<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>18585</bug_id>
          
          <creation_ts>2008-04-18 10:08:03 -0700</creation_ts>
          <short_desc>Frame::ownerRenderer() is likely causing strange crashes</short_desc>
          <delta_ts>2008-04-18 15:03:32 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>Frames</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>Mac</rep_platform>
          <op_sys>OS X 10.5</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords></keywords>
          <priority>P1</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Eric Seidel (no email)">eric</reporter>
          <assigned_to name="Eric Seidel (no email)">eric</assigned_to>
          
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>78121</commentid>
    <comment_count>0</comment_count>
    <who name="Eric Seidel (no email)">eric</who>
    <bug_when>2008-04-18 10:08:03 -0700</bug_when>
    <thetext>I was cleaning up Frame yesterday and added a few more ASSERTS.  One in ownerRenderer:

RenderPart* Frame::ownerRenderer() const
{
    HTMLFrameOwnerElement* ownerElement = d-&gt;m_ownerElement;
    if (!ownerElement)
        return 0;
    RenderObject* object = ownerElement-&gt;renderer();
    if (!object)
        return 0;
    ASSERT(object-&gt;isRenderPart());
    return static_cast&lt;RenderPart*&gt;(object);
}

This ASSERT fails with FOUR layout tests.  Yes, I was surprised too.  I expect that this could be causing all sorts of wacky crashes in real Safari.

I&apos;m not sure why it&apos;s hitting these ASSERTs yet.  I&apos;m also not sure if simply returning 0 is the right thing.  Why would a frame still think an element was owning it which wasn&apos;t?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>78123</commentid>
    <comment_count>1</comment_count>
      <attachid>20670</attachid>
    <who name="Eric Seidel (no email)">eric</who>
    <bug_when>2008-04-18 10:18:56 -0700</bug_when>
    <thetext>Created attachment 20670
cleanup patch which fixes layout issue and shows this crash!

I could mark this patch for review, since part of it fixes an issue where we would not be properly adjusting the view size when things change during relayout... I doubt it&apos;s seen very often.

But I won&apos;t yet since the ASSERT would cause 4 layout test failures.

This was based on the Frame cleanup patch I posted yesterday as part of bug 18556</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>78124</commentid>
    <comment_count>2</comment_count>
    <who name="Eric Seidel (no email)">eric</who>
    <bug_when>2008-04-18 10:32:52 -0700</bug_when>
    <thetext>The for cases which supposedly caused crashes:

Tests that caused the DumpRenderTree tool to crash:

fast/css/acid2				stderr
fast/table/giantRowspan2				stderr
http/tests/misc/acid2				stderr
http/tests/navigation/fallback-anchor-reload				stderr

I think fast/table/giantRowspan was bogus.  But http/tests/navigation/fallback-anchor-reload crashes reliably.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>78126</commentid>
    <comment_count>3</comment_count>
    <who name="Eric Seidel (no email)">eric</who>
    <bug_when>2008-04-18 10:33:26 -0700</bug_when>
    <thetext>ASSERTION FAILED: object-&gt;isRenderPart()
(/Users/eseidel/Projects/WebKit/WebCore/page/Frame.cpp:1191 WebCore::RenderPart* WebCore::Frame::ownerRenderer() const)

Is the output, btw.  Exactly what was expected, the ASSERT is failing.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>78129</commentid>
    <comment_count>4</comment_count>
    <who name="Eric Seidel (no email)">eric</who>
    <bug_when>2008-04-18 10:44:38 -0700</bug_when>
    <thetext>I think this is caused by &lt;object&gt; elements not disassociating themselves with the frames that they created when they decide to render fallback content (or any other content).  I imagine if you were to change an &lt;object&gt; from pointing at an .html file to pointing at a .png, it might crash in a similar manner.

It looks like there are only a few clients of ownerRenderer():

WebCore/page/FrameView.cpp:        RenderPart* renderer = m_frame-&gt;ownerRenderer();
WebCore/page/FrameView.cpp:        if (RenderPart* renderer = m_frame-&gt;ownerRenderer())
WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp:    if (frame-&gt;ownerRenderer())
WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp:        frame-&gt;ownerRenderer()-&gt;setWidget(frameView);
WebKit/mac/WebView/WebFrameView.mm:    if (RenderPart* owner = frame-&gt;ownerRenderer()) {
WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp:    if (m_frame-&gt;ownerRenderer())
WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp:        m_frame-&gt;ownerRenderer()-&gt;setWidget(frameView);
WebKit/win/WebCoreSupport/WebFrameLoaderClient.cpp:    if (frame-&gt;ownerRenderer())
WebKit/win/WebCoreSupport/WebFrameLoaderClient.cpp:        frame-&gt;ownerRenderer()-&gt;setWidget(frameView);

