172552 2017-05-24 12:17:39 -0700 REGRESSION (r206481): Don't assume frameCount() is larger than or equal to the size of the image frame cache 2017-07-24 10:54:17 -0700 1 1 1 Unclassified WebKit Images WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED https://bugs.webkit.org/show_bug.cgi?id=172556 InRadar P2 Normal --- 1 sabouhallawa sabouhallawa andersca benjamin buildbot cdumez cmarcelo commit-queue dbates ggaren jer.noble simon.fraser thorton webkit-bug-importer oldest_to_newest 1312353 0 sabouhallawa 2017-05-24 12:17:39 -0700 Before <http://trac.webkit.org/changeset/206481>, BitmapImage::cacheFrame() had the following statement: if (m_frames.size() < numFrames) m_frames.grow(numFrames) Since this change was landed, ImageFrameCache::growFrames() has the following code: ASSERT(m_frames.size() <= frameCount()); m_frames.grow(frameCount()); The assumption was ImageDecoder may change the value of the frameCount() when it receives more data but for sure the value of the new frameCount() is larger than the previous value. And since in ImageFrameCache::growFrames() we want to match m_frames.size() with the current frameCount(), m_frames.size() should be equal to the previous or the current frameCount() which should be equal to or less than the current frameCount(). This means m_frames.size() should be less than or equal to frameCount() always. And this why I replaced the if-satament with just an assertion. But this assumption does not consider the case when the image is cached and its encoded data is released. In this case, the encoded data will be read incrementally and the current m_frames.size() will be larger than the initial frameCount(). Aside form the assertion will fire in debug build, this would not be a problem if Vector::grow() handles this case safely but it does not. Vector::grow() asserts ASSERT(size >= m_size) but it does not return if (size < m_size). The real problem happens because of this statement in Vector::grow() if (begin()) TypeOperations::initialize(end(), begin() + size); If size < m_size => begin() + size < begin() + m_size => begin() + size() < end(). So we are sending two pointers to TypeOperations::initialize(), the first is larger than the second. In the case of ImageFrame, this will be VectorInitializer to be called: template<typename T> struct VectorInitializer<true, false, T> { static void initialize(T* begin, T* end) { for (T* cur = begin; cur != end; ++cur) new (NotNull, cur) T; } }; if begin > end, the for loop above will never terminates and will crash because of memory access violation and get a crash like this: 0 com.apple.WebCore 0x00007fffc0688481 WebCore::ImageFrame::ImageFrame() + 