<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>167919</bug_id>
          
          <creation_ts>2017-02-06 19:23:32 -0800</creation_ts>
          <short_desc>Air IRC might spill a terminal that produces a value after the terminal</short_desc>
          <delta_ts>2017-03-27 20:02:52 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>JavaScriptCore</component>
          <version>WebKit Local Build</version>
          <rep_platform>Unspecified</rep_platform>
          <op_sys>Unspecified</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>InRadar</keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Saam Barati">saam</reporter>
          <assigned_to name="Saam Barati">saam</assigned_to>
          <cc>benjamin</cc>
    
    <cc>fpizlo</cc>
    
    <cc>ggaren</cc>
    
    <cc>gskachkov</cc>
    
    <cc>jfbastien</cc>
    
    <cc>keith_miller</cc>
    
    <cc>mark.lam</cc>
    
    <cc>msaboff</cc>
    
    <cc>oliver</cc>
    
    <cc>ticaiolima</cc>
    
    <cc>webkit-bug-importer</cc>
    
    <cc>ysuzuki</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>1273819</commentid>
    <comment_count>0</comment_count>
    <who name="Saam Barati">saam</who>
    <bug_when>2017-02-06 19:23:32 -0800</bug_when>
    <thetext>This can happen when a value producing patchpoint is a terminal. Air will happily spill in the block after the terminal. It should instead spill in all successor blocks.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1273820</commentid>
    <comment_count>1</comment_count>
    <who name="Saam Barati">saam</who>
    <bug_when>2017-02-06 19:25:28 -0800</bug_when>
    <thetext>&lt;rdar://problem/29754721&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1273824</commentid>
    <comment_count>2</comment_count>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2017-02-06 20:01:36 -0800</bug_when>
    <thetext>Thought about this a bit. I think that the cleanest solution is to just have a post-IRC fixup, implemented as part of the iteratedRegisterCoalescing phase but separately from the main algorithm, that just looks for instructions after terminals and fixes them. The fix-up would then:

- If any of the successor edges of the block with the Inst after terminal are critial, break them.

- Shove the code after the terminal to each of the successors.

I believe that this is best done as a post-IRC fixup because inside IRC we reuse some analysis results and what-not.  It would be awkward if we were adding blocks on the fly.  Also, adding the critical edge blocks before IRC would increase IRC&apos;s running time.  Finally, I think that adding code to IRC that adds the spill code either in this block via InsertionSet or in another block using some other method sounds like it would complicate IRC a lot.  But the post-hoc fixup would be a simple algorithm.

I can&apos;t think of any reason why this would be wrong, since IRC doesn&apos;t care if something is a terminal.

The other options would be:

- Break critical edges before IRC.  This sounds expensive.  It increases the amount of per-edge work for IRC in cases where we wouldn&apos;t have spilled or wouldn&apos;t have had a temrinal that produces a result.  But, this would trivially allow the spiller to put spill code in the successor.

- Break critical edges before IRC only when the previous block has a terminal with a Def.  This is beginning to sound more complicated than my proposal.

Note that these options are definitely or probably borked:

- Just put the spill code in the successor block.  That doesn&apos;t work because the successor edge could be critical: the successor could have a predecessor other than us.  Air allows critical edges and they are very likely to come into existence via taildup.  So, this approach is definitely wrong, even if it passes tests.

- Break the critical edges as we try to insert the spill code.  It&apos;s important for Air to preserve sane block order.  Also, IRC has a bunch of analyses live while it&apos;s running, and it would be confusing if the number of basic blocks was changing while IRC ran.  So, this approach is undesirable, but not definitely wrong.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1273852</commentid>
    <comment_count>3</comment_count>
    <who name="Saam Barati">saam</who>
    <bug_when>2017-02-06 21:24:12 -0800</bug_when>
    <thetext>(In reply to comment #2)
&gt; Thought about this a bit. I think that the cleanest solution is to just have
&gt; a post-IRC fixup, implemented as part of the iteratedRegisterCoalescing
&gt; phase but separately from the main algorithm, that just looks for
&gt; instructions after terminals and fixes them. The fix-up would then:
&gt; 
&gt; - If any of the successor edges of the block with the Inst after terminal
&gt; are critial, break them.
&gt; 
&gt; - Shove the code after the terminal to each of the successors.
&gt; 
&gt; I believe that this is best done as a post-IRC fixup because inside IRC we
&gt; reuse some analysis results and what-not.  It would be awkward if we were
&gt; adding blocks on the fly.  Also, adding the critical edge blocks before IRC
&gt; would increase IRC&apos;s running time.  Finally, I think that adding code to IRC
&gt; that adds the spill code either in this block via InsertionSet or in another
&gt; block using some other method sounds like it would complicate IRC a lot. 
&gt; But the post-hoc fixup would be a simple algorithm.
&gt; 
&gt; I can&apos;t think of any reason why this would be wrong, since IRC doesn&apos;t care
&gt; if something is a terminal.
&gt; 
&gt; The other options would be:
&gt; 
&gt; - Break critical edges before IRC.  This sounds expensive.  It increases the
&gt; amount of per-edge work for IRC in cases where we wouldn&apos;t have spilled or
&gt; wouldn&apos;t have had a temrinal that produces a result.  But, this would
&gt; trivially allow the spiller to put spill code in the successor.
&gt; 
&gt; - Break critical edges before IRC only when the previous block has a
&gt; terminal with a Def.  This is beginning to sound more complicated than my
&gt; proposal.
&gt; 
&gt; Note that these options are definitely or probably borked:
&gt; 
&gt; - Just put the spill code in the successor block.  That doesn&apos;t work because
&gt; the successor edge could be critical: the successor could have a predecessor
&gt; other than us.  Air allows critical edges and they are very likely to come
&gt; into existence via taildup.  So, this approach is definitely wrong, even if
&gt; it passes tests.
&gt; 
&gt; - Break the critical edges as we try to insert the spill code.  It&apos;s
&gt; important for Air to preserve sane block order.  Also, IRC has a bunch of
&gt; analyses live while it&apos;s running, and it would be confusing if the number of
&gt; basic blocks was changing while IRC ran.  So, this approach is undesirable,
&gt; but not definitely wrong.

I&apos;m going to go with your suggestion.
That said, thinking more about what it means to have a critical edge branch-value-producing patchpoint is somewhat awkward.
I&apos;m consider these two cases:
1. The patchpoint&apos;s successors each have *only* the patchpoint as the predecessor. This is simple.
   Each successor can happily use the patchpoint&apos;s result.
2. One or more of the patchpoint&apos;s successors have other predecessors that are not the patchpoint.
   This is somewhat awkward. Because we create these in B3 in SSA, I think this means that
   such a successor won&apos;t be able to use the patchpoint&apos;s result.

That said, I believe we precisely do (2) inside the FTL, because we&apos;ll use the patchpoint&apos;s value
on success, but not on failure. The success path has exactly one predecessor, the patchpoint,
and the failure path may have many edges to it.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1273857</commentid>
    <comment_count>4</comment_count>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2017-02-06 21:54:17 -0800</bug_when>
    <thetext>(In reply to comment #3)
&gt; (In reply to comment #2)
&gt; &gt; Thought about this a bit. I think that the cleanest solution is to just have
&gt; &gt; a post-IRC fixup, implemented as part of the iteratedRegisterCoalescing
&gt; &gt; phase but separately from the main algorithm, that just looks for
&gt; &gt; instructions after terminals and fixes them. The fix-up would then:
&gt; &gt; 
&gt; &gt; - If any of the successor edges of the block with the Inst after terminal
&gt; &gt; are critial, break them.
&gt; &gt; 
&gt; &gt; - Shove the code after the terminal to each of the successors.
&gt; &gt; 
&gt; &gt; I believe that this is best done as a post-IRC fixup because inside IRC we
&gt; &gt; reuse some analysis results and what-not.  It would be awkward if we were
&gt; &gt; adding blocks on the fly.  Also, adding the critical edge blocks before IRC
&gt; &gt; would increase IRC&apos;s running time.  Finally, I think that adding code to IRC
&gt; &gt; that adds the spill code either in this block via InsertionSet or in another
&gt; &gt; block using some other method sounds like it would complicate IRC a lot. 
&gt; &gt; But the post-hoc fixup would be a simple algorithm.
&gt; &gt; 
&gt; &gt; I can&apos;t think of any reason why this would be wrong, since IRC doesn&apos;t care
&gt; &gt; if something is a terminal.
&gt; &gt; 
&gt; &gt; The other options would be:
&gt; &gt; 
&gt; &gt; - Break critical edges before IRC.  This sounds expensive.  It increases the
&gt; &gt; amount of per-edge work for IRC in cases where we wouldn&apos;t have spilled or
&gt; &gt; wouldn&apos;t have had a temrinal that produces a result.  But, this would
&gt; &gt; trivially allow the spiller to put spill code in the successor.
&gt; &gt; 
&gt; &gt; - Break critical edges before IRC only when the previous block has a
&gt; &gt; terminal with a Def.  This is beginning to sound more complicated than my
&gt; &gt; proposal.
&gt; &gt; 
&gt; &gt; Note that these options are definitely or probably borked:
&gt; &gt; 
&gt; &gt; - Just put the spill code in the successor block.  That doesn&apos;t work because
&gt; &gt; the successor edge could be critical: the successor could have a predecessor
&gt; &gt; other than us.  Air allows critical edges and they are very likely to come
&gt; &gt; into existence via taildup.  So, this approach is definitely wrong, even if
&gt; &gt; it passes tests.
&gt; &gt; 
&gt; &gt; - Break the critical edges as we try to insert the spill code.  It&apos;s
&gt; &gt; important for Air to preserve sane block order.  Also, IRC has a bunch of
&gt; &gt; analyses live while it&apos;s running, and it would be confusing if the number of
&gt; &gt; basic blocks was changing while IRC ran.  So, this approach is undesirable,
&gt; &gt; but not definitely wrong.
&gt; 
&gt; I&apos;m going to go with your suggestion.
&gt; That said, thinking more about what it means to have a critical edge
&gt; branch-value-producing patchpoint is somewhat awkward.
&gt; I&apos;m consider these two cases:
&gt; 1. The patchpoint&apos;s successors each have *only* the patchpoint as the
&gt; predecessor. This is simple.
&gt;    Each successor can happily use the patchpoint&apos;s result.
&gt; 2. One or more of the patchpoint&apos;s successors have other predecessors that
&gt; are not the patchpoint.
&gt;    This is somewhat awkward. Because we create these in B3 in SSA, I think
&gt; this means that
&gt;    such a successor won&apos;t be able to use the patchpoint&apos;s result.
&gt; 
&gt; That said, I believe we precisely do (2) inside the FTL, because we&apos;ll use
&gt; the patchpoint&apos;s value
&gt; on success, but not on failure. The success path has exactly one
&gt; predecessor, the patchpoint,
&gt; and the failure path may have many edges to it.