It looks safe to return 0 from ownerRenderer() so I&apos;m going to fix this potential crash by doing so.  I&apos;m not sure it&apos;s right for HTMLObjectElements to remain the ownerElement for these canceled/errored frames so long... but I guess we can deal with that later.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>78130</commentid>
    <comment_count>5</comment_count>
      <attachid>20671</attachid>
    <who name="Eric Seidel (no email)">eric</who>
    <bug_when>2008-04-18 10:50:06 -0700</bug_when>
    <thetext>Created attachment 20671
Actually fix the ASSERT/potential crasher</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>78158</commentid>
    <comment_count>6</comment_count>
    <who name="Eric Seidel (no email)">eric</who>
    <bug_when>2008-04-18 13:26:24 -0700</bug_when>
    <thetext>Hum.. I bet if some Apple person searched Radar or crashtracer there would be results related to this.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>78160</commentid>
    <comment_count>7</comment_count>
      <attachid>20671</attachid>
    <who name="Darin Adler">darin</who>
    <bug_when>2008-04-18 13:27:16 -0700</bug_when>
    <thetext>Comment on attachment 20671
Actually fix the ASSERT/potential crasher

+    if (!subtree &amp;&amp; (!root-&gt;isRenderView() || !static_cast&lt;RenderView*&gt;(root)-&gt;printing()))

The isRenderView() check here isn&apos;t needed. If subtree is false, it&apos;s guaranteed to be a RenderView.

Change looks OK otherwise.

r=me either as-is or with that fix</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>78175</commentid>
    <comment_count>8</comment_count>
    <who name="Eric Seidel (no email)">eric</who>
    <bug_when>2008-04-18 14:07:41 -0700</bug_when>
    <thetext>(In reply to comment #7)
&gt; (From update of attachment 20671 [edit])
&gt; +    if (!subtree &amp;&amp; (!root-&gt;isRenderView() ||
&gt; !static_cast&lt;RenderView*&gt;(root)-&gt;printing()))
&gt; 
&gt; The isRenderView() check here isn&apos;t needed. If subtree is false, it&apos;s
&gt; guaranteed to be a RenderView.
&gt; 
&gt; Change looks OK otherwise.
&gt; 
&gt; r=me either as-is or with that fix
&gt; 

I&apos;ll add a different ASSERT then.

Thx.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>78182</commentid>
    <comment_count>9</comment_count>
    <who name="Eric Seidel (no email)">eric</who>
    <bug_when>2008-04-18 15:03:32 -0700</bug_when>
    <thetext>Committed: e0d08dbe94fef979b381b6470fdb8a91e9be5c2f
	M	WebCore/ChangeLog
	M	WebCore/page/Frame.cpp
	M	WebCore/rendering/RenderObject.h
	M	WebCore/rendering/RenderPart.h
Committed r32232

</thetext>
  </long_desc>
      
          <attachment
              isobsolete="1"
              ispatch="1"
              isprivate="0"
          >
            <attachid>20670</attachid>
            <date>2008-04-18 10:18:56 -0700</date>
            <delta_ts>2008-04-18 10:50:06 -0700</delta_ts>
            <desc>cleanup patch which fixes layout issue and shows this crash!</desc>
            <filename>test.diff</filename>
            <type>text/plain</type>
            <size>5024</size>
            <attacher name="Eric Seidel (no email)">eric</attacher>
            
