<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>18465</bug_id>
          
          <creation_ts>2008-04-13 13:32:14 -0700</creation_ts>
          <short_desc>wxWebit crash in BitmapImage::draw  on particular site</short_desc>
          <delta_ts>2008-05-28 11:38:01 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>WebKit wx</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>PC</rep_platform>
          <op_sys>Windows XP</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords></keywords>
          <priority>P2</priority>
          <bug_severity>Major</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Alexander Vassilev">avasilev</reporter>
          <assigned_to name="Kevin Ollivier">kevino</assigned_to>
          <cc>avasilev</cc>
    
    <cc>kevino</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>77412</commentid>
    <comment_count>0</comment_count>
    <who name="Alexander Vassilev">avasilev</who>
    <bug_when>2008-04-13 13:32:14 -0700</bug_when>
    <thetext>Opening the site &apos;dir.bg&apos; in wxBrowser, after it is completely loaded (tha statusbar says &apos;Load complete&apos;, then starting to resize increasing the size of the window - at one point the application crashes with access violation. I am in the process of investigating hte bug, but seems gdb provides some misleading information about the point of the crash, or I have not figured out something yet.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>77436</commentid>
    <comment_count>1</comment_count>
      <attachid>20510</attachid>
    <who name="Alexander Vassilev">avasilev</who>
    <bug_when>2008-04-13 18:31:14 -0700</bug_when>
    <thetext>Created attachment 20510
patch

The problem is that the source and destination areas are not always the same sizes, and without a check the underlying wx Blit code crashes. This is why I jsut added a simple check and if the sizes dont match hte function quits. This is just to prevent a crash, I am not sure how is it specified in the call how exactly to handle stretching or tiling of the image to fit the destination rect.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>77437</commentid>
    <comment_count>2</comment_count>
      <attachid>20510</attachid>
    <who name="Dave Hyatt">hyatt</who>
    <bug_when>2008-04-13 18:41:20 -0700</bug_when>
    <thetext>Comment on attachment 20510
patch

I think you probably just need to add a null check for your underlying platform image (like Mac has).

I recently removed the cross-platform null checks from draw and drawTiled, so it&apos;s up to the platforms to null-check now.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>77442</commentid>
    <comment_count>3</comment_count>
    <who name="Kevin Ollivier">kevino</who>
    <bug_when>2008-04-13 19:28:47 -0700</bug_when>
    <thetext>@Hyatt, we do check for a NULL image when we call frameAtIndex, so we shouldn&apos;t be hitting this point in the code without a valid image.

@Alexander, I&apos;ll prepare some code to resize images as we need that anyway, but we&apos;ve never hit a crash before just because the src and dest rect were different, and I have so far been unable to reproduce your crash. Since I don&apos;t have MinGW setup, I would really appreciate if you could attach the stack traces for these crashes (this and the mouse one too) so I can look at the code paths that lead to these crashes.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>77539</commentid>
    <comment_count>4</comment_count>
      <attachid>20528</attachid>
    <who name="Alexander Vassilev">avasilev</who>
    <bug_when>2008-04-14 05:11:23 -0700</bug_when>
    <thetext>Created attachment 20528
patch to ImageWx.cpp

This patch adds support for image rescaling in the draw method, as well as filling with solid color when source is 1x1 pixel</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>77542</commentid>
    <comment_count>5</comment_count>
    <who name="Alexander Vassilev">avasilev</who>
    <bug_when>2008-04-14 05:26:53 -0700</bug_when>
    <thetext>@Hyatt: Yes, the images are checked and they aren&apos;t null, we have valid images when the crash happens.
@Kevin: The crash with the &apos;dir.bg&apos; site occurred also with msvc, in exactly the same way. I have dug deeply in wxWidgets to find the cause - it was because of the Blit code trying to read the source image past its end - wxWidgets assumes that the source and destination are of the same size and does not perform any checks on this. As for the image resize, I just committed a patch and then read your reply that you are going to do the same - I&apos;m not sure my variant of rescaling is very efficient, but this seems to be the only way to rescale image - by converting to wxImage and then back to wxBitmap, the doc says the only other way is to blit between wxMemoryDC-s but i didn&apos;t find out any resizing support special for wxMemoryDC, so I used the canonical way via wxImage.

