<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>163264</bug_id>
          
          <creation_ts>2016-10-10 20:47:06 -0700</creation_ts>
          <short_desc>B3-&gt;Air lowering needs the same defenses in effectiveAddr() that it has in tryAppendLea()</short_desc>
          <delta_ts>2016-10-11 15:01:50 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>JavaScriptCore</component>
          <version>WebKit Nightly Build</version>
          <rep_platform>All</rep_platform>
          <op_sys>All</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords></keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Filip Pizlo">fpizlo</reporter>
          <assigned_to name="Filip Pizlo">fpizlo</assigned_to>
          <cc>commit-queue</cc>
    
    <cc>keith_miller</cc>
    
    <cc>mark.lam</cc>
    
    <cc>msaboff</cc>
    
    <cc>saam</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>1238711</commentid>
    <comment_count>0</comment_count>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2016-10-10 20:47:06 -0700</bug_when>
    <thetext>There are two ways we may end up matching left-shifts into address calculations: effectiveAddr() and tryAppendLea(). tryAppendLea() does it right, effectiveAddr() does it wrong.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1238882</commentid>
    <comment_count>1</comment_count>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2016-10-11 09:26:24 -0700</bug_when>
    <thetext>Yup, this test generates wrong code and crashes:

void testLoadBaseIndexShift32()
{
    Procedure proc;
    BasicBlock* root = proc.addBlock();
    root-&gt;appendNew&lt;Value&gt;(
        proc, Return, Origin(),
        root-&gt;appendNew&lt;MemoryValue&gt;(
            proc, Load, Int32, Origin(),
            root-&gt;appendNew&lt;Value&gt;(
                proc, Add, Origin(),
                root-&gt;appendNew&lt;ArgumentRegValue&gt;(proc, Origin(), GPRInfo::argumentGPR0),
                root-&gt;appendNew&lt;Value&gt;(
                    proc, Shl, Origin(),
                    root-&gt;appendNew&lt;ArgumentRegValue&gt;(proc, Origin(), GPRInfo::argumentGPR1),
                    root-&gt;appendNew&lt;Const32Value&gt;(proc, Origin(), 32)))));
    auto code = compile(proc);
    int32_t value = 12341234;
    char* ptr = bitwise_cast&lt;char*&gt;(&amp;value);
    for (unsigned i = 0; i &lt; 10; ++i)
        CHECK_EQ(invoke&lt;int32_t&gt;(*code, ptr - (static_cast&lt;intptr_t&gt;(1) &lt;&lt; static_cast&lt;intptr_t&gt;(32)) * i, i), 12341234);
}</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1238898</commentid>
    <comment_count>2</comment_count>
      <attachid>291271</attachid>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2016-10-11 09:49:51 -0700</bug_when>
    <thetext>Created attachment 291271
the patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1238913</commentid>
    <comment_count>3</comment_count>
      <attachid>291271</attachid>
    <who name="Mark Lam">mark.lam</who>
    <bug_when>2016-10-11 10:30:21 -0700</bug_when>
    <thetext>Comment on attachment 291271
the patch

r=me if this works for ARM as well.  Otherwise, you might need to make this adjustment conditional on isX86 (if that&apos;s not already the case).

I could be mistaken, but I vaguely remember that for 32-bit ARM, I think the shift operand is internally masked with 31 by the CPU before executing the shift.  Hence, it&apos;s not possible to get a shift by 32.  I&apos;m not sure of the treatment on ARM64.  Regardless, you should run the test on ARM64 as well to make sure that this does work there (if you haven&apos;t already done so).</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1238918</commentid>
    <comment_count>4</comment_count>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2016-10-11 10:55:55 -0700</bug_when>
    <thetext>(In reply to comment #3)
&gt; Comment on attachment 291271 [details]
&gt; the patch
&gt; 
&gt; r=me if this works for ARM as well.  Otherwise, you might need to make this
&gt; adjustment conditional on isX86 (if that&apos;s not already the case).
&gt; 
&gt; I could be mistaken, but I vaguely remember that for 32-bit ARM, I think the
&gt; shift operand is internally masked with 31 by the CPU before executing the
&gt; shift.  Hence, it&apos;s not possible to get a shift by 32.  I&apos;m not sure of the
&gt; treatment on ARM64.  Regardless, you should run the test on ARM64 as well to
&gt; make sure that this does work there (if you haven&apos;t already done so).