17 1 com.apple.WebCore 0x00007fffc0689038 WebCore::ImageFrameCache::growFrames() + 152 2 com.apple.WebCore 0x00007fffc068f71b WebCore::ImageSource::dataChanged(WebCore::SharedBuffer*, bool) + 91 3 com.apple.WebCore 0x00007fffc0224095 WebCore::CachedImage::setImageDataBuffer(WebCore::SharedBuffer*, bool) + 53 4 com.apple.WebCore 0x00007fffc0223f8f WebCore::CachedImage::addIncrementalDataBuffer(WebCore::SharedBuffer&) + 63 5 com.apple.WebCore 0x00007fffc0224132 WebCore::CachedImage::addDataBuffer(WebCore::SharedBuffer&) + 18 6 com.apple.WebCore 0x00007fffc0fd1ef7 WebCore::SubresourceLoader::didReceiveDataOrBuffer(char const*, int, WTF::RefPtr<WebCore::SharedBuffer>&&, long long, WebCore::DataPayloadType) + 183 7 com.apple.WebCore 0x00007fffc0fd1f8a WebCore::SubresourceLoader::didReceiveBuffer(WTF::Ref<WebCore::SharedBuffer>&&, long long, WebCore::DataPayloadType) + 42 1312358 1 311144 sabouhallawa 2017-05-24 12:34:41 -0700 Created attachment 311144 Patch 1312359 2 sabouhallawa 2017-05-24 12:35:46 -0700 <rdar://problem/32296566> 1312381 3 jer.noble 2017-05-24 13:34:16 -0700 (In reply to Said Abou-Hallawa from comment #2) > <rdar://problem/32296566> I talked about this patch with Geoff, who said that the purpose of grow() and shrink() was that they were an optimization if you knew the size was increasing (or decreasing, respectively). So I think you should back out the change to Vector.h and leave in the change to ImageFrameCache.cpp. 1312382 4 311144 ggaren 2017-05-24 13:35:06 -0700 Comment on attachment 311144 Patch The purpose of shrink() and grow() is to optimize the case when you know that you're shrinking or growing, by avoiding a check. Clients that don't know what kind of size change they're making can call resize(). 1312399 5 sabouhallawa 2017-05-24 14:41:16 -0700 (In reply to Geoffrey Garen from comment #4) > Comment on attachment 311144 [details] > Patch > > The purpose of shrink() and grow() is to optimize the case when you know > that you're shrinking or growing, by avoiding a check. > > Clients that don't know what kind of size change they're making can call > resize(). I disagree with leaving the vector code as it. The image frame caching used this optimization because I assumed the size of the vector would be always increasing. The problem is my assumption itself was worng and this optimization in the grow() function did not try to help in any way asserting the problem. The code just goes in infinite loop and causes memory access violation. But since you dislike changing grow() and shrink() function, how about changing the loops in VectorInitializer::initialize() and VectorDestructor::destruct() to