Since I have changed the original files, and now the crashes don&apos;t occur, I will do a build on the original source tree and send you the traces</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>77549</commentid>
    <comment_count>6</comment_count>
    <who name="Alexander Vassilev">avasilev</who>
    <bug_when>2008-04-14 06:28:59 -0700</bug_when>
    <thetext>Kevin, here are the stack traces for both crashes:


Image crash:
Program received signal SIGSEGV, Segmentation fault.
AlphaBlt (hdcDst=0xfc0132de, x=707, y=51, width=42, height=18, srcX=0, srcY=0, 
    hdcSrc=0x0, bmp=@0x22d650) at ../include/wx/rawbmp.h:588
588                 ChannelType&amp; Alpha() { return m_ptr[PixelFormat::ALPHA]; }
Current language:  auto; currently c++
(gdb) bt
#0  AlphaBlt (hdcDst=0xfc0132de, x=707, y=51, width=42, height=18, srcX=0, 
    srcY=0, hdcSrc=0x0, bmp=@0x22d650) at ../include/wx/rawbmp.h:588
#1  0x6289a5f0 in wxDC::DoBlit (this=0x22e5f4, xdest=707, ydest=51, width=42, 
    height=18, source=0x22d574, xsrc=0, ysrc=0, rop=5, useMask=true, 
    xsrcMask=-1, ysrcMask=-1) at ../include/wx/msw/dc.h:107
#2  0x00cbb187 in wxDCBase::Blit (this=0x22e5f4, xdest=707, ydest=51, 
    width=42, height=18, source=0x22d574, xsrc=0, ysrc=0, rop=5, useMask=true, 
    xsrcMask=-1, ysrcMask=-1) at /devel/wxWidgets-2.8.7/include/wx/dc.h:306
#3  0x006fb732 in WebCore::BitmapImage::draw (this=0xfcc8b68, ctxt=0x10474bd8, 
    dst=@0x22d704, src=@0x22d724, op=CompositeSourceOver)
    at platform/graphics/wx/ImageWx.cpp:112
#4  0x0054b745 in WebCore::GraphicsContext::drawImage (this=0x10474bd8, 
    image=0xfcc8b68, dest=@0x22d784, src=@0x22d794, op=CompositeSourceOver, 
    useLowQualityScale=false) at platform/graphics/GraphicsContext.cpp:358
#5  0x0054ad20 in WebCore::GraphicsContext::drawImage (this=0x10474bd8, 
    image=0xfcc8b68, dest=@0x22d914, srcRect=@0x22d7e4, 
    op=CompositeSourceOver, useLowQualityScale=false)
    at platform/graphics/GraphicsContext.cpp:227
#6  0x0054ac5c in WebCore::GraphicsContext::drawImage (this=0x10474bd8, 
    image=0xfcc8b68, r=@0x22d914, op=CompositeSourceOver, 
    useLowQualityScale=false) at platform/graphics/GraphicsContext.cpp:217
#7  0x007449fe in WebCore::RenderImage::paintReplaced (this=0x103d904c, 
    paintInfo=@0x22d9f4, tx=707, ty=51) at rendering/RenderImage.cpp:258
#8  0x007301ab in WebCore::RenderReplaced::paint (this=0x103d904c, 
    paintInfo=@0x22d9f4, tx=707, ty=51) at rendering/RenderReplaced.cpp:129
#9  0x006fa66a in WebCore::InlineBox::paint (this=0xfc58a2c, 
    paintInfo=@0x22da74, tx=707, ty=51) at rendering/InlineBox.cpp:154
#10 0x00712470 in WebCore::InlineFlowBox::paint (this=0x10385114, 