              <data encoding="base64">ZGlmZiAtLWdpdCBhL1dlYkNvcmUvcGFnZS9GcmFtZS5jcHAgYi9XZWJDb3JlL3BhZ2UvRnJhbWUu
Y3BwCmluZGV4IGZmYmI1OWEuLjhlMjdhMzcgMTAwNjQ0Ci0tLSBhL1dlYkNvcmUvcGFnZS9GcmFt
ZS5jcHAKKysrIGIvV2ViQ29yZS9wYWdlL0ZyYW1lLmNwcApAQCAtMTE2OSw2ICsxMTY5LDggQEAg
UmVuZGVyVmlldyogRnJhbWU6OmNvbnRlbnRSZW5kZXJlcigpIGNvbnN0CiAgICAgaWYgKCFkb2Mp
CiAgICAgICAgIHJldHVybiAwOwogICAgIFJlbmRlck9iamVjdCogb2JqZWN0ID0gZG9jLT5yZW5k
ZXJlcigpOworICAgIGlmICghb2JqZWN0KQorICAgICAgICByZXR1cm4gMDsKICAgICBBU1NFUlQo
b2JqZWN0LT5pc1JlbmRlclZpZXcoKSk7CiAgICAgcmV0dXJuIHN0YXRpY19jYXN0PFJlbmRlclZp
ZXcqPihvYmplY3QpOwogfQpAQCAtMTE4Myw3ICsxMTg1LDExIEBAIFJlbmRlclBhcnQqIEZyYW1l
Ojpvd25lclJlbmRlcmVyKCkgY29uc3QKICAgICBIVE1MRnJhbWVPd25lckVsZW1lbnQqIG93bmVy
RWxlbWVudCA9IGQtPm1fb3duZXJFbGVtZW50OwogICAgIGlmICghb3duZXJFbGVtZW50KQogICAg
ICAgICByZXR1cm4gMDsKLSAgICByZXR1cm4gc3RhdGljX2Nhc3Q8UmVuZGVyUGFydCo+KG93bmVy
RWxlbWVudC0+cmVuZGVyZXIoKSk7CisgICAgUmVuZGVyT2JqZWN0KiBvYmplY3QgPSBvd25lckVs
ZW1lbnQtPnJlbmRlcmVyKCk7CisgICAgaWYgKCFvYmplY3QpCisgICAgICAgIHJldHVybiAwOwor
ICAgIEFTU0VSVChvYmplY3QtPmlzUmVuZGVyUGFydCgpKTsKKyAgICByZXR1cm4gc3RhdGljX2Nh
c3Q8UmVuZGVyUGFydCo+KG9iamVjdCk7CiB9CiAKIC8vIHJldHVybnMgRmxvYXRSZWN0IGJlY2F1
c2UgZ29pbmcgdGhyb3VnaCBJbnRSZWN0IHdvdWxkIHRydW5jYXRlIGFueSBmbG9hdHMKZGlmZiAt
LWdpdCBhL1dlYkNvcmUvcGFnZS9GcmFtZVZpZXcuY3BwIGIvV2ViQ29yZS9wYWdlL0ZyYW1lVmll
dy5jcHAKaW5kZXggZGJlODdkNy4uNWEyNWNhYSAxMDA2NDQKLS0tIGEvV2ViQ29yZS9wYWdlL0Zy
YW1lVmlldy5jcHAKKysrIGIvV2ViQ29yZS9wYWdlL0ZyYW1lVmlldy5jcHAKQEAgLTQ5MCw5ICs0
OTAsNyBAQCB2b2lkIEZyYW1lVmlldzo6bGF5b3V0KGJvb2wgYWxsb3dTdWJ0cmVlKQogICAgCiAg
ICAgZC0+bGF5b3V0U2NoZWR1bGluZ0VuYWJsZWQgPSB0cnVlOwogCi0gICAgLy8gRklYTUU6IGlz
IHJvb3QgYWx3YXlzIGEgUmVuZGVyVmlldz8gaWYgc28sIHN0YXRpY19jYXN0IGF0IGluaXRpYWxp
emF0aW9uCi0gICAgQVNTRVJUKHJvb3QtPmlzUmVuZGVyVmlldygpKTsKLSAgICBpZiAoIXN1YnRy
ZWUgJiYgIXN0YXRpY19jYXN0PFJlbmRlclZpZXcqPihyb290KS0+cHJpbnRpbmcoKSkKKyAgICBp
ZiAoIXN1YnRyZWUgJiYgKCFyb290LT5pc1JlbmRlclZpZXcoKSB8fCAhc3RhdGljX2Nhc3Q8UmVu
ZGVyVmlldyo+KHJvb3QpLT5wcmludGluZygpKSkKICAgICAgICAgYWRqdXN0Vmlld1NpemUoKTsK
IAogICAgIC8vIE5vdyB1cGRhdGUgdGhlIHBvc2l0aW9ucyBvZiBhbGwgbGF5ZXJzLgpkaWZmIC0t
Z2l0IGEvV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyT2JqZWN0LmggYi9XZWJDb3JlL3JlbmRlcmlu
Zy9SZW5kZXJPYmplY3QuaAppbmRleCAxNmYzODU0Li41YjVkY2YyIDEwMDY0NAotLS0gYS9XZWJD