be like this: for (T* cur = begin; cur < end; ++cur) instead of for (T* cur = begin; cur != end; ++cur) I am not sure why these function use cur != end instead of cur < end. Is it another optimization? Is != is faster than <? Another suggestion is to replace the ASSERT() in grow() and shrink with RELEASE_ASSERT(). The reason for me making these suggestions is I spent long time trying to figure out the reason of this crash from looking at the crash trace and I could not figure it out. I could figure it out only when Jer could reproduce the bug and debug it and knew that the crash is happening because the new size is less than the current size. I just don't want someone else to waste his time because of this silent optimization. 1312400 6 311156 sabouhallawa 2017-05-24 14:41:34 -0700 Created attachment 311156 Patch 1312415 7 311156 sabouhallawa 2017-05-24 15:04:12 -0700 Comment on attachment 311156 Patch I filed https://bugs.webkit.org/show_bug.cgi?id=172556 to address the WFT::Vector problem. Here I will address the ImageFrameCache problem only. 1312423 8 311162 sabouhallawa 2017-05-24 15:46:46 -0700 Created attachment 311162 Patch 1312425 9 311162 ggaren 2017-05-24 15:50:57 -0700 Comment on attachment 311162 Patch r=me 1312428 10 ggaren 2017-05-24 15:58:38 -0700 > But since you dislike changing grow() and shrink() function, how about > changing the loops in VectorInitializer::initialize() and > VectorDestructor::destruct() to be like this: > > for (T* cur = begin; cur < end; ++cur) > > instead of > > for (T* cur = begin; cur != end; ++cur) I don't think we should build support for invalid pointers into our low level data structures. That way madness lies. 1312438 11 311162 commit-queue 2017-05-24 16:13:54 -0700 Comment on attachment 311162 Patch Clearing flags on attachment: 311162 Committed r217392: <http://trac.webkit.org/changeset/217392> 1312439 12 commit-queue 2017-05-24 16:13:56 -0700 All reviewed patches have been landed. Closing bug. 1331670 13 sabouhallawa 2017-07-24 10:54:17 -0700 *** Bug 168396 has been marked as a duplicate of this bug. *** 311144 2017-05-24 12:34:41 -0700 2017-05-24 14:41:32 -0700 Patch bug-172552-20170524123441.patch text/plain 4037 sabouhallawa U3VidmVyc2lvbiBSZXZpc2lvbjogMjE3MzcyCmRpZmYgLS1naXQgYS9Tb3VyY2UvV1RGL0NoYW5n ZUxvZyBiL1NvdXJjZS9XVEYvQ2hhbmdlTG9nCmluZGV4IGEwOTYwNGM3YWFkMDIxYTc3Zjg0N2Mw NDQ3MjVlYzZkZGRlNjg0MzcuLmQwZTBmMDEzMDBmZTU1N2FlNWY4ZWEwNmNhMjA0MGEyMDg3ZmM5 ZjkgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XVEYvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9XVEYvQ2hh bmdlTG9nCkBAIC0xLDMgKzEsMjEgQEAKKzIwMTctMDUtMjQgIFNhaWQgQWJvdS1IYWxsYXdhICA8 