    paintInfo=@0x22db04, tx=707, ty=51) at rendering/InlineFlowBox.cpp:640
---Type &lt;return&gt; to continue, or q &lt;return&gt; to quit---
#11 0x00712470 in WebCore::InlineFlowBox::paint (this=0x10385184, 
    paintInfo=@0x22dc84, tx=707, ty=51) at rendering/InlineFlowBox.cpp:640
#12 0x00707f14 in WebCore::RootInlineBox::paint (this=0x10385184, 
    paintInfo=@0x22dc84, tx=707, ty=51) at rendering/RootInlineBox.cpp:179
#13 0x00717b44 in WebCore::RenderFlow::paintLines (this=0x103d83fc, 
    paintInfo=@0x22de14, tx=707, ty=51) at rendering/RenderFlow.cpp:433
#14 0x006718e7 in WebCore::RenderBlock::paintContents (this=0x103d83fc, 
    paintInfo=@0x22de14, tx=707, ty=51) at rendering/RenderBlock.cpp:1502
#15 0x00672020 in WebCore::RenderBlock::paintObject (this=0x103d83fc, 
    paintInfo=@0x22de14, tx=707, ty=51) at rendering/RenderBlock.cpp:1586
#16 0x00671357 in WebCore::RenderBlock::paint (this=0x103d83fc, 
    paintInfo=@0x22de14, tx=707, ty=51) at rendering/RenderBlock.cpp:1416
#17 0x00672653 in WebCore::RenderBlock::paintFloats (this=0x1049fd9c, 
    paintInfo=@0x22df54, tx=0, ty=39, preservePhase=false)
    at rendering/RenderBlock.cpp:1650
#18 0x00672107 in WebCore::RenderBlock::paintObject (this=0x1049fd9c, 
    paintInfo=@0x22df54, tx=0, ty=39) at rendering/RenderBlock.cpp:1600
#19 0x00671357 in WebCore::RenderBlock::paint (this=0x1049fd9c, 
    paintInfo=@0x22df54, tx=0, ty=39) at rendering/RenderBlock.cpp:1416
#20 0x00671b14 in WebCore::RenderBlock::paintChildren (this=0x1049fbac, 
    paintInfo=@0x22e094, tx=0, ty=39) at rendering/RenderBlock.cpp:1528
#21 0x00671909 in WebCore::RenderBlock::paintContents (this=0x1049fbac, 
    paintInfo=@0x22e094, tx=0, ty=39) at rendering/RenderBlock.cpp:1504
#22 0x00672020 in WebCore::RenderBlock::paintObject (this=0x1049fbac, 
    paintInfo=@0x22e094, tx=0, ty=39) at rendering/RenderBlock.cpp:1586
#23 0x00671357 in WebCore::RenderBlock::paint (this=0x1049fbac, 
    paintInfo=@0x22e094, tx=0, ty=39) at rendering/RenderBlock.cpp:1416
#24 0x00671b14 in WebCore::RenderBlock::paintChildren (this=0x10278ddc, 
    paintInfo=@0x22e1d4, tx=0, ty=0) at rendering/RenderBlock.cpp:1528
---Type &lt;return&gt; to continue, or q &lt;return&gt; to quit---
#25 0x00671909 in WebCore::RenderBlock::paintContents (this=0x10278ddc, 
    paintInfo=@0x22e1d4, tx=0, ty=0) at rendering/RenderBlock.cpp:1504
#26 0x00672020 in WebCore::RenderBlock::paintObject (this=0x10278ddc, 
    paintInfo=@0x22e1d4, tx=0, ty=0) at rendering/RenderBlock.cpp:1586
#27 0x00671357 in WebCore::RenderBlock::paint (this=0x10278ddc, 
    paintInfo=@0x22e1d4, tx=0, ty=0) at rendering/RenderBlock.cpp:1416
#28 0x00671b14 in WebCore::RenderBlock::paintChildren (this=0xfc95c2c, 
