<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>196055</bug_id>
          
          <creation_ts>2019-03-20 21:46:32 -0700</creation_ts>
          <short_desc>Cap length of an array with spread to MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH.</short_desc>
          <delta_ts>2019-03-21 00:52:13 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>JavaScriptCore</component>
          <version>WebKit Nightly Build</version>
          <rep_platform>Unspecified</rep_platform>
          <op_sys>Unspecified</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>InRadar</keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Mark Lam">mark.lam</reporter>
          <assigned_to name="Mark Lam">mark.lam</assigned_to>
          <cc>ews-watchlist</cc>
    
    <cc>fpizlo</cc>
    
    <cc>keith_miller</cc>
    
    <cc>msaboff</cc>
    
    <cc>rmorisset</cc>
    
    <cc>saam</cc>
    
    <cc>tzagallo</cc>
    
    <cc>webkit-bug-importer</cc>
    
    <cc>ysuzuki</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>1519466</commentid>
    <comment_count>0</comment_count>
    <who name="Mark Lam">mark.lam</who>
    <bug_when>2019-03-20 21:46:32 -0700</bug_when>
    <thetext>We are doing this because:
1. We expect the array to be densely packed.
2. SpeculativeJIT::compileAllocateNewArrayWithSize() (and the FTL equivalent) expects the array length to be less than MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH if we don&apos;t want to use an ArrayStorage shape.
3. There&apos;s no reason why an array with spread needs to be that large anyway.  MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH is plenty.

&lt;rdar://problem/49067448&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1519470</commentid>
    <comment_count>1</comment_count>
      <attachid>365484</attachid>
    <who name="Mark Lam">mark.lam</who>
    <bug_when>2019-03-20 22:19:08 -0700</bug_when>
    <thetext>Created attachment 365484
proposed patch.

Let&apos;s try this on the EWS first.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1519489</commentid>
    <comment_count>2</comment_count>
      <attachid>365484</attachid>
    <who name="Mark Lam">mark.lam</who>
    <bug_when>2019-03-20 23:00:47 -0700</bug_when>
    <thetext>Comment on attachment 365484
proposed patch.

The JSC tests run to completion locally without any failures.  Let&apos;s get a review.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1519529</commentid>
    <comment_count>3</comment_count>
      <attachid>365484</attachid>
    <who name="Yusuke Suzuki">ysuzuki</who>
    <bug_when>2019-03-21 00:18:56 -0700</bug_when>
    <thetext>Comment on attachment 365484
proposed patch.

View in context: https://bugs.webkit.org/attachment.cgi?id=365484&amp;action=review

r=me

&gt; Source/JavaScriptCore/dfg/DFGOperations.cpp:2727
&gt; +    }

If some program hits this, we could

1. make `length &gt;= MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH` OSR exit with Overflow (this is already done in this patch)
2. In operationNewArrayWithSpreadSlow, we return some information, and cause OSR exit with Overflow
3. In baseline / LLInt, we just allocate ArrayStorage JSArray
4. avoids emitting NewArrayWithSpread DFG nodes if hasExitSite(Overflow) = true in DFG

but I think throwing OOM error is OK until we find some real programs hit this condition.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1519539</commentid>
    <comment_count>4</comment_count>
    <who name="Mark Lam">mark.lam</who>
    <bug_when>2019-03-21 00:52:13 -0700</bug_when>
    <thetext>Thanks for the review.  Landed in r243280: &lt;http://trac.webkit.org/r243280&gt;.</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>365484</attachid>
            <date>2019-03-20 22:19:08 -0700</date>
            <delta_ts>2019-03-21 00:18:56 -0700</delta_ts>
            <desc>proposed patch.</desc>
            <filename>bug-196055.patch</filename>
            <type>text/plain</type>
            <size>12356</size>
            <attacher name="Mark Lam">mark.lam</attacher>
            