c2Fib3VoYWxsYXdhQGFwcGxlLmNvbT4KKworICAgICAgICBSRUdSRVNTSU9OIChyMjA2NDgxKTog RG9uJ3QgYXNzdW1lIGZyYW1lQ291bnQoKSBpcyBsYXJnZXIgdGhhbiBvciBlcXVhbCB0byB0aGUg c2l6ZSBvZiB0aGUgaW1hZ2UgZnJhbWUgY2FjaGUKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtp dC5vcmcvc2hvd19idWcuY2dpP2lkPTE3MjU1MgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9E WSAoT09QUyEpLgorCisgICAgICAgIEF2b2lkIGluZmluaXRlIGxvb3AgYW5kIG1lbW9yeSBhY2Nl c3MgdmlvbGF0aW9uIGlmIFZlY3Rvcjo6Z3JvdygpIGlzCisgICAgICAgIGNhbGxlZCB3aXRoIGEg c2l6ZSBsZXNzIHRoYW4gdGhlIGN1cnJlbnQgc2l6ZS4gU2ltaWxhciBwcm9ibGVtcyB3aWxsIG9j Y3VyCisgICAgICAgIGlmIFZlY3Rvcjo6c2hyaW5rKCkgaXMgY2FsbGVkIHdpdGggYSBzaXplIGxh cmdlciB0aGFuIHRoZSBjdXJyZW50IHNpemUuCisKKyAgICAgICAgVmVjdG9ySW5pdGlhbGl6ZXI6 OmluaXRpYWxpemUoKSBhbmQgVmVjdG9yRGVzdHJ1Y3Rvcjo6ZGVzdHJ1Y3QoKSB3aWxsCisgICAg ICAgIGxvb3AgaW5kZWZpbml0ZWx5IGlmIHRoZSAnYmVnaW4nIHBvaW50ZXIgaXMgbGFyZ2VyIHRo YW4gdGhlICdlbmQnIHBvaW50ZXIuICAgCisKKyAgICAgICAgKiB3dGYvVmVjdG9yLmg6CisgICAg ICAgIChXVEY6Om1pbkNhcGFjaXR5Pjo6c2hyaW5rKToKKyAgICAgICAgKFdURjo6bWluQ2FwYWNp dHk+Ojpncm93KToKKwogMjAxNy0wNS0yMiAgSmlld2VuIFRhbiAgPGppZXdlbl90YW5AYXBwbGUu Y29tPgogCiAgICAgICAgIFtXZWJDcnlwdG9dIFN1cHBvcnQgUlNBLVBTUwpkaWZmIC0tZ2l0IGEv U291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nIGIvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCmluZGV4 IDFkZjM0OTVlOGJjNmI2MGI2Mjc5MGMzMGNmYWFiN2VjYWY0ZTA0MzEuLjdkZTFmMDY3MDc3MDZm NTc0NmRkZDhjMDA1MmEzY2JlY2E5ZTA3ZDQgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL0No YW5nZUxvZworKysgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKQEAgLTEsMyArMSwyMiBAQAor MjAxNy0wNS0yNCAgU2FpZCBBYm91LUhhbGxhd2EgIDxzYWJvdWhhbGxhd2FAYXBwbGUuY29tPgor CisgICAgICAgIFJFR1JFU1NJT04gKHIyMDY0ODEpOiBEb24ndCBhc3N1bWUgZnJhbWVDb3VudCgp IGlzIGxhcmdlciB0aGFuIG9yIGVxdWFsIHRvIHRoZSBzaXplIG9mIHRoZSBpbWFnZSBmcmFtZSBj YWNoZQorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTcy NTUyCisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgSWYg YW4gaW1hZ2Ugd2l0aCBtYW55IGNhY2hlZCBJbWFnZUZyYW1lcyBpcyBjYWNoZWQgYnV0IGl0cyBl bmNvZGVkIGRhdGEgaXMKKyAgICAgICAgZnJlZWQsIHRoZW4gdGhlIHNhbWUgaW1hZ2UgaXMgcmV1 c2VkLCB0aGUgZW5jb2RlZCBkYXRhIHdpbGwgYmUgZmV0Y2hlZC4KKyAgICAgICAgQnV0IHRoZSBp bml0aWFsIGZyYW1lQ291bnQoKSBtaWdodCBiZSBsZXNzIHRoYW4gdGhlIGN1cnJlbnQgbnVtYmVy IG9mIHRoZQorICAgICAgICBjYWNoZWQgSW1hZ2VGcmFtZXMuCisKKyAgICAgICAgVGhpcyB3YXMg Y2F1c2luZyBhbiBhc3NlcnRpb24gaW4gdGhlIGRlYnVnIGJ1aWxkIGFuZCBjcmFzaCBpbiB0aGUg cmVsZWFzZQorICAgICAgICBidWlsZC4gVmVjdG9yOjpncm93KCkgZG9lcyBub3QgaGFuZGxlIHRo ZSBjYXNlIHdoZXJlIHRoZSBuZXcgc2l6ZSBpcyBzbWFsbGVyCisgICAgICAgIHRoYW4gdGhlIGN1 cnJlbnQgc2l6ZSBzYWZlbHkuCisKKyAgICAgICAgKiBwbGF0Zm9ybS9ncmFwaGljcy9JbWFnZUZy YW1lQ2FjaGUuY3BwOgorICAgICAgICAoV2ViQ29yZTo6SW1hZ2VGcmFtZUNhY2hlOjpncm93RnJh