This is correct on arm64. The semantics of B3 Shl are to mask by 63 for 64-bit shifts and to mask by 31 for 32-bit shifts. Since this code is about emitting BaseIndex instead of Shl, it only has to worry about B3 semantics of Shl (which don&apos;t change from architecture to architecture) and target CPU semantics for BaseIndez (which vary wildly, hence the isValidIndexForm call). 

Incidentally, ARM64, x86, and x86-64 all agree with B3 about Shl. ARMv7 disagrees (it masks shifts by 255). But even on ARMv7 this code is right since its converting a Shl to BaseIndex, not ARMv7&apos;s shift instruction. To support ARMv7 we would leave this code alone, we would continue to keep our same Shl semantics, and we would make our lowering of Shl on ARMv7 have an extra legalization step that injects a shift by 31 or 63 to make ARMv7 comply with our expectations.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1238981</commentid>
    <comment_count>5</comment_count>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2016-10-11 13:42:05 -0700</bug_when>
    <thetext>Landed in https://trac.webkit.org/changeset/207163</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1239023</commentid>
    <comment_count>6</comment_count>
      <attachid>291271</attachid>
    <who name="Saam Barati">saam</who>
    <bug_when>2016-10-11 14:58:32 -0700</bug_when>
    <thetext>Comment on attachment 291271
the patch

View in context: https://bugs.webkit.org/attachment.cgi?id=291271&amp;action=review

&gt; Source/JavaScriptCore/b3/testb3.cpp:13679
&gt; +    if (isX86())
&gt; +        checkUsesInstruction(*code, &quot;(%rdi,%rsi,4)&quot;);

It would also be nice to check we do good things for ARM64 here? Will this optimization kick in on ARM64?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1239030</commentid>
    <comment_count>7</comment_count>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2016-10-11 15:01:50 -0700</bug_when>
    <thetext>(In reply to comment #6)
&gt; Comment on attachment 291271 [details]
&gt; the patch
&gt; 
&gt; View in context:
&gt; https://bugs.webkit.org/attachment.cgi?id=291271&amp;action=review
&gt; 
&gt; &gt; Source/JavaScriptCore/b3/testb3.cpp:13679
&gt; &gt; +    if (isX86())
&gt; &gt; +        checkUsesInstruction(*code, &quot;(%rdi,%rsi,4)&quot;);
&gt; 
&gt; It would also be nice to check we do good things for ARM64 here? Will this
&gt; optimization kick in on ARM64?

The ARM optimization is more restricted.  I think it might kick in here, but I wasn&apos;t sure.  I think that if/when we start trying to get this right on ARM we should write ARM-specific tests for that.

Also, the reason for this check is to make sure that the fix for this bug didn&apos;t completely break BaseIndex.  To do that, it can do the check on any architecture on which we regularly run tests.</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>291271</attachid>
            <date>2016-10-11 09:49:51 -0700</date>
            <delta_ts>2016-10-11 10:30:21 -0700</delta_ts>
            <desc>the patch</desc>
            <filename>blah.patch</filename>
            <type>text/plain</type>
            <size>9241</size>
            <attacher name="Filip Pizlo">fpizlo</attacher>
            