              <data encoding="base64">SW5kZXg6IEpTVGVzdHMvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIEpTVGVzdHMvQ2hhbmdlTG9n
CShyZXZpc2lvbiAyNDMyNzYpCisrKyBKU1Rlc3RzL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpA
QCAtMSwzICsxLDEzIEBACisyMDE5LTAzLTIwICBNYXJrIExhbSAgPG1hcmsubGFtQGFwcGxlLmNv
bT4KKworICAgICAgICBDYXAgbGVuZ3RoIG9mIGFuIGFycmF5IHdpdGggc3ByZWFkIHRvIE1JTl9B
UlJBWV9TVE9SQUdFX0NPTlNUUlVDVElPTl9MRU5HVEguCisgICAgICAgIGh0dHBzOi8vYnVncy53
ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xOTYwNTUKKyAgICAgICAgPHJkYXI6Ly9wcm9ibGVt
LzQ5MDY3NDQ4PgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAg
ICAgICogc3RyZXNzL25ld19hcnJheV93aXRoX3NwcmVhZC1zaG91bGQtY2FwLWFycmF5LXNpemUt
dG8tTUlOX0FSUkFZX1NUT1JBR0VfQ09OU1RSVUNUSU9OX0xFTkdUSC5qczogQWRkZWQuCisKIDIw
MTktMDMtMjAgIFl1c3VrZSBTdXp1a2kgIDx5c3V6dWtpQGFwcGxlLmNvbT4KIAogICAgICAgICBV
cGRhdGUgdGhlIHRlc3QgdG8gZW5zdXJlIE91dE9mTWVtb3J5RXJyb3IgaXMgdGhyb3duIGFzIGlu
dGVuZGVkCkluZGV4OiBKU1Rlc3RzL3N0cmVzcy9uZXdfYXJyYXlfd2l0aF9zcHJlYWQtc2hvdWxk
LWNhcC1hcnJheS1zaXplLXRvLU1JTl9BUlJBWV9TVE9SQUdFX0NPTlNUUlVDVElPTl9MRU5HVEgu
anMKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PQotLS0gSlNUZXN0cy9zdHJlc3MvbmV3X2FycmF5X3dpdGhfc3ByZWFkLXNo
b3VsZC1jYXAtYXJyYXktc2l6ZS10by1NSU5fQVJSQVlfU1RPUkFHRV9DT05TVFJVQ1RJT05fTEVO
R1RILmpzCShub25leGlzdGVudCkKKysrIEpTVGVzdHMvc3RyZXNzL25ld19hcnJheV93aXRoX3Nw
cmVhZC1zaG91bGQtY2FwLWFycmF5LXNpemUtdG8tTUlOX0FSUkFZX1NUT1JBR0VfQ09OU1RSVUNU
SU9OX0xFTkdUSC5qcwkod29ya2luZyBjb3B5KQpAQCAtMCwwICsxLDQ0IEBACisvL0Agc2tpcCBp
ZiAkbWVtb3J5TGltaXRlZCBvciAkYnVpbGRUeXBlID09ICJkZWJ1ZyIKKworZnVuY3Rpb24gdGVz
dCgpIHsKKyAgICBmdW5jdGlvbiBtYWtlRm9vKG4pIHsKKyAgICAgICAgbGV0IHNyYyA9ICJyZXR1
cm4gZnVuY3Rpb24oYSwgYikgeyBmb3IgKGxldCBpID0gMDsgaSA8IDIwMDAwOyBpKyspOyByZXR1
cm4gWyI7CisgICAgICAgIGZvciAobGV0IGkgPSAwOyBpIDwgbjsgaSsrKSB7CisgICAgICAgICAg
ICBzcmMgKz0gIi4uLmEiOworICAgICAgICAgICAgaWYgKGkgPCBuLTEpCisgICAgICAgICAgICAg
ICAgc3JjICs9ICIsIjsKKyAgICAgICAgfQorICAgICAgICBzcmMgKz0gIiwuLi5iXTt9IjsKKyAg
ICAgICAgcmV0dXJuIChuZXcgRnVuY3Rpb24oc3JjKSkoKTsKKyAgICB9CisKKyAgICB2YXIgTlVN
X1NQUkVBRF9BUkdTID0gODsKKyAgICB2YXIgZm9vID0gbWFrZUZvbyhOVU1fU1BSRUFEX0FSR1Mp
OworCisgICAgdmFyIGIgPSBbMS4xLCAxLjFdOworICAgIGZvciAobGV0IGkgPSAwOyBpIDwgMTA7
IGkrKykKKyAgICAgICAgZm9vKGIsIGIpOworCisgICAgZnVuY3Rpb24gbWFrZUFycmF5KGxlbiwg
diA9IDEuMjM0KSB7CisgICAgICAgIGxldCBhID0gW107CisgICAgICAgIHdoaWxlIChhLmxlbmd0