bWVzKToKKwogMjAxNy0wNS0yNCAgSm9obiBXaWxhbmRlciAgPHdpbGFuZGVyQGFwcGxlLmNvbT4K IAogICAgICAgICBSZXNvdXJjZSBMb2FkIFN0YXRpc3RpY3M6IENoYW5nZSBncmFuZGZhdGhlcmlu ZyBkZWZhdWx0IHRvIG9uZSBob3VyCmRpZmYgLS1naXQgYS9Tb3VyY2UvV1RGL3d0Zi9WZWN0b3Iu aCBiL1NvdXJjZS9XVEYvd3RmL1ZlY3Rvci5oCmluZGV4IGY4ZDQ3Zjk5NThmNjg5ZmEzMDNlOGM0 ZTEzMzI1NzA0Yjk3NWEyMjcuLmE2Y2EwMjU5YjcxMjYzNzAyMjcxY2MxOGNkMjYzOGI5ZGQxY2Y5 ZTYgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XVEYvd3RmL1ZlY3Rvci5oCisrKyBiL1NvdXJjZS9XVEYv d3RmL1ZlY3Rvci5oCkBAIC0xMDQ1LDYgKzEwNDUsOCBAQCB0ZW1wbGF0ZTx0eXBlbmFtZSBULCBz aXplX3QgaW5saW5lQ2FwYWNpdHksIHR5cGVuYW1lIE92ZXJmbG93SGFuZGxlciwgc2l6ZV90IG1p bgogdm9pZCBWZWN0b3I8VCwgaW5saW5lQ2FwYWNpdHksIE92ZXJmbG93SGFuZGxlciwgbWluQ2Fw YWNpdHk+OjpzaHJpbmsoc2l6ZV90IHNpemUpCiB7CiAgICAgQVNTRVJUKHNpemUgPD0gbV9zaXpl KTsKKyAgICBpZiAoc2l6ZSA+IG1fc2l6ZSkKKyAgICAgICAgcmV0dXJuOwogICAgIFR5cGVPcGVy YXRpb25zOjpkZXN0cnVjdChiZWdpbigpICsgc2l6ZSwgZW5kKCkpOwogICAgIGFzYW5CdWZmZXJT aXplV2lsbENoYW5nZVRvKHNpemUpOwogICAgIG1fc2l6ZSA9IHNpemU7CkBAIC0xMDU0LDYgKzEw NTYsOCBAQCB0ZW1wbGF0ZTx0eXBlbmFtZSBULCBzaXplX3QgaW5saW5lQ2FwYWNpdHksIHR5cGVu YW1lIE92ZXJmbG93SGFuZGxlciwgc2l6ZV90IG1pbgogdm9pZCBWZWN0b3I8VCwgaW5saW5lQ2Fw YWNpdHksIE92ZXJmbG93SGFuZGxlciwgbWluQ2FwYWNpdHk+Ojpncm93KHNpemVfdCBzaXplKQog ewogICAgIEFTU0VSVChzaXplID49IG1fc2l6ZSk7CisgICAgaWYgKHNpemUgPCBtX3NpemUpCisg ICAgICAgIHJldHVybjsKICAgICBpZiAoc2l6ZSA+IGNhcGFjaXR5KCkpCiAgICAgICAgIGV4cGFu ZENhcGFjaXR5KHNpemUpOwogICAgIGFzYW5CdWZmZXJTaXplV2lsbENoYW5nZVRvKHNpemUpOwpk aWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvcGxhdGZvcm0vZ3JhcGhpY3MvSW1hZ2VGcmFtZUNh Y2hlLmNwcCBiL1NvdXJjZS9XZWJDb3JlL3BsYXRmb3JtL2dyYXBoaWNzL0ltYWdlRnJhbWVDYWNo ZS5jcHAKaW5kZXggZGQ0OTQwZjk4ZTFkMTM0OGM4ODk4MjBiOWVlMTc1YjkyMWZhM2EyOS4uMWQy NzcyYzQyZTU3MDA0M2JjMjFmMDNiYmM1NjYyNmFlOWZjYmMwNSAxMDA2NDQKLS0tIGEvU291cmNl L1dlYkNvcmUvcGxhdGZvcm0vZ3JhcGhpY3MvSW1hZ2VGcmFtZUNhY2hlLmNwcAorKysgYi9Tb3Vy Y2UvV2ViQ29yZS9wbGF0Zm9ybS9ncmFwaGljcy9JbWFnZUZyYW1lQ2FjaGUuY3BwCkBAIC0xNzYs OCArMTc2LDggQEAgdm9pZCBJbWFnZUZyYW1lQ2FjaGU6OmRpZERlY29kZVByb3BlcnRpZXModW5z aWduZWQgZGVjb2RlZFByb3BlcnRpZXNTaXplKQogdm9pZCBJbWFnZUZyYW1lQ2FjaGU6Omdyb3dG cmFtZXMoKQogewogICAgIEFTU0VSVChpc1NpemVBdmFpbGFibGUoKSk7Ci0gICAgQVNTRVJUKG1f ZnJhbWVzLnNpemUoKSA8PSBmcmFtZUNvdW50KCkpOwotICAgIG1fZnJhbWVzLmdyb3coZnJhbWVD b3VudCgpKTsKKyAgICBpZiAoZnJhbWVDb3VudCgpID4gbV9mcmFtZXMuc2l6ZSgpKQorICAgICAg ICBtX2ZyYW1lcy5ncm93KGZyYW1lQ291bnQoKSk7CiB9CiAKIHZvaWQgSW1hZ2VGcmFtZUNhY2hl OjpzZXROYXRpdmVJbWFnZShOYXRpdmVJbWFnZVB0ciYmIG5hdGl2ZUltYWdlKQo= 311156 2017-05-24 14:41:34 -0700 2017-05-24 15:46:45 -0700 Patch bug-172552-20170524144133.patch text/plain 3712 sabouhallawa