<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>191155</bug_id>
          
          <creation_ts>2018-11-01 10:04:22 -0700</creation_ts>
          <short_desc>SimulatedInputDispatcher::transitionInputSourceToState() can reuse a moved-from completion handler</short_desc>
          <delta_ts>2018-12-11 09:39:26 -0800</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>WebDriver</component>
          <version>WebKit Nightly Build</version>
          <rep_platform>Unspecified</rep_platform>
          <op_sys>Unspecified</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          <see_also>https://bugs.webkit.org/show_bug.cgi?id=192424</see_also>
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>InRadar</keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Zan Dobersek">zan</reporter>
          <assigned_to name="Blaze Burg">bburg</assigned_to>
          <cc>bburg</cc>
    
    <cc>cgarcia</cc>
    
    <cc>commit-queue</cc>
    
    <cc>joepeck</cc>
    
    <cc>mcatanzaro</cc>
    
    <cc>thorton</cc>
    
    <cc>timothy</cc>
    
    <cc>webkit-bug-importer</cc>
    
    <cc>zan</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>1474148</commentid>
    <comment_count>0</comment_count>
    <who name="Zan Dobersek">zan</who>
    <bug_when>2018-11-01 10:04:22 -0700</bug_when>
    <thetext>In the SimulatedInputDispatcher::transitionInputSourceToState() method, the `eventDispatchFinished` completion handler can be incorrectly reused when multiple WebAutomationSession::simulateKeyboardInteraction() calls are done.

This can specifically happen when keyboard input simulation ends up adjusting to differences between the current and the new state of pressed virtual keys. As soon as two or more virtual keys are different between the states, the corresponding simulateKeyboardInteraction() invocations are dispatched. Problem is that while the first invocation moves out from the `eventDispatchFinished` variable that contains the completion handler, the second dispatch (and any additional ones) does the same -- on an already moved-out variable.

This results in a crash later in WebAutomationSession, when the completion handlers stored in the `m_pendingKeyboardEventsFlushedCallbacksPerPage` HashMap are retrieved from there and dispatched.

I don&apos;t know if this is a problem in any of the currently-imported WebDriver tests, but it was observed in existing WebDriver tests in the web-platform-tests suite.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1474149</commentid>
    <comment_count>1</comment_count>
    <who name="Zan Dobersek">zan</who>
    <bug_when>2018-11-01 10:05:42 -0700</bug_when>
    <thetext>(In reply to Zan Dobersek from comment #0)
&gt; In the SimulatedInputDispatcher::transitionInputSourceToState() method, the
&gt; `eventDispatchFinished` completion handler can be incorrectly reused when
&gt; multiple WebAutomationSession::simulateKeyboardInteraction() calls are done.
&gt; 

Here&apos;s the problematic code:
https://trac.webkit.org/browser/webkit/trunk/Source/WebKit/UIProcess/Automation/SimulatedInputDispatcher.cpp#L299</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1474302</commentid>
    <comment_count>2</comment_count>
    <who name="Radar WebKit Bug Importer">webkit-bug-importer</who>
    <bug_when>2018-11-01 15:50:47 -0700</bug_when>
    <thetext>&lt;rdar://problem/45745569&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1474303</commentid>
    <comment_count>3</comment_count>
    <who name="Blaze Burg">bburg</who>
    <bug_when>2018-11-01 15:50:55 -0700</bug_when>
    <thetext>Zan, what wpt test cases does this affect?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1474805</commentid>
    <comment_count>4</comment_count>
    <who name="Zan Dobersek">zan</who>
    <bug_when>2018-11-03 12:20:32 -0700</bug_when>
    <thetext>This crash occurs at least on the /webdriver/tests/perform_actions/key_modifiers.py test, as contained in the tip-of-tree wpt repository:
https://github.com/web-platform-tests/wpt/blob/master/webdriver/tests/perform_actions/key_modifiers.py

This happens on the `test_shift_modifier_and_non_printable_keys` subtest.