b3JlL3JlbmRlcmluZy9SZW5kZXJPYmplY3QuaAorKysgYi9XZWJDb3JlL3JlbmRlcmluZy9SZW5k
ZXJPYmplY3QuaApAQCAtMjU2LDM0ICsyNTYsMzYgQEAgcHJpdmF0ZToKIHB1YmxpYzoKICAgICBS
ZW5kZXJBcmVuYSogcmVuZGVyQXJlbmEoKSBjb25zdCB7IHJldHVybiBkb2N1bWVudCgpLT5yZW5k
ZXJBcmVuYSgpOyB9CiAKLSAgICB2aXJ0dWFsIGJvb2wgaXNSZW5kZXJCbG9jaygpIGNvbnN0IHsg
cmV0dXJuIGZhbHNlOyB9Ci0gICAgdmlydHVhbCBib29sIGlzUmVuZGVySW5saW5lKCkgY29uc3Qg
eyByZXR1cm4gZmFsc2U7IH0KLSAgICB2aXJ0dWFsIGJvb2wgaXNSZW5kZXJJbWFnZSgpIGNvbnN0
IHsgcmV0dXJuIGZhbHNlOyB9Ci0gICAgdmlydHVhbCBib29sIGlzSW5saW5lRmxvdygpIGNvbnN0
IHsgcmV0dXJuIGZhbHNlOyB9CisgICAgdmlydHVhbCBib29sIGlzQXBwbGV0KCkgY29uc3QgeyBy
ZXR1cm4gZmFsc2U7IH0KKyAgICB2aXJ0dWFsIGJvb2wgaXNCUigpIGNvbnN0IHsgcmV0dXJuIGZh
bHNlOyB9CiAgICAgdmlydHVhbCBib29sIGlzQmxvY2tGbG93KCkgY29uc3QgeyByZXR1cm4gZmFs
c2U7IH0KKyAgICB2aXJ0dWFsIGJvb2wgaXNDb3VudGVyKCkgY29uc3QgeyByZXR1cm4gZmFsc2U7
IH0KKyAgICB2aXJ0dWFsIGJvb2wgaXNGcmFtZSgpIGNvbnN0IHsgcmV0dXJuIGZhbHNlOyB9Cisg
ICAgdmlydHVhbCBib29sIGlzRnJhbWVTZXQoKSBjb25zdCB7IHJldHVybiBmYWxzZTsgfQorICAg
IHZpcnR1YWwgYm9vbCBpc0ltYWdlKCkgY29uc3QgeyByZXR1cm4gZmFsc2U7IH0KICAgICB2aXJ0
dWFsIGJvb2wgaXNJbmxpbmVCbG9ja09ySW5saW5lVGFibGUoKSBjb25zdCB7IHJldHVybiBmYWxz
ZTsgfQogICAgIHZpcnR1YWwgYm9vbCBpc0lubGluZUNvbnRpbnVhdGlvbigpIGNvbnN0OworICAg
IHZpcnR1YWwgYm9vbCBpc0lubGluZUZsb3coKSBjb25zdCB7IHJldHVybiBmYWxzZTsgfQorICAg
IHZpcnR1YWwgYm9vbCBpc0xpc3RCb3goKSBjb25zdCB7IHJldHVybiBmYWxzZTsgfQogICAgIHZp
cnR1YWwgYm9vbCBpc0xpc3RJdGVtKCkgY29uc3QgeyByZXR1cm4gZmFsc2U7IH0KICAgICB2aXJ0
dWFsIGJvb2wgaXNMaXN0TWFya2VyKCkgY29uc3QgeyByZXR1cm4gZmFsc2U7IH0KLSAgICB2aXJ0
dWFsIGJvb2wgaXNDb3VudGVyKCkgY29uc3QgeyByZXR1cm4gZmFsc2U7IH0KKyAgICB2aXJ0dWFs
IGJvb2wgaXNNZWRpYSgpIGNvbnN0IHsgcmV0dXJuIGZhbHNlOyB9CisgICAgdmlydHVhbCBib29s
IGlzTWVudUxpc3QoKSBjb25zdCB7IHJldHVybiBmYWxzZTsgfQorICAgIHZpcnR1YWwgYm9vbCBp
c1JlbmRlckJsb2NrKCkgY29uc3QgeyByZXR1cm4gZmFsc2U7IH0KKyAgICB2aXJ0dWFsIGJvb2wg
aXNSZW5kZXJJbWFnZSgpIGNvbnN0IHsgcmV0dXJuIGZhbHNlOyB9CisgICAgdmlydHVhbCBib29s
IGlzUmVuZGVySW5saW5lKCkgY29uc3QgeyByZXR1cm4gZmFsc2U7IH0KKyAgICB2aXJ0dWFsIGJv
b2wgaXNSZW5kZXJQYXJ0KCkgY29uc3QgeyByZXR1cm4gZmFsc2U7IH0KICAgICB2aXJ0dWFsIGJv
b2wgaXNSZW5kZXJWaWV3KCkgY29uc3QgeyByZXR1cm4gZmFsc2U7IH0KLSAgICB2aXJ0dWFsIGJv
b2wgaXNCUigpIGNvbnN0IHsgcmV0dXJuIGZhbHNlOyB9CisgICAgdmlydHVhbCBib29sIGlzU2xp
ZGVyKCkgY29uc3QgeyByZXR1cm4gZmFsc2U7IH0KKyAgICB2aXJ0dWFsIGJvb2wgaXNUYWJsZSgp