I think that the Air way of handling this case is:

1) IRC emits spill code all over the place.
2) allocateStack DCEs the spill on those paths where it&apos;s not needed. This happens for free in allocateStack.

Otherwise, you&apos;d need to query more things about the liveness of the variable.  Not impossible, but seems harder.

Also, Tmp in Air is not an SSA variable.  Things may have happened.  So, it&apos;s possible that you have:

Block #A:
    Patch def:%tmp42
  Successors: #C

Block #B:
    Move ..., %tmp42
  Successors: #C

Block #C:
    ... use %tmp42

It&apos;s not obvious that we would see such Air because it&apos;s ordinarily generated from B3.  However, we perform transformations in Air that duplicate code, which can trivially introduce two assignments to the same tmp.  Maybe this can cause this pattern.  Therefore, I think it&apos;s best to ensure that every Air phase can handle any Air input, and that includes the above.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1273861</commentid>
    <comment_count>5</comment_count>
    <who name="Saam Barati">saam</who>
    <bug_when>2017-02-06 21:59:10 -0800</bug_when>
    <thetext>(In reply to comment #4)
&gt; (In reply to comment #3)
&gt; &gt; (In reply to comment #2)
&gt; &gt; &gt; Thought about this a bit. I think that the cleanest solution is to just have
&gt; &gt; &gt; a post-IRC fixup, implemented as part of the iteratedRegisterCoalescing
&gt; &gt; &gt; phase but separately from the main algorithm, that just looks for
&gt; &gt; &gt; instructions after terminals and fixes them. The fix-up would then:
&gt; &gt; &gt; 
&gt; &gt; &gt; - If any of the successor edges of the block with the Inst after terminal
&gt; &gt; &gt; are critial, break them.
&gt; &gt; &gt; 
&gt; &gt; &gt; - Shove the code after the terminal to each of the successors.
&gt; &gt; &gt; 
&gt; &gt; &gt; I believe that this is best done as a post-IRC fixup because inside IRC we
&gt; &gt; &gt; reuse some analysis results and what-not.  It would be awkward if we were
&gt; &gt; &gt; adding blocks on the fly.  Also, adding the critical edge blocks before IRC
&gt; &gt; &gt; would increase IRC&apos;s running time.  Finally, I think that adding code to IRC
&gt; &gt; &gt; that adds the spill code either in this block via InsertionSet or in another
&gt; &gt; &gt; block using some other method sounds like it would complicate IRC a lot. 
&gt; &gt; &gt; But the post-hoc fixup would be a simple algorithm.
&gt; &gt; &gt; 
&gt; &gt; &gt; I can&apos;t think of any reason why this would be wrong, since IRC doesn&apos;t care
&gt; &gt; &gt; if something is a terminal.
&gt; &gt; &gt; 
&gt; &gt; &gt; The other options would be:
&gt; &gt; &gt; 
&gt; &gt; &gt; - Break critical edges before IRC.  This sounds expensive.  It increases the
&gt; &gt; &gt; amount of per-edge work for IRC in cases where we wouldn&apos;t have spilled or
&gt; &gt; &gt; wouldn&apos;t have had a temrinal that produces a result.  But, this would
&gt; &gt; &gt; trivially allow the spiller to put spill code in the successor.
&gt; &gt; &gt; 
&gt; &gt; &gt; - Break critical edges before IRC only when the previous block has a
&gt; &gt; &gt; terminal with a Def.  This is beginning to sound more complicated than my
&gt; &gt; &gt; proposal.
&gt; &gt; &gt; 
&gt; &gt; &gt; Note that these options are definitely or probably borked:
&gt; &gt; &gt; 
&gt; &gt; &gt; - Just put the spill code in the successor block.  That doesn&apos;t work because
&gt; &gt; &gt; the successor edge could be critical: the successor could have a predecessor
&gt; &gt; &gt; other than us.  Air allows critical edges and they are very likely to come
&gt; &gt; &gt; into existence via taildup.  So, this approach is definitely wrong, even if
&gt; &gt; &gt; it passes tests.
&gt; &gt; &gt; 
&gt; &gt; &gt; - Break the critical edges as we try to insert the spill code.  It&apos;s
&gt; &gt; &gt; important for Air to preserve sane block order.  Also, IRC has a bunch of
&gt; &gt; &gt; analyses live while it&apos;s running, and it would be confusing if the number of
&gt; &gt; &gt; basic blocks was changing while IRC ran.  So, this approach is undesirable,
&gt; &gt; &gt; but not definitely wrong.
&gt; &gt; 
&gt; &gt; I&apos;m going to go with your suggestion.
&gt; &gt; That said, thinking more about what it means to have a critical edge
&gt; &gt; branch-value-producing patchpoint is somewhat awkward.
&gt; &gt; I&apos;m consider these two cases:
&gt; &gt; 1. The patchpoint&apos;s successors each have *only* the patchpoint as the
&gt; &gt; predecessor. This is simple.
&gt; &gt;    Each successor can happily use the patchpoint&apos;s result.
&gt; &gt; 2. One or more of the patchpoint&apos;s successors have other predecessors that
&gt; &gt; are not the patchpoint.
&gt; &gt;    This is somewhat awkward. Because we create these in B3 in SSA, I think
&gt; &gt; this means that
&gt; &gt;    such a successor won&apos;t be able to use the patchpoint&apos;s result.
&gt; &gt; 
&gt; &gt; That said, I believe we precisely do (2) inside the FTL, because we&apos;ll use
&gt; &gt; the patchpoint&apos;s value
&gt; &gt; on success, but not on failure. The success path has exactly one
&gt; &gt; predecessor, the patchpoint,
&gt; &gt; and the failure path may have many edges to it.
&gt; 
&gt; I think that the Air way of handling this case is:
&gt; 
&gt; 1) IRC emits spill code all over the place.
&gt; 2) allocateStack DCEs the spill on those paths where it&apos;s not needed. This
&gt; happens for free in allocateStack.
&gt; 
&gt; Otherwise, you&apos;d need to query more things about the liveness of the
&gt; variable.  Not impossible, but seems harder.
&gt; 
&gt; Also, Tmp in Air is not an SSA variable.  Things may have happened.  So,
&gt; it&apos;s possible that you have:
&gt; 
&gt; Block #A:
&gt;     Patch def:%tmp42
&gt;   Successors: #C
&gt; 
&gt; Block #B:
&gt;     Move ..., %tmp42
&gt;   Successors: #C
&gt; 
&gt; Block #C:
&gt;     ... use %tmp42
&gt; 
&gt; It&apos;s not obvious that we would see such Air because it&apos;s ordinarily
&gt; generated from B3.  However, we perform transformations in Air that
&gt; duplicate code, which can trivially introduce two assignments to the same
&gt; tmp.  Maybe this can cause this pattern.  Therefore, I think it&apos;s best to
&gt; ensure that every Air phase can handle any Air input, and that includes the
&gt; above.