    paintInfo=@0x22e314, tx=0, ty=0) at rendering/RenderBlock.cpp:1528
#29 0x00671909 in WebCore::RenderBlock::paintContents (this=0xfc95c2c, 
    paintInfo=@0x22e314, tx=0, ty=0) at rendering/RenderBlock.cpp:1504
#30 0x00672020 in WebCore::RenderBlock::paintObject (this=0xfc95c2c, 
    paintInfo=@0x22e314, tx=0, ty=0) at rendering/RenderBlock.cpp:1586
#31 0x00671357 in WebCore::RenderBlock::paint (this=0xfc95c2c, 
    paintInfo=@0x22e314, tx=0, ty=0) at rendering/RenderBlock.cpp:1416
#32 0x0050437b in WebCore::RenderLayer::paintLayer (this=0xfc95cd4, 
    rootLayer=0xfc3222c, p=0x10474bd8, paintDirtyRect=@0x22e5c4, 
    haveTransparency=false, paintRestriction=PaintRestrictionNone, 
    paintingRoot=0x0, appliedTransform=false) at rendering/RenderLayer.cpp:1599
#33 0x005045c7 in WebCore::RenderLayer::paintLayer (this=0xfc3222c, 
    rootLayer=0xfc3222c, p=0x10474bd8, paintDirtyRect=@0x22e5c4, 
    haveTransparency=false, paintRestriction=PaintRestrictionNone, 
    paintingRoot=0x0, appliedTransform=false) at rendering/RenderLayer.cpp:1626
#34 0x00503bc0 in WebCore::RenderLayer::paint (this=0xfc3222c, p=0x10474bd8, 
    damageRect=@0x22e5c4, paintRestriction=PaintRestrictionNone, 
    paintingRoot=0x0) at rendering/RenderLayer.cpp:1451
#35 0x0042ddc8 in WebCore::Frame::paint (this=0xfc3d188, p=0x10474bd8, 
    rect=@0x22e5c4) at page/Frame.cpp:1346
#36 0x0040c928 in wxWebView::OnPaint (this=0xfc3c638, event=@0x22e934)
    at WebView.cpp:442
---Type &lt;return&gt; to continue, or q &lt;return&gt; to quit---
#37 0x6cec7285 in wxEvtHandler::ProcessEventIfMatches (entry=@0x10852e0, 
    handler=0xfc3c638, event=@0x22e934) at ../include/wx/app.h:287
#38 0x6cec75dc in wxEventHashTable::HandleEvent (this=0x1, event=@0x22e934, 
    self=0xfc3c638) at ../include/wx/event.h:2319
#39 0x6cec85d9 in wxEvtHandler::ProcessEvent (this=0xfc3c638, event=@0x22e934)
    at ../src/common/event.cpp:1287
#40 0x628d4e34 in wxWindow::HandlePaint (this=0xfc3c638)
    at ../include/wx/window.h:612
#41 0x628da5e2 in wxWindow::MSWWindowProc (this=0xfc3c638, message=15, 
    wParam=0, lParam=0) at ../src/msw/window.cpp:2723
#42 0x628d1830 in wxWndProc (hWnd=0xa60bca, message=15, wParam=0, lParam=0)
    at ../src/msw/window.cpp:2594
#43 0x7e418734 in USER32!GetDC () from /cygdrive/c/WINDOWS/system32/user32.dll
#44 0x00a60bca in xmlSchemaXPathProcessHistory ()
#45 0x7e418816 in USER32!GetDC () from /cygdrive/c/WINDOWS/system32/user32.dll
#46 0x628d1780 in wxWindowCreationHook::~wxWindowCreationHook ()
    at ../src/msw/window.cpp:2566
#47 0x7e41b4c0 in USER32!DefWindowProcW ()
   from /cygdrive/c/WINDOWS/system32/user32.dll
#48 0x00000000 in ?? ()
(gdb) 