IGNvbnN0IHsgcmV0dXJuIGZhbHNlOyB9CiAgICAgdmlydHVhbCBib29sIGlzVGFibGVDZWxsKCkg
Y29uc3QgeyByZXR1cm4gZmFsc2U7IH0KKyAgICB2aXJ0dWFsIGJvb2wgaXNUYWJsZUNvbCgpIGNv
bnN0IHsgcmV0dXJuIGZhbHNlOyB9CiAgICAgdmlydHVhbCBib29sIGlzVGFibGVSb3coKSBjb25z
dCB7IHJldHVybiBmYWxzZTsgfQogICAgIHZpcnR1YWwgYm9vbCBpc1RhYmxlU2VjdGlvbigpIGNv
bnN0IHsgcmV0dXJuIGZhbHNlOyB9Ci0gICAgdmlydHVhbCBib29sIGlzVGFibGVDb2woKSBjb25z
dCB7IHJldHVybiBmYWxzZTsgfQotICAgIHZpcnR1YWwgYm9vbCBpc1RhYmxlKCkgY29uc3QgeyBy
ZXR1cm4gZmFsc2U7IH0KLSAgICB2aXJ0dWFsIGJvb2wgaXNXaWRnZXQoKSBjb25zdCB7IHJldHVy
biBmYWxzZTsgfQotICAgIHZpcnR1YWwgYm9vbCBpc0ltYWdlKCkgY29uc3QgeyByZXR1cm4gZmFs
c2U7IH0KICAgICB2aXJ0dWFsIGJvb2wgaXNUZXh0QXJlYSgpIGNvbnN0IHsgcmV0dXJuIGZhbHNl
OyB9CiAgICAgdmlydHVhbCBib29sIGlzVGV4dEZpZWxkKCkgY29uc3QgeyByZXR1cm4gZmFsc2U7
IH0KLSAgICB2aXJ0dWFsIGJvb2wgaXNGcmFtZSgpIGNvbnN0IHsgcmV0dXJuIGZhbHNlOyB9Ci0g
ICAgdmlydHVhbCBib29sIGlzRnJhbWVTZXQoKSBjb25zdCB7IHJldHVybiBmYWxzZTsgfQotICAg
IHZpcnR1YWwgYm9vbCBpc0FwcGxldCgpIGNvbnN0IHsgcmV0dXJuIGZhbHNlOyB9Ci0gICAgdmly
dHVhbCBib29sIGlzTWVudUxpc3QoKSBjb25zdCB7IHJldHVybiBmYWxzZTsgfQotICAgIHZpcnR1
YWwgYm9vbCBpc0xpc3RCb3goKSBjb25zdCB7IHJldHVybiBmYWxzZTsgfQotICAgIHZpcnR1YWwg
Ym9vbCBpc1NsaWRlcigpIGNvbnN0IHsgcmV0dXJuIGZhbHNlOyB9Ci0gICAgdmlydHVhbCBib29s
IGlzTWVkaWEoKSBjb25zdCB7IHJldHVybiBmYWxzZTsgfQorICAgIHZpcnR1YWwgYm9vbCBpc1dp
ZGdldCgpIGNvbnN0IHsgcmV0dXJuIGZhbHNlOyB9CisKIAogICAgIGJvb2wgaXNSb290KCkgY29u
c3QgeyByZXR1cm4gZG9jdW1lbnQoKS0+ZG9jdW1lbnRFbGVtZW50KCkgPT0gbm9kZSgpOyB9CiAg
ICAgYm9vbCBpc0JvZHkoKSBjb25zdDsKZGlmZiAtLWdpdCBhL1dlYkNvcmUvcmVuZGVyaW5nL1Jl
bmRlclBhcnQuaCBiL1dlYkNvcmUvcmVuZGVyaW5nL1JlbmRlclBhcnQuaAppbmRleCAzZTVmMTZm
Li5lMzM5NDY4IDEwMDY0NAotLS0gYS9XZWJDb3JlL3JlbmRlcmluZy9SZW5kZXJQYXJ0LmgKKysr
IGIvV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyUGFydC5oCkBAIC0zNyw2ICszNyw3IEBAIHB1Ymxp
YzoKICAgICBSZW5kZXJQYXJ0KEhUTUxGcmFtZU93bmVyRWxlbWVudCopOwogICAgIHZpcnR1YWwg
flJlbmRlclBhcnQoKTsKICAgICAKKyAgICB2aXJ0dWFsIGJvb2wgaXNSZW5kZXJQYXJ0KCkgY29u
c3QgeyByZXR1cm4gdHJ1ZTsgfQogICAgIHZpcnR1YWwgY29uc3QgY2hhciogcmVuZGVyTmFtZSgp
IGNvbnN0IHsgcmV0dXJuICJSZW5kZXJQYXJ0IjsgfQogCiAgICAgdmlydHVhbCB2b2lkIHNldFdp
ZGdldChXaWRnZXQqKTsKQEAgLTU0LDggKzU1LDYgQEAgcHJvdGVjdGVkOgogCiBwcml2YXRlOgog
ICAgIHZpcnR1YWwgdm9pZCBkZWxldGVXaWRnZXQoKTsKLQotICAgIEZyYW1lKiBtX2ZyYW1lOwog
fTsKIAogfQo=
</data>