In the first meaningful SimulatedInputDispatcher::transitionInputSourceToState() invocation, the new state&apos;s pressed-virtual-keys set only contains the Shift key, as expected. In the following invocation, the new state&apos;s pressed-virtual-keys set only contains the Backspace key. This means the Backspace key press is simulated first, followed by the Shift key release. Upon that second simulation the `eventDispatchFinished` functor is already empty because of the first WTFMove().

Here&apos;s the backtrace that leads to the crash (which occurs later, when flushing pending events):

#0  0x00007f3c57ea3045 in WTF::Function&lt;void (std::optional&lt;WebKit::AutomationCommandError&gt;)&gt;::CallableWrapper&lt;WebKit::WebAutomationSession::simulateKeyboardInteraction(WebKit::WebPageProxy&amp;, Inspector::Protocol::Automation::KeyboardInteractionType, WTF::Variant&lt;Inspector::Protocol::Automation::VirtualKey, char&gt;&amp;&amp;, WTF::CompletionHandler&lt;void (std::optional&lt;WebKit::AutomationCommandError&gt;)&gt;&amp;&amp;)::{lambda(std::optional&lt;WebKit::AutomationCommandError&gt;)#1}&gt;::call(std::optional&lt;WebKit::AutomationCommandError&gt;) () from /home/zan/Work/webkit/git/WebKitBuild/Release/lib/libWPEWebKit-0.1.so.2
#1  0x00007f3c57eaba37 in WebKit::WebAutomationSession::keyboardEventsFlushedForPage(WebKit::WebPageProxy const&amp;) () from /home/zan/Work/webkit/git/WebKitBuild/Release/lib/libWPEWebKit-0.1.so.2
#2  0x00007f3c57dd8a02 in WebKit::WebPageProxy::didReceiveEvent(unsigned int, bool) () from /home/zan/Work/webkit/git/WebKitBuild/Release/lib/libWPEWebKit-0.1.so.2
#3  0x00007f3c57c10af5 in WebKit::WebPageProxy::didReceiveMessage(IPC::Connection&amp;, IPC::Decoder&amp;) () from /home/zan/Work/webkit/git/WebKitBuild/Release/lib/libWPEWebKit-0.1.so.2
#4  0x00007f3c57d1aab3 in IPC::MessageReceiverMap::dispatchMessage(IPC::Connection&amp;, IPC::Decoder&amp;) () from /home/zan/Work/webkit/git/WebKitBuild/Release/lib/libWPEWebKit-0.1.so.2
#5  0x00007f3c57e0400f in non-virtual thunk to WebKit::WebProcessProxy::didReceiveMessage(IPC::Connection&amp;, IPC::Decoder&amp;) [clone .localalias.1033] () from /home/zan/Work/webkit/git/WebKitBuild/Release/lib/libWPEWebKit-0.1.so.2
#6  0x00007f3c57d1418f in IPC::Connection::dispatchMessage(IPC::Decoder&amp;) () from /home/zan/Work/webkit/git/WebKitBuild/Release/lib/libWPEWebKit-0.1.so.2
#7  0x00007f3c57d159fb in IPC::Connection::dispatchMessage(std::unique_ptr&lt;IPC::Decoder, std::default_delete&lt;IPC::Decoder&gt; &gt;) () from /home/zan/Work/webkit/git/WebKitBuild/Release/lib/libWPEWebKit-0.1.so.2
#8  0x00007f3c57d16548 in IPC::Connection::dispatchIncomingMessages() () from /home/zan/Work/webkit/git/WebKitBuild/Release/lib/libWPEWebKit-0.1.so.2
#9  0x00007f3c5a1f6ffd in WTF::RunLoop::performWork() () from /home/zan/Work/webkit/git/WebKitBuild/Release/lib/libWPEWebKit-0.1.so.2
#10 0x00007f3c5a232f69 in WTF::RunLoop::RunLoop()::{lambda(void*)#1}::_FUN(void*) () from /home/zan/Work/webkit/git/WebKitBuild/Release/lib/libWPEWebKit-0.1.so.2
#11 0x00007f3c51897888 in g_main_dispatch (context=0x56312a8bd040) at /home/zan/Work/webkit/git/WebKitBuild/DependenciesWPE/Source/glib-2.54.3/glib/gmain.c:3142
#12 g_main_context_dispatch (context=context@entry=0x56312a8bd040) at /home/zan/Work/webkit/git/WebKitBuild/DependenciesWPE/Source/glib-2.54.3/glib/gmain.c:3795
#13 0x00007f3c51897c48 in g_main_context_iterate (context=0x56312a8bd040, block=block@entry=1, dispatch=dispatch@entry=1, self=&lt;optimized out&gt;) at /home/zan/Work/webkit/git/WebKitBuild/DependenciesWPE/Source/glib-2.54.3/glib/gmain.c:3868
#14 0x00007f3c51897f32 in g_main_loop_run (loop=0x56312a8bd590) at /home/zan/Work/webkit/git/WebKitBuild/DependenciesWPE/Source/glib-2.54.3/glib/gmain.c:4064
#15 0x0000563128aa69f5 in main ()</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1485339</commentid>
    <comment_count>5</comment_count>
    <who name="Blaze Burg">bburg</who>
    <bug_when>2018-12-05 11:39:34 -0800</bug_when>
    <thetext>Hi Zan, I looked into this some more. The code does indeed move the completion and operate in a loop. This doesn&apos;t affect safaridriver because it sends a differently formatted interaction sequence. safaridriver&apos;s sequence makes a separate state for each virtual key change. Thus, the problematic loop only ever executes once.