Indeed. I agree we should handle it, and the code I have written does. I just don&apos;t know how to write a test uses the value being spilled along that path. I&apos;ve written a test that makes sure we break the critical edge, but not one that uses the value along the path of the critical edge.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1273873</commentid>
    <comment_count>6</comment_count>
      <attachid>300792</attachid>
    <who name="Saam Barati">saam</who>
    <bug_when>2017-02-06 22:35:35 -0800</bug_when>
    <thetext>Created attachment 300792
patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1273883</commentid>
    <comment_count>7</comment_count>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2017-02-06 22:52:54 -0800</bug_when>
    <thetext>(In reply to comment #5)
&gt; (In reply to comment #4)
&gt; &gt; (In reply to comment #3)
&gt; &gt; &gt; (In reply to comment #2)
&gt; &gt; &gt; &gt; Thought about this a bit. I think that the cleanest solution is to just have
&gt; &gt; &gt; &gt; a post-IRC fixup, implemented as part of the iteratedRegisterCoalescing
&gt; &gt; &gt; &gt; phase but separately from the main algorithm, that just looks for
&gt; &gt; &gt; &gt; instructions after terminals and fixes them. The fix-up would then:
&gt; &gt; &gt; &gt; 
&gt; &gt; &gt; &gt; - If any of the successor edges of the block with the Inst after terminal
&gt; &gt; &gt; &gt; are critial, break them.
&gt; &gt; &gt; &gt; 
&gt; &gt; &gt; &gt; - Shove the code after the terminal to each of the successors.
&gt; &gt; &gt; &gt; 
&gt; &gt; &gt; &gt; I believe that this is best done as a post-IRC fixup because inside IRC we
&gt; &gt; &gt; &gt; reuse some analysis results and what-not.  It would be awkward if we were
&gt; &gt; &gt; &gt; adding blocks on the fly.  Also, adding the critical edge blocks before IRC
&gt; &gt; &gt; &gt; would increase IRC&apos;s running time.  Finally, I think that adding code to IRC
&gt; &gt; &gt; &gt; that adds the spill code either in this block via InsertionSet or in another
&gt; &gt; &gt; &gt; block using some other method sounds like it would complicate IRC a lot. 
&gt; &gt; &gt; &gt; But the post-hoc fixup would be a simple algorithm.
&gt; &gt; &gt; &gt; 
&gt; &gt; &gt; &gt; I can&apos;t think of any reason why this would be wrong, since IRC doesn&apos;t care
&gt; &gt; &gt; &gt; if something is a terminal.
&gt; &gt; &gt; &gt; 
&gt; &gt; &gt; &gt; The other options would be:
&gt; &gt; &gt; &gt; 
&gt; &gt; &gt; &gt; - Break critical edges before IRC.  This sounds expensive.  It increases the
&gt; &gt; &gt; &gt; amount of per-edge work for IRC in cases where we wouldn&apos;t have spilled or
&gt; &gt; &gt; &gt; wouldn&apos;t have had a temrinal that produces a result.  But, this would
&gt; &gt; &gt; &gt; trivially allow the spiller to put spill code in the successor.
&gt; &gt; &gt; &gt; 
&gt; &gt; &gt; &gt; - Break critical edges before IRC only when the previous block has a
&gt; &gt; &gt; &gt; terminal with a Def.  This is beginning to sound more complicated than my
&gt; &gt; &gt; &gt; proposal.
&gt; &gt; &gt; &gt; 
&gt; &gt; &gt; &gt; Note that these options are definitely or probably borked:
&gt; &gt; &gt; &gt; 
&gt; &gt; &gt; &gt; - Just put the spill code in the successor block.  That doesn&apos;t work because
&gt; &gt; &gt; &gt; the successor edge could be critical: the successor could have a predecessor
&gt; &gt; &gt; &gt; other than us.  Air allows critical edges and they are very likely to come
&gt; &gt; &gt; &gt; into existence via taildup.  So, this approach is definitely wrong, even if
&gt; &gt; &gt; &gt; it passes tests.
&gt; &gt; &gt; &gt; 
&gt; &gt; &gt; &gt; - Break the critical edges as we try to insert the spill code.  It&apos;s
&gt; &gt; &gt; &gt; important for Air to preserve sane block order.  Also, IRC has a bunch of
&gt; &gt; &gt; &gt; analyses live while it&apos;s running, and it would be confusing if the number of
&gt; &gt; &gt; &gt; basic blocks was changing while IRC ran.  So, this approach is undesirable,
&gt; &gt; &gt; &gt; but not definitely wrong.
&gt; &gt; &gt; 
&gt; &gt; &gt; I&apos;m going to go with your suggestion.
&gt; &gt; &gt; That said, thinking more about what it means to have a critical edge
&gt; &gt; &gt; branch-value-producing patchpoint is somewhat awkward.
&gt; &gt; &gt; I&apos;m consider these two cases:
&gt; &gt; &gt; 1. The patchpoint&apos;s successors each have *only* the patchpoint as the
&gt; &gt; &gt; predecessor. This is simple.
&gt; &gt; &gt;    Each successor can happily use the patchpoint&apos;s result.
&gt; &gt; &gt; 2. One or more of the patchpoint&apos;s successors have other predecessors that
&gt; &gt; &gt; are not the patchpoint.
&gt; &gt; &gt;    This is somewhat awkward. Because we create these in B3 in SSA, I think
&gt; &gt; &gt; this means that
&gt; &gt; &gt;    such a successor won&apos;t be able to use the patchpoint&apos;s result.
&gt; &gt; &gt; 
&gt; &gt; &gt; That said, I believe we precisely do (2) inside the FTL, because we&apos;ll use
&gt; &gt; &gt; the patchpoint&apos;s value
&gt; &gt; &gt; on success, but not on failure. The success path has exactly one
&gt; &gt; &gt; predecessor, the patchpoint,
&gt; &gt; &gt; and the failure path may have many edges to it.
&gt; &gt; 
&gt; &gt; I think that the Air way of handling this case is:
&gt; &gt; 
&gt; &gt; 1) IRC emits spill code all over the place.
&gt; &gt; 2) allocateStack DCEs the spill on those paths where it&apos;s not needed. This
&gt; &gt; happens for free in allocateStack.
&gt; &gt; 
&gt; &gt; Otherwise, you&apos;d need to query more things about the liveness of the
&gt; &gt; variable.  Not impossible, but seems harder.
&gt; &gt; 
&gt; &gt; Also, Tmp in Air is not an SSA variable.  Things may have happened.  So,
&gt; &gt; it&apos;s possible that you have:
&gt; &gt; 
&gt; &gt; Block #A:
&gt; &gt;     Patch def:%tmp42
&gt; &gt;   Successors: #C
&gt; &gt; 
&gt; &gt; Block #B:
&gt; &gt;     Move ..., %tmp42
&gt; &gt;   Successors: #C
&gt; &gt; 
&gt; &gt; Block #C:
&gt; &gt;     ... use %tmp42
&gt; &gt; 
&gt; &gt; It&apos;s not obvious that we would see such Air because it&apos;s ordinarily
&gt; &gt; generated from B3.  However, we perform transformations in Air that
&gt; &gt; duplicate code, which can trivially introduce two assignments to the same
&gt; &gt; tmp.  Maybe this can cause this pattern.  Therefore, I think it&apos;s best to
&gt; &gt; ensure that every Air phase can handle any Air input, and that includes the
&gt; &gt; above.
&gt; 
&gt; Indeed. I agree we should handle it, and the code I have written does. I
&gt; just don&apos;t know how to write a test uses the value being spilled along that
&gt; path. I&apos;ve written a test that makes sure we break the critical edge, but
&gt; not one that uses the value along the path of the critical edge.

You could write an Air unit test, maybe in testair. Just feed IR straight into IRC and then assert things about the output, like maybe just validating terminals.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1273887</commentid>
    <comment_count>8</comment_count>
    <who name="Saam Barati">saam</who>
    <bug_when>2017-02-06 23:13:53 -0800</bug_when>
    <thetext>(In reply to comment #7)
&gt; (In reply to comment #5)
&gt; &gt; (In reply to comment #4)
&gt; &gt; &gt; (In reply to comment #3)