aCA8IGxlbikKKyAgICAgICAgICAgIGFbYS5sZW5ndGhdID0gdjsKKyAgICAgICAgcmV0dXJuIGE7
CisgICAgfQorCisgICAgdmFyIGEgPSBtYWtlQXJyYXkoMHgyMDAwMDA0MCAvIE5VTV9TUFJFQURf
QVJHUyk7CisgICAgdmFyIGMgPSBbXTsgYy5sZW5ndGggPSAxOworCisgICAgdmFyIGFyciA9IGZv
byhhLCBjKTsKKyAgICBwcmludChhcnIubGVuZ3RoKTsKK30KKwordmFyIGV4Y2VwdGlvbjsKK3Ry
eSB7CisgICAgdGVzdCgpOworfSBjYXRjaCAoZSkgeworICAgIGV4Y2VwdGlvbiA9IGU7Cit9CisK
K2lmIChleGNlcHRpb24gIT0gIkVycm9yOiBPdXQgb2YgbWVtb3J5IikKKyAgICB0aHJvdyAiRkFJ
TEVEIjsKSW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQot
LS0gU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMjQzMjc2KQorKysg
U291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsx
LDM1IEBACisyMDE5LTAzLTIwICBNYXJrIExhbSAgPG1hcmsubGFtQGFwcGxlLmNvbT4KKworICAg
ICAgICBDYXAgbGVuZ3RoIG9mIGFuIGFycmF5IHdpdGggc3ByZWFkIHRvIE1JTl9BUlJBWV9TVE9S
QUdFX0NPTlNUUlVDVElPTl9MRU5HVEguCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3Jn
L3Nob3dfYnVnLmNnaT9pZD0xOTYwNTUKKyAgICAgICAgPHJkYXI6Ly9wcm9ibGVtLzQ5MDY3NDQ4
PgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIFdlIGFy
ZSBkb2luZyB0aGlzIGJlY2F1c2U6CisgICAgICAgIDEuIFdlIGV4cGVjdCB0aGUgYXJyYXkgdG8g
YmUgZGVuc2VseSBwYWNrZWQuCisgICAgICAgIDIuIFNwZWN1bGF0aXZlSklUOjpjb21waWxlQWxs
b2NhdGVOZXdBcnJheVdpdGhTaXplKCkgKGFuZCB0aGUgRlRMIGVxdWl2YWxlbnQpCisgICAgICAg
ICAgIGV4cGVjdHMgdGhlIGFycmF5IGxlbmd0aCB0byBiZSBsZXNzIHRoYW4gTUlOX0FSUkFZX1NU
T1JBR0VfQ09OU1RSVUNUSU9OX0xFTkdUSAorICAgICAgICAgICBpZiB3ZSBkb24ndCB3YW50IHRv
IHVzZSBhbiBBcnJheVN0b3JhZ2Ugc2hhcGUuCisgICAgICAgIDMuIFRoZXJlJ3Mgbm8gcmVhc29u
IHdoeSBhbiBhcnJheSB3aXRoIHNwcmVhZCBuZWVkcyB0byBiZSB0aGF0IGxhcmdlIGFueXdheS4K
KyAgICAgICAgICAgTUlOX0FSUkFZX1NUT1JBR0VfQ09OU1RSVUNUSU9OX0xFTkdUSCBpcyBwbGVu
dHkuCisKKyAgICAgICAgSW4gdGhpcyBwYXRjaCwgd2UgYWxzbyBhZGQgYSBkZWJ1ZyBhc3NlcnQg
aW4gY29tcGlsZUFsbG9jYXRlTmV3QXJyYXlXaXRoU2l6ZSgpIGFuZAorICAgICAgICBlbWl0QWxs
b2NhdGVCdXR0ZXJmbHkoKSB0byBjaGVjayBmb3Igb3ZlcmZsb3dzLgorCisgICAgICAgICogYXNz
ZW1ibGVyL0Fib3J0UmVhc29uLmg6CisgICAgICAgICogZGZnL0RGR09wZXJhdGlvbnMuY3BwOgor
ICAgICAgICAqIGRmZy9ERkdTcGVjdWxhdGl2ZUpJVC5jcHA6CisgICAgICAgIChKU0M6OkRGRzo6
U3BlY3VsYXRpdmVKSVQ6OmNvbXBpbGVDcmVhdGVSZXN0KToKKyAgICAgICAgKEpTQzo6REZHOjpT
cGVjdWxhdGl2ZUpJVDo6Y29tcGlsZU5ld0FycmF5V2l0aFNwcmVhZCk6CisgICAgICAgIChKU0M6
OkRGRzo6U3BlY3VsYXRpdmVKSVQ6OmVtaXRBbGxvY2F0ZUJ1dHRlcmZseSk6CisgICAgICAgIChK
U0M6OkRGRzo6U3BlY3VsYXRpdmVKSVQ6OmNvbXBpbGVBbGxvY2F0ZU5ld0FycmF5V2l0aFNpemUp
OgorICAgICAgICAqIGZ0bC9GVExMb3dlckRGR1RvQjMuY3BwOgorICAgICAgICAoSlNDOjpGVEw6