Mouse event crash:

Program received signal SIGSEGV, Segmentation fault.
0x0050c42e in WebCore::EventTargetNode::dispatchMouseEvent (this=0xfc56f30, 
    event=@0x22f57c, eventType=@0x1086dcc, detail=1, relatedTarget=0x0)
    at dom/EventTargetNode.cpp:195
195         ASSERT(event.eventType() == MouseEventMoved || button != NoButton);
Current language:  auto; currently c++
(gdb) bt
#0  0x0050c42e in WebCore::EventTargetNode::dispatchMouseEvent (
    this=0xfc56f30, event=@0x22f57c, eventType=@0x1086dcc, detail=1, 
    relatedTarget=0x0) at dom/EventTargetNode.cpp:195
#1  0x0043b602 in WebCore::EventHandler::dispatchMouseEvent (this=0xfc3de70, 
    eventType=@0x1086dcc, targetNode=0xfc56f30, cancelable=true, clickCount=1, 
    mouseEvent=@0x22f57c, setUnder=false) at page/EventHandler.cpp:1262
#2  0x0043a4df in WebCore::EventHandler::handleMouseReleaseEvent (
    this=0xfc3de70, mouseEvent=@0x22f57c) at page/EventHandler.cpp:1079
#3  0x0040cbf7 in wxWebView::OnMouseEvents (this=0xfc3c638, event=@0x22f6bc)
    at WebView.cpp:483
#4  0x6cec7285 in wxEvtHandler::ProcessEventIfMatches (entry=@0x1085328, 
    handler=0xfc3c638, event=@0x22f6bc) at ../include/wx/app.h:287
#5  0x6cec75dc in wxEventHashTable::HandleEvent (this=0x1, event=@0x22f6bc, 
    self=0xfc3c638) at ../include/wx/event.h:2319
#6  0x6cec85d9 in wxEvtHandler::ProcessEvent (this=0xfc3c638, event=@0x22f6bc)
    at ../src/common/event.cpp:1287
#7  0x628d6996 in wxWindow::HandleMouseEvent (this=0xfc3c638, msg=167, x=167, 
    y=167, flags=167) at ../include/wx/window.h:612
#8  0x628d95c1 in wxWindow::MSWWindowProc (this=0xfc3c638, message=514, 
    wParam=0, lParam=9109751) at ../src/msw/window.cpp:2860
#9  0x628d1830 in wxWndProc (hWnd=0x7a0b20, message=514, wParam=0, 
    lParam=9109751) at ../src/msw/window.cpp:2594
#10 0x7e418734 in USER32!GetDC () from /cygdrive/c/WINDOWS/system32/user32.dll
#11 0x007a0b20 in WebCore::HTMLTokenizer::HTMLTokenizer (this=0x628d1780, 
    doc=0x7a0b20, reportErrors=220) at html/HTMLTokenizer.cpp:169
#12 0x7e418816 in USER32!GetDC () from /cygdrive/c/WINDOWS/system32/user32.dll
#13 0x628d1780 in wxWindowCreationHook::~wxWindowCreationHook ()
    at ../src/msw/window.cpp:2566
#14 0x7e4189cd in USER32!GetWindowLongW ()
---Type &lt;return&gt; to continue, or q &lt;return&gt; to quit---
   from /cygdrive/c/WINDOWS/system32/user32.dll
#15 0x00000000 in ?? ()
(gdb) 

</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>77695</commentid>
    <comment_count>7</comment_count>
    <who name="Kevin Ollivier">kevino</who>
    <bug_when>2008-04-15 09:23:19 -0700</bug_when>
    <thetext>If you want to submit a patch for review, you should flag it with a &apos;?&apos; rather than a &apos;+&apos;. A WebKit reviewer needs to be the one to give it a &apos;+&apos;, which means it&apos;s ready to land in the trunk. (All WebKit patches must be reviewed by someone other than the submitter.) Thanks!</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>77782</commentid>
    <comment_count>8</comment_count>
    <who name="Alexander Vassilev">avasilev</who>
    <bug_when>2008-04-16 06:11:26 -0700</bug_when>
    <thetext>Ups, sorry, Kevin, as you can see I am not yet familiar with bugzilla :) Sorry for the confusion</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>81770</commentid>
    <comment_count>9</comment_count>
    <who name="Kevin Ollivier">kevino</who>
    <bug_when>2008-05-28 11:38:01 -0700</bug_when>
    <thetext>Landed in r34178, thanks!</thetext>
  </long_desc>
      
          <attachment
              isobsolete="1"
              ispatch="1"
              isprivate="0"
          >
            <attachid>20510</attachid>
            <date>2008-04-13 18:31:14 -0700</date>
            <delta_ts>2008-04-14 05:11:23 -0700</delta_ts>
            <desc>patch</desc>
            <filename>image.patch</filename>
            <type>text/plain</type>
            <size>425</size>
            <attacher name="Alexander Vassilev">avasilev</attacher>
            
              <data encoding="base64">LS0tIC4vd2Via2l0X21pbmd3L1dlYkNvcmUvcGxhdGZvcm0vZ3JhcGhpY3Mvd3gvSW1hZ2VXeC5j
cHAJMjAwOC0wNC0wNCAxNTowMjo0OS40MjE4NzUwMDAgKzAzMDAKKysrIC4vd2Via2l0X2NsZWFu
L1dlYkNvcmUvcGxhdGZvcm0vZ3JhcGhpY3Mvd3gvSW1hZ2VXeC5jcHAJMjAwOC0wNC0xNCAwNDoy
NjowNi44MTY2MjUwMDAgKzAzMDAKQEAgLTg3LDYgKzg3LDkgQEAKICAgICBpZiAoIW1fc291cmNl
LmluaXRpYWxpemVkKCkpCiAgICAgICAgIHJldHVybjsKIAorCWlmICgoZHN0LndpZHRoKCkgIT0g
c3JjLndpZHRoKCkpIHx8IChkc3QuaGVpZ2h0KCkgIT0gc3JjLmhlaWdodCgpKSkKKwkJcmV0dXJu
OworCiAjaWYgVVNFKFdYR0MpCiAgICAgd3hHQ0RDKiBjb250ZXh0ID0gKHd4R0NEQyopY3R4dC0+
cGxhdGZvcm1Db250ZXh0KCk7CiAjZWxzZQo=
</data>