              <data encoding="base64">SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291
cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMjA3MTQ2KQorKysgU291cmNl
L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDQwIEBA
CisyMDE2LTEwLTExICBGaWxpcCBQaXpsbyAgPGZwaXpsb0BhcHBsZS5jb20+CisKKyAgICAgICAg
QjMtPkFpciBsb3dlcmluZyBuZWVkcyB0aGUgc2FtZSBkZWZlbnNlcyBpbiBlZmZlY3RpdmVBZGRy
KCkgdGhhdCBpdCBoYXMgaW4gdHJ5QXBwZW5kTGVhKCkKKyAgICAgICAgaHR0cHM6Ly9idWdzLndl
YmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE2MzI2NAorCisgICAgICAgIFJldmlld2VkIGJ5IE5P
Qk9EWSAoT09QUyEpLgorICAgICAgICAKKyAgICAgICAgV2hlbiB3cml0aW5nIHRoZSBsZWEgcGF0
Y2ggKHIyMDcwMzkpLCBJIHdhcyB2ZXJ5IGNhcmVmdWwgYWJvdXQgaG93IEkgY29udmVydCBhIFNo
bCBpbnRvIGEKKyAgICAgICAgQmFzZUluZGV4IHNjYWxlLiBCdXQgSSBmb3Jnb3QgdG8gY2hlY2sg
aWYgdGhlIG9sZGVyIGNvZGUgZm9yIGNyZWF0aW5nIEJhc2VJbmRleGVzIGZvcgorICAgICAgICBl
ZmZlY3RpdmVBZGRyKCkgZ290IHRoaXMgcmlnaHQuIEl0IHR1cm5zIG91dCB0aGF0IHRoZSBvbGRl
ciBjb2RlIG1pc3NlZCB0aGUgPDwzMiBjb3JuZXIKKyAgICAgICAgY2FzZS4KKyAgICAgICAgCisg
ICAgICAgIEl0J3Mgc2FkIHRoYXQgdGhlIHR3byBwYXRocyBjYW4ndCBzaGFyZSBhbGwgb2YgdGhl
aXIgY29kZSwgYnV0IGl0J3Mgc29tZXdoYXQgaW5ldml0YWJsZSBkdWUKKyAgICAgICAgdG8gaG93
IG1hdGNoaW5nIGFuIGFkZHJlc3MgYW5kIG1hdGNoaW5nIGEgbGVhIGhhdmUgdG8gZG8gdmVyeSBk
aWZmZXJlbnQgdGhpbmdzLiBNYXRjaGluZyBhCisgICAgICAgIGxlYSBtZWFucyBjcmVhdGluZyBh
biBpbnN0cnVjdGlvbiB0aGF0IGlzIGRpc3RpbmN0IGZyb20gb3RoZXIgaW5zdHJ1Y3Rpb25zIHRv
IGRvIG11bHRpcGxlCisgICAgICAgIG1hdGggb3BlcmF0aW9ucyBhdCBvbmNlLiBNYXRjaGluZyBh
biBhZGRyZXNzIG1lYW5zIG1ha2luZyBzb21lIGluc3RydWN0aW9uIGRvIGV4dHJhIHdvcmsKKyAg
ICAgICAgZm9yIGZyZWUuIEFsc28sIGFkZHJlc3MgbWF0Y2hpbmcgY2FuIHRha2UgYWR2YW50YWdl
IG9mIHRoZSBmYWN0IHRoYXQgdGhlIG9mZnNldCBpcyBhbHJlYWR5CisgICAgICAgIGFzc29jaWF0
ZWQgd2l0aCB0aGUgbWVtb3J5IG9wZXJhdGlvbiBieSBzdHJlbmd0aCByZWR1Y3Rpb24gLSBsZWEg
bWF0Y2hpbmcgY2FuJ3QgZG8gdGhpczsgaXQKKyAgICAgICAgaGFzIHRvIGZpZ3VyZSBvdXQgQWRk
KEB2YWx1ZSwgJGNvbnN0KSBvbiBpdHMgb3duLiBUaGlzIGNoYW5nZSBtYWtlcyB0aGUgc2l0dWF0
aW9uIHNsaWdodGx5CisgICAgICAgIG1vcmUgc2FuZSBieSBhZGRpbmcgYSBzY2FsZUZvclNobCgp
IGhlbHBlciB0aGF0IGhhbmRsZXMgdGhpcyB3ZWlyZCBjYXNlLiBJdCdzIGJhc2VkIG9uIHRoZQor
