<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>19891</bug_id>
          
          <creation_ts>2008-07-03 15:30:35 -0700</creation_ts>
          <short_desc>Broken HTML object elements cause de-reference of pointer to freed memory</short_desc>
          <delta_ts>2008-08-12 14:49:25 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>Page Loading</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>Mac</rep_platform>
          <op_sys>OS X 10.4</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>HasReduction, InRadar</keywords>
          <priority>P1</priority>
          <bug_severity>Critical</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Chris Brichford">chrisb</reporter>
          <assigned_to name="Nobody">webkit-unassigned</assigned_to>
          <cc>ap</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>85123</commentid>
    <comment_count>0</comment_count>
    <who name="Chris Brichford">chrisb</who>
    <bug_when>2008-07-03 15:30:35 -0700</bug_when>
    <thetext>When loading the attached test case WebCore requests that the FrameLoaderClient create multiple frames with the same owner element.  When we tear down the DOM only the frame that is pointed at by the owner element&apos;s contentFrame pointer is properly torn down.  The other frames end up using their owner element pointer to calculate topDocument during their tear down sequence.  At that point the ownerElement is free&apos;d memory.

Steps to reproduce:
1. Apply first attached patch.  Patch works ~ revision 34962.  This patch adds debugging code that will cause a crash is Frame::ownerElement would return a reference to a free&apos;d FrameOwnerElement.
2. Load the attached test html file via HTTP.
3. After the page loads navigate to about:blank.

I believe the second attached patch should catch the problem earier by asserting in the debug build that a new frame&apos;s owner element does not already have a content frame that points to the same owner element.

I can not get this to crash reliably in the nightly builds.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>85124</commentid>
    <comment_count>1</comment_count>
      <attachid>22070</attachid>
    <who name="Chris Brichford">chrisb</who>
    <bug_when>2008-07-03 15:31:50 -0700</bug_when>
    <thetext>Created attachment 22070
Patch to add debug code to make problem 100% reproducible in Debug and Release builds.

Attaching debug code to make bug 100% reproducible.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>85125</commentid>
    <comment_count>2</comment_count>
      <attachid>22071</attachid>
    <who name="Chris Brichford">chrisb</who>
    <bug_when>2008-07-03 15:32:27 -0700</bug_when>
    <thetext>Created attachment 22071
test case</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>85126</commentid>
    <comment_count>3</comment_count>
      <attachid>22072</attachid>
    <who name="Chris Brichford">chrisb</who>
    <bug_when>2008-07-03 15:33:15 -0700</bug_when>
    <thetext>Created attachment 22072
Patch to add ASSERT to catch problem sooner.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>85127</commentid>
    <comment_count>4</comment_count>
      <attachid>22071</attachid>
    <who name="Chris Brichford">chrisb</who>
    <bug_when>2008-07-03 15:33:58 -0700</bug_when>
    <thetext>Comment on attachment 22071
test case

Attempting to change mime type of attachment.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>85128</commentid>
    <comment_count>5</comment_count>
    <who name="Chris Brichford">chrisb</who>
    <bug_when>2008-07-03 15:35:50 -0700</bug_when>
    <thetext>Loading the test file with the debug code in the first patch directly out of this bug report causes the bug to happen for me.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>85130</commentid>
    <comment_count>6</comment_count>
      <attachid>22074</attachid>
    <who name="Chris Brichford">chrisb</who>
    <bug_when>2008-07-03 15:47:18 -0700</bug_when>
    <thetext>Created attachment 22074
Patch to add debug code to make problem 100% reproducible in Debug and Release builds.