&gt; &gt; &gt; &gt; (In reply to comment #2)
&gt; &gt; &gt; &gt; &gt; Thought about this a bit. I think that the cleanest solution is to just have
&gt; &gt; &gt; &gt; &gt; a post-IRC fixup, implemented as part of the iteratedRegisterCoalescing
&gt; &gt; &gt; &gt; &gt; phase but separately from the main algorithm, that just looks for
&gt; &gt; &gt; &gt; &gt; instructions after terminals and fixes them. The fix-up would then:
&gt; &gt; &gt; &gt; &gt; 
&gt; &gt; &gt; &gt; &gt; - If any of the successor edges of the block with the Inst after terminal
&gt; &gt; &gt; &gt; &gt; are critial, break them.
&gt; &gt; &gt; &gt; &gt; 
&gt; &gt; &gt; &gt; &gt; - Shove the code after the terminal to each of the successors.
&gt; &gt; &gt; &gt; &gt; 
&gt; &gt; &gt; &gt; &gt; I believe that this is best done as a post-IRC fixup because inside IRC we
&gt; &gt; &gt; &gt; &gt; reuse some analysis results and what-not.  It would be awkward if we were
&gt; &gt; &gt; &gt; &gt; adding blocks on the fly.  Also, adding the critical edge blocks before IRC
&gt; &gt; &gt; &gt; &gt; would increase IRC&apos;s running time.  Finally, I think that adding code to IRC
&gt; &gt; &gt; &gt; &gt; that adds the spill code either in this block via InsertionSet or in another
&gt; &gt; &gt; &gt; &gt; block using some other method sounds like it would complicate IRC a lot. 
&gt; &gt; &gt; &gt; &gt; But the post-hoc fixup would be a simple algorithm.
&gt; &gt; &gt; &gt; &gt; 
&gt; &gt; &gt; &gt; &gt; I can&apos;t think of any reason why this would be wrong, since IRC doesn&apos;t care
&gt; &gt; &gt; &gt; &gt; if something is a terminal.
&gt; &gt; &gt; &gt; &gt; 
&gt; &gt; &gt; &gt; &gt; The other options would be:
&gt; &gt; &gt; &gt; &gt; 
&gt; &gt; &gt; &gt; &gt; - Break critical edges before IRC.  This sounds expensive.  It increases the
&gt; &gt; &gt; &gt; &gt; amount of per-edge work for IRC in cases where we wouldn&apos;t have spilled or
&gt; &gt; &gt; &gt; &gt; wouldn&apos;t have had a temrinal that produces a result.  But, this would
&gt; &gt; &gt; &gt; &gt; trivially allow the spiller to put spill code in the successor.
&gt; &gt; &gt; &gt; &gt; 
&gt; &gt; &gt; &gt; &gt; - Break critical edges before IRC only when the previous block has a
&gt; &gt; &gt; &gt; &gt; terminal with a Def.  This is beginning to sound more complicated than my
&gt; &gt; &gt; &gt; &gt; proposal.
&gt; &gt; &gt; &gt; &gt; 
&gt; &gt; &gt; &gt; &gt; Note that these options are definitely or probably borked:
&gt; &gt; &gt; &gt; &gt; 
&gt; &gt; &gt; &gt; &gt; - Just put the spill code in the successor block.  That doesn&apos;t work because
&gt; &gt; &gt; &gt; &gt; the successor edge could be critical: the successor could have a predecessor
&gt; &gt; &gt; &gt; &gt; other than us.  Air allows critical edges and they are very likely to come
&gt; &gt; &gt; &gt; &gt; into existence via taildup.  So, this approach is definitely wrong, even if
&gt; &gt; &gt; &gt; &gt; it passes tests.
&gt; &gt; &gt; &gt; &gt; 
&gt; &gt; &gt; &gt; &gt; - Break the critical edges as we try to insert the spill code.  It&apos;s
&gt; &gt; &gt; &gt; &gt; important for Air to preserve sane block order.  Also, IRC has a bunch of
&gt; &gt; &gt; &gt; &gt; analyses live while it&apos;s running, and it would be confusing if the number of
&gt; &gt; &gt; &gt; &gt; basic blocks was changing while IRC ran.  So, this approach is undesirable,
&gt; &gt; &gt; &gt; &gt; but not definitely wrong.
&gt; &gt; &gt; &gt; 
&gt; &gt; &gt; &gt; I&apos;m going to go with your suggestion.
&gt; &gt; &gt; &gt; That said, thinking more about what it means to have a critical edge
&gt; &gt; &gt; &gt; branch-value-producing patchpoint is somewhat awkward.
&gt; &gt; &gt; &gt; I&apos;m consider these two cases:
&gt; &gt; &gt; &gt; 1. The patchpoint&apos;s successors each have *only* the patchpoint as the
&gt; &gt; &gt; &gt; predecessor. This is simple.
&gt; &gt; &gt; &gt;    Each successor can happily use the patchpoint&apos;s result.
&gt; &gt; &gt; &gt; 2. One or more of the patchpoint&apos;s successors have other predecessors that
&gt; &gt; &gt; &gt; are not the patchpoint.
&gt; &gt; &gt; &gt;    This is somewhat awkward. Because we create these in B3 in SSA, I think
&gt; &gt; &gt; &gt; this means that
&gt; &gt; &gt; &gt;    such a successor won&apos;t be able to use the patchpoint&apos;s result.
&gt; &gt; &gt; &gt; 
&gt; &gt; &gt; &gt; That said, I believe we precisely do (2) inside the FTL, because we&apos;ll use
&gt; &gt; &gt; &gt; the patchpoint&apos;s value
&gt; &gt; &gt; &gt; on success, but not on failure. The success path has exactly one
&gt; &gt; &gt; &gt; predecessor, the patchpoint,
&gt; &gt; &gt; &gt; and the failure path may have many edges to it.
&gt; &gt; &gt; 
&gt; &gt; &gt; I think that the Air way of handling this case is:
&gt; &gt; &gt; 
&gt; &gt; &gt; 1) IRC emits spill code all over the place.
&gt; &gt; &gt; 2) allocateStack DCEs the spill on those paths where it&apos;s not needed. This
&gt; &gt; &gt; happens for free in allocateStack.
&gt; &gt; &gt; 
&gt; &gt; &gt; Otherwise, you&apos;d need to query more things about the liveness of the
&gt; &gt; &gt; variable.  Not impossible, but seems harder.
&gt; &gt; &gt; 
&gt; &gt; &gt; Also, Tmp in Air is not an SSA variable.  Things may have happened.  So,
&gt; &gt; &gt; it&apos;s possible that you have:
&gt; &gt; &gt; 
&gt; &gt; &gt; Block #A:
&gt; &gt; &gt;     Patch def:%tmp42
&gt; &gt; &gt;   Successors: #C
&gt; &gt; &gt; 
&gt; &gt; &gt; Block #B:
&gt; &gt; &gt;     Move ..., %tmp42
&gt; &gt; &gt;   Successors: #C
&gt; &gt; &gt; 
&gt; &gt; &gt; Block #C:
&gt; &gt; &gt;     ... use %tmp42
&gt; &gt; &gt; 
&gt; &gt; &gt; It&apos;s not obvious that we would see such Air because it&apos;s ordinarily
&gt; &gt; &gt; generated from B3.  However, we perform transformations in Air that
&gt; &gt; &gt; duplicate code, which can trivially introduce two assignments to the same
&gt; &gt; &gt; tmp.  Maybe this can cause this pattern.  Therefore, I think it&apos;s best to
&gt; &gt; &gt; ensure that every Air phase can handle any Air input, and that includes the
&gt; &gt; &gt; above.
&gt; &gt; 
&gt; &gt; Indeed. I agree we should handle it, and the code I have written does. I
&gt; &gt; just don&apos;t know how to write a test uses the value being spilled along that
&gt; &gt; path. I&apos;ve written a test that makes sure we break the critical edge, but
&gt; &gt; not one that uses the value along the path of the critical edge.
&gt; 
&gt; You could write an Air unit test, maybe in testair. Just feed IR straight
&gt; into IRC and then assert things about the output, like maybe just validating
&gt; terminals.
Good point. I forgot about testair&apos;s existsence.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1274537</commentid>
    <comment_count>9</comment_count>
    <who name="Saam Barati">saam</who>
    <bug_when>2017-02-08 13:24:09 -0800</bug_when>
    <thetext>landed in:
https://trac.webkit.org/changeset/211896</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1291759</commentid>
    <comment_count>10</comment_count>
      <attachid>300792</attachid>
    <who name="Filip Pizlo">fpizlo</who>
    <bug_when>2017-03-27 20:02:52 -0700</bug_when>
    <thetext>Comment on attachment 300792
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=300792&amp;action=review