I&apos;d prefer to add a return in the loop so it can&apos;t possibly simulate &gt;1 action. Then, fix webkitdriver to emit more intermediate events.

It might be possible to use an accumulator-like thing so that such inputs are acceptable input for SimulatedInputDispatcher, but this code is already really async and it will be hard to get it right.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1485340</commentid>
    <comment_count>6</comment_count>
      <attachid>356628</attachid>
    <who name="Blaze Burg">bburg</who>
    <bug_when>2018-12-05 11:39:56 -0800</bug_when>
    <thetext>Created attachment 356628
REST API and Automation Protocol trace (safaridriver)</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1485341</commentid>
    <comment_count>7</comment_count>
      <attachid>356628</attachid>
    <who name="Blaze Burg">bburg</who>
    <bug_when>2018-12-05 11:41:29 -0800</bug_when>
    <thetext>Comment on attachment 356628
REST API and Automation Protocol trace (safaridriver)

In the 2nd and 3rd from last state, you can see that pressedVirtualKeys only changes once at a time. I&apos;d prefer we keep that semantics so that the ordering of virtual key presses is deterministic.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1485404</commentid>
    <comment_count>8</comment_count>
      <attachid>356649</attachid>
    <who name="Blaze Burg">bburg</who>
    <bug_when>2018-12-05 13:22:46 -0800</bug_when>
    <thetext>Created attachment 356649
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1486813</commentid>
    <comment_count>9</comment_count>
      <attachid>356649</attachid>
    <who name="Joseph Pecoraro">joepeck</who>
    <bug_when>2018-12-10 16:40:31 -0800</bug_when>
    <thetext>Comment on attachment 356649
Patch

r=me</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1486951</commentid>
    <comment_count>10</comment_count>
      <attachid>356649</attachid>
    <who name="WebKit Commit Bot">commit-queue</who>
    <bug_when>2018-12-11 09:39:24 -0800</bug_when>
    <thetext>Comment on attachment 356649
Patch

Clearing flags on attachment: 356649

Committed r239074: &lt;https://trac.webkit.org/changeset/239074&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1486952</commentid>
    <comment_count>11</comment_count>
    <who name="WebKit Commit Bot">commit-queue</who>
    <bug_when>2018-12-11 09:39:26 -0800</bug_when>
    <thetext>All reviewed patches have been landed.  Closing bug.</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="0"
              isprivate="0"
          >
            <attachid>356628</attachid>
            <date>2018-12-05 11:39:56 -0800</date>
            <delta_ts>2018-12-05 11:40:05 -0800</delta_ts>
            <desc>REST API and Automation Protocol trace (safaridriver)</desc>
            <filename>intermediates.txt</filename>
            <type>text/plain</type>
            <size>3087</size>
            <attacher name="Blaze Burg">bburg</attacher>
            