Fixing bug in debug code.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>85132</commentid>
    <comment_count>7</comment_count>
    <who name="Chris Brichford">chrisb</who>
    <bug_when>2008-07-03 15:50:21 -0700</bug_when>
    <thetext>Interesting details about the test html file:
The object tag references a non-existent GIF.
There is a call to window.document.open in the onload handler.
The codetype on the object element is set to an image mime type.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>85136</commentid>
    <comment_count>8</comment_count>
    <who name="Mark Rowe (bdash)">mrowe</who>
    <bug_when>2008-07-03 16:45:13 -0700</bug_when>
    <thetext>&lt;rdar://problem/6054249&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>86909</commentid>
    <comment_count>9</comment_count>
    <who name="Chris Brichford">chrisb</who>
    <bug_when>2008-07-24 13:39:13 -0700</bug_when>
    <thetext>This bug was introduced by changeset 30438, which fixed bug 16760</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>86910</commentid>
    <comment_count>10</comment_count>
      <attachid>22469</attachid>
    <who name="Chris Brichford">chrisb</who>
    <bug_when>2008-07-24 13:45:04 -0700</bug_when>
    <thetext>Created attachment 22469
Proposed fix

Attaching proposed fix.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>86913</commentid>
    <comment_count>11</comment_count>
      <attachid>22469</attachid>
    <who name="Dave Hyatt">hyatt</who>
    <bug_when>2008-07-24 13:58:09 -0700</bug_when>
    <thetext>Comment on attachment 22469
Proposed fix

r=me</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>86940</commentid>
    <comment_count>12</comment_count>
    <who name="Alexey Proskuryakov">ap</who>
    <bug_when>2008-07-25 07:12:22 -0700</bug_when>
    <thetext>Please land this with a test case! Ideally, the patch should include its test cases in LayoutTests.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>86942</commentid>
    <comment_count>13</comment_count>
    <who name="Chris Brichford">chrisb</who>
    <bug_when>2008-07-25 09:34:33 -0700</bug_when>
    <thetext>(In reply to comment #12)
&gt; Please land this with a test case! Ideally, the patch should include its test
&gt; cases in LayoutTests.
&gt; 

I can add a LayoutTest, but the LayoutTest would have to hit the network.  The bug only happens if the we get a 404 response with a non-image content type header.  Also, I&apos;m not sure I know how to detect that the test failed other than the ASSERT I added to WebCore::Frame&apos;s constructor.

The attached test case is a reduction of an existing LayoutTest: LayoutTests/dom/html/level2/html/HTMLBodyElement08.html

</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>86950</commentid>
    <comment_count>14</comment_count>
    <who name="Alexey Proskuryakov">ap</who>
    <bug_when>2008-07-25 12:34:13 -0700</bug_when>
    <thetext>(In reply to comment #13)
&gt; I can add a LayoutTest, but the LayoutTest would have to hit the network.  The
&gt; bug only happens if the we get a 404 response with a non-image content type
&gt; header.

That&apos;s fine, our HTTP tests can do that easily (see e.g. LayoutTests/http/tests/misc/resources/404image.php).

&gt; Also, I&apos;m not sure I know how to detect that the test failed other
&gt; than the ASSERT I added to WebCore::Frame&apos;s constructor.

Well, if it&apos;s dereferencing freed memory, it&apos;s likely to fail when run as &quot;run-webkit-tests --threaded&quot;, so it&apos;s OK to land the test even if it&apos;s not 100% reproducible in release mode.

&gt; The attached test case is a reduction of an existing LayoutTest:
&gt; LayoutTests/dom/html/level2/html/HTMLBodyElement08.html

This leaves me a bit confused, as this test doesn&apos;t hit the network - in which sense is it a reduction? Does this existing test use the same buggy code path?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>86958</commentid>
    <comment_count>15</comment_count>
    <who name="Chris Brichford">chrisb</who>
    <bug_when>2008-07-25 13:17:48 -0700</bug_when>
    <thetext>(In reply to comment #14)
&gt; (In reply to comment #13)
&gt; &gt; I can add a LayoutTest, but the LayoutTest would have to hit the network.  The
&gt; &gt; bug only happens if the we get a 404 response with a non-image content type
&gt; &gt; header.
&gt; 
&gt; That&apos;s fine, our HTTP tests can do that easily (see e.g.
&gt; LayoutTests/http/tests/misc/resources/404image.php).
&gt; 
&gt; &gt; Also, I&apos;m not sure I know how to detect that the test failed other
&gt; &gt; than the ASSERT I added to WebCore::Frame&apos;s constructor.
&gt; 
&gt; Well, if it&apos;s dereferencing freed memory, it&apos;s likely to fail when run as
&gt; &quot;run-webkit-tests --threaded&quot;, so it&apos;s OK to land the test even if it&apos;s not
&gt; 100% reproducible in release mode.
&gt; 
&gt; &gt; The attached test case is a reduction of an existing LayoutTest:
&gt; &gt; LayoutTests/dom/html/level2/html/HTMLBodyElement08.html
&gt; 
&gt; This leaves me a bit confused, as this test doesn&apos;t hit the network - in which
&gt; sense is it a reduction? Does this existing test use the same buggy code path?
&gt; 