OkRGRzo6TG93ZXJERkdUb0IzOjpjb21waWxlTmV3QXJyYXlXaXRoU3ByZWFkKToKKyAgICAgICAg
KiBydW50aW1lL0FycmF5Q29udmVudGlvbnMuaDoKKyAgICAgICAgKiBydW50aW1lL0NvbW1vblNs
b3dQYXRocy5jcHA6CisgICAgICAgIChKU0M6OlNMT1dfUEFUSF9ERUNMKToKKwogMjAxOS0wMy0y
MCAgTWFyayBMYW0gIDxtYXJrLmxhbUBhcHBsZS5jb20+CiAKICAgICAgICAgT3BlbiBzb3VyY2Ug
YXJtNjRlIGNvZGUuCkluZGV4OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUvYXNzZW1ibGVyL0Fib3J0
UmVhc29uLmgKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL0phdmFTY3JpcHRDb3JlL2Fzc2VtYmxlci9B
Ym9ydFJlYXNvbi5oCShyZXZpc2lvbiAyNDMyNzYpCisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUv
YXNzZW1ibGVyL0Fib3J0UmVhc29uLmgJKHdvcmtpbmcgY29weSkKQEAgLTEsNSArMSw1IEBACiAv
KgotICogQ29weXJpZ2h0IChDKSAyMDE0LTIwMTYgQXBwbGUgSW5jLiBBbGwgcmlnaHRzIHJlc2Vy
dmVkLgorICogQ29weXJpZ2h0IChDKSAyMDE0LTIwMTkgQXBwbGUgSW5jLiBBbGwgcmlnaHRzIHJl
c2VydmVkLgogICoKICAqIFJlZGlzdHJpYnV0aW9uIGFuZCB1c2UgaW4gc291cmNlIGFuZCBiaW5h
cnkgZm9ybXMsIHdpdGggb3Igd2l0aG91dAogICogbW9kaWZpY2F0aW9uLCBhcmUgcGVybWl0dGVk
IHByb3ZpZGVkIHRoYXQgdGhlIGZvbGxvd2luZyBjb25kaXRpb25zCkBAIC03Myw2ICs3Myw3IEBA
IGVudW0gQWJvcnRSZWFzb24gewogICAgIFJlcGF0Y2hJbnNhbmVBcmd1bWVudENvdW50ICAgICAg
ICAgICAgICAgICAgICAgICAgPSAzMTAsCiAgICAgVEdJbnZhbGlkUG9pbnRlciAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICA9IDMyMCwKICAgICBUR05vdFN1cHBvcnRlZCAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gMzMwLAorICAgIFVuY2hlY2tlZE92ZXJmbG93
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAzMzUsCiAgICAgWUFSUk5vSW5wdXRD
b25zdW1lZCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9IDM0MCwKIH07CiAKSW5kZXg6
IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9kZmcvREZHT3BlcmF0aW9ucy5jcHAKPT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQot
LS0gU291cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9ERkdPcGVyYXRpb25zLmNwcAkocmV2aXNpb24g
MjQzMjc2KQorKysgU291cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9ERkdPcGVyYXRpb25zLmNwcAko
d29ya2luZyBjb3B5KQpAQCAtMSw1ICsxLDUgQEAKIC8qCi0gKiBDb3B5cmlnaHQgKEMpIDIwMTEt
MjAxOCBBcHBsZSBJbmMuIEFsbCByaWdodHMgcmVzZXJ2ZWQuCisgKiBDb3B5cmlnaHQgKEMpIDIw
MTEtMjAxOSBBcHBsZSBJbmMuIEFsbCByaWdodHMgcmVzZXJ2ZWQuCiAgKgogICogUmVkaXN0cmli
dXRpb24gYW5kIHVzZSBpbiBzb3VyY2UgYW5kIGJpbmFyeSBmb3Jtcywgd2l0aCBvciB3aXRob3V0
CiAgKiBtb2RpZmljYXRpb24sIGFyZSBwZXJtaXR0ZWQgcHJvdmlkZWQgdGhhdCB0aGUgZm9sbG93
aW5nIGNvbmRpdGlvbnMKQEAgLTI3MjEsNiArMjcyMSwxMSBAQCBKU0NlbGwqIEpJVF9PUEVSQVRJ