ICAgICAgICBuZXcgU2hsIGhhbmRsaW5nIGZyb20gcjIwNzAzOSwgYW5kIGV4cG9zZXMgaXQgYXMg
YW4gQVBJIGZvciBlZmZlY3RpdmVBZGRyKCkgdG8gdXNlLgorICAgICAgICAKKyAgICAgICAgVGhl
IHRlc3RMb2FkQmFzZUluZGV4U2hpZnQzMigpIHVzZWQgdG8gY3Jhc2guIEkgZG9uJ3QgdGhpbmsg
dGhhdCB0aGlzIGNhc2UgYWZmZWN0cyBKUworICAgICAgICBjb250ZW50LCBzaW5jZSA8PDMyIGlz
IHN1Y2ggYSBiaXphcnJlIG91dGxpZXIuIEkgZG9uJ3QgdGhpbmsgd2UgZXZlbiBoYXZlIGEgcGF0
aCBhbG9uZworICAgICAgICB3aGljaCB0aGUgRlRMIHdvdWxkIGVtaXQgYSA2NC1iaXQgPDwzMi4g
SXQgcHJvYmFibHkgd29uJ3QgZXZlbiBhZmZlY3QgV2ViQXNzZW1ibHkgc2luY2UKKyAgICAgICAg
dGhhdCB1c2VzIDMyLWJpdCBwb2ludGVycywgc28gd2Ugd29uJ3Qgc2VlIDY0LWJpdCA8PDMyIGlu
IGVmZmVjdGl2ZUFkZHIoKSB0aGVyZS4KKworICAgICAgICAqIGIzL0IzTG93ZXJUb0Fpci5jcHA6
CisgICAgICAgIChKU0M6OkIzOjpBaXI6Okxvd2VyVG9BaXI6OnNjYWxlRm9yU2hsKToKKyAgICAg
ICAgKEpTQzo6QjM6OkFpcjo6TG93ZXJUb0Fpcjo6ZWZmZWN0aXZlQWRkcik6CisgICAgICAgIChK
U0M6OkIzOjpBaXI6Okxvd2VyVG9BaXI6OnRyeUFwcGVuZExlYSk6CisgICAgICAgIChKU0M6OkIz
OjpBaXI6Okxvd2VyVG9BaXI6OmNyb3NzZXNJbnRlcmZlcmVuY2UpOiBEZWxldGVkLgorICAgICAg
ICAqIGIzL3Rlc3RiMy5jcHA6CisgICAgICAgIChKU0M6OkIzOjp0ZXN0TG9hZEJhc2VJbmRleFNo
aWZ0Mik6CisgICAgICAgIChKU0M6OkIzOjp0ZXN0TG9hZEJhc2VJbmRleFNoaWZ0MzIpOgorICAg
ICAgICAoSlNDOjpCMzo6cnVuKToKKwogMjAxNi0xMC0xMSAgU2FhbSBCYXJhdGkgIDxzYmFyYXRp
QGFwcGxlLmNvbT4KIAogICAgICAgICBWYWx1ZUFkZCBzaG91bGQgYmUgY29uc3RhbnQgZm9sZGVk
IGlmIHRoZSBvcGVyYW5kcyBhcmUgY29uc3RhbnQgU3RyaW5nLFByaW1pdGl2ZSBvciBQcmltaXRp
dmUsU3RyaW5nCkluZGV4OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUvYjMvQjNMb3dlclRvQWlyLmNw
cAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09Ci0tLSBTb3VyY2UvSmF2YVNjcmlwdENvcmUvYjMvQjNMb3dlclRvQWlyLmNw
cAkocmV2aXNpb24gMjA3MDM5KQorKysgU291cmNlL0phdmFTY3JpcHRDb3JlL2IzL0IzTG93ZXJU
b0Fpci5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTQyNSw2ICs0MjUsMjggQEAgcHJpdmF0ZToKICAg
ICAgICAgQVNTRVJUX05PVF9SRUFDSEVEKCk7CiAgICAgICAgIHJldHVybiB0cnVlOwogICAgIH0K
KyAgICAKKyAgICBPcHRpb25hbDx1bnNpZ25lZD4gc2NhbGVGb3JTaGwoVmFsdWUqIHNobCwgaW50
MzJfdCBvZmZzZXQsIE9wdGlvbmFsPEFyZzo6V2lkdGg+IHdpZHRoID0gTnVsbG9wdCkKKyAgICB7
CisgICAgICAgIGlmIChzaGwtPm9wY29kZSgpICE9IFNobCkKKyAgICAgICAgICAgIHJldHVybiBO