If you load LayoutTests/dom/html/level2/html/HTMLBodyElement08.html over an http connection it will exercise the same code path.
</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>86976</commentid>
    <comment_count>16</comment_count>
      <attachid>22484</attachid>
    <who name="Chris Brichford">chrisb</who>
    <bug_when>2008-07-25 16:23:23 -0700</bug_when>
    <thetext>Created attachment 22484
proposed fix with test

Added LayoutTest to proposed fix.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>86994</commentid>
    <comment_count>17</comment_count>
      <attachid>22484</attachid>
    <who name="Alexey Proskuryakov">ap</who>
    <bug_when>2008-07-26 01:31:09 -0700</bug_when>
    <thetext>Comment on attachment 22484
proposed fix with test

+	// Make sure we will not end up with two frames referencing the same owner element.
+	ASSERT((!(ownerElement-&gt;m_contentFrame)) || (ownerElement-&gt;m_contentFrame-&gt;ownerElement() != ownerElement));

Please use spaces, not tabs (pre-commit hook will deny landing the patch otherwise).

Index: LayoutTests/http/tests/misc/object-image-error-with-onload-expected.txt
===================================================================

Ugh, so the results are empty, and opening the test will leave the tester puzzled. Can this be improved (maybe with a document.write())?

+&lt;object data=&quot;this.image.does.not.exist.gif&quot; codetype=&quot;image/gif&quot; height=&quot;10&quot;&gt;&lt;/object&gt;

It might help to have a comment saying that this relies on a text/html 404 page being generated by the server.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>87029</commentid>
    <comment_count>18</comment_count>
      <attachid>22469</attachid>
    <who name="Mark Rowe (bdash)">mrowe</who>
    <bug_when>2008-07-26 22:11:59 -0700</bug_when>
    <thetext>Comment on attachment 22469
Proposed fix

Clearing review flag on obsolete patch.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>87030</commentid>
    <comment_count>19</comment_count>
      <attachid>22484</attachid>
    <who name="Mark Rowe (bdash)">mrowe</who>
    <bug_when>2008-07-26 22:12:40 -0700</bug_when>
    <thetext>Comment on attachment 22484
proposed fix with test

Marking as r- due to Alexey&apos;s comments in Comment #17.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>87974</commentid>
    <comment_count>20</comment_count>
      <attachid>22683</attachid>
    <who name="Mihnea Ovidenie">mihnea</who>
    <bug_when>2008-08-06 10:36:54 -0700</bug_when>
    <thetext>Created attachment 22683
Patch for bug 19891

Rework the former patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>88179</commentid>
    <comment_count>21</comment_count>
      <attachid>22683</attachid>
    <who name="Alexey Proskuryakov">ap</who>
    <bug_when>2008-08-10 07:54:19 -0700</bug_when>
    <thetext>Comment on attachment 22683
Patch for bug 19891

r=me (substantial changes being already reviewed by Dave Hyatt).