&gt; Source/JavaScriptCore/b3/air/AirIteratedRegisterCoalescing.cpp:1578
&gt; +    void fixSpillsAfterTerminals()

Too bad we didn&apos;t make this an independent function so that spillEverything() could call it!

&gt; Source/JavaScriptCore/b3/air/AirIteratedRegisterCoalescing.cpp:1621
&gt; +                    // FIXME: We probably want better block ordering here.

That&apos;s why we have BlockInsertionSet.

It&apos;s super important that we always have clean basic block order.

Can I rely on Wasm&apos;s B3IRGen giving us sensible block order?</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>300792</attachid>
            <date>2017-02-06 22:35:35 -0800</date>
            <delta_ts>2017-02-08 10:43:03 -0800</delta_ts>
            <desc>patch</desc>
            <filename>c-backup.diff</filename>
            <type>text/plain</type>
            <size>14927</size>
            <attacher name="Saam Barati">saam</attacher>
            
              <data encoding="base64">SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291
cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMjExNzczKQorKysgU291cmNl
L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDMzIEBA
CisyMDE3LTAyLTA2ICBTYWFtIEJhcmF0aSAgPHNiYXJhdGlAYXBwbGUuY29tPgorCisgICAgICAg
IEFpciBJUkMgbWlnaHQgc3BpbGwgYSB0ZXJtaW5hbCB0aGF0IHByb2R1Y2VzIGEgdmFsdWUgYWZ0
ZXIgdGhlIHRlcm1pbmFsCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVn
LmNnaT9pZD0xNjc5MTkKKyAgICAgICAgPHJkYXI6Ly9wcm9ibGVtLzI5NzU0NzIxPgorCisgICAg
ICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIElSQyBtYXkgc3BpbGwg
YSB2YWx1ZS1wcm9kdWNpbmcgdGVybWluYWwgKGEgcGF0Y2hwb2ludCBjYW4gYmUgYSB2YWx1ZS1w
cm9kdWNpbmcgdGVybWluYWwpLgorICAgICAgICBJdCB1c2VkIHRvIGRvIHRoaXMgYnkgcGxhY2lu
ZyB0aGUgc3BpbGwgKmFmdGVyKiB0aGUgdGVybWluYWwuIFRoaXMgcHJvZHVjZXMgYW4gaW52YWxp
ZAorICAgICAgICBncmFwaCBiZWNhdXNlIG5vIGluc3RydWN0aW9ucyBhcmUgYWxsb3dlZCBhZnRl
ciB0aGUgdGVybWluYWwuCisgICAgICAgIAorICAgICAgICBJIGZpeGVkIHRoaXMgYnVnIGJ5IGhh
dmluZyBhIGNsZWFudXAgcGFzcyBvdmVyIHRoZSBJUiBhZnRlciBJUkMgaXMgZG9uZS4KKyAgICAg
ICAgVGhlIHBhc3MgZGV0ZWN0cyB0aGlzIHByb2JsZW0sIGFuZCBmaXhlcyBpdCBieSBtb3Zpbmcg
dGhlIHNwaWxsIGludG8gdGhlCisgICAgICAgIHN1Y2Nlc3NvcnMuIEhvd2V2ZXIsIGl0IGlzIGNh
cmVmdWwgdG8gZGV0ZWN0IHdoZW4gdGhlIGVkZ2UgdG8gdGhlCisgICAgICAgIHN1Y2Nlc3NvciBp
cyBhIGNyaXRpY2FsIGVkZ2UuIElmIHRoZSB2YWx1ZS1wcm9kdWNpbmcgcGF0Y2hwb2ludCBpcwor
ICAgICAgICB0aGUgb25seSBwcmVkZWNlc3NvciBvZiB0aGUgc3VjY2Vzc29yLCBpdCBqdXN0IG1v
dmVzIHRoZSBzcGlsbAorICAgICAgICBjb2RlIHRvIHRoZSBiZWdpbm5pbmcgb2YgdGhlIHN1Y2Nl
c3Nvci4gT3RoZXJ3aXNlLCBpdCdzIGEgY3JpdGljYWwKKyAgICAgICAgZWRnZSBhbmQgaXQgYnJl
YWtzIGl0IGJ5IGFkZGluZyBhIGJsb2NrIHRoYXQgZG9lcyB0aGUgc3BpbGxpbmcgdGhlbgorICAg
ICAgICBqdW1wcyB0byB0aGUgc3VjY2Vzc29yLgorCisgICAgICAgICogYjMvYWlyL0Fpckluc2Vy
dGlvblNldC5jcHA6CisgICAgICAgICogYjMvYWlyL0Fpckluc2VydGlvblNldC5oOgorICAgICAg
ICAoSlNDOjpCMzo6QWlyOjpJbnNlcnRpb25TZXQ6Omluc2VydEluc3RzKToKKyAgICAgICAgKiBi
My9haXIvQWlySXRlcmF0ZWRSZWdpc3RlckNvYWxlc2NpbmcuY3BwOgorICAgICAgICAqIGIzL3Rl
c3RiMy5jcHA6CisgICAgICAgIChKU0M6OkIzOjp0ZXN0VGVybWluYWxQYXRjaHBvaW50VGhhdE5l
ZWRzVG9CZVNwaWxsZWQpOgorICAgICAgICAoSlNDOjpCMzo6dGVzdFRlcm1pbmFsUGF0Y2hwb2lu
dFRoYXROZWVkc1RvQmVTcGlsbGVkMik6CisgICAgICAgIChKU0M6OkIzOjpydW4pOgorCiAyMDE3
LTAyLTA2ICBKb3NlcGggUGVjb3Jhcm8gIDxwZWNvcmFyb0BhcHBsZS5jb20+CiAKICAgICAgICAg
V2ViIEluc3BlY3RvcjogRG8gbm90IHVzZSBSdW5Mb29wIHdoZW4gZGlzcGF0Y2hpbmcgaW5zcGVj
dG9yIEdDIGV2ZW50CkluZGV4OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUvYjMvdGVzdGIzLmNwcAo9
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09Ci0tLSBTb3VyY2UvSmF2YVNjcmlwdENvcmUvYjMvdGVzdGIzLmNwcAkocmV2aXNp
b24gMjExNjg4KQorKysgU291cmNlL0phdmFTY3JpcHRDb3JlL2IzL3Rlc3RiMy5jcHAJKHdvcmtp
bmcgY29weSkKQEAgLTEsNSArMSw1IEBACiAvKgotICogQ29weXJpZ2h0IChDKSAyMDE1LTIwMTYg
QXBwbGUgSW5jLiBBbGwgcmlnaHRzIHJlc2VydmVkLgorICogQ29weXJpZ2h0IChDKSAyMDE1LTIw
MTcgQXBwbGUgSW5jLiBBbGwgcmlnaHRzIHJlc2VydmVkLgogICoKICAqIFJlZGlzdHJpYnV0aW9u
IGFuZCB1c2UgaW4gc291cmNlIGFuZCBiaW5hcnkgZm9ybXMsIHdpdGggb3Igd2l0aG91dAogICog
bW9kaWZpY2F0aW9uLCBhcmUgcGVybWl0dGVkIHByb3ZpZGVkIHRoYXQgdGhlIGZvbGxvd2luZyBj
b25kaXRpb25zCkBAIC0xMzM3Nyw2ICsxMzM3NywxNjYgQEAgdm9pZCB0ZXN0QnJhbmNoQml0QW5k
SW1tRnVzaW9uKAogICAgIENIRUNLKHRlcm1pbmFsLmFyZ3NbMl0ua2luZCgpID09IEFpcjo6QXJn
OjpCaXRJbW0gfHwgdGVybWluYWwuYXJnc1syXS5raW5kKCkgPT0gQWlyOjpBcmc6OkJpdEltbTY0
KTsKIH0KIAordm9pZCB0ZXN0VGVybWluYWxQYXRjaHBvaW50VGhhdE5lZWRzVG9CZVNwaWxsZWQo
KQoreworICAgIC8vIFRoaXMgaXMgYSB1bml0IHRlc3QgZm9yIGhvdyBGVEwncyBoZWFwIGFsbG9j
YXRpb24gZmFzdCBwYXRocyBiZWhhdmUuCisgICAgUHJvY2VkdXJlIHByb2M7CisgICAgCisgICAg
QmFzaWNCbG9jayogcm9vdCA9IHByb2MuYWRkQmxvY2soKTsKKyAgICBCYXNpY0Jsb2NrKiBzdWNj
ZXNzID0gcHJvYy5hZGRCbG9jaygpOworICAgIEJhc2ljQmxvY2sqIHNsb3dQYXRoID0gcHJvYy5h
ZGRCbG9jaygpOworICAgIAorICAgIFBhdGNocG9pbnRWYWx1ZSogcGF0Y2hwb2ludCA9IHJvb3Qt
PmFwcGVuZE5ldzxQYXRjaHBvaW50VmFsdWU+KHByb2MsIEludDMyLCBPcmlnaW4oKSk7CisgICAg
cGF0Y2hwb2ludC0+ZWZmZWN0cy50ZXJtaW5hbCA9IHRydWU7CisgICAgcGF0Y2hwb2ludC0+Y2xv
YmJlcihSZWdpc3RlclNldDo6bWFjcm9TY3JhdGNoUmVnaXN0ZXJzKCkpOworICAgIAorICAgIHJv
b3QtPmFwcGVuZFN1Y2Nlc3NvcihzdWNjZXNzKTsKKyAgICByb290LT5hcHBlbmRTdWNjZXNzb3Io
RnJlcXVlbnRlZEJsb2NrKHNsb3dQYXRoLCBGcmVxdWVuY3lDbGFzczo6UmFyZSkpOworICAgIAor
ICAgIHBhdGNocG9pbnQtPnNldEdlbmVyYXRvcigKKyAgICAgICAgWyZdIChDQ2FsbEhlbHBlcnMm
IGppdCwgY29uc3QgU3RhY2ttYXBHZW5lcmF0aW9uUGFyYW1zJiBwYXJhbXMpIHsKKyAgICAgICAg