              <data encoding="base64">UkVTVCBBUEkKPT09PT09PT0KCkhUVFBTZXJ2ZXI6IFBPU1QgaHR0cDovL2xvY2FsaG9zdDo0NDQ0
L3Nlc3Npb24vNTE3NEE0NUYtQzZERS00N0VGLTg5OTAtQUE2NEMzMjg1Mzg3L2FjdGlvbnMKSFRU
UFNlcnZlcjoKewogICJhY3Rpb25zIjogWwogICAgewogICAgICAidHlwZSI6ICJrZXkiLAogICAg
ICAiaWQiOiAia2V5Ym9hcmRfaWQiLAogICAgICAiYWN0aW9ucyI6IFsKICAgICAgICB7CiAgICAg
ICAgICAidHlwZSI6ICJrZXlEb3duIiwKICAgICAgICAgICJ2YWx1ZSI6ICJmIgogICAgICAgIH0s
CiAgICAgICAgewogICAgICAgICAgInR5cGUiOiAia2V5VXAiLAogICAgICAgICAgInZhbHVlIjog
ImYiCiAgICAgICAgfSwKICAgICAgICB7CiAgICAgICAgICAidHlwZSI6ICJrZXlEb3duIiwKICAg
ICAgICAgICJ2YWx1ZSI6ICJvIgogICAgICAgIH0sCiAgICAgICAgewogICAgICAgICAgInR5cGUi
OiAia2V5VXAiLAogICAgICAgICAgInZhbHVlIjogIm8iCiAgICAgICAgfSwKICAgICAgICB7CiAg
ICAgICAgICAidHlwZSI6ICJrZXlEb3duIiwKICAgICAgICAgICJ2YWx1ZSI6ICJvIgogICAgICAg
IH0sCiAgICAgICAgewogICAgICAgICAgInR5cGUiOiAia2V5VXAiLAogICAgICAgICAgInZhbHVl
IjogIm8iCiAgICAgICAgfSwKICAgICAgICB7CiAgICAgICAgICAidHlwZSI6ICJrZXlEb3duIiwK
ICAgICAgICAgICJ2YWx1ZSI6ICLugZAiCiAgICAgICAgfSwKICAgICAgICB7CiAgICAgICAgICAi
dHlwZSI6ICJrZXlEb3duIiwKICAgICAgICAgICJ2YWx1ZSI6ICLugIMiCiAgICAgICAgfSwKICAg
ICAgICB7CiAgICAgICAgICAidHlwZSI6ICJrZXlVcCIsCiAgICAgICAgICAidmFsdWUiOiAi7oGQ
IgogICAgICAgIH0sCiAgICAgICAgewogICAgICAgICAgInR5cGUiOiAia2V5VXAiLAogICAgICAg
ICAgInZhbHVlIjogIu6AgyIKICAgICAgICB9CiAgICAgIF0KICAgIH0KICBdCn0KCgpBdXRvbWF0
aW9uUHJvdG9jb2wKPT09PT09PT09PT09PT09PT09Cgp7CiAgIm1ldGhvZCI6ICJBdXRvbWF0aW9u
LnBlcmZvcm1JbnRlcmFjdGlvblNlcXVlbmNlIiwKICAicGFyYW1zIjogewogICAgImZyYW1lSGFu
ZGxlIjogIiIsCiAgICAiaW5wdXRTb3VyY2VzIjogWwogICAgICB7CiAgICAgICAgInNvdXJjZUlk
IjogImtleWJvYXJkX2lkIiwKICAgICAgICAic291cmNlVHlwZSI6ICJLZXlib2FyZCIKICAgICAg
fQogICAgXSwKICAgICJzdGVwcyI6IFsKICAgICAgewogICAgICAgICJzdGF0ZXMiOiBbCiAgICAg
ICAgICB7CiAgICAgICAgICAgICJzb3VyY2VJZCI6ICJrZXlib2FyZF9pZCIsCiAgICAgICAgICAg
ICJwcmVzc2VkQ2hhcktleSI6ICJmIiwKICAgICAgICAgICAgIm9yaWdpbiI6ICJWaWV3cG9ydCIK
ICAgICAgICAgIH0KICAgICAgICBdCiAgICAgIH0sCiAgICAgIHsKICAgICAgICAic3RhdGVzIjog
WwogICAgICAgICAgewogICAgICAgICAgICAic291cmNlSWQiOiAia2V5Ym9hcmRfaWQiLAogICAg
ICAgICAgICAib3JpZ2luIjogIlZpZXdwb3J0IgogICAgICAgICAgfQogICAgICAgIF0KICAgICAg