dWxsb3B0OworICAgICAgICBpZiAoIXNobC0+Y2hpbGQoMSktPmhhc0ludDMyKCkpCisgICAgICAg
ICAgICByZXR1cm4gTnVsbG9wdDsKKyAgICAgICAgdW5zaWduZWQgbG9nU2NhbGUgPSBzaGwtPmNo
aWxkKDEpLT5hc0ludDMyKCk7CisgICAgICAgIGlmIChzaGwtPnR5cGUoKSA9PSBJbnQzMikKKyAg
ICAgICAgICAgIGxvZ1NjYWxlICY9IDMxOworICAgICAgICBlbHNlCisgICAgICAgICAgICBsb2dT
Y2FsZSAmPSA2MzsKKyAgICAgICAgLy8gVXNlIDY0LWJpdCBtYXRoIHRvIHBlcmZvcm0gdGhlIHNo
aWZ0IHNvIHRoYXQgPDwzMiBkb2VzIHRoZSByaWdodCB0aGluZywgYnV0IHRoZW4gc3dpdGNoCisg
ICAgICAgIC8vIHRvIHNpZ25lZCBzaW5jZSB0aGF0J3Mgd2hhdCBhbGwgb2Ygb3VyIEFQSXMgd2Fu
dC4KKyAgICAgICAgaW50NjRfdCBiaWdTY2FsZSA9IHN0YXRpY19jYXN0PHVpbnQ2NF90PigxKSA8
PCBzdGF0aWNfY2FzdDx1aW50NjRfdD4obG9nU2NhbGUpOworICAgICAgICBpZiAoIWlzUmVwcmVz
ZW50YWJsZUFzPGludDMyX3Q+KGJpZ1NjYWxlKSkKKyAgICAgICAgICAgIHJldHVybiBOdWxsb3B0
OworICAgICAgICB1bnNpZ25lZCBzY2FsZSA9IHN0YXRpY19jYXN0PGludDMyX3Q+KGJpZ1NjYWxl
KTsKKyAgICAgICAgaWYgKCFBcmc6OmlzVmFsaWRJbmRleEZvcm0oc2NhbGUsIG9mZnNldCwgd2lk
dGgpKQorICAgICAgICAgICAgcmV0dXJuIE51bGxvcHQ7CisgICAgICAgIHJldHVybiBzY2FsZTsK
KyAgICB9CiAKICAgICAvLyBUaGlzIHR1cm5zIHRoZSBnaXZlbiBvcGVyYW5kIGludG8gYW4gYWRk
cmVzcy4KICAgICBBcmcgZWZmZWN0aXZlQWRkcihWYWx1ZSogYWRkcmVzcywgaW50MzJfdCBvZmZz
ZXQsIEFyZzo6V2lkdGggd2lkdGgpCkBAIC00NDcsMTggKzQ2OSwxMiBAQCBwcml2YXRlOgogICAg
ICAgICAgICAgVmFsdWUqIHJpZ2h0ID0gYWRkcmVzcy0+Y2hpbGQoMSk7CiAKICAgICAgICAgICAg
IGF1dG8gdHJ5SW5kZXggPSBbJl0gKFZhbHVlKiBpbmRleCwgVmFsdWUqIGJhc2UpIC0+IEFyZyB7
Ci0gICAgICAgICAgICAgICAgaWYgKGluZGV4LT5vcGNvZGUoKSAhPSBTaGwpCisgICAgICAgICAg
ICAgICAgT3B0aW9uYWw8dW5zaWduZWQ+IHNjYWxlID0gc2NhbGVGb3JTaGwoaW5kZXgsIG9mZnNl
dCwgd2lkdGgpOworICAgICAgICAgICAgICAgIGlmICghc2NhbGUpCiAgICAgICAgICAgICAgICAg
ICAgIHJldHVybiBBcmcoKTsKICAgICAgICAgICAgICAgICBpZiAobV9sb2NrZWQuY29udGFpbnMo
aW5kZXgtPmNoaWxkKDApKSB8fCBtX2xvY2tlZC5jb250YWlucyhiYXNlKSkKICAgICAgICAgICAg
ICAgICAgICAgcmV0dXJuIEFyZygpOwotICAgICAgICAgICAgICAgIGlmICghaW5kZXgtPmNoaWxk
KDEpLT5oYXNJbnQzMigpKQotICAgICAgICAgICAgICAgICAgICByZXR1cm4gQXJnKCk7Ci0gICAg
ICAgICAgICAgICAgCi0gICAgICAgICAgICAgICAgdW5zaWduZWQgc2NhbGUgPSAxIDw8IChpbmRl
eC0+Y2hpbGQoMSktPmFzSW50MzIoKSAmIDMxKTsKLSAgICAgICAgICAgICAgICBpZiAoIUFyZzo6