ICAgIEFsbG93TWFjcm9TY3JhdGNoUmVnaXN0ZXJVc2FnZSBhbGxvd1NjcmF0Y2goaml0KTsKKyAg
ICAgICAgICAgIGppdC5tb3ZlKENDYWxsSGVscGVyczo6VHJ1c3RlZEltbTMyKDQyKSwgcGFyYW1z
WzBdLmdwcigpKTsKKyAgICAgICAgICAgIAorICAgICAgICAgICAgQ0NhbGxIZWxwZXJzOjpKdW1w
IGp1bXBUb1N1Y2Nlc3M7CisgICAgICAgICAgICBpZiAoIXBhcmFtcy5mYWxsc1Rocm91Z2hUb1N1
Y2Nlc3NvcigwKSkKKyAgICAgICAgICAgICAgICBqdW1wVG9TdWNjZXNzID0gaml0Lmp1bXAoKTsK
KyAgICAgICAgICAgIAorICAgICAgICAgICAgVmVjdG9yPEJveDxDQ2FsbEhlbHBlcnM6OkxhYmVs
Pj4gbGFiZWxzID0gcGFyYW1zLnN1Y2Nlc3NvckxhYmVscygpOworICAgICAgICAgICAgCisgICAg
ICAgICAgICBwYXJhbXMuYWRkTGF0ZVBhdGgoCisgICAgICAgICAgICAgICAgWz1dIChDQ2FsbEhl
bHBlcnMmIGppdCkgeworICAgICAgICAgICAgICAgICAgICBpZiAoanVtcFRvU3VjY2Vzcy5pc1Nl
dCgpKQorICAgICAgICAgICAgICAgICAgICAgICAganVtcFRvU3VjY2Vzcy5saW5rVG8oKmxhYmVs
c1swXSwgJmppdCk7CisgICAgICAgICAgICAgICAgfSk7CisgICAgICAgIH0pOworICAgIAorICAg
IFZlY3RvcjxWYWx1ZSo+IGFyZ3M7CisgICAgeworICAgICAgICBSZWdpc3RlclNldCBmaWxsQWxs
R1BSc1NldCA9IFJlZ2lzdGVyU2V0OjphbGxHUFJzKCk7CisgICAgICAgIGZpbGxBbGxHUFJzU2V0
LmV4Y2x1ZGUoUmVnaXN0ZXJTZXQ6OnN0YWNrUmVnaXN0ZXJzKCkpOworICAgICAgICBmaWxsQWxs
R1BSc1NldC5leGNsdWRlKFJlZ2lzdGVyU2V0OjpyZXNlcnZlZEhhcmR3YXJlUmVnaXN0ZXJzKCkp
OworCisgICAgICAgIGZvciAodW5zaWduZWQgaSA9IDA7IGkgPCBmaWxsQWxsR1BSc1NldC5udW1i
ZXJPZlNldFJlZ2lzdGVycygpOyBpKyspCisgICAgICAgICAgICBhcmdzLmFwcGVuZChzdWNjZXNz
LT5hcHBlbmROZXc8Q29uc3QzMlZhbHVlPihwcm9jLCBPcmlnaW4oKSwgaSkpOworICAgIH0KKwor
ICAgIHsKKyAgICAgICAgLy8gTm93IGZvcmNlIGFsbCB2YWx1ZXMgaW50byBldmVyeSBhdmFpbGFi
bGUgcmVnaXN0ZXIuCisgICAgICAgIFBhdGNocG9pbnRWYWx1ZSogcCA9IHN1Y2Nlc3MtPmFwcGVu
ZE5ldzxQYXRjaHBvaW50VmFsdWU+KHByb2MsIFZvaWQsIE9yaWdpbigpKTsKKyAgICAgICAgZm9y
IChWYWx1ZSogdiA6IGFyZ3MpCisgICAgICAgICAgICBwLT5hcHBlbmQodiwgVmFsdWVSZXA6OlNv
bWVSZWdpc3Rlcik7CisgICAgICAgIHAtPnNldEdlbmVyYXRvcihbJl0gKENDYWxsSGVscGVycyYs
IGNvbnN0IFN0YWNrbWFwR2VuZXJhdGlvblBhcmFtcyYpIHsgfSk7CisgICAgfQorCisgICAgewor
ICAgICAgICAvLyBOb3cgcmVxdWlyZSB0aGUgb3JpZ2luYWwgcGF0Y2hwb2ludCB0byBiZSBtYXRl
cmlhbGl6ZWQgaW50byBhIHJlZ2lzdGVyLgorICAgICAgICBQYXRjaHBvaW50VmFsdWUqIHAgPSBz
dWNjZXNzLT5hcHBlbmROZXc8UGF0Y2hwb2ludFZhbHVlPihwcm9jLCBWb2lkLCBPcmlnaW4oKSk7
CisgICAgICAgIHAtPmFwcGVuZChwYXRjaHBvaW50LCBWYWx1ZVJlcDo6U29tZVJlZ2lzdGVyKTsK
KyAgICAgICAgcC0+c2V0R2VuZXJhdG9yKFsmXSAoQ0NhbGxIZWxwZXJzJiwgY29uc3QgU3RhY2tt
YXBHZW5lcmF0aW9uUGFyYW1zJikgeyB9KTsKKyAgICB9CisKKyAgICBzdWNjZXNzLT5hcHBlbmRO
ZXc8VmFsdWU+KHByb2MsIFJldHVybiwgT3JpZ2luKCksIHN1Y2Nlc3MtPmFwcGVuZE5ldzxDb25z
dDMyVmFsdWU+KHByb2MsIE9yaWdpbigpLCAxMCkpOworICAgIAorICAgIHNsb3dQYXRoLT5hcHBl
bmROZXc8VmFsdWU+KHByb2MsIFJldHVybiwgT3JpZ2luKCksIHNsb3dQYXRoLT5hcHBlbmROZXc8
Q29uc3QzMlZhbHVlPihwcm9jLCBPcmlnaW4oKSwgMjApKTsKKyAgICAKKyAgICBhdXRvIGNvZGUg
PSBjb21waWxlKHByb2MpOworICAgIENIRUNLX0VRKGludm9rZTxpbnQ+KCpjb2RlKSwgMTApOwor
fQorCit2b2lkIHRlc3RUZXJtaW5hbFBhdGNocG9pbnRUaGF0TmVlZHNUb0JlU3BpbGxlZDIoKQor
eworICAgIC8vIFRoaXMgaXMgYSB1bml0IHRlc3QgZm9yIGhvdyBGVEwncyBoZWFwIGFsbG9jYXRp
b24gZmFzdCBwYXRocyBiZWhhdmUuCisgICAgUHJvY2VkdXJlIHByb2M7CisgICAgCisgICAgQmFz
aWNCbG9jayogcm9vdCA9IHByb2MuYWRkQmxvY2soKTsKKyAgICBCYXNpY0Jsb2NrKiBvbmUgPSBw
cm9jLmFkZEJsb2NrKCk7CisgICAgQmFzaWNCbG9jayogc3VjY2VzcyA9IHByb2MuYWRkQmxvY2so
KTsKKyAgICBCYXNpY0Jsb2NrKiBzbG93UGF0aCA9IHByb2MuYWRkQmxvY2soKTsKKworICAgIFZh
bHVlKiBhcmcgPSByb290LT5hcHBlbmROZXc8VmFsdWU+KAorICAgICAgICBwcm9jLCBUcnVuYywg
T3JpZ2luKCksCisgICAgICAgIHJvb3QtPmFwcGVuZE5ldzxBcmd1bWVudFJlZ1ZhbHVlPihwcm9j
LCBPcmlnaW4oKSwgR1BSSW5mbzo6YXJndW1lbnRHUFIwKSk7CisKKyAgICByb290LT5hcHBlbmRO
ZXc8VmFsdWU+KAorICAgICAgICBwcm9jLCBCcmFuY2gsIE9yaWdpbigpLCBhcmcpOworICAgIHJv
b3QtPmFwcGVuZFN1Y2Nlc3NvcihvbmUpOworICAgIHJvb3QtPmFwcGVuZFN1Y2Nlc3NvcihGcmVx
dWVudGVkQmxvY2soc2xvd1BhdGgsIEZyZXF1ZW5jeUNsYXNzOjpSYXJlKSk7CisgICAgCisgICAg
UGF0Y2hwb2ludFZhbHVlKiBwYXRjaHBvaW50ID0gb25lLT5hcHBlbmROZXc8UGF0Y2hwb2ludFZh
bHVlPihwcm9jLCBJbnQzMiwgT3JpZ2luKCkpOworICAgIHBhdGNocG9pbnQtPmVmZmVjdHMudGVy
bWluYWwgPSB0cnVlOworICAgIHBhdGNocG9pbnQtPmNsb2JiZXIoUmVnaXN0ZXJTZXQ6Om1hY3Jv
U2NyYXRjaFJlZ2lzdGVycygpKTsKKyAgICBwYXRjaHBvaW50LT5hcHBlbmQoYXJnLCBWYWx1ZVJl
cDo6U29tZVJlZ2lzdGVyKTsKKyAgICAKKyAgICBvbmUtPmFwcGVuZFN1Y2Nlc3NvcihzdWNjZXNz
KTsKKyAgICBvbmUtPmFwcGVuZFN1Y2Nlc3NvcihGcmVxdWVudGVkQmxvY2soc2xvd1BhdGgsIEZy
ZXF1ZW5jeUNsYXNzOjpSYXJlKSk7CisgICAgCisgICAgcGF0Y2hwb2ludC0+c2V0R2VuZXJhdG9y
KAorICAgICAgICBbJl0gKENDYWxsSGVscGVycyYgaml0LCBjb25zdCBTdGFja21hcEdlbmVyYXRp
b25QYXJhbXMmIHBhcmFtcykgeworICAgICAgICAgICAgQWxsb3dNYWNyb1NjcmF0Y2hSZWdpc3Rl
clVzYWdlIGFsbG93U2NyYXRjaChqaXQpOworICAgICAgICAgICAgaml0Lm1vdmUoQ0NhbGxIZWxw
ZXJzOjpUcnVzdGVkSW1tMzIoNjY2KSwgcGFyYW1zWzBdLmdwcigpKTsKKyAgICAgICAgICAgIGF1
dG8gZ29Ub0Zhc3RQYXRoID0gaml0LmJyYW5jaDMyKENDYWxsSGVscGVyczo6RXF1YWwsIHBhcmFt
c1sxXS5ncHIoKSwgQ0NhbGxIZWxwZXJzOjpUcnVzdGVkSW1tMzIoNDIpKTsKKyAgICAgICAgICAg
IGF1dG8ganVtcFRvU2xvdyA9IGppdC5qdW1wKCk7CisgICAgICAgICAgICAKKyAgICAgICAgICAg
IC8vIE1ha2Ugc3VyZSB0aGUgYXNzZXJ0cyBoZXJlIHBhc3MuCisgICAgICAgICAgICBwYXJhbXMu
ZmFsbHNUaHJvdWdoVG9TdWNjZXNzb3IoMCk7CisgICAgICAgICAgICBwYXJhbXMuZmFsbHNUaHJv
dWdoVG9TdWNjZXNzb3IoMSk7CisKKyAgICAgICAgICAgIFZlY3RvcjxCb3g8Q0NhbGxIZWxwZXJz
OjpMYWJlbD4+IGxhYmVscyA9IHBhcmFtcy5zdWNjZXNzb3JMYWJlbHMoKTsKKyAgICAgICAgICAg
IAorICAgICAgICAgICAgcGFyYW1zLmFkZExhdGVQYXRoKAorICAgICAgICAgICAgICAgIFs9XSAo
Q0NhbGxIZWxwZXJzJiBqaXQpIHsKKyAgICAgICAgICAgICAgICAgICAgZ29Ub0Zhc3RQYXRoLmxp
bmtUbygqbGFiZWxzWzBdLCAmaml0KTsKKyAgICAgICAgICAgICAgICAgICAganVtcFRvU2xvdy5s
aW5rVG8oKmxhYmVsc1sxXSwgJmppdCk7CisgICAgICAgICAgICAgICAgfSk7CisgICAgICAgIH0p