fSwKICAgICAgewogICAgICAgICJzdGF0ZXMiOiBbCiAgICAgICAgICB7CiAgICAgICAgICAgICJz
b3VyY2VJZCI6ICJrZXlib2FyZF9pZCIsCiAgICAgICAgICAgICJwcmVzc2VkQ2hhcktleSI6ICJv
IiwKICAgICAgICAgICAgIm9yaWdpbiI6ICJWaWV3cG9ydCIKICAgICAgICAgIH0KICAgICAgICBd
CiAgICAgIH0sCiAgICAgIHsKICAgICAgICAic3RhdGVzIjogWwogICAgICAgICAgewogICAgICAg
ICAgICAic291cmNlSWQiOiAia2V5Ym9hcmRfaWQiLAogICAgICAgICAgICAib3JpZ2luIjogIlZp
ZXdwb3J0IgogICAgICAgICAgfQogICAgICAgIF0KICAgICAgfSwKICAgICAgewogICAgICAgICJz
dGF0ZXMiOiBbCiAgICAgICAgICB7CiAgICAgICAgICAgICJzb3VyY2VJZCI6ICJrZXlib2FyZF9p
ZCIsCiAgICAgICAgICAgICJwcmVzc2VkQ2hhcktleSI6ICJvIiwKICAgICAgICAgICAgIm9yaWdp
biI6ICJWaWV3cG9ydCIKICAgICAgICAgIH0KICAgICAgICBdCiAgICAgIH0sCiAgICAgIHsKICAg
ICAgICAic3RhdGVzIjogWwogICAgICAgICAgewogICAgICAgICAgICAic291cmNlSWQiOiAia2V5
Ym9hcmRfaWQiLAogICAgICAgICAgICAib3JpZ2luIjogIlZpZXdwb3J0IgogICAgICAgICAgfQog
ICAgICAgIF0KICAgICAgfSwKICAgICAgewogICAgICAgICJzdGF0ZXMiOiBbCiAgICAgICAgICB7
CiAgICAgICAgICAgICJzb3VyY2VJZCI6ICJrZXlib2FyZF9pZCIsCiAgICAgICAgICAgICJwcmVz
c2VkVmlydHVhbEtleXMiOiBbCiAgICAgICAgICAgICAgIlNoaWZ0IgogICAgICAgICAgICBdLAog
ICAgICAgICAgICAib3JpZ2luIjogIlZpZXdwb3J0IgogICAgICAgICAgfQogICAgICAgIF0KICAg
ICAgfSwKICAgICAgewogICAgICAgICJzdGF0ZXMiOiBbCiAgICAgICAgICB7CiAgICAgICAgICAg
ICJzb3VyY2VJZCI6ICJrZXlib2FyZF9pZCIsCiAgICAgICAgICAgICJwcmVzc2VkVmlydHVhbEtl
eXMiOiBbCiAgICAgICAgICAgICAgIlNoaWZ0IiwKICAgICAgICAgICAgICAiQmFja3NwYWNlIgog
ICAgICAgICAgICBdLAogICAgICAgICAgICAib3JpZ2luIjogIlZpZXdwb3J0IgogICAgICAgICAg
fQogICAgICAgIF0KICAgICAgfSwKICAgICAgewogICAgICAgICJzdGF0ZXMiOiBbCiAgICAgICAg
ICB7CiAgICAgICAgICAgICJzb3VyY2VJZCI6ICJrZXlib2FyZF9pZCIsCiAgICAgICAgICAgICJw
cmVzc2VkVmlydHVhbEtleXMiOiBbCiAgICAgICAgICAgICAgIkJhY2tzcGFjZSIKICAgICAgICAg
ICAgXSwKICAgICAgICAgICAgIm9yaWdpbiI6ICJWaWV3cG9ydCIKICAgICAgICAgIH0KICAgICAg
ICBdCiAgICAgIH0sCiAgICAgIHsKICAgICAgICAic3RhdGVzIjogWwogICAgICAgICAgewogICAg
ICAgICAgICAic291cmNlSWQiOiAia2V5Ym9hcmRfaWQiLAogICAgICAgICAgICAib3JpZ2luIjog
IlZpZXdwb3J0IgogICAgICAgICAgfQogICAgICAgIF0KICAgICAgfQogICAgXSwKICAgICJoYW5k
bGUiOiAicGFnZS05NDU4RDNBRS0wNEU2LTQ3QkEtQTI4MS03NkY3MTk2MzIxNTciCiAgfSwKICAi
aWQiOiA1MAp9
</data>