aXNWYWxpZEluZGV4Rm9ybShzY2FsZSwgb2Zmc2V0LCB3aWR0aCkpCi0gICAgICAgICAgICAgICAg
ICAgIHJldHVybiBBcmcoKTsKLQotICAgICAgICAgICAgICAgIHJldHVybiBBcmc6OmluZGV4KHRt
cChiYXNlKSwgdG1wKGluZGV4LT5jaGlsZCgwKSksIHNjYWxlLCBvZmZzZXQpOworICAgICAgICAg
ICAgICAgIHJldHVybiBBcmc6OmluZGV4KHRtcChiYXNlKSwgdG1wKGluZGV4LT5jaGlsZCgwKSks
ICpzY2FsZSwgb2Zmc2V0KTsKICAgICAgICAgICAgIH07CiAKICAgICAgICAgICAgIGlmIChBcmcg
cmVzdWx0ID0gdHJ5SW5kZXgobGVmdCwgcmlnaHQpKQpAQCAtMTg5OCwyOSArMTkxNCwxNiBAQCBw
cml2YXRlOgogICAgICAgICB9CiAgICAgICAgIAogICAgICAgICBhdXRvIHRyeVNobCA9IFsmXSAo
VmFsdWUqIHNobCwgVmFsdWUqIG90aGVyKSAtPiBib29sIHsKLSAgICAgICAgICAgIGlmIChzaGwt
Pm9wY29kZSgpICE9IFNobCkKKyAgICAgICAgICAgIE9wdGlvbmFsPHVuc2lnbmVkPiBzY2FsZSA9
IHNjYWxlRm9yU2hsKHNobCwgb2Zmc2V0KTsKKyAgICAgICAgICAgIGlmICghc2NhbGUpCiAgICAg
ICAgICAgICAgICAgcmV0dXJuIGZhbHNlOwogICAgICAgICAgICAgaWYgKCFjYW5CZUludGVybmFs
KHNobCkpCiAgICAgICAgICAgICAgICAgcmV0dXJuIGZhbHNlOwotICAgICAgICAgICAgaWYgKCFz
aGwtPmNoaWxkKDEpLT5oYXNJbnQzMigpKQotICAgICAgICAgICAgICAgIHJldHVybiBmYWxzZTsK
LSAgICAgICAgICAgIHVuc2lnbmVkIGxvZ1NjYWxlID0gc2hsLT5jaGlsZCgxKS0+YXNJbnQzMigp
OwotICAgICAgICAgICAgaWYgKG1fdmFsdWUtPnR5cGUoKSA9PSBJbnQzMikKLSAgICAgICAgICAg
ICAgICBsb2dTY2FsZSAmPSAzMTsKLSAgICAgICAgICAgIGVsc2UKLSAgICAgICAgICAgICAgICBs
b2dTY2FsZSAmPSA2MzsKLSAgICAgICAgICAgIC8vIFVzZSA2NC1iaXQgbWF0aCB0byBwZXJmb3Jt
IHRoZSBzaGlmdCBzbyB0aGF0IDw8MzIgZG9lcyB0aGUgcmlnaHQgdGhpbmcuCi0gICAgICAgICAg
ICBpbnQ2NF90IGJpZ1NjYWxlID0gc3RhdGljX2Nhc3Q8dWludDY0X3Q+KDEpIDw8IHN0YXRpY19j
YXN0PHVpbnQ2NF90Pihsb2dTY2FsZSk7Ci0gICAgICAgICAgICBpZiAoIWlzUmVwcmVzZW50YWJs
ZUFzPGludDMyX3Q+KGJpZ1NjYWxlKSkKLSAgICAgICAgICAgICAgICByZXR1cm4gZmFsc2U7Ci0g
ICAgICAgICAgICB1bnNpZ25lZCBzY2FsZSA9IHN0YXRpY19jYXN0PGludDMyX3Q+KGJpZ1NjYWxl
KTsKLSAgICAgICAgICAgIGlmICghQXJnOjppc1ZhbGlkSW5kZXhGb3JtKHNjYWxlLCBvZmZzZXQp
KQotICAgICAgICAgICAgICAgIHJldHVybiBmYWxzZTsKICAgICAgICAgICAgIAogICAgICAgICAg
ICAgQVNTRVJUKCFtX2xvY2tlZC5jb250YWlucyhzaGwtPmNoaWxkKDApKSk7CiAgICAgICAgICAg
ICBBU1NFUlQoIW1fbG9ja2VkLmNvbnRhaW5zKG90aGVyKSk7CiAgICAgICAgICAgICAKLSAgICAg
ICAgICAgIGFwcGVuZChsZWFPcGNvZGUsIEFyZzo6aW5kZXgodG1wKG90aGVyKSwgdG1wKHNobC0+
Y2hpbGQoMCkpLCBzY2FsZSwgb2Zmc2V0KSwgdG1wKG1fdmFsdWUpKTsKKyAgICAgICAgICAgIGFw
