHVlTWFwOjppdGVyYXRvciBpdCA9IG1hcC0+ZmluZChpKTsKKyAgICAgICAgICAgIGlmIChpdCAh
PSBtYXAtPmVuZCgpKSB7CisgICAgICAgICAgICAgICAgc2xvdC5zZXRWYWx1ZVNsb3QodGhpcywg
Jml0LT5zZWNvbmQpOworICAgICAgICAgICAgICAgIHJldHVybiB0cnVlOworICAgICAgICAgICAg
fQogICAgICAgICB9CiAgICAgfQogCkBAIC0zMTgsMTAgKzMyMCwxMiBAQCBib29sIEFycmF5SW5z
dGFuY2U6OmRlbGV0ZVByb3BlcnR5KEV4ZWNTCiAgICAgfQogCiAgICAgaWYgKFNwYXJzZUFycmF5
VmFsdWVNYXAqIG1hcCA9IHN0b3JhZ2UtPm1fc3BhcnNlVmFsdWVNYXApIHsKLSAgICAgICAgU3Bh
cnNlQXJyYXlWYWx1ZU1hcDo6aXRlcmF0b3IgaXQgPSBtYXAtPmZpbmQoaSk7Ci0gICAgICAgIGlm
IChpdCAhPSBtYXAtPmVuZCgpKSB7Ci0gICAgICAgICAgICBtYXAtPnJlbW92ZShpdCk7Ci0gICAg
ICAgICAgICByZXR1cm4gdHJ1ZTsKKyAgICAgICAgaWYgKGkgPj0gc3BhcnNlQXJyYXlDdXRvZmYp
IHsKKyAgICAgICAgICAgIFNwYXJzZUFycmF5VmFsdWVNYXA6Oml0ZXJhdG9yIGl0ID0gbWFwLT5m
aW5kKGkpOworICAgICAgICAgICAgaWYgKGl0ICE9IG1hcC0+ZW5kKCkpIHsKKyAgICAgICAgICAg
ICAgICBtYXAtPnJlbW92ZShpdCk7CisgICAgICAgICAgICAgICAgcmV0dXJuIHRydWU7CisgICAg
ICAgICAgICB9CiAgICAgICAgIH0KICAgICB9CiAKSW5kZXg6IExheW91dFRlc3RzL0NoYW5nZUxv
Zwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9DaGFuZ2VMb2cJKHJldmlzaW9uIDI4MzI3KQor
KysgTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTQgQEAK
KzIwMDctMTItMDIgIERhcmluIEFkbGVyICA8ZGFyaW5AYXBwbGUuY29tPgorCisgICAgICAgIFJl
dmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIC0gdGVzdCBmb3IgaHR0cDovL2J1
Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTU4NDgKKyAgICAgICAgICA8cmRhcjovL3By
b2JsZW0vNTYxOTMzMD4gUkVHUkVTU0lPTjogQXNzZXJ0aW9uIGZhaWx1cmUgdmlld2luZyBjb21t
ZW50cyBwYWdlIG9uIGRpZ2cuY29tCisKKyAgICAgICAgKiBmYXN0L2pzL3Jlc291cmNlcy9zcGFy
c2UtYXJyYXkuanM6IEFkZGVkLgorICAgICAgICAqIGZhc3QvanMvc3BhcnNlLWFycmF5LWV4cGVj
dGVkLnR4dDogQWRkZWQuCisgICAgICAgICogZmFzdC9qcy9zcGFyc2UtYXJyYXkuaHRtbDogQWRk
ZWQuCisKIDIwMDctMTItMDIgIERhcmluIEFkbGVyICA8ZGFyaW5AYXBwbGUuY29tPgogCiAgICAg
ICAgIFJldmlld2VkIGJ5IE1pdHouCkluZGV4OiBMYXlvdXRUZXN0cy9mYXN0L2pzL3NwYXJzZS1h
cnJheS1leHBlY3RlZC50eHQKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvZmFzdC9qcy9zcGFy
c2UtYXJyYXktZXhwZWN0ZWQudHh0CShyZXZpc2lvbiAwKQorKysgTGF5b3V0VGVzdHMvZmFzdC9q
cy9zcGFyc2UtYXJyYXktZXhwZWN0ZWQudHh0CShyZXZpc2lvbiAwKQpAQCAtMCwwICsxLDE4IEBA
CitUaGlzIHRlc3RzIHNvbWUgc3BhcnNlIGFycmF5IG9wZXJhdGlvbnMuCisKK09uIHN1Y2Nlc3Ms
IHlvdSB3aWxsIHNlZSBhIHNlcmllcyBvZiAiUEFTUyIgbWVzc2FnZXMsIGZvbGxvd2VkIGJ5ICJU
RVNUIENPTVBMRVRFIi4KKworCitQQVNTIGFycmF5WzBdIGlzIHVuZGVmaW5lZAorUEFTUyBhcnJh
eVs0OTk5OV0gaXMgdW5kZWZpbmVkCitQQVNTIGFycmF5WzUwMDAwXSBpcyAxMDAKK1BBU1MgYXJy