          </attachment>
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>20671</attachid>
            <date>2008-04-18 10:50:06 -0700</date>
            <delta_ts>2008-04-18 13:27:16 -0700</delta_ts>
            <desc>Actually fix the ASSERT/potential crasher</desc>
            <filename>fix.patch</filename>
            <type>text/plain</type>
            <size>5316</size>
            <attacher name="Eric Seidel (no email)">eric</attacher>
            
              <data encoding="base64">ZGlmZiAtLWdpdCBhL1dlYkNvcmUvcGFnZS9GcmFtZS5jcHAgYi9XZWJDb3JlL3BhZ2UvRnJhbWUu
Y3BwCmluZGV4IGZmYmI1OWEuLmE1MDZlNDkgMTAwNjQ0Ci0tLSBhL1dlYkNvcmUvcGFnZS9GcmFt
ZS5jcHAKKysrIGIvV2ViQ29yZS9wYWdlL0ZyYW1lLmNwcApAQCAtMTE2OSw2ICsxMTY5LDggQEAg
UmVuZGVyVmlldyogRnJhbWU6OmNvbnRlbnRSZW5kZXJlcigpIGNvbnN0CiAgICAgaWYgKCFkb2Mp
CiAgICAgICAgIHJldHVybiAwOwogICAgIFJlbmRlck9iamVjdCogb2JqZWN0ID0gZG9jLT5yZW5k
ZXJlcigpOworICAgIGlmICghb2JqZWN0KQorICAgICAgICByZXR1cm4gMDsKICAgICBBU1NFUlQo
b2JqZWN0LT5pc1JlbmRlclZpZXcoKSk7CiAgICAgcmV0dXJuIHN0YXRpY19jYXN0PFJlbmRlclZp
ZXcqPihvYmplY3QpOwogfQpAQCAtMTE4Myw3ICsxMTg1LDE2IEBAIFJlbmRlclBhcnQqIEZyYW1l
Ojpvd25lclJlbmRlcmVyKCkgY29uc3QKICAgICBIVE1MRnJhbWVPd25lckVsZW1lbnQqIG93bmVy
RWxlbWVudCA9IGQtPm1fb3duZXJFbGVtZW50OwogICAgIGlmICghb3duZXJFbGVtZW50KQogICAg
ICAgICByZXR1cm4gMDsKLSAgICByZXR1cm4gc3RhdGljX2Nhc3Q8UmVuZGVyUGFydCo+KG93bmVy
RWxlbWVudC0+cmVuZGVyZXIoKSk7CisgICAgUmVuZGVyT2JqZWN0KiBvYmplY3QgPSBvd25lckVs
ZW1lbnQtPnJlbmRlcmVyKCk7CisgICAgaWYgKCFvYmplY3QpCisgICAgICAgIHJldHVybiAwOwor
ICAgIC8vIEZJWE1FOiBJZiA8b2JqZWN0PiBpcyBldmVyIGZpeGVkIHRvIGRpc2Fzc29jaWF0ZSBp
dHNlbGYgZnJvbSBmcmFtZXMKKyAgICAvLyB0aGF0IGl0IGhhcyBzdGFydGVkIGJ1dCBjYW5jZWxl
ZCwgdGhlbiB0aGlzIGNhbiB0dXJuIGludG8gYW4gQVNTRVJUCisgICAgLy8gc2luY2UgZC0+bV9v
d25lckVsZW1lbnQgd291bGQgYmUgMCB3aGVuIHRoZSBsb2FkIGlzIGNhbmNlbGVkLgorICAgIC8v
IGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xODU4NQorICAgIGlmICgh
b2JqZWN0LT5pc1JlbmRlclBhcnQoKSkKKyAgICAgICAgcmV0dXJuIDA7CisgICAgcmV0dXJuIHN0
YXRpY19jYXN0PFJlbmRlclBhcnQqPihvYmplY3QpOwogfQogCiAvLyByZXR1cm5zIEZsb2F0UmVj
dCBiZWNhdXNlIGdvaW5nIHRocm91Z2ggSW50UmVjdCB3b3VsZCB0cnVuY2F0ZSBhbnkgZmxvYXRz
CmRpZmYgLS1naXQgYS9XZWJDb3JlL3BhZ2UvRnJhbWVWaWV3LmNwcCBiL1dlYkNvcmUvcGFnZS9G
cmFtZVZpZXcuY3BwCmluZGV4IGRiZTg3ZDcuLjVhMjVjYWEgMTAwNjQ0Ci0tLSBhL1dlYkNvcmUv
cGFnZS9GcmFtZVZpZXcuY3BwCisrKyBiL1dlYkNvcmUvcGFnZS9GcmFtZVZpZXcuY3BwCkBAIC00
OTAsOSArNDkwLDcgQEAgdm9pZCBGcmFtZVZpZXc6OmxheW91dChib29sIGFsbG93U3VidHJlZSkK
ICAgIAogICAgIGQtPmxheW91dFNjaGVkdWxpbmdFbmFibGVkID0gdHJ1ZTsKIAotICAgIC8vIEZJ
WE1FOiBpcyByb290IGFsd2F5cyBhIFJlbmRlclZpZXc/IGlmIHNvLCBzdGF0aWNfY2FzdCBhdCBp
bml0aWFsaXphdGlvbgotICAgIEFTU0VSVChyb290LT5pc1JlbmRlclZpZXcoKSk7Ci0gICAgaWYg