T04gb3BlcmF0aW9uTmV3QXJyYXlXCiAgICAgfQogCiAgICAgdW5zaWduZWQgbGVuZ3RoID0gY2hl
Y2tlZExlbmd0aC51bnNhZmVHZXQoKTsKKyAgICBpZiAoVU5MSUtFTFkobGVuZ3RoID49IE1JTl9B
UlJBWV9TVE9SQUdFX0NPTlNUUlVDVElPTl9MRU5HVEgpKSB7CisgICAgICAgIHRocm93T3V0T2ZN
ZW1vcnlFcnJvcihleGVjLCBzY29wZSk7CisgICAgICAgIHJldHVybiBudWxscHRyOworICAgIH0K
KwogICAgIEpTR2xvYmFsT2JqZWN0KiBnbG9iYWxPYmplY3QgPSBleGVjLT5sZXhpY2FsR2xvYmFs
T2JqZWN0KCk7CiAgICAgU3RydWN0dXJlKiBzdHJ1Y3R1cmUgPSBnbG9iYWxPYmplY3QtPmFycmF5
U3RydWN0dXJlRm9ySW5kZXhpbmdUeXBlRHVyaW5nQWxsb2NhdGlvbihBcnJheVdpdGhDb250aWd1
b3VzKTsKIApJbmRleDogU291cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9ERkdTcGVjdWxhdGl2ZUpJ
VC5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PQotLS0gU291cmNlL0phdmFTY3JpcHRDb3JlL2RmZy9ERkdTcGVjdWxh
dGl2ZUpJVC5jcHAJKHJldmlzaW9uIDI0MzI3NikKKysrIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9k
ZmcvREZHU3BlY3VsYXRpdmVKSVQuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC03NjU0LDYgKzc2NTQs
MTAgQEAgdm9pZCBTcGVjdWxhdGl2ZUpJVDo6Y29tcGlsZUNyZWF0ZVJlc3QoTgogICAgICAgICBH
UFJSZWcgYXJyYXlMZW5ndGhHUFIgPSBhcnJheUxlbmd0aC5ncHIoKTsKICAgICAgICAgR1BSUmVn
IGFycmF5UmVzdWx0R1BSID0gYXJyYXlSZXN1bHQuZ3ByKCk7CiAKKyAgICAgICAgLy8gV2UgY2Fu
IHRlbGwgY29tcGlsZUFsbG9jYXRlTmV3QXJyYXlXaXRoU2l6ZSgpIHRoYXQgaXQgZG9lcyBub3Qg
bmVlZCB0byBjaGVjaworICAgICAgICAvLyBmb3IgbGFyZ2UgYXJyYXlzIGFuZCB1c2UgQXJyYXlT
dG9yYWdlIHN0cnVjdHVyZSBiZWNhdXNlIGFycmF5TGVuZ3RoIGhlcmUgd2lsbAorICAgICAgICAv
LyBhbHdheXMgYmUgYm91bmRlZCBieSBzdGFjayBzaXplLiBSZWFsaXN0aWNhbGx5LCB3ZSB3b24n
dCBiZSBhYmxlIHRvIHB1c2ggZW5vdWdoCisgICAgICAgIC8vIGFyZ3VtZW50cyB0byBoYXZlIGFy
cmF5TGVuZ3RoIGV4Y2VlZCBNSU5fQVJSQVlfU1RPUkFHRV9DT05TVFJVQ1RJT05fTEVOR1RILgog
ICAgICAgICBib29sIHNob3VsZEFsbG93Rm9yQXJyYXlTdG9yYWdlU3RydWN0dXJlRm9yTGFyZ2VB
cnJheXMgPSBmYWxzZTsKICAgICAgICAgQVNTRVJUKG1faml0LmdyYXBoKCkuZ2xvYmFsT2JqZWN0
Rm9yKG5vZGUtPm9yaWdpbi5zZW1hbnRpYyktPnJlc3RQYXJhbWV0ZXJTdHJ1Y3R1cmUoKS0+aW5k
ZXhpbmdNb2RlKCkgPT0gQXJyYXlXaXRoQ29udGlndW91cyB8fCBtX2ppdC5ncmFwaCgpLmdsb2Jh
bE9iamVjdEZvcihub2RlLT5vcmlnaW4uc2VtYW50aWMpLT5pc0hhdmluZ0FCYWRUaW1lKCkpOwog
ICAgICAgICBjb21waWxlQWxsb2NhdGVOZXdBcnJheVdpdGhTaXplKG1faml0LmdyYXBoKCkuZ2xv
YmFsT2JqZWN0Rm9yKG5vZGUtPm9yaWdpbi5zZW1hbnRpYyksIGFycmF5UmVzdWx0R1BSLCBhcnJh
eUxlbmd0aEdQUiwgQXJyYXlXaXRoQ29udGlndW91cywgc2hvdWxkQWxsb3dGb3JBcnJheVN0b3Jh
Z2VTdHJ1Y3R1cmVGb3JMYXJnZUFycmF5cyk7CkBAIC04MDA3LDcgKzgwMTEsMTIgQEAgdm9pZCBT
cGVjdWxhdGl2ZUpJVDo6Y29tcGlsZU5ld0FycmF5V2l0aAogICAgICAgICAgICAgICAgIH0KICAg