          </attachment>
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>356649</attachid>
            <date>2018-12-05 13:22:46 -0800</date>
            <delta_ts>2018-12-11 09:39:24 -0800</delta_ts>
            <desc>Patch</desc>
            <filename>bug-191155-20181205132245.patch</filename>
            <type>text/plain</type>
            <size>3652</size>
            <attacher name="Blaze Burg">bburg</attacher>
            
              <data encoding="base64">U3VidmVyc2lvbiBSZXZpc2lvbjogMjM4ODgxCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0L0No
YW5nZUxvZyBiL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCmluZGV4IDNhMzA1YzgzODY2MzMxOWYx
NjdmMGEwZTljYjUzMmY0ZDZlMWMzN2UuLmQxNmFhZjJiNTVkZDIwYzMwYWI5NDMxYzcyODUzMjAx
NGRkYWYwNzQgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCisrKyBiL1NvdXJj
ZS9XZWJLaXQvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTcgQEAKKzIwMTgtMTItMDUgIEJyaWFuIEJ1
cmcgIDxiYnVyZ0BhcHBsZS5jb20+CisKKyAgICAgICAgU2ltdWxhdGVkSW5wdXREaXNwYXRjaGVy
Ojp0cmFuc2l0aW9uSW5wdXRTb3VyY2VUb1N0YXRlKCkgY2FuIHJldXNlIGEgbW92ZWQtZnJvbSBj
b21wbGV0aW9uIGhhbmRsZXIKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19i
dWcuY2dpP2lkPTE5MTE1NQorICAgICAgICA8cmRhcjovL3Byb2JsZW0vNDU3NDU1Njk+CisKKyAg
ICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgKiBVSVByb2Nlc3Mv
QXV0b21hdGlvbi9TaW11bGF0ZWRJbnB1dERpc3BhdGNoZXIuY3BwOgorICAgICAgICAoV2ViS2l0
OjpTaW11bGF0ZWRJbnB1dERpc3BhdGNoZXI6OnRyYW5zaXRpb25JbnB1dFNvdXJjZVRvU3RhdGUp
OgorICAgICAgICBBZGQgYW4gQVNTRVJUIHRvIGd1YXJkIGFnYWluc3QgdW5leHBlY3RlZCBpbnB1
dHMgd2hlcmUgPjEgVmlydHVhbEtleSBjaGFuZ2VzIHBlciBzdGF0ZS4KKyAgICAgICAgd2Via2l0
ZHJpdmVyIG5lZWRzIHRvIGJlIHVwZGF0ZWQgdG8gbm90IHByb2R1Y2Ugc3VjaCBzdGF0ZXMgaW4g
dGhpcyBzY2VuYXJpbywgYnV0IHRoaXMgd2lsbAorICAgICAgICBhdm9pZCBhIHJ1bnRpbWUgY3Jh
c2ggY2F1c2VkIGJ5IHRyeWluZyB0byBjYWxsIGEgbW92ZWQtb3V0IGNvbXBsZXRpb24gaGFuZGxl