YXlbNTAwMDFdIGlzIHVuZGVmaW5lZAorUEFTUyBhcnJheVswXSBpcyBOYU4KK1BBU1MgYXJyYXlb
NDk5OTldIGlzIHVuZGVmaW5lZAorUEFTUyBhcnJheVs1MDAwMF0gaXMgMTAwCitQQVNTIGFycmF5
WzUwMDAxXSBpcyB1bmRlZmluZWQKKworUEFTUyBzdWNjZXNzZnVsbHlQYXJzZWQgaXMgdHJ1ZQor
CitURVNUIENPTVBMRVRFCisKClByb3BlcnR5IGNoYW5nZXMgb246IExheW91dFRlc3RzL2Zhc3Qv
anMvc3BhcnNlLWFycmF5LWV4cGVjdGVkLnR4dApfX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCk5hbWU6IHN2bjplb2wtc3R5
bGUKICAgKyBuYXRpdmUKCkluZGV4OiBMYXlvdXRUZXN0cy9mYXN0L2pzL3NwYXJzZS1hcnJheS5o
dG1sCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT0KLS0tIExheW91dFRlc3RzL2Zhc3QvanMvc3BhcnNlLWFycmF5Lmh0bWwJ
KHJldmlzaW9uIDApCisrKyBMYXlvdXRUZXN0cy9mYXN0L2pzL3NwYXJzZS1hcnJheS5odG1sCShy
ZXZpc2lvbiAwKQpAQCAtMCwwICsxLDEzIEBACis8IURPQ1RZUEUgSFRNTCBQVUJMSUMgIi0vL0lF
VEYvL0RURCBIVE1MLy9FTiI+Cis8aHRtbD4KKzxoZWFkPgorPGxpbmsgcmVsPSJzdHlsZXNoZWV0
IiBocmVmPSJyZXNvdXJjZXMvanMtdGVzdC1zdHlsZS5jc3MiPgorPHNjcmlwdCBzcmM9InJlc291
cmNlcy9qcy10ZXN0LXByZS5qcyI+PC9zY3JpcHQ+Cis8L2hlYWQ+Cis8Ym9keT4KKzxwIGlkPSJk
ZXNjcmlwdGlvbiI+PC9wPgorPGRpdiBpZD0iY29uc29sZSI+PC9kaXY+Cis8c2NyaXB0IHNyYz0i
cmVzb3VyY2VzL3NwYXJzZS1hcnJheS5qcyI+PC9zY3JpcHQ+Cis8c2NyaXB0IHNyYz0icmVzb3Vy
Y2VzL2pzLXRlc3QtcG9zdC5qcyI+PC9zY3JpcHQ+Cis8L2JvZHk+Cis8L2h0bWw+CgpQcm9wZXJ0
eSBjaGFuZ2VzIG9uOiBMYXlvdXRUZXN0cy9mYXN0L2pzL3NwYXJzZS1hcnJheS5odG1sCl9fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX18KTmFtZTogc3ZuOm1pbWUtdHlwZQogICArIHRleHQvaHRtbApOYW1lOiBzdm46ZW9sLXN0
eWxlCiAgICsgbmF0aXZlCgpJbmRleDogTGF5b3V0VGVzdHMvZmFzdC9qcy9yZXNvdXJjZXMvc3Bh
cnNlLWFycmF5LmpzCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExheW91dFRlc3RzL2Zhc3QvanMvcmVzb3VyY2Vz
L3NwYXJzZS1hcnJheS5qcwkocmV2aXNpb24gMCkKKysrIExheW91dFRlc3RzL2Zhc3QvanMvcmVz
b3VyY2VzL3NwYXJzZS1hcnJheS5qcwkocmV2aXNpb24gMCkKQEAgLTAsMCArMSwyMSBAQAorZGVz
Y3JpcHRpb24oCisnVGhpcyB0ZXN0cyBzb21lIHNwYXJzZSBhcnJheSBvcGVyYXRpb25zLicKKyk7
CisKK3ZhciBhcnJheSA9IFsgXTsKKworYXJyYXlbNTAwMDBdID0gMTAwOworCitzaG91bGRCZSgn
YXJyYXlbMF0nLCAndW5kZWZpbmVkJyk7CitzaG91bGRCZSgnYXJyYXlbNDk5OTldJywgJ3VuZGVm
aW5lZCcpOworc2hvdWxkQmUoJ2FycmF5WzUwMDAwXScsICcxMDAnKTsKK3Nob3VsZEJlKCdhcnJh
eVs1MDAwMV0nLCAndW5kZWZpbmVkJyk7CithcnJheVswXSsrOworc2hvdWxkQmUoJ2FycmF5WzBd
JywgJ05hTicpOworc2hvdWxkQmUoJ2FycmF5WzQ5OTk5XScsICd1bmRlZmluZWQnKTsKK3Nob3Vs
ZEJlKCdhcnJheVs1MDAwMF0nLCAnMTAwJyk7CitzaG91bGRCZSgnYXJyYXlbNTAwMDFdJywgJ3Vu
ZGVmaW5lZCcpOworCitkZWJ1ZygnJyk7CisKK3N1Y2Nlc3NmdWxseVBhcnNlZCA9IHRydWU7Clwg