ICAgICAgICAgIH0KIAorICAgICAgICAgICAgc3BlY3VsYXRpb25DaGVjayhPdmVyZmxvdywgSlNW
YWx1ZVJlZ3MoKSwgbnVsbHB0ciwgbV9qaXQuYnJhbmNoMzIoTWFjcm9Bc3NlbWJsZXI6OkFib3Zl
T3JFcXVhbCwgbGVuZ3RoR1BSLCBUcnVzdGVkSW1tMzIoTUlOX0FSUkFZX1NUT1JBR0VfQ09OU1RS
VUNUSU9OX0xFTkdUSCkpKTsKIAorICAgICAgICAgICAgLy8gV2UgY2FuIHRlbGwgY29tcGlsZUFs
bG9jYXRlTmV3QXJyYXlXaXRoU2l6ZSgpIHRoYXQgaXQgZG9lcyBub3QgbmVlZCB0bworICAgICAg
ICAgICAgLy8gY2hlY2sgZm9yIGxhcmdlIGFycmF5cyBhbmQgdXNlIEFycmF5U3RvcmFnZSBzdHJ1
Y3R1cmUgYmVjYXVzZSB3ZSBhbHJlYWR5CisgICAgICAgICAgICAvLyBlbnN1cmVkIGFib3ZlIHRo
YXQgdGhlIHNwcmVhZCBhcnJheSBsZW5ndGggd2lsbCBkZWZpbml0ZWx5IGZpdCBpbiBhCisgICAg
ICAgICAgICAvLyBub24tQXJyYXlTdG9yYWdlIHNoYXBlZCBhcnJheS4KICAgICAgICAgICAgIGJv
b2wgc2hvdWxkQWxsb3dGb3JBcnJheVN0b3JhZ2VTdHJ1Y3R1cmVGb3JMYXJnZUFycmF5cyA9IGZh
bHNlOwogICAgICAgICAgICAgQVNTRVJUKG1faml0LmdyYXBoKCkuZ2xvYmFsT2JqZWN0Rm9yKG5v
ZGUtPm9yaWdpbi5zZW1hbnRpYyktPnJlc3RQYXJhbWV0ZXJTdHJ1Y3R1cmUoKS0+aW5kZXhpbmdU
eXBlKCkgPT0gQXJyYXlXaXRoQ29udGlndW91cyB8fCBtX2ppdC5ncmFwaCgpLmdsb2JhbE9iamVj
dEZvcihub2RlLT5vcmlnaW4uc2VtYW50aWMpLT5pc0hhdmluZ0FCYWRUaW1lKCkpOwogICAgICAg
ICAgICAgY29tcGlsZUFsbG9jYXRlTmV3QXJyYXlXaXRoU2l6ZShtX2ppdC5ncmFwaCgpLmdsb2Jh
bE9iamVjdEZvcihub2RlLT5vcmlnaW4uc2VtYW50aWMpLCByZXN1bHRHUFIsIGxlbmd0aEdQUiwg
QXJyYXlXaXRoQ29udGlndW91cywgc2hvdWxkQWxsb3dGb3JBcnJheVN0b3JhZ2VTdHJ1Y3R1cmVG
b3JMYXJnZUFycmF5cyk7CkBAIC0xMTY3NCw2ICsxMTY4MywxMSBAQCB2b2lkIFNwZWN1bGF0aXZl
SklUOjplbWl0QWxsb2NhdGVCdXR0ZXJmCiAgICAgbV9qaXQuemVyb0V4dGVuZDMyVG9QdHIoc2l6
ZUdQUiwgc2NyYXRjaDEpOwogICAgIG1faml0LmxzaGlmdDMyKFRydXN0ZWRJbW0zMigzKSwgc2Ny
YXRjaDEpOwogICAgIG1faml0LmFkZDMyKFRydXN0ZWRJbW0zMihzaXplb2YoSW5kZXhpbmdIZWFk
ZXIpKSwgc2NyYXRjaDEsIHNjcmF0Y2gyKTsKKyNpZiAhQVNTRVJUX0RJU0FCTEVECisgICAgTWFj
cm9Bc3NlbWJsZXI6Okp1bXAgZGlkTm90T3ZlcmZsb3cgPSBtX2ppdC5icmFuY2gzMihNYWNyb0Fz
c2VtYmxlcjo6QWJvdmVPckVxdWFsLCBzY3JhdGNoMiwgc2l6ZUdQUik7CisgICAgbV9qaXQuYWJv
cnRXaXRoUmVhc29uKFVuY2hlY2tlZE92ZXJmbG93KTsKKyAgICBkaWROb3RPdmVyZmxvdy5saW5r
KCZtX2ppdCk7CisjZW5kaWYKICAgICBtX2ppdC5lbWl0QWxsb2NhdGVWYXJpYWJsZVNpemVkKAog
ICAgICAgICBzdG9yYWdlUmVzdWx0R1BSLCBtX2ppdC52bSgpLT5qc1ZhbHVlR2lnYWNhZ2VBdXhp
bGlhcnlTcGFjZSwgc2NyYXRjaDIsIHNjcmF0Y2gxLCBzY3JhdGNoMywgc2xvd0Nhc2VzKTsKICAg
ICBtX2ppdC5hZGRQdHIoVHJ1c3RlZEltbTMyKHNpemVvZihJbmRleGluZ0hlYWRlcikpLCBzdG9y
YWdlUmVzdWx0R1BSKTsKQEAgLTEyOTczLDYgKzEyOTg3LDE0IEBAIHZvaWQgU3BlY3VsYXRpdmVK
SVQ6OmNvbXBpbGVBbGxvY2F0ZU5ld0EKICAgICBNYWNyb0Fzc2VtYmxlcjo6SnVtcExpc3Qgc2xv