ciBhIHNlY29uZCB0aW1lLgorCiAyMDE4LTEyLTA0ICBZb3Vlbm4gRmFibGV0ICA8eW91ZW5uQGFw
cGxlLmNvbT4KIAogICAgICAgICBDYWxsaW5nIGdldFVzZXJNZWRpYSBpbiBhIGxpbmsgdGhhdCB3
YXMgb3BlbmVkIHdpdGggdGFyZ2V0PSJfYmxhbmsiIGRvZXMgbm90IHdvcmsgdGhlIHNlY29uZCB0
aW1lCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0L1VJUHJvY2Vzcy9BdXRvbWF0aW9uL1NpbXVs
YXRlZElucHV0RGlzcGF0Y2hlci5jcHAgYi9Tb3VyY2UvV2ViS2l0L1VJUHJvY2Vzcy9BdXRvbWF0
aW9uL1NpbXVsYXRlZElucHV0RGlzcGF0Y2hlci5jcHAKaW5kZXggODQ2MzA4NDhmZjYzMGQ2ZTg1
YjgyNDJjMTU1Mzc0N2I2YzgwZWM4Yy4uNDQ4YjI3MTU2MjY4MjNkNzFkZmFlM2EyYTgzNTk1NjJj
Y2EzMDY5YSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYktpdC9VSVByb2Nlc3MvQXV0b21hdGlvbi9T
aW11bGF0ZWRJbnB1dERpc3BhdGNoZXIuY3BwCisrKyBiL1NvdXJjZS9XZWJLaXQvVUlQcm9jZXNz
L0F1dG9tYXRpb24vU2ltdWxhdGVkSW5wdXREaXNwYXRjaGVyLmNwcApAQCAtMjk3LDggKzI5Nywx
MyBAQCB2b2lkIFNpbXVsYXRlZElucHV0RGlzcGF0Y2hlcjo6dHJhbnNpdGlvbklucHV0U291cmNl
VG9TdGF0ZShTaW11bGF0ZWRJbnB1dFNvdXJjZQogICAgICAgICAgICAgTE9HKEF1dG9tYXRpb24s
ICJTaW11bGF0ZWRJbnB1dERpc3BhdGNoZXJbJXBdOiBzaW11bGF0aW5nIEtleVJlbGVhc2Vba2V5
PSVjXSBmb3IgdHJhbnNpdGlvbiB0byAlZC4lZCIsIHRoaXMsIGEucHJlc3NlZENoYXJLZXkudmFs
dWUoKSwgbV9rZXlmcmFtZUluZGV4LCBtX2lucHV0U291cmNlU3RhdGVJbmRleCk7CiAgICAgICAg
ICAgICBtX2NsaWVudC5zaW11bGF0ZUtleWJvYXJkSW50ZXJhY3Rpb24obV9wYWdlLCBLZXlib2Fy
ZEludGVyYWN0aW9uOjpLZXlSZWxlYXNlLCBhLnByZXNzZWRDaGFyS2V5LnZhbHVlKCksIFdURk1v
dmUoZXZlbnREaXNwYXRjaEZpbmlzaGVkKSk7CiAgICAgICAgIH0gZWxzZSBpZiAoYS5wcmVzc2Vk
VmlydHVhbEtleXMgIT0gYi5wcmVzc2VkVmlydHVhbEtleXMpIHsKKyAgICAgICAgICAgIGJvb2wg
c2ltdWxhdGVkQW5JbnRlcmFjdGlvbiA9IGZhbHNlOwogICAgICAgICAgICAgZm9yIChWaXJ0dWFs
S2V5IGtleSA6IGIucHJlc3NlZFZpcnR1YWxLZXlzKSB7CiAgICAgICAgICAgICAgICAgaWYgKCFh
LnByZXNzZWRWaXJ0dWFsS2V5cy5jb250YWlucyhrZXkpKSB7CisgICAgICAgICAgICAgICAgICAg
IEFTU0VSVF9XSVRIX01FU1NBR0UoIXNpbXVsYXRlZEFuSW50ZXJhY3Rpb24sICJPbmx5IG9uZSBW
aXJ0dWFsS2V5IG1heSBkaWZmZXIgYXQgYSB0aW1lIGJldHdlZW4gdHdvIGlucHV0IHNvdXJjZSBz