OworICAgIAorICAgIFZlY3RvcjxWYWx1ZSo+IGFyZ3M7CisgICAgeworICAgICAgICBSZWdpc3Rl
clNldCBmaWxsQWxsR1BSc1NldCA9IFJlZ2lzdGVyU2V0OjphbGxHUFJzKCk7CisgICAgICAgIGZp
bGxBbGxHUFJzU2V0LmV4Y2x1ZGUoUmVnaXN0ZXJTZXQ6OnN0YWNrUmVnaXN0ZXJzKCkpOworICAg
ICAgICBmaWxsQWxsR1BSc1NldC5leGNsdWRlKFJlZ2lzdGVyU2V0OjpyZXNlcnZlZEhhcmR3YXJl
UmVnaXN0ZXJzKCkpOworCisgICAgICAgIGZvciAodW5zaWduZWQgaSA9IDA7IGkgPCBmaWxsQWxs
R1BSc1NldC5udW1iZXJPZlNldFJlZ2lzdGVycygpOyBpKyspCisgICAgICAgICAgICBhcmdzLmFw
cGVuZChzdWNjZXNzLT5hcHBlbmROZXc8Q29uc3QzMlZhbHVlPihwcm9jLCBPcmlnaW4oKSwgaSkp
OworICAgIH0KKworICAgIHsKKyAgICAgICAgLy8gTm93IGZvcmNlIGFsbCB2YWx1ZXMgaW50byBl
dmVyeSBhdmFpbGFibGUgcmVnaXN0ZXIuCisgICAgICAgIFBhdGNocG9pbnRWYWx1ZSogcCA9IHN1
Y2Nlc3MtPmFwcGVuZE5ldzxQYXRjaHBvaW50VmFsdWU+KHByb2MsIFZvaWQsIE9yaWdpbigpKTsK
KyAgICAgICAgZm9yIChWYWx1ZSogdiA6IGFyZ3MpCisgICAgICAgICAgICBwLT5hcHBlbmQodiwg
VmFsdWVSZXA6OlNvbWVSZWdpc3Rlcik7CisgICAgICAgIHAtPnNldEdlbmVyYXRvcihbJl0gKEND
YWxsSGVscGVycyYsIGNvbnN0IFN0YWNrbWFwR2VuZXJhdGlvblBhcmFtcyYpIHsgfSk7CisgICAg
fQorCisgICAgeworICAgICAgICAvLyBOb3cgcmVxdWlyZSB0aGUgb3JpZ2luYWwgcGF0Y2hwb2lu
dCB0byBiZSBtYXRlcmlhbGl6ZWQgaW50byBhIHJlZ2lzdGVyLgorICAgICAgICBQYXRjaHBvaW50
VmFsdWUqIHAgPSBzdWNjZXNzLT5hcHBlbmROZXc8UGF0Y2hwb2ludFZhbHVlPihwcm9jLCBWb2lk
LCBPcmlnaW4oKSk7CisgICAgICAgIHAtPmFwcGVuZChwYXRjaHBvaW50LCBWYWx1ZVJlcDo6U29t
ZVJlZ2lzdGVyKTsKKyAgICAgICAgcC0+c2V0R2VuZXJhdG9yKFsmXSAoQ0NhbGxIZWxwZXJzJiwg
Y29uc3QgU3RhY2ttYXBHZW5lcmF0aW9uUGFyYW1zJikgeyB9KTsKKyAgICB9CisKKyAgICBzdWNj
ZXNzLT5hcHBlbmROZXc8VmFsdWU+KHByb2MsIFJldHVybiwgT3JpZ2luKCksIHBhdGNocG9pbnQp
OworICAgIAorICAgIHNsb3dQYXRoLT5hcHBlbmROZXc8VmFsdWU+KHByb2MsIFJldHVybiwgT3Jp
Z2luKCksIGFyZyk7CisgICAgCisgICAgYXV0byBvcmlnaW5hbDEgPSBPcHRpb25zOjptYXhCM1Rh
aWxEdXBCbG9ja1NpemUoKTsKKyAgICBhdXRvIG9yaWdpbmFsMiA9IE9wdGlvbnM6Om1heEIzVGFp
bER1cEJsb2NrU3VjY2Vzc29ycygpOworCisgICAgLy8gVGFpbCBkdXBsaWNhdGlvbiB3aWxsIGJy
ZWFrIHRoZSBjcml0aWNhbCBlZGdlIHdlJ3JlIHRyeWluZyB0byB0ZXN0IGJlY2F1c2UgaXQKKyAg
ICAvLyB3aWxsIGNsb25lIHRoZSBzbG93UGF0aCBibG9jayBmb3IgYm90aCBlZGdlcyB0byBpdCEK
KyAgICBPcHRpb25zOjptYXhCM1RhaWxEdXBCbG9ja1NpemUoKSA9IDA7CisgICAgT3B0aW9uczo6
bWF4QjNUYWlsRHVwQmxvY2tTdWNjZXNzb3JzKCkgPSAwOworCisgICAgYXV0byBjb2RlID0gY29t
cGlsZShwcm9jKTsKKyAgICBDSEVDS19FUShpbnZva2U8aW50PigqY29kZSwgMSksIDEpOworICAg
IENIRUNLX0VRKGludm9rZTxpbnQ+KCpjb2RlLCAwKSwgMCk7CisgICAgQ0hFQ0tfRVEoaW52b2tl
PGludD4oKmNvZGUsIDQyKSwgNjY2KTsKKworICAgIE9wdGlvbnM6Om1heEIzVGFpbER1cEJsb2Nr
U2l6ZSgpID0gb3JpZ2luYWwxOworICAgIE9wdGlvbnM6Om1heEIzVGFpbER1cEJsb2NrU3VjY2Vz
c29ycygpID0gb3JpZ2luYWwyOworfQorCiB2b2lkIHRlc3RQYXRjaHBvaW50VGVybWluYWxSZXR1
cm5WYWx1ZShib29sIHN1Y2Nlc3NJc1JhcmUpCiB7CiAgICAgLy8gVGhpcyBpcyBhIHVuaXQgdGVz
dCBmb3IgaG93IEZUTCdzIGhlYXAgYWxsb2NhdGlvbiBmYXN0IHBhdGhzIGJlaGF2ZS4KQEAgLTE0
MjYxLDYgKzE0NDIxLDEwIEBAIHZvaWQgcnVuKGNvbnN0IGNoYXIqIGZpbHRlcikKICAgICAgICAg
cmV0dXJuICFmaWx0ZXIgfHwgISFzdHJjYXNlc3RyKHRlc3ROYW1lLCBmaWx0ZXIpOwogICAgIH07
CiAKKyAgICAvLyBXZSBydW4gdGhpcyB0ZXN0IGZpcnN0IGJlY2F1c2UgaXQgZmlkZGxlcyB3aXRo
IHNvbWUKKyAgICAvLyBKU0Mgb3B0aW9ucy4KKyAgICB0ZXN0VGVybWluYWxQYXRjaHBvaW50VGhh
dE5lZWRzVG9CZVNwaWxsZWQyKCk7CisKICAgICBSVU4odGVzdDQyKCkpOwogICAgIFJVTih0ZXN0
TG9hZDQyKCkpOwogICAgIFJVTih0ZXN0TG9hZE9mZnNldEltbTlNYXgoKSk7CkBAIC0xNTY0Niw2
ICsxNTgxMCw3IEBAIHZvaWQgcnVuKGNvbnN0IGNoYXIqIGZpbHRlcikKICAgICBSVU4odGVzdFNv
bWVFYXJseVJlZ2lzdGVyKCkpOwogICAgIFJVTih0ZXN0UGF0Y2hwb2ludFRlcm1pbmFsUmV0dXJu
VmFsdWUodHJ1ZSkpOwogICAgIFJVTih0ZXN0UGF0Y2hwb2ludFRlcm1pbmFsUmV0dXJuVmFsdWUo
ZmFsc2UpKTsKKyAgICBSVU4odGVzdFRlcm1pbmFsUGF0Y2hwb2ludFRoYXROZWVkc1RvQmVTcGls
bGVkKCkpOwogCiAgICAgUlVOKHRlc3RNZW1vcnlGZW5jZSgpKTsKICAgICBSVU4odGVzdFN0b3Jl
RmVuY2UoKSk7CkluZGV4OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUvYjMvYWlyL0Fpckluc2VydGlv
blNldC5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL0phdmFTY3JpcHRDb3JlL2IzL2Fpci9BaXJJ
bnNlcnRpb25TZXQuY3BwCShyZXZpc2lvbiAyMTE2ODgpCisrKyBTb3VyY2UvSmF2YVNjcmlwdENv
cmUvYjMvYWlyL0Fpckluc2VydGlvblNldC5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTMzLDEyICsz
Myw2IEBACiAKIG5hbWVzcGFjZSBKU0MgeyBuYW1lc3BhY2UgQjMgeyBuYW1lc3BhY2UgQWlyIHsK
IAotdm9pZCBJbnNlcnRpb25TZXQ6Omluc2VydEluc3RzKHNpemVfdCBpbmRleCwgY29uc3QgVmVj
dG9yPEluc3Q+JiBpbnN0cykKLXsKLSAgICBmb3IgKGNvbnN0IEluc3QmIGluc3QgOiBpbnN0cykK
LSAgICAgICAgaW5zZXJ0SW5zdChpbmRleCwgaW5zdCk7Ci19Ci0KIHZvaWQgSW5zZXJ0aW9uU2V0
OjppbnNlcnRJbnN0cyhzaXplX3QgaW5kZXgsIFZlY3RvcjxJbnN0PiYmIGluc3RzKQogewogICAg
IGZvciAoSW5zdCYgaW5zdCA6IGluc3RzKQpJbmRleDogU291cmNlL0phdmFTY3JpcHRDb3JlL2Iz
L2Fpci9BaXJJbnNlcnRpb25TZXQuaAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvSmF2YVNjcmlwdENv
cmUvYjMvYWlyL0Fpckluc2VydGlvblNldC5oCShyZXZpc2lvbiAyMTE2ODgpCisrKyBTb3VyY2Uv
SmF2YVNjcmlwdENvcmUvYjMvYWlyL0Fpckluc2VydGlvblNldC5oCSh3b3JraW5nIGNvcHkpCkBA
IC0xLDUgKzEsNSBAQAogLyoKLSAqIENvcHlyaWdodCAoQykgMjAxNS0yMDE2IEFwcGxlIEluYy4g
QWxsIHJpZ2h0cyByZXNlcnZlZC4KKyAqIENvcHlyaWdodCAoQykgMjAxNS0yMDE3IEFwcGxlIElu
Yy4gQWxsIHJpZ2h0cyByZXNlcnZlZC4KICAqCiAgKiBSZWRpc3RyaWJ1dGlvbiBhbmQgdXNlIGlu
IHNvdXJjZSBhbmQgYmluYXJ5IGZvcm1zLCB3aXRoIG9yIHdpdGhvdXQKICAqIG1vZGlmaWNhdGlv
biwgYXJlIHBlcm1pdHRlZCBwcm92aWRlZCB0aGF0IHRoZSBmb2xsb3dpbmcgY29uZGl0aW9ucwpA
QCAtNTksNyArNTksMTIgQEAgcHVibGljOgogICAgICAgICBhcHBlbmRJbnNlcnRpb24oSW5zZXJ0
aW9uKGluZGV4LCBzdGQ6OmZvcndhcmQ8SW5zdD4oaW5zdCkpKTsKICAgICB9CiAKLSAgICB2b2lk
IGluc2VydEluc3RzKHNpemVfdCBpbmRleCwgY29uc3QgVmVjdG9yPEluc3Q+Jik7CisgICAgdGVt