U3VidmVyc2lvbiBSZXZpc2lvbjogMjE3MzcyCmRpZmYgLS1naXQgYS9Tb3VyY2UvV1RGL0NoYW5n ZUxvZyBiL1NvdXJjZS9XVEYvQ2hhbmdlTG9nCmluZGV4IGEwOTYwNGM3YWFkMDIxYTc3Zjg0N2Mw NDQ3MjVlYzZkZGRlNjg0MzcuLjhjOTI1MmMwNTk5OGYyYjc5ZjNiYzYxNWUyYTVjZTg3OTQzNWEy YWMgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XVEYvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9XVEYvQ2hh bmdlTG9nCkBAIC0xLDMgKzEsMTkgQEAKKzIwMTctMDUtMjQgIFNhaWQgQWJvdS1IYWxsYXdhICA8 c2Fib3VoYWxsYXdhQGFwcGxlLmNvbT4KKworICAgICAgICBSRUdSRVNTSU9OIChyMjA2NDgxKTog RG9uJ3QgYXNzdW1lIGZyYW1lQ291bnQoKSBpcyBsYXJnZXIgdGhhbiBvciBlcXVhbCB0byB0aGUg c2l6ZSBvZiB0aGUgaW1hZ2UgZnJhbWUgY2FjaGUKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtp dC5vcmcvc2hvd19idWcuY2dpP2lkPTE3MjU1MgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9E WSAoT09QUyEpLgorCisgICAgICAgIEF2b2lkIGluZmluaXRlIGxvb3AgYW5kIG1lbW9yeSBhY2Nl c3MgdmlvbGF0aW9uIGlmIFZlY3Rvcjo6Z3JvdygpIGlzCisgICAgICAgIGNhbGxlZCB3aXRoIGEg c2l6ZSBsZXNzIHRoYW4gdGhlIGN1cnJlbnQgc2l6ZS4gU2ltaWxhciBwcm9ibGVtcyB3aWxsIG9j Y3VyCisgICAgICAgIGlmIFZlY3Rvcjo6c2hyaW5rKCkgaXMgY2FsbGVkIHdpdGggYSBzaXplIGxh cmdlciB0aGFuIHRoZSBjdXJyZW50IHNpemUuCisKKyAgICAgICAgVmVjdG9ySW5pdGlhbGl6ZXI6 OmluaXRpYWxpemUoKSBhbmQgVmVjdG9yRGVzdHJ1Y3Rvcjo6ZGVzdHJ1Y3QoKSBzaG91bGQKKyAg ICAgICAgY2hlY2sgd2hldGhlciB0aGUgY3VyIHBvaW50ZXIgaXMgbGVzcyB0aGUgZW5kIHBvaW50 ZXIuCisKKyAgICAgICAgKiB3dGYvVmVjdG9yLmg6CisKIDIwMTctMDUtMjIgIEppZXdlbiBUYW4g IDxqaWV3ZW5fdGFuQGFwcGxlLmNvbT4KIAogICAgICAgICBbV2ViQ3J5cHRvXSBTdXBwb3J0IFJT QS1QU1MKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZyBiL1NvdXJjZS9XZWJD b3JlL0NoYW5nZUxvZwppbmRleCAxZGYzNDk1ZThiYzZiNjBiNjI3OTBjMzBjZmFhYjdlY2FmNGUw NDMxLi43ZGUxZjA2NzA3NzA2ZjU3NDZkZGQ4YzAwNTJhM2NiZWNhOWUwN2Q0IDEwMDY0NAotLS0g YS9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKKysrIGIvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9n CkBAIC0xLDMgKzEsMjIgQEAKKzIwMTctMDUtMjQgIFNhaWQgQWJvdS1IYWxsYXdhICA8c2Fib3Vo YWxsYXdhQGFwcGxlLmNvbT4KKworICAgICAgICBSRUdSRVNTSU9OIChyMjA2NDgxKTogRG9uJ3Qg YXNzdW1lIGZyYW1lQ291bnQoKSBpcyBsYXJnZXIgdGhhbiBvciBlcXVhbCB0byB0aGUgc2l6ZSBv ZiB0aGUgaW1hZ2UgZnJhbWUgY2FjaGUKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcv c2hvd19idWcuY2dpP2lkPTE3MjU1MgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09Q UyEpLgorCisgICAgICAgIElmIGFuIGltYWdlIHdpdGggbWFueSBjYWNoZWQgSW1hZ2VGcmFtZXMg aXMgY2FjaGVkIGJ1dCBpdHMgZW5jb2RlZCBkYXRhIGlzCisgICAgICAgIGZyZWVkLCB0aGVuIHRo ZSBzYW1lIGltYWdlIGlzIHJldXNlZCwgdGhlIGVuY29kZWQgZGF0YSB3aWxsIGJlIGZldGNoZWQu CisgICAgICAgIEJ1dCB0aGUgaW5pdGlhbCBmcmFtZUNvdW50KCkgbWlnaHQgYmUgbGVzcyB0aGFu IHRoZSBjdXJyZW50IG51bWJlciBvZiB0aGUKKyAgICAgICAgY2FjaGVkIEltYWdlRnJhbWVzLgor CisgICAgICAgIFRoaXMgd2FzIGNhdXNpbmcgYW4gYXNzZXJ0aW9uIGluIHRoZSBkZWJ1ZyBidWls