d0Nhc2VzOwogICAgIGlmIChzaG91bGRDb252ZXJ0TGFyZ2VTaXplVG9BcnJheVN0b3JhZ2UpCiAg
ICAgICAgIHNsb3dDYXNlcy5hcHBlbmQobV9qaXQuYnJhbmNoMzIoTWFjcm9Bc3NlbWJsZXI6OkFi
b3ZlT3JFcXVhbCwgc2l6ZUdQUiwgVHJ1c3RlZEltbTMyKE1JTl9BUlJBWV9TVE9SQUdFX0NPTlNU
UlVDVElPTl9MRU5HVEgpKSk7CisjaWYgIUFTU0VSVF9ESVNBQkxFRAorICAgIGVsc2UgeworICAg
ICAgICBNYWNyb0Fzc2VtYmxlcjo6SnVtcCBsZW5ndGhJc1dpdGhpbkxpbWl0czsKKyAgICAgICAg
bGVuZ3RoSXNXaXRoaW5MaW1pdHMgPSBtX2ppdC5icmFuY2gzMihNYWNyb0Fzc2VtYmxlcjo6QmVs
b3csIHNpemVHUFIsIFRydXN0ZWRJbW0zMihNSU5fQVJSQVlfU1RPUkFHRV9DT05TVFJVQ1RJT05f
TEVOR1RIKSk7CisgICAgICAgIG1faml0LmFib3J0V2l0aFJlYXNvbihVbmNoZWNrZWRPdmVyZmxv
dyk7CisgICAgICAgIGxlbmd0aElzV2l0aGluTGltaXRzLmxpbmsoJm1faml0KTsKKyAgICB9Cisj
ZW5kaWYKIAogICAgIC8vIFdlIGNhbiB1c2UgcmVzdWx0R1BSIGFzIGEgc2NyYXRjaCByaWdodCBu
b3cuCiAgICAgZW1pdEFsbG9jYXRlQnV0dGVyZmx5KHN0b3JhZ2VHUFIsIHNpemVHUFIsIHNjcmF0
Y2hHUFIsIHNjcmF0Y2gyR1BSLCByZXN1bHRHUFIsIHNsb3dDYXNlcyk7CkluZGV4OiBTb3VyY2Uv
SmF2YVNjcmlwdENvcmUvZnRsL0ZUTExvd2VyREZHVG9CMy5jcHAKPT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291
cmNlL0phdmFTY3JpcHRDb3JlL2Z0bC9GVExMb3dlckRGR1RvQjMuY3BwCShyZXZpc2lvbiAyNDMy
NzYpCisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvZnRsL0ZUTExvd2VyREZHVG9CMy5jcHAJKHdv
cmtpbmcgY29weSkKQEAgLTU4NDAsNiArNTg0MCw5IEBAIHByaXZhdGU6CiAgICAgICAgICAgICAg
ICAgfQogICAgICAgICAgICAgfQogCisgICAgICAgICAgICBMVmFsdWUgZXhjZWVkc01heEFsbG93
ZWRMZW5ndGggPSBtX291dC5hYm92ZU9yRXF1YWwobGVuZ3RoLCBtX291dC5jb25zdEludDMyKE1J
Tl9BUlJBWV9TVE9SQUdFX0NPTlNUUlVDVElPTl9MRU5HVEgpKTsKKyAgICAgICAgICAgIGJsZXNz
U3BlY3VsYXRpb24obV9vdXQuc3BlY3VsYXRlKGV4Y2VlZHNNYXhBbGxvd2VkTGVuZ3RoKSwgT3Zl
cmZsb3csIG5vVmFsdWUoKSwgbnVsbHB0ciwgbV9vcmlnaW4pOworCiAgICAgICAgICAgICBSZWdp
c3RlcmVkU3RydWN0dXJlIHN0cnVjdHVyZSA9IG1fZ3JhcGgucmVnaXN0ZXJTdHJ1Y3R1cmUobV9n
cmFwaC5nbG9iYWxPYmplY3RGb3IobV9ub2RlLT5vcmlnaW4uc2VtYW50aWMpLT5vcmlnaW5hbEFy
cmF5U3RydWN0dXJlRm9ySW5kZXhpbmdUeXBlKEFycmF5V2l0aENvbnRpZ3VvdXMpKTsKICAgICAg
ICAgICAgIEFycmF5VmFsdWVzIGFycmF5VmFsdWVzID0gYWxsb2NhdGVVbmluaXRpYWxpemVkQ29u
dGlndW91c0pTQXJyYXkobGVuZ3RoLCBzdHJ1Y3R1cmUpOwogICAgICAgICAgICAgTFZhbHVlIHJl
c3VsdCA9IGFycmF5VmFsdWVzLmFycmF5OwpJbmRleDogU291cmNlL0phdmFTY3JpcHRDb3JlL3J1
bnRpbWUvQXJyYXlDb252ZW50aW9ucy5oCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0
Q29yZS9ydW50aW1lL0FycmF5Q29udmVudGlvbnMuaAkocmV2aXNpb24gMjQzMjc2KQorKysgU291
cmNlL0phdmFTY3JpcHRDb3JlL3J1bnRpbWUvQXJyYXlDb252ZW50aW9ucy5oCSh3b3JraW5nIGNv