cGxhdGUgPHR5cGVuYW1lIEluc3RWZWN0b3I+CisgICAgdm9pZCBpbnNlcnRJbnN0cyhzaXplX3Qg
aW5kZXgsIGNvbnN0IEluc3RWZWN0b3ImIGluc3RzKQorICAgIHsKKyAgICAgICAgZm9yIChjb25z
dCBJbnN0JiBpbnN0IDogaW5zdHMpCisgICAgICAgICAgICBpbnNlcnRJbnN0KGluZGV4LCBpbnN0
KTsKKyAgICB9CiAgICAgdm9pZCBpbnNlcnRJbnN0cyhzaXplX3QgaW5kZXgsIFZlY3RvcjxJbnN0
PiYmKTsKICAgICAKICAgICB0ZW1wbGF0ZTx0eXBlbmFtZS4uLiBBcmd1bWVudHM+CkluZGV4OiBT
b3VyY2UvSmF2YVNjcmlwdENvcmUvYjMvYWlyL0Fpckl0ZXJhdGVkUmVnaXN0ZXJDb2FsZXNjaW5n
LmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvSmF2YVNjcmlwdENvcmUvYjMvYWlyL0Fpckl0ZXJh
dGVkUmVnaXN0ZXJDb2FsZXNjaW5nLmNwcAkocmV2aXNpb24gMjExNjg4KQorKysgU291cmNlL0ph
dmFTY3JpcHRDb3JlL2IzL2Fpci9BaXJJdGVyYXRlZFJlZ2lzdGVyQ29hbGVzY2luZy5jcHAJKHdv
cmtpbmcgY29weSkKQEAgLTEsNSArMSw1IEBACiAvKgotICogQ29weXJpZ2h0IChDKSAyMDE1LTIw
MTYgQXBwbGUgSW5jLiBBbGwgcmlnaHRzIHJlc2VydmVkLgorICogQ29weXJpZ2h0IChDKSAyMDE1
LTIwMTcgQXBwbGUgSW5jLiBBbGwgcmlnaHRzIHJlc2VydmVkLgogICoKICAqIFJlZGlzdHJpYnV0
aW9uIGFuZCB1c2UgaW4gc291cmNlIGFuZCBiaW5hcnkgZm9ybXMsIHdpdGggb3Igd2l0aG91dAog
ICogbW9kaWZpY2F0aW9uLCBhcmUgcGVybWl0dGVkIHByb3ZpZGVkIHRoYXQgdGhlIGZvbGxvd2lu
ZyBjb25kaXRpb25zCkBAIC0xMjc0LDYgKzEyNzQsOCBAQCBwdWJsaWM6CiAgICAgICAgIGl0ZXJh
dGVkUmVnaXN0ZXJDb2FsZXNjaW5nT25UeXBlPEFyZzo6R1A+KCk7CiAgICAgICAgIGl0ZXJhdGVk
UmVnaXN0ZXJDb2FsZXNjaW5nT25UeXBlPEFyZzo6RlA+KCk7CiAKKyAgICAgICAgZml4U3BpbGxz
QWZ0ZXJUZXJtaW5hbHMoKTsKKwogICAgICAgICBpZiAocmVwb3J0U3RhdHMpCiAgICAgICAgICAg
ICBkYXRhTG9nKCJOdW0gaXRlcmF0aW9ucyA9ICIsIG1fbnVtSXRlcmF0aW9ucywgIlxuIik7CiAg
ICAgfQpAQCAtMTU3Myw2ICsxNTc1LDY2IEBAIHByaXZhdGU6CiAgICAgICAgIH0KICAgICB9CiAK
KyAgICB2b2lkIGZpeFNwaWxsc0FmdGVyVGVybWluYWxzKCkKKyAgICB7CisgICAgICAgIC8vIEJl
Y2F1c2UgdGhlcmUgbWF5IGJlIHRlcm1pbmFscyB0aGF0IHByb2R1Y2UgdmFsdWVzLCBJUkMgbWF5
CisgICAgICAgIC8vIHdhbnQgdG8gc3BpbGwgdGhvc2UgdGVybWluYWxzLiBJdCdsbCBoYXBwZW4g
dG8gc3BpbGwgaXQgYWZ0ZXIKKyAgICAgICAgLy8gdGhlIHRlcm1pbmFsLiBJZiB3ZSBsZWZ0IGdy
YXBoIGluIHRoaXMgc3RhdGUsIGl0J2QgYmUgaW52YWxpZAorICAgICAgICAvLyBiZWNhdXNlIGEg
dGVybWluYWwgbXVzdCBiZSB0aGUgbGFzdCBpbnN0cnVjdGlvbiBpbiBhIGJsb2NrLgorICAgICAg
ICAvLyBXZSBmaXggdGhhdCBoZXJlLgorCisgICAgICAgIEluc2VydGlvblNldCBpbnNlcnRpb25T
ZXQobV9jb2RlKTsKKworICAgICAgICBib29sIGFkZGVkQmxvY2tzID0gZmFsc2U7CisKKyAgICAg
ICAgZm9yIChCYXNpY0Jsb2NrKiBibG9jayA6IG1fY29kZSkgeworICAgICAgICAgICAgdW5zaWdu
ZWQgdGVybWluYWxJbmRleCA9IGJsb2NrLT5zaXplKCk7CisgICAgICAgICAgICBib29sIGZvdW5k
VGVybWluYWwgPSBmYWxzZTsKKyAgICAgICAgICAgIHdoaWxlICh0ZXJtaW5hbEluZGV4LS0pIHsK
KyAgICAgICAgICAgICAgICBpZiAoYmxvY2stPmF0KHRlcm1pbmFsSW5kZXgpLmlzVGVybWluYWwo
KSkgeworICAgICAgICAgICAgICAgICAgICBmb3VuZFRlcm1pbmFsID0gdHJ1ZTsKKyAgICAgICAg
ICAgICAgICAgICAgYnJlYWs7CisgICAgICAgICAgICAgICAgfQorICAgICAgICAgICAgfQorICAg
ICAgICAgICAgQVNTRVJUKGZvdW5kVGVybWluYWwpOworCisgICAgICAgICAgICBpZiAodGVybWlu
YWxJbmRleCA9PSBibG9jay0+c2l6ZSgpIC0gMSkKKyAgICAgICAgICAgICAgICBjb250aW51ZTsK
KworICAgICAgICAgICAgLy8gVGhlcmUgbXVzdCBiZSBpbnN0cnVjdGlvbnMgYWZ0ZXIgdGhlIHRl
cm1pbmFsIGJlY2F1c2UgaXQncyBub3QgdGhlIGxhc3QgaW5zdHJ1Y3Rpb24uCisgICAgICAgICAg
ICBBU1NFUlQodGVybWluYWxJbmRleCA8IGJsb2NrLT5zaXplKCkgLSAxKTsKKyAgICAgICAgICAg
IFZlY3RvcjxJbnN0LCAxPiBpbnN0c1RvTW92ZTsKKyAgICAgICAgICAgIGZvciAodW5zaWduZWQg
aSA9IHRlcm1pbmFsSW5kZXggKyAxOyBpIDwgYmxvY2stPnNpemUoKTsgaSsrKQorICAgICAgICAg
ICAgICAgIGluc3RzVG9Nb3ZlLmFwcGVuZChibG9jay0+YXQoaSkpOworICAgICAgICAgICAgUkVM
RUFTRV9BU1NFUlQoaW5zdHNUb01vdmUuc2l6ZSgpKTsKKworICAgICAgICAgICAgZm9yIChGcmVx
dWVudGVkQmxvY2smIGZyZXF1ZW50ZWRTdWNjZXNzb3IgOiBibG9jay0+c3VjY2Vzc29ycygpKSB7
CisgICAgICAgICAgICAgICAgQmFzaWNCbG9jayogc3VjY2Vzc29yID0gZnJlcXVlbnRlZFN1Y2Nl
c3Nvci5ibG9jaygpOworICAgICAgICAgICAgICAgIC8vIElmIHN1Y2Nlc3NvcidzIG9ubHkgcHJl
ZGVjZXNzb3IgaXMgYmxvY2ssIHdlIGNhbiBwbGFudCB0aGUgc3BpbGwgaW5zaWRlCisgICAgICAg
ICAgICAgICAgLy8gdGhlIHN1Y2Nlc3Nvci4gT3RoZXJ3aXNlLCB3ZSBtdXN0IHNwbGl0IHRoZSBj
cml0aWNhbCBlZGdlIGFuZCBjcmVhdGUKKyAgICAgICAgICAgICAgICAvLyBhIG5ldyBibG9jayBm
b3IgdGhlIHNwaWxsLgorICAgICAgICAgICAgICAgIGlmIChzdWNjZXNzb3ItPm51bVByZWRlY2Vz
c29ycygpID09IDEpIHsKKyAgICAgICAgICAgICAgICAgICAgaW5zZXJ0aW9uU2V0Lmluc2VydElu
c3RzKDAsIGluc3RzVG9Nb3ZlKTsKKyAgICAgICAgICAgICAgICAgICAgaW5zZXJ0aW9uU2V0LmV4
ZWN1dGUoc3VjY2Vzc29yKTsKKyAgICAgICAgICAgICAgICB9IGVsc2UgeworICAgICAgICAgICAg
ICAgICAgICBhZGRlZEJsb2NrcyA9IHRydWU7CisgICAgICAgICAgICAgICAgICAgIC8vIEZJWE1F
OiBXZSBwcm9iYWJseSB3YW50IGJldHRlciBibG9jayBvcmRlcmluZyBoZXJlLgorICAgICAgICAg
ICAgICAgICAgICBCYXNpY0Jsb2NrKiBuZXdCbG9jayA9IG1fY29kZS5hZGRCbG9jaygpOworICAg
ICAgICAgICAgICAgICAgICBmb3IgKGNvbnN0IEluc3QmIGluc3QgOiBpbnN0c1RvTW92ZSkKKyAg
ICAgICAgICAgICAgICAgICAgICAgIG5ld0Jsb2NrLT5hcHBlbmRJbnN0KGluc3QpOworICAgICAg
ICAgICAgICAgICAgICBuZXdCbG9jay0+YXBwZW5kSW5zdChJbnN0KEp1bXAsIGluc3RzVG9Nb3Zl
Lmxhc3QoKS5vcmlnaW4pKTsKKyAgICAgICAgICAgICAgICAgICAgbmV3QmxvY2stPnN1Y2Nlc3Nv
cnMoKS5hcHBlbmQoc3VjY2Vzc29yKTsKKyAgICAgICAgICAgICAgICAgICAgZnJlcXVlbnRlZFN1
Y2Nlc3Nvci5ibG9jaygpID0gbmV3QmxvY2s7CisgICAgICAgICAgICAgICAgfQorICAgICAgICAg
ICAgfQorCisgICAgICAgICAgICBibG9jay0+cmVzaXplKHRlcm1pbmFsSW5kZXggKyAxKTsKKyAg
ICAgICAgfQorCisgICAgICAgIGlmIChhZGRlZEJsb2NrcykKKyAgICAgICAgICAgIG1fY29kZS5y
ZXNldFJlYWNoYWJpbGl0eSgpOworICAgIH0KKwogICAgIENvZGUmIG1fY29kZTsKICAgICBUbXBX
aWR0aCBtX3RtcFdpZHRoOwogICAgIFVzZUNvdW50czxUbXA+IG1fdXNlQ291bnRzOwo=
</data>
<flag name="review"
          id="322651"
          type_id="1"
          status="+"
          setter="fpizlo"
    />
          </attachment>
      

    </bug>

</bugzilla>