cGVuZChsZWFPcGNvZGUsIEFyZzo6aW5kZXgodG1wKG90aGVyKSwgdG1wKHNobC0+Y2hpbGQoMCkp
LCAqc2NhbGUsIG9mZnNldCksIHRtcChtX3ZhbHVlKSk7CiAgICAgICAgICAgICBjb21taXRJbnRl
cm5hbChpbm5lckFkZCk7CiAgICAgICAgICAgICBjb21taXRJbnRlcm5hbChzaGwpOwogICAgICAg
ICAgICAgcmV0dXJuIHRydWU7CkluZGV4OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUvYjMvdGVzdGIz
LmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvSmF2YVNjcmlwdENvcmUvYjMvdGVzdGIzLmNwcAko
cmV2aXNpb24gMjA3MDM5KQorKysgU291cmNlL0phdmFTY3JpcHRDb3JlL2IzL3Rlc3RiMy5jcHAJ
KHdvcmtpbmcgY29weSkKQEAgLTEzNjU5LDYgKzEzNjU5LDUyIEBAIHZvaWQgdGVzdFJlZHVjZVN0
cmVuZ3RoUmVhc3NvY2lhdGlvbihib28KICAgICAgICAgKHJvb3QtPmxhc3QoKS0+Y2hpbGQoMCkt
PmNoaWxkKDApLT5jaGlsZCgwKSA9PSBhcmcyICYmIHJvb3QtPmxhc3QoKS0+Y2hpbGQoMCktPmNo
aWxkKDApLT5jaGlsZCgxKSA9PSBhcmcxKSk7CiB9CiAKK3ZvaWQgdGVzdExvYWRCYXNlSW5kZXhT
aGlmdDIoKQoreworICAgIFByb2NlZHVyZSBwcm9jOworICAgIEJhc2ljQmxvY2sqIHJvb3QgPSBw
cm9jLmFkZEJsb2NrKCk7CisgICAgcm9vdC0+YXBwZW5kTmV3PFZhbHVlPigKKyAgICAgICAgcHJv
YywgUmV0dXJuLCBPcmlnaW4oKSwKKyAgICAgICAgcm9vdC0+YXBwZW5kTmV3PE1lbW9yeVZhbHVl
PigKKyAgICAgICAgICAgIHByb2MsIExvYWQsIEludDMyLCBPcmlnaW4oKSwKKyAgICAgICAgICAg
IHJvb3QtPmFwcGVuZE5ldzxWYWx1ZT4oCisgICAgICAgICAgICAgICAgcHJvYywgQWRkLCBPcmln
aW4oKSwKKyAgICAgICAgICAgICAgICByb290LT5hcHBlbmROZXc8QXJndW1lbnRSZWdWYWx1ZT4o
cHJvYywgT3JpZ2luKCksIEdQUkluZm86OmFyZ3VtZW50R1BSMCksCisgICAgICAgICAgICAgICAg
cm9vdC0+YXBwZW5kTmV3PFZhbHVlPigKKyAgICAgICAgICAgICAgICAgICAgcHJvYywgU2hsLCBP
cmlnaW4oKSwKKyAgICAgICAgICAgICAgICAgICAgcm9vdC0+YXBwZW5kTmV3PEFyZ3VtZW50UmVn
VmFsdWU+KHByb2MsIE9yaWdpbigpLCBHUFJJbmZvOjphcmd1bWVudEdQUjEpLAorICAgICAgICAg
ICAgICAgICAgICByb290LT5hcHBlbmROZXc8Q29uc3QzMlZhbHVlPihwcm9jLCBPcmlnaW4oKSwg
MikpKSkpOworICAgIGF1dG8gY29kZSA9IGNvbXBpbGUocHJvYyk7CisgICAgaWYgKGlzWDg2KCkp
CisgICAgICAgIGNoZWNrVXNlc0luc3RydWN0aW9uKCpjb2RlLCAiKCVyZGksJXJzaSw0KSIpOwor
ICAgIGludDMyX3QgdmFsdWUgPSAxMjM0MTIzNDsKKyAgICBjaGFyKiBwdHIgPSBiaXR3aXNlX2Nh
c3Q8Y2hhcio+KCZ2YWx1ZSk7CisgICAgZm9yICh1bnNpZ25lZCBpID0gMDsgaSA8IDEwOyArK2kp
CisgICAgICAgIENIRUNLX0VRKGludm9rZTxpbnQzMl90PigqY29kZSwgcHRyIC0gKHN0YXRpY19j