cHkpCkBAIC0xLDYgKzEsNiBAQAogLyoKICAqICBDb3B5cmlnaHQgKEMpIDE5OTktMjAwMCBIYXJy
aSBQb3J0ZW4gKHBvcnRlbkBrZGUub3JnKQotICogIENvcHlyaWdodCAoQykgMjAwMy0yMDE3IEFw
cGxlIEluYy4gQWxsIHJpZ2h0cyByZXNlcnZlZC4KKyAqICBDb3B5cmlnaHQgKEMpIDIwMDMtMjAx
OSBBcHBsZSBJbmMuIEFsbCByaWdodHMgcmVzZXJ2ZWQuCiAgKgogICogIFRoaXMgbGlicmFyeSBp
cyBmcmVlIHNvZnR3YXJlOyB5b3UgY2FuIHJlZGlzdHJpYnV0ZSBpdCBhbmQvb3IKICAqICBtb2Rp
ZnkgaXQgdW5kZXIgdGhlIHRlcm1zIG9mIHRoZSBHTlUgTGVzc2VyIEdlbmVyYWwgUHVibGljCkBA
IC02NSw3ICs2NSw3IEBAIG5hbWVzcGFjZSBKU0MgewogI2RlZmluZSBNSU5fU1BBUlNFX0FSUkFZ
X0lOREVYIDEwMDAwMFUKIC8vIElmIHlvdSB0cnkgdG8gYWxsb2NhdGUgYSBjb250aWd1b3VzIGFy
cmF5IGxhcmdlciB0aGFuIHRoaXMsIHRoZW4gd2Ugd2lsbCBhbGxvY2F0ZSBhbiBBcnJheVN0b3Jh
Z2UKIC8vIGFycmF5IGluc3RlYWQuIFdlIGFsbG93IGZvciBhbiBhcnJheSB0aGF0IG9jY3VwaWVz
IDFHQiBvZiBWTS4KLSNkZWZpbmUgTUlOX0FSUkFZX1NUT1JBR0VfQ09OU1RSVUNUSU9OX0xFTkdU
SCAxMDI0ICogMTAyNCAqIDEwMjQgLyA4CisjZGVmaW5lIE1JTl9BUlJBWV9TVE9SQUdFX0NPTlNU
UlVDVElPTl9MRU5HVEggKDEwMjQgKiAxMDI0ICogMTAyNCAvIDgpCiAjZGVmaW5lIE1BWF9TVE9S
QUdFX1ZFQ1RPUl9JTkRFWCAoTUFYX1NUT1JBR0VfVkVDVE9SX0xFTkdUSCAtIDEpCiAvLyAweEZG
RkZGRkZGIGlzIGEgYml0IHdlaXJkIC0tIGlzIG5vdCBhbiBhcnJheSBpbmRleCBldmVuIHRob3Vn
aCBpdCdzIGFuIGludGVnZXIuCiAjZGVmaW5lIE1BWF9BUlJBWV9JTkRFWCAweEZGRkZGRkZFVQpJ
bmRleDogU291cmNlL0phdmFTY3JpcHRDb3JlL3J1bnRpbWUvQ29tbW9uU2xvd1BhdGhzLmNwcAo9
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09Ci0tLSBTb3VyY2UvSmF2YVNjcmlwdENvcmUvcnVudGltZS9Db21tb25TbG93UGF0
aHMuY3BwCShyZXZpc2lvbiAyNDMyNzYpCisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvcnVudGlt
ZS9Db21tb25TbG93UGF0aHMuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC0xMjU4LDYgKzEyNTgsOSBA
QCBTTE9XX1BBVEhfREVDTChzbG93X3BhdGhfbmV3X2FycmF5X3dpdGhfCiAgICAgICAgIFRIUk9X
KGNyZWF0ZU91dE9mTWVtb3J5RXJyb3IoZXhlYykpOwogCiAgICAgdW5zaWduZWQgYXJyYXlTaXpl
ID0gY2hlY2tlZEFycmF5U2l6ZS51bnNhZmVHZXQoKTsKKyAgICBpZiAoVU5MSUtFTFkoYXJyYXlT
aXplID49IE1JTl9BUlJBWV9TVE9SQUdFX0NPTlNUUlVDVElPTl9MRU5HVEgpKQorICAgICAgICBU
SFJPVyhjcmVhdGVPdXRPZk1lbW9yeUVycm9yKGV4ZWMpKTsKKwogICAgIEpTR2xvYmFsT2JqZWN0
KiBnbG9iYWxPYmplY3QgPSBleGVjLT5sZXhpY2FsR2xvYmFsT2JqZWN0KCk7CiAgICAgU3RydWN0
dXJlKiBzdHJ1Y3R1cmUgPSBnbG9iYWxPYmplY3QtPmFycmF5U3RydWN0dXJlRm9ySW5kZXhpbmdU
eXBlRHVyaW5nQWxsb2NhdGlvbihBcnJheVdpdGhDb250aWd1b3VzKTsKIAo=
</data>
<flag name="review"
          id="381936"
          type_id="1"
          status="+"
          setter="ysuzuki"
    />
          </attachment>
      

    </bug>

</bugzilla>