          </attachment>
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>20528</attachid>
            <date>2008-04-14 05:11:23 -0700</date>
            <delta_ts>2008-05-28 11:37:52 -0700</delta_ts>
            <desc>patch to ImageWx.cpp</desc>
            <filename>image1.patch</filename>
            <type>text/plain</type>
            <size>2376</size>
            <attacher name="Alexander Vassilev">avasilev</attacher>
            
              <data encoding="base64">LS0tIC4vd2Via2l0X21pbmd3L1dlYkNvcmUvcGxhdGZvcm0vZ3JhcGhpY3Mvd3gvSW1hZ2VXeC5j
cHAJMjAwOC0wNC0wNCAxNTowMjo0OS40MjE4NzUwMDAgKzAzMDAKKysrIC4vd2Via2l0X2NsZWFu
L1dlYkNvcmUvcGxhdGZvcm0vZ3JhcGhpY3Mvd3gvSW1hZ2VXeC5jcHAJMjAwOC0wNC0xNCAxNDo0
MzoxMS44MTY2MjUwMDAgKzAzMDAKQEAgLTk3LDIwICs5NywzNyBAQAogICAgIGlmICghYml0bWFw
KSAvLyBJZiBpdCdzIHRvbyBlYXJseSB3ZSB3b24ndCBoYXZlIGFuIGltYWdlIHlldC4KICAgICAg
ICAgcmV0dXJuOwogCi0gICAgSW50U2l6ZSBzZWxmU2l6ZSA9IHNpemUoKTsgICAgICAgICAgICAg
ICAgCi0gICAgRmxvYXRSZWN0IHNyY1JlY3Qoc3JjKTsKLSAgICBGbG9hdFJlY3QgZHN0UmVjdChk
c3QpOwotICAgIAorCWlmIChtYXlGaWxsV2l0aFNvbGlkQ29sb3IoKSkgeworICAgICAgICBmaWxs
V2l0aFNvbGlkQ29sb3IoY3R4dCwgZHN0LCBzb2xpZENvbG9yKCksIG9wKTsKKyAgICAgICAgcmV0
dXJuOworICAgIH0KKwkKICAgICAvLyBJZiB3ZSdyZSBkcmF3aW5nIGEgc3ViIHBvcnRpb24gb2Yg
dGhlIGltYWdlIG9yIHNjYWxpbmcgdGhlbiBjcmVhdGUKICAgICAvLyBhIHBhdHRlcm4gdHJhbnNm
b3JtYXRpb24gb24gdGhlIGltYWdlIGFuZCBkcmF3IHRoZSB0cmFuc2Zvcm1lZCBwYXR0ZXJuLgog
ICAgIC8vIFRlc3QgdXNpbmcgZXhhbXBsZSBzaXRlIGF0IGh0dHA6Ly93d3cubWV5ZXJ3ZWIuY29t
L2VyaWMvY3NzL2VkZ2UvY29tcGxleHNwaXJhbC9kZW1vLmh0bWwKICAgICAvLyBGSVhNRTogTllJ
CiAgICAKKwljdHh0LT5zYXZlKCk7CisKKyAgICAvLyBTZXQgdGhlIGNvbXBvc2l0aW5nIG9wZXJh
dGlvbi4KKyAgICBjdHh0LT5zZXRDb21wb3NpdGVPcGVyYXRpb24ob3ApOworCisJSW50UmVjdCBz
cmNJbnRSZWN0KHNyYyk7CisJSW50UmVjdCBkc3RJbnRSZWN0KGRzdCk7CisJYm9vbCByZXNjYWxp
bmcgPSBmYWxzZTsKKwlpZiAoKGRzdEludFJlY3Qud2lkdGgoKSAhPSBzcmNJbnRSZWN0LndpZHRo
KCkpIHx8IChkc3RJbnRSZWN0LmhlaWdodCgpICE9IHNyY0ludFJlY3QuaGVpZ2h0KCkpKQorCXsK