KCFzdWJ0cmVlICYmICFzdGF0aWNfY2FzdDxSZW5kZXJWaWV3Kj4ocm9vdCktPnByaW50aW5nKCkp
CisgICAgaWYgKCFzdWJ0cmVlICYmICghcm9vdC0+aXNSZW5kZXJWaWV3KCkgfHwgIXN0YXRpY19j
YXN0PFJlbmRlclZpZXcqPihyb290KS0+cHJpbnRpbmcoKSkpCiAgICAgICAgIGFkanVzdFZpZXdT
aXplKCk7CiAKICAgICAvLyBOb3cgdXBkYXRlIHRoZSBwb3NpdGlvbnMgb2YgYWxsIGxheWVycy4K
ZGlmZiAtLWdpdCBhL1dlYkNvcmUvcmVuZGVyaW5nL1JlbmRlck9iamVjdC5oIGIvV2ViQ29yZS9y
ZW5kZXJpbmcvUmVuZGVyT2JqZWN0LmgKaW5kZXggMTZmMzg1NC4uNWI1ZGNmMiAxMDA2NDQKLS0t
IGEvV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyT2JqZWN0LmgKKysrIGIvV2ViQ29yZS9yZW5kZXJp
bmcvUmVuZGVyT2JqZWN0LmgKQEAgLTI1NiwzNCArMjU2LDM2IEBAIHByaXZhdGU6CiBwdWJsaWM6
CiAgICAgUmVuZGVyQXJlbmEqIHJlbmRlckFyZW5hKCkgY29uc3QgeyByZXR1cm4gZG9jdW1lbnQo
KS0+cmVuZGVyQXJlbmEoKTsgfQogCi0gICAgdmlydHVhbCBib29sIGlzUmVuZGVyQmxvY2soKSBj
b25zdCB7IHJldHVybiBmYWxzZTsgfQotICAgIHZpcnR1YWwgYm9vbCBpc1JlbmRlcklubGluZSgp
IGNvbnN0IHsgcmV0dXJuIGZhbHNlOyB9Ci0gICAgdmlydHVhbCBib29sIGlzUmVuZGVySW1hZ2Uo
KSBjb25zdCB7IHJldHVybiBmYWxzZTsgfQotICAgIHZpcnR1YWwgYm9vbCBpc0lubGluZUZsb3co
KSBjb25zdCB7IHJldHVybiBmYWxzZTsgfQorICAgIHZpcnR1YWwgYm9vbCBpc0FwcGxldCgpIGNv
bnN0IHsgcmV0dXJuIGZhbHNlOyB9CisgICAgdmlydHVhbCBib29sIGlzQlIoKSBjb25zdCB7IHJl
dHVybiBmYWxzZTsgfQogICAgIHZpcnR1YWwgYm9vbCBpc0Jsb2NrRmxvdygpIGNvbnN0IHsgcmV0
dXJuIGZhbHNlOyB9CisgICAgdmlydHVhbCBib29sIGlzQ291bnRlcigpIGNvbnN0IHsgcmV0dXJu
IGZhbHNlOyB9CisgICAgdmlydHVhbCBib29sIGlzRnJhbWUoKSBjb25zdCB7IHJldHVybiBmYWxz
ZTsgfQorICAgIHZpcnR1YWwgYm9vbCBpc0ZyYW1lU2V0KCkgY29uc3QgeyByZXR1cm4gZmFsc2U7
IH0KKyAgICB2aXJ0dWFsIGJvb2wgaXNJbWFnZSgpIGNvbnN0IHsgcmV0dXJuIGZhbHNlOyB9CiAg
ICAgdmlydHVhbCBib29sIGlzSW5saW5lQmxvY2tPcklubGluZVRhYmxlKCkgY29uc3QgeyByZXR1
cm4gZmFsc2U7IH0KICAgICB2aXJ0dWFsIGJvb2wgaXNJbmxpbmVDb250aW51YXRpb24oKSBjb25z
dDsKKyAgICB2aXJ0dWFsIGJvb2wgaXNJbmxpbmVGbG93KCkgY29uc3QgeyByZXR1cm4gZmFsc2U7
IH0KKyAgICB2aXJ0dWFsIGJvb2wgaXNMaXN0Qm94KCkgY29uc3QgeyByZXR1cm4gZmFsc2U7IH0K
ICAgICB2aXJ0dWFsIGJvb2wgaXNMaXN0SXRlbSgpIGNvbnN0IHsgcmV0dXJuIGZhbHNlOyB9CiAg
ICAgdmlydHVhbCBib29sIGlzTGlzdE1hcmtlcigpIGNvbnN0IHsgcmV0dXJuIGZhbHNlOyB9Ci0g
ICAgdmlydHVhbCBib29sIGlzQ291bnRlcigpIGNvbnN0IHsgcmV0dXJuIGZhbHNlOyB9CisgICAg
dmlydHVhbCBib29sIGlzTWVkaWEoKSBjb25zdCB7IHJldHVybiBmYWxzZTsgfQorICAgIHZpcnR1
YWwgYm9vbCBpc01lbnVMaXN0KCkgY29uc3QgeyByZXR1cm4gZmFsc2U7IH0KKyAgICB2aXJ0dWFs
IGJvb2wgaXNSZW5kZXJCbG9jaygpIGNvbnN0IHsgcmV0dXJuIGZhbHNlOyB9CisgICAgdmlydHVh
bCBib29sIGlzUmVuZGVySW1hZ2UoKSBjb25zdCB7IHJldHVybiBmYWxzZTsgfQorICAgIHZpcnR1
YWwgYm9vbCBpc1JlbmRlcklubGluZSgpIGNvbnN0IHsgcmV0dXJuIGZhbHNlOyB9CisgICAgdmly
dHVhbCBib29sIGlzUmVuZGVyUGFydCgpIGNvbnN0IHsgcmV0dXJuIGZhbHNlOyB9CiAgICAgdmly
dHVhbCBib29sIGlzUmVuZGVyVmlldygpIGNvbnN0IHsgcmV0dXJuIGZhbHNlOyB9Ci0gICAgdmly