Tm8gbmV3bGluZSBhdCBlbmQgb2YgZmlsZQo=
</data>
<flag name="review"
          id="7602"
          type_id="1"
          status="+"
          setter="mitz"
    />
          </attachment>
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>17666</attachid>
            <date>2007-12-02 22:54:13 -0800</date>
            <delta_ts>2007-12-02 22:54:13 -0800</delta_ts>
            <desc>Different approach, without an extra branch</desc>
            <filename>digg-assert-sparse-array.diff</filename>
            <type>text/plain</type>
            <size>1270</size>
            <attacher>mitz</attacher>
            
              <data encoding="base64">SW5kZXg6IEphdmFTY3JpcHRDb3JlL2tqcy9hcnJheV9pbnN0YW5jZS5jcHAKPT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQot
LS0gSmF2YVNjcmlwdENvcmUva2pzL2FycmF5X2luc3RhbmNlLmNwcAkocmV2aXNpb24gMjgzMjAp
CisrKyBKYXZhU2NyaXB0Q29yZS9ranMvYXJyYXlfaW5zdGFuY2UuY3BwCSh3b3JraW5nIGNvcHkp
CkBAIC0zMSw3ICszMSwxMiBAQCB1c2luZyBzdGQ6Om1pbjsKIAogbmFtZXNwYWNlIEtKUyB7CiAK
LXR5cGVkZWYgSGFzaE1hcDx1bnNpZ25lZCwgSlNWYWx1ZSo+IFNwYXJzZUFycmF5VmFsdWVNYXA7
CitzdHJ1Y3QgU3BhcnNlQXJyYXlJbmRleEhhc2hUcmFpdHMgOiBIYXNoVHJhaXRzPHVuc2lnbmVk
PiB7CisgICAgc3RhdGljIHVuc2lnbmVkIGVtcHR5VmFsdWUoKSB7IHJldHVybiBzdGF0aWNfY2Fz
dDx1bnNpZ25lZD4oLTIpOyB9CisgICAgc3RhdGljIGNvbnN0IGJvb2wgZW1wdHlWYWx1ZUlzWmVy
byA9IGZhbHNlOworfTsKKwordHlwZWRlZiBIYXNoTWFwPHVuc2lnbmVkLCBKU1ZhbHVlKiwgRGVm
YXVsdEhhc2g8dW5zaWduZWQ+OjpIYXNoLCBTcGFyc2VBcnJheUluZGV4SGFzaFRyYWl0cz4gU3Bh
cnNlQXJyYXlWYWx1ZU1hcDsKIAogc3RydWN0IEFycmF5U3RvcmFnZSB7CiAgICAgdW5zaWduZWQg
bV9udW1WYWx1ZXNJblZlY3RvcjsKQEAgLTM5LDggKzQ0LDkgQEAgc3RydWN0IEFycmF5U3RvcmFn
ZSB7CiAgICAgSlNWYWx1ZSogbV92ZWN0b3JbMV07CiB9OwogCi0vLyAweEZGRkZGRkZGIGlzIGEg
Yml0IHdlaXJkIC0tIGlzIG5vdCBhbiBhcnJheSBpbmRleCBldmVuIHRob3VnaCBpdCdzIGFuIGlu
dGVnZXIKLXN0YXRpYyBjb25zdCB1bnNpZ25lZCBtYXhBcnJheUluZGV4ID0gMHhGRkZGRkZGRVU7
CisvLyAweEZGRkZGRkZFIGFuZCAweEZGRkZGRkZEIGFyZSBub3QgYXJyYXkgaW5kaWNlcyBldmVu
IHRob3VnaCB0aGV5IGFyZSBpbnRlZ2VycywgYmVjYXVzZSB0aGV5CisvLyBoYXZlIHNwZWNpYWwg
bWVhbmluZ3MgaW4gdGhlIHNwYXJzZSBhcnJheSBpbXBsZW1lbnRhdGlvbi4KK3N0YXRpYyBjb25z
dCB1bnNpZ25lZCBtYXhBcnJheUluZGV4ID0gMHhGRkZGRkZGRFU7CiAKIC8vIE91ciBwb2xpY3kg
Zm9yIHdoZW4gdG8gdXNlIGEgdmVjdG9yIGFuZCB3aGVuIHRvIHVzZSBhIHNwYXJzZSBtYXAuCiAv
LyBGb3IgYWxsIGFycmF5IGluZGljZXMgdW5kZXIgc3BhcnNlQXJyYXlDdXRvZmYsIHdlIGFsd2F5
cyB1c2UgYSB2ZWN0b3IuCg==
</data>

          </attachment>
      

    </bug>

</bugzilla>