KwkJcmVzY2FsaW5nID0gdHJ1ZTsKKwkJd3hJbWFnZSBpbWcgPSBiaXRtYXAtPkNvbnZlcnRUb0lt
YWdlKCk7CisJCWltZy5SZXNjYWxlKGRzdEludFJlY3Qud2lkdGgoKSwgZHN0SW50UmVjdC5oZWln
aHQoKSk7CisJCWJpdG1hcCA9IG5ldyB3eEJpdG1hcChpbWcpOworCX0JCiAgICAgd3hNZW1vcnlE
QyBteWRjOyAKICAgICBBU1NFUlQoYml0bWFwLT5HZXRSZWZEYXRhKCkpOwogICAgIG15ZGMuU2Vs
ZWN0T2JqZWN0KCpiaXRtYXApOyAKLSAgICBjb250ZXh0LT5CbGl0KCh3eENvb3JkKWRzdC54KCks
KHd4Q29vcmQpZHN0LnkoKSwgKHd4Q29vcmQpZHN0LndpZHRoKCksICh3eENvb3JkKWRzdC5oZWln
aHQoKSwgJm15ZGMsIAotICAgICAgICAgICAgICAgICAgICAod3hDb29yZClzcmMueCgpLCAod3hD
b29yZClzcmMueSgpLCB3eENPUFksIHRydWUpOyAKKwkKKyAgICBjb250ZXh0LT5CbGl0KCh3eENv
b3JkKWRzdEludFJlY3QueCgpLCh3eENvb3JkKWRzdEludFJlY3QueSgpLCAod3hDb29yZClkc3RJ
bnRSZWN0LndpZHRoKCksICh3eENvb3JkKWRzdEludFJlY3QuaGVpZ2h0KCksICZteWRjLCAKKyAg
ICAgICAgICAgICAgICAgICAgKHd4Q29vcmQpc3JjSW50UmVjdC54KCksICh3eENvb3JkKXNyY0lu
dFJlY3QueSgpLCB3eENPUFksIHRydWUpOyAKICAgICBteWRjLlNlbGVjdE9iamVjdCh3eE51bGxC
aXRtYXApOwogICAgIAogICAgIC8vIE5COiBkZWxldGUgaXMgY2F1c2luZyBjcmFzaGVzIGR1cmlu
ZyBwYWdlIGxvYWQsIGJ1dCBub3QgZHVyaW5nIHRoZSBkZWxldGlvbgpAQCAtMTE4LDEwICsxMzUs
MTUgQEAKICAgICAvLyBzdWRkZW5seSBiZWNvbWVzIGludmFsaWQgYWZ0ZXIgcmV0dXJuaW5nLiBJ
dCdzIHBvc3NpYmxlIHRoZXNlIGVycm9ycyBkZWFsCiAgICAgLy8gd2l0aCByZWVudHJhbmN5IGFu
ZCB0aHJlZGluZyBwcm9ibGVtcy4KICAgICAvL2RlbGV0ZSBiaXRtYXA7CisJaWYgKHJlc2NhbGlu
ZykKKwl7CisJCWRlbGV0ZSBiaXRtYXA7CisJCWJpdG1hcCA9IE5VTEw7CisJfQorCWN0eHQtPnJl
c3RvcmUoKTsKICAgICBzdGFydEFuaW1hdGlvbigpOwogfQogCi0KIHZvaWQgQml0bWFwSW1hZ2U6
OmRyYXdQYXR0ZXJuKEdyYXBoaWNzQ29udGV4dCogY3R4dCwgY29uc3QgRmxvYXRSZWN0JiBzcmNS
ZWN0LCBjb25zdCBBZmZpbmVUcmFuc2Zvcm0mIHBhdHRlcm5UcmFuc2Zvcm0sIGNvbnN0IEZsb2F0
UG9pbnQmIHBoYXNlLCBDb21wb3NpdGVPcGVyYXRvciwgY29uc3QgRmxvYXRSZWN0JiBkc3RSZWN0
KQogewogICAgIGlmICghbV9zb3VyY2UuaW5pdGlhbGl6ZWQoKSkK
</data>
<flag name="review"
          id="8962"
          type_id="1"
          status="+"
          setter="kevino"
    />
          </attachment>
      

    </bug>

</bugzilla>