YXN0PGludHB0cl90PigxKSA8PCBzdGF0aWNfY2FzdDxpbnRwdHJfdD4oMikpICogaSwgaSksIDEy
MzQxMjM0KTsKK30KKwordm9pZCB0ZXN0TG9hZEJhc2VJbmRleFNoaWZ0MzIoKQoreworICAgIFBy
b2NlZHVyZSBwcm9jOworICAgIEJhc2ljQmxvY2sqIHJvb3QgPSBwcm9jLmFkZEJsb2NrKCk7Cisg
ICAgcm9vdC0+YXBwZW5kTmV3PFZhbHVlPigKKyAgICAgICAgcHJvYywgUmV0dXJuLCBPcmlnaW4o
KSwKKyAgICAgICAgcm9vdC0+YXBwZW5kTmV3PE1lbW9yeVZhbHVlPigKKyAgICAgICAgICAgIHBy
b2MsIExvYWQsIEludDMyLCBPcmlnaW4oKSwKKyAgICAgICAgICAgIHJvb3QtPmFwcGVuZE5ldzxW
YWx1ZT4oCisgICAgICAgICAgICAgICAgcHJvYywgQWRkLCBPcmlnaW4oKSwKKyAgICAgICAgICAg
ICAgICByb290LT5hcHBlbmROZXc8QXJndW1lbnRSZWdWYWx1ZT4ocHJvYywgT3JpZ2luKCksIEdQ
UkluZm86OmFyZ3VtZW50R1BSMCksCisgICAgICAgICAgICAgICAgcm9vdC0+YXBwZW5kTmV3PFZh
bHVlPigKKyAgICAgICAgICAgICAgICAgICAgcHJvYywgU2hsLCBPcmlnaW4oKSwKKyAgICAgICAg
ICAgICAgICAgICAgcm9vdC0+YXBwZW5kTmV3PEFyZ3VtZW50UmVnVmFsdWU+KHByb2MsIE9yaWdp
bigpLCBHUFJJbmZvOjphcmd1bWVudEdQUjEpLAorICAgICAgICAgICAgICAgICAgICByb290LT5h
cHBlbmROZXc8Q29uc3QzMlZhbHVlPihwcm9jLCBPcmlnaW4oKSwgMzIpKSkpKTsKKyAgICBhdXRv
IGNvZGUgPSBjb21waWxlKHByb2MpOworICAgIGludDMyX3QgdmFsdWUgPSAxMjM0MTIzNDsKKyAg
ICBjaGFyKiBwdHIgPSBiaXR3aXNlX2Nhc3Q8Y2hhcio+KCZ2YWx1ZSk7CisgICAgZm9yICh1bnNp
Z25lZCBpID0gMDsgaSA8IDEwOyArK2kpCisgICAgICAgIENIRUNLX0VRKGludm9rZTxpbnQzMl90
PigqY29kZSwgcHRyIC0gKHN0YXRpY19jYXN0PGludHB0cl90PigxKSA8PCBzdGF0aWNfY2FzdDxp
bnRwdHJfdD4oMzIpKSAqIGksIGkpLCAxMjM0MTIzNCk7Cit9CisKIC8vIE1ha2Ugc3VyZSB0aGUg
Y29tcGlsZXIgZG9lcyBub3QgdHJ5IHRvIG9wdGltaXplIGFueXRoaW5nIG91dC4KIE5FVkVSX0lO
TElORSBkb3VibGUgemVybygpCiB7CkBAIC0xNTA5NSw2ICsxNTE0MSw4IEBAIHZvaWQgcnVuKGNv
bnN0IGNoYXIqIGZpbHRlcikKICAgICBSVU4odGVzdEFkZFNobDMyKCkpOwogICAgIFJVTih0ZXN0
QWRkU2hsNjQoKSk7CiAgICAgUlVOKHRlc3RBZGRTaGw2NSgpKTsKKyAgICBSVU4odGVzdExvYWRC
YXNlSW5kZXhTaGlmdDIoKSk7CisgICAgUlVOKHRlc3RMb2FkQmFzZUluZGV4U2hpZnQzMigpKTsK
ICAgICAKICAgICBpZiAoaXNYODYoKSkgewogICAgICAgICBSVU4odGVzdEJyYW5jaEJpdEFuZElt
bUZ1c2lvbihJZGVudGl0eSwgSW50NjQsIDEsIEFpcjo6QnJhbmNoVGVzdDMyLCBBaXI6OkFyZzo6
VG1wKSk7Cg==
</data>
<flag name="review"
          id="314407"
          type_id="1"
          status="+"
          setter="mark.lam"
    />
          </attachment>
      

    </bug>

</bugzilla>