ZCBhbmQgY3Jhc2ggaW4gdGhlIHJlbGVhc2UKKyAgICAgICAgYnVpbGQuIFZlY3Rvcjo6Z3Jvdygp IGRvZXMgbm90IGhhbmRsZSB0aGUgY2FzZSB3aGVyZSB0aGUgbmV3IHNpemUgaXMgc21hbGxlcgor ICAgICAgICB0aGFuIHRoZSBjdXJyZW50IHNpemUgc2FmZWx5LgorCisgICAgICAgICogcGxhdGZv cm0vZ3JhcGhpY3MvSW1hZ2VGcmFtZUNhY2hlLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OkltYWdl RnJhbWVDYWNoZTo6Z3Jvd0ZyYW1lcyk6CisKIDIwMTctMDUtMjQgIEpvaG4gV2lsYW5kZXIgIDx3 aWxhbmRlckBhcHBsZS5jb20+CiAKICAgICAgICAgUmVzb3VyY2UgTG9hZCBTdGF0aXN0aWNzOiBD aGFuZ2UgZ3JhbmRmYXRoZXJpbmcgZGVmYXVsdCB0byBvbmUgaG91cgpkaWZmIC0tZ2l0IGEvU291 cmNlL1dURi93dGYvVmVjdG9yLmggYi9Tb3VyY2UvV1RGL3d0Zi9WZWN0b3IuaAppbmRleCBmOGQ0 N2Y5OTU4ZjY4OWZhMzAzZThjNGUxMzMyNTcwNGI5NzVhMjI3Li4yZmQ3ZDM1MjgxMTQ1M2EwODg5 MDNlM2FmOTY5M2ExYjQ2YTRhYmJjIDEwMDY0NAotLS0gYS9Tb3VyY2UvV1RGL3d0Zi9WZWN0b3Iu aAorKysgYi9Tb3VyY2UvV1RGL3d0Zi9WZWN0b3IuaApAQCAtNTUsNyArNTUsNyBAQCBzdHJ1Y3Qg VmVjdG9yRGVzdHJ1Y3Rvcjx0cnVlLCBUPgogewogICAgIHN0YXRpYyB2b2lkIGRlc3RydWN0KFQq IGJlZ2luLCBUKiBlbmQpIAogICAgIHsKLSAgICAgICAgZm9yIChUKiBjdXIgPSBiZWdpbjsgY3Vy ICE9IGVuZDsgKytjdXIpCisgICAgICAgIGZvciAoVCogY3VyID0gYmVnaW47IGN1ciA8IGVuZDsg KytjdXIpCiAgICAgICAgICAgICBjdXItPn5UKCk7CiAgICAgfQogfTsKQEAgLTc0LDcgKzc0LDcg QEAgc3RydWN0IFZlY3RvckluaXRpYWxpemVyPHRydWUsIGZhbHNlLCBUPgogewogICAgIHN0YXRp YyB2b2lkIGluaXRpYWxpemUoVCogYmVnaW4sIFQqIGVuZCkgCiAgICAgewotICAgICAgICBmb3Ig KFQqIGN1ciA9IGJlZ2luOyBjdXIgIT0gZW5kOyArK2N1cikKKyAgICAgICAgZm9yIChUKiBjdXIg PSBiZWdpbjsgY3VyIDwgZW5kOyArK2N1cikKICAgICAgICAgICAgIG5ldyAoTm90TnVsbCwgY3Vy KSBUOwogICAgIH0KIH07CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9ncmFw aGljcy9JbWFnZUZyYW1lQ2FjaGUuY3BwIGIvU291cmNlL1dlYkNvcmUvcGxhdGZvcm0vZ3JhcGhp Y3MvSW1hZ2VGcmFtZUNhY2hlLmNwcAppbmRleCBkZDQ5NDBmOThlMWQxMzQ4Yzg4OTgyMGI5ZWUx NzViOTIxZmEzYTI5Li4xZDI3NzJjNDJlNTcwMDQzYmMyMWYwM2JiYzU2NjI2YWU5ZmNiYzA1IDEw MDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9ncmFwaGljcy9JbWFnZUZyYW1lQ2Fj aGUuY3BwCisrKyBiL1NvdXJjZS9XZWJDb3JlL3BsYXRmb3JtL2dyYXBoaWNzL0ltYWdlRnJhbWVD YWNoZS5jcHAKQEAgLTE3Niw4ICsxNzYsOCBAQCB2b2lkIEltYWdlRnJhbWVDYWNoZTo6ZGlkRGVj b2RlUHJvcGVydGllcyh1bnNpZ25lZCBkZWNvZGVkUHJvcGVydGllc1NpemUpCiB2b2lkIEltYWdl RnJhbWVDYWNoZTo6Z3Jvd0ZyYW1lcygpCiB7CiAgICAgQVNTRVJUKGlzU2l6ZUF2YWlsYWJsZSgp KTsKLSAgICBBU1NFUlQobV9mcmFtZXMuc2l6ZSgpIDw9IGZyYW1lQ291bnQoKSk7Ci0gICAgbV9m cmFtZXMuZ3JvdyhmcmFtZUNvdW50KCkpOworICAgIGlmIChmcmFtZUNvdW50KCkgPiBtX2ZyYW1l cy5zaXplKCkpCisgICAgICAgIG1fZnJhbWVzLmdyb3coZnJhbWVDb3VudCgpKTsKIH0KIAogdm9p ZCBJbWFnZUZyYW1lQ2FjaGU6OnNldE5hdGl2ZUltYWdlKE5hdGl2ZUltYWdlUHRyJiYgbmF0aXZl SW1hZ2UpCg== 311162 2017-05-24 15:46:46 -0700 2017-05-24 16:13:54 -0700 Patch bug-172552-20170524154646.patch text/plain 2013 sabouhallawa