dHVhbCBib29sIGlzQlIoKSBjb25zdCB7IHJldHVybiBmYWxzZTsgfQorICAgIHZpcnR1YWwgYm9v
bCBpc1NsaWRlcigpIGNvbnN0IHsgcmV0dXJuIGZhbHNlOyB9CisgICAgdmlydHVhbCBib29sIGlz
VGFibGUoKSBjb25zdCB7IHJldHVybiBmYWxzZTsgfQogICAgIHZpcnR1YWwgYm9vbCBpc1RhYmxl
Q2VsbCgpIGNvbnN0IHsgcmV0dXJuIGZhbHNlOyB9CisgICAgdmlydHVhbCBib29sIGlzVGFibGVD
b2woKSBjb25zdCB7IHJldHVybiBmYWxzZTsgfQogICAgIHZpcnR1YWwgYm9vbCBpc1RhYmxlUm93
KCkgY29uc3QgeyByZXR1cm4gZmFsc2U7IH0KICAgICB2aXJ0dWFsIGJvb2wgaXNUYWJsZVNlY3Rp
b24oKSBjb25zdCB7IHJldHVybiBmYWxzZTsgfQotICAgIHZpcnR1YWwgYm9vbCBpc1RhYmxlQ29s
KCkgY29uc3QgeyByZXR1cm4gZmFsc2U7IH0KLSAgICB2aXJ0dWFsIGJvb2wgaXNUYWJsZSgpIGNv
bnN0IHsgcmV0dXJuIGZhbHNlOyB9Ci0gICAgdmlydHVhbCBib29sIGlzV2lkZ2V0KCkgY29uc3Qg
eyByZXR1cm4gZmFsc2U7IH0KLSAgICB2aXJ0dWFsIGJvb2wgaXNJbWFnZSgpIGNvbnN0IHsgcmV0
dXJuIGZhbHNlOyB9CiAgICAgdmlydHVhbCBib29sIGlzVGV4dEFyZWEoKSBjb25zdCB7IHJldHVy
biBmYWxzZTsgfQogICAgIHZpcnR1YWwgYm9vbCBpc1RleHRGaWVsZCgpIGNvbnN0IHsgcmV0dXJu
IGZhbHNlOyB9Ci0gICAgdmlydHVhbCBib29sIGlzRnJhbWUoKSBjb25zdCB7IHJldHVybiBmYWxz
ZTsgfQotICAgIHZpcnR1YWwgYm9vbCBpc0ZyYW1lU2V0KCkgY29uc3QgeyByZXR1cm4gZmFsc2U7
IH0KLSAgICB2aXJ0dWFsIGJvb2wgaXNBcHBsZXQoKSBjb25zdCB7IHJldHVybiBmYWxzZTsgfQot
ICAgIHZpcnR1YWwgYm9vbCBpc01lbnVMaXN0KCkgY29uc3QgeyByZXR1cm4gZmFsc2U7IH0KLSAg
ICB2aXJ0dWFsIGJvb2wgaXNMaXN0Qm94KCkgY29uc3QgeyByZXR1cm4gZmFsc2U7IH0KLSAgICB2
aXJ0dWFsIGJvb2wgaXNTbGlkZXIoKSBjb25zdCB7IHJldHVybiBmYWxzZTsgfQotICAgIHZpcnR1
YWwgYm9vbCBpc01lZGlhKCkgY29uc3QgeyByZXR1cm4gZmFsc2U7IH0KKyAgICB2aXJ0dWFsIGJv
b2wgaXNXaWRnZXQoKSBjb25zdCB7IHJldHVybiBmYWxzZTsgfQorCiAKICAgICBib29sIGlzUm9v
dCgpIGNvbnN0IHsgcmV0dXJuIGRvY3VtZW50KCktPmRvY3VtZW50RWxlbWVudCgpID09IG5vZGUo
KTsgfQogICAgIGJvb2wgaXNCb2R5KCkgY29uc3Q7CmRpZmYgLS1naXQgYS9XZWJDb3JlL3JlbmRl
cmluZy9SZW5kZXJQYXJ0LmggYi9XZWJDb3JlL3JlbmRlcmluZy9SZW5kZXJQYXJ0LmgKaW5kZXgg
M2U1ZjE2Zi4uZTMzOTQ2OCAxMDA2NDQKLS0tIGEvV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyUGFy
dC5oCisrKyBiL1dlYkNvcmUvcmVuZGVyaW5nL1JlbmRlclBhcnQuaApAQCAtMzcsNiArMzcsNyBA
QCBwdWJsaWM6CiAgICAgUmVuZGVyUGFydChIVE1MRnJhbWVPd25lckVsZW1lbnQqKTsKICAgICB2
aXJ0dWFsIH5SZW5kZXJQYXJ0KCk7CiAgICAgCisgICAgdmlydHVhbCBib29sIGlzUmVuZGVyUGFy
dCgpIGNvbnN0IHsgcmV0dXJuIHRydWU7IH0KICAgICB2aXJ0dWFsIGNvbnN0IGNoYXIqIHJlbmRl
ck5hbWUoKSBjb25zdCB7IHJldHVybiAiUmVuZGVyUGFydCI7IH0KIAogICAgIHZpcnR1YWwgdm9p
ZCBzZXRXaWRnZXQoV2lkZ2V0Kik7CkBAIC01NCw4ICs1NSw2IEBAIHByb3RlY3RlZDoKIAogcHJp
dmF0ZToKICAgICB2aXJ0dWFsIHZvaWQgZGVsZXRlV2lkZ2V0KCk7Ci0KLSAgICBGcmFtZSogbV9m
cmFtZTsKIH07CiAKIH0K
</data>
<flag name="review"
          id="9024"
          type_id="1"
          status="+"
          setter="darin"
    />
          </attachment>
      

    </bug>

</bugzilla>