dGF0ZXMuIik7CisgICAgICAgICAgICAgICAgICAgIGlmIChzaW11bGF0ZWRBbkludGVyYWN0aW9u
KQorICAgICAgICAgICAgICAgICAgICAgICAgY29udGludWU7CisgICAgICAgICAgICAgICAgICAg
IHNpbXVsYXRlZEFuSW50ZXJhY3Rpb24gPSB0cnVlOwogI2lmICFMT0dfRElTQUJMRUQKICAgICAg
ICAgICAgICAgICAgICAgU3RyaW5nIHZpcnR1YWxLZXlOYW1lID0gSW5zcGVjdG9yOjpQcm90b2Nv
bDo6QXV0b21hdGlvbkhlbHBlcnM6OmdldEVudW1Db25zdGFudFZhbHVlKGtleSk7CiAgICAgICAg
ICAgICAgICAgICAgIExPRyhBdXRvbWF0aW9uLCAiU2ltdWxhdGVkSW5wdXREaXNwYXRjaGVyWyVw
XTogc2ltdWxhdGluZyBLZXlQcmVzc1trZXk9JXNdIGZvciB0cmFuc2l0aW9uIHRvICVkLiVkIiwg
dGhpcywgdmlydHVhbEtleU5hbWUudXRmOCgpLmRhdGEoKSwgbV9rZXlmcmFtZUluZGV4LCBtX2lu
cHV0U291cmNlU3RhdGVJbmRleCk7CkBAIC0zMDksNiArMzE0LDEwIEBAIHZvaWQgU2ltdWxhdGVk
SW5wdXREaXNwYXRjaGVyOjp0cmFuc2l0aW9uSW5wdXRTb3VyY2VUb1N0YXRlKFNpbXVsYXRlZElu
cHV0U291cmNlCiAKICAgICAgICAgICAgIGZvciAoVmlydHVhbEtleSBrZXkgOiBhLnByZXNzZWRW
aXJ0dWFsS2V5cykgewogICAgICAgICAgICAgICAgIGlmICghYi5wcmVzc2VkVmlydHVhbEtleXMu
Y29udGFpbnMoa2V5KSkgeworICAgICAgICAgICAgICAgICAgICBBU1NFUlRfV0lUSF9NRVNTQUdF
KCFzaW11bGF0ZWRBbkludGVyYWN0aW9uLCAiT25seSBvbmUgVmlydHVhbEtleSBtYXkgZGlmZmVy
IGF0IGEgdGltZSBiZXR3ZWVuIHR3byBpbnB1dCBzb3VyY2Ugc3RhdGVzLiIpOworICAgICAgICAg
ICAgICAgICAgICBpZiAoc2ltdWxhdGVkQW5JbnRlcmFjdGlvbikKKyAgICAgICAgICAgICAgICAg
ICAgICAgIGNvbnRpbnVlOworICAgICAgICAgICAgICAgICAgICBzaW11bGF0ZWRBbkludGVyYWN0
aW9uID0gdHJ1ZTsKICNpZiAhTE9HX0RJU0FCTEVECiAgICAgICAgICAgICAgICAgICAgIFN0cmlu
ZyB2aXJ0dWFsS2V5TmFtZSA9IEluc3BlY3Rvcjo6UHJvdG9jb2w6OkF1dG9tYXRpb25IZWxwZXJz
OjpnZXRFbnVtQ29uc3RhbnRWYWx1ZShrZXkpOwogICAgICAgICAgICAgICAgICAgICBMT0coQXV0
b21hdGlvbiwgIlNpbXVsYXRlZElucHV0RGlzcGF0Y2hlclslcF06IHNpbXVsYXRpbmcgS2V5UmVs
ZWFzZVtrZXk9JXNdIGZvciB0cmFuc2l0aW9uIHRvICVkLiVkIiwgdGhpcywgdmlydHVhbEtleU5h
bWUudXRmOCgpLmRhdGEoKSwgbV9rZXlmcmFtZUluZGV4LCBtX2lucHV0U291cmNlU3RhdGVJbmRl
eCk7Cg==
</data>

          </attachment>
      

    </bug>

</bugzilla>