U3VidmVyc2lvbiBSZXZpc2lvbjogMjE3MzcyCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggMWRmMzQ5NWU4YmM2YjYw YjYyNzkwYzMwY2ZhYWI3ZWNhZjRlMDQzMS4uNTYyOGMxM2MzN2JlNTcyODQxZTc0OTFhZGU2MjY0 OWE4YjQxMzEwNCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDIyIEBACisyMDE3LTA1LTI0ICBTYWlk IEFib3UtSGFsbGF3YSAgPHNhYm91aGFsbGF3YUBhcHBsZS5jb20+CisKKyAgICAgICAgUkVHUkVT U0lPTiAocjIwNjQ4MSk6IERvbid0IGFzc3VtZSBmcmFtZUNvdW50KCkgaXMgbGFyZ2VyIHRoYW4g b3IgZXF1YWwgdG8gdGhlIHNpemUgb2YgdGhlIGltYWdlIGZyYW1lIGNhY2hlCisgICAgICAgIGh0 dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNzI1NTIKKworICAgICAgICBS ZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBJZiBhbiBpbWFnZSB3aXRoIG1h bnkgY2FjaGVkIEltYWdlRnJhbWVzIGlzIGNhY2hlZCBidXQgaXRzIGVuY29kZWQgZGF0YSBpcwor ICAgICAgICBmcmVlZCwgdGhlbiB0aGUgc2FtZSBpbWFnZSBpcyByZXVzZWQsIHRoZSBlbmNvZGVk IGRhdGEgd2lsbCBiZSBmZXRjaGVkLgorICAgICAgICBCdXQgdGhlIGluaXRpYWwgZnJhbWVDb3Vu dCgpIG1pZ2h0IGJlIGxlc3MgdGhhbiB0aGUgY3VycmVudCBzaXplIG9mIHRoZQorICAgICAgICBJ bWFnZUZyYW1lcyBjYWNoZS4KKworICAgICAgICBUaGlzIHdhcyBjYXVzaW5nIGFuIGFzc2VydGlv biBpbiB0aGUgZGVidWcgYnVpbGQgYW5kIGNyYXNoIGluIHRoZSByZWxlYXNlCisgICAgICAgIGJ1 aWxkLiBWZWN0b3I6Omdyb3coKSBkb2VzIG5vdCBoYW5kbGUgdGhlIGNhc2Ugd2hlcmUgdGhlIG5l dyBzaXplIGlzIHNtYWxsZXIKKyAgICAgICAgdGhhbiB0aGUgY3VycmVudCBzaXplIHNhZmVseS4K KworICAgICAgICAqIHBsYXRmb3JtL2dyYXBoaWNzL0ltYWdlRnJhbWVDYWNoZS5jcHA6CisgICAg ICAgIChXZWJDb3JlOjpJbWFnZUZyYW1lQ2FjaGU6Omdyb3dGcmFtZXMpOgorCiAyMDE3LTA1LTI0 ICBKb2huIFdpbGFuZGVyICA8d2lsYW5kZXJAYXBwbGUuY29tPgogCiAgICAgICAgIFJlc291cmNl IExvYWQgU3RhdGlzdGljczogQ2hhbmdlIGdyYW5kZmF0aGVyaW5nIGRlZmF1bHQgdG8gb25lIGhv dXIKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL3BsYXRmb3JtL2dyYXBoaWNzL0ltYWdlRnJh bWVDYWNoZS5jcHAgYi9Tb3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9ncmFwaGljcy9JbWFnZUZyYW1l Q2FjaGUuY3BwCmluZGV4IGRkNDk0MGY5OGUxZDEzNDhjODg5ODIwYjllZTE3NWI5MjFmYTNhMjku LmY2ZWI0NzY0MWEwZTAyNWExOTI2MzllNTYyMGI1MTNhZWQ0MTk4NzUgMTAwNjQ0Ci0tLSBhL1Nv dXJjZS9XZWJDb3JlL3BsYXRmb3JtL2dyYXBoaWNzL0ltYWdlRnJhbWVDYWNoZS5jcHAKKysrIGIv U291cmNlL1dlYkNvcmUvcGxhdGZvcm0vZ3JhcGhpY3MvSW1hZ2VGcmFtZUNhY2hlLmNwcApAQCAt MTc2LDggKzE3Niw5IEBAIHZvaWQgSW1hZ2VGcmFtZUNhY2hlOjpkaWREZWNvZGVQcm9wZXJ0aWVz KHVuc2lnbmVkIGRlY29kZWRQcm9wZXJ0aWVzU2l6ZSkKIHZvaWQgSW1hZ2VGcmFtZUNhY2hlOjpn cm93RnJhbWVzKCkKIHsKICAgICBBU1NFUlQoaXNTaXplQXZhaWxhYmxlKCkpOwotICAgIEFTU0VS VChtX2ZyYW1lcy5zaXplKCkgPD0gZnJhbWVDb3VudCgpKTsKLSAgICBtX2ZyYW1lcy5ncm93KGZy YW1lQ291bnQoKSk7CisgICAgYXV0byBuZXdTaXplID0gZnJhbWVDb3VudCgpOworICAgIGlmIChu ZXdTaXplID4gbV9mcmFtZXMuc2l6ZSgpKQorICAgICAgICBtX2ZyYW1lcy5ncm93KG5ld1NpemUp OwogfQogCiB2b2lkIEltYWdlRnJhbWVDYWNoZTo6c2V0TmF0aXZlSW1hZ2UoTmF0aXZlSW1hZ2VQ dHImJiBuYXRpdmVJbWFnZSkK