+        * ChangeLog:

This line will need to be removed from the ChangeLog when landing.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>88306</commentid>
    <comment_count>22</comment_count>
    <who name="Mihnea Ovidenie">mihnea</who>
    <bug_when>2008-08-12 06:24:29 -0700</bug_when>
    <thetext>(In reply to comment #21)
&gt; (From update of attachment 22683 [edit])
&gt; r=me (substantial changes being already reviewed by Dave Hyatt).
&gt; 
&gt; +        * ChangeLog:
&gt; 
&gt; This line will need to be removed from the ChangeLog when landing.
&gt; 

Hello,
In order for the patch to be submitted, is there anything i can do to help further? Should i just wait for somebody with commit right to submit the changes into the main trunk?
</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>88307</commentid>
    <comment_count>23</comment_count>
    <who name="Alexey Proskuryakov">ap</who>
    <bug_when>2008-08-12 07:02:37 -0700</bug_when>
    <thetext>(In reply to comment #22)
&gt; Should i just wait for somebody with commit right to submit the
&gt; changes into the main trunk?

That&apos;s correct - the mentioned correction is simple enough to be made by the committer.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>88339</commentid>
    <comment_count>24</comment_count>
    <who name="">mitz</who>
    <bug_when>2008-08-12 14:49:25 -0700</bug_when>
    <thetext>Landed in &lt;http://trac.webkit.org/changeset/35697&gt;.</thetext>
  </long_desc>
      
          <attachment
              isobsolete="1"
              ispatch="1"
              isprivate="0"
          >
            <attachid>22070</attachid>
            <date>2008-07-03 15:31:50 -0700</date>
            <delta_ts>2008-07-03 15:47:18 -0700</delta_ts>
            <desc>Patch to add debug code to make problem 100% reproducible in Debug and Release builds.</desc>
            <filename>trackHTMLFrameOwnerElements2.patch</filename>
            <type>text/plain</type>
            <size>2113</size>
            <attacher name="Chris Brichford">chrisb</attacher>
            
              <data encoding="base64">SW5kZXg6IFdlYkNvcmUvaHRtbC9IVE1MRnJhbWVPd25lckVsZW1lbnQuY3BwCj09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0K
LS0tIFdlYkNvcmUvaHRtbC9IVE1MRnJhbWVPd25lckVsZW1lbnQuY3BwCShyZXZpc2lvbiAzNDk2
MikKKysrIFdlYkNvcmUvaHRtbC9IVE1MRnJhbWVPd25lckVsZW1lbnQuY3BwCSh3b3JraW5nIGNv
cHkpCkBAIC0zMiwxMSArMzIsMzQgQEAKIAogbmFtZXNwYWNlIFdlYkNvcmUgewogCitzdGF0aWMg
V1RGOjpIYXNoU2V0PEhUTUxGcmFtZU93bmVyRWxlbWVudCo+KiBzX2xpdmluZ0ZyYW1lT3duZXJF
bGVtZW50cyA9IDA7Cit2b2lkIGZyYW1lT3duZXJFbGVtZW50Q29uc3RydWN0ZWQoSFRNTEZyYW1l
T3duZXJFbGVtZW50KiBjb25zdCBvd25lckVsZW1lbnQpCit7CisgICAgaWYgKCFzX2xpdmluZ0Zy
YW1lT3duZXJFbGVtZW50cykKKyAgICAgICAgc19saXZpbmdGcmFtZU93bmVyRWxlbWVudHMgPSBu
ZXcgV1RGOjpIYXNoU2V0PEhUTUxGcmFtZU93bmVyRWxlbWVudCo+KCk7CisgICAgc19saXZpbmdG
cmFtZU93bmVyRWxlbWVudHMtPmFkZChvd25lckVsZW1lbnQpOworfQorCit2b2lkIGZyYW1lT3du
ZXJFbGVtZW50RGVzdHJveWVkKEhUTUxGcmFtZU93bmVyRWxlbWVudCogY29uc3Qgb3duZXJFbGVt
ZW50KQoreworICAgIEFTU0VSVChzX2xpdmluZ0ZyYW1lT3duZXJFbGVtZW50cyk7CisgICAgc19s
aXZpbmdGcmFtZU93bmVyRWxlbWVudHMtPnJlbW92ZShvd25lckVsZW1lbnQpOworfQorCit2b2lk
IGNyYXNoSWZOb3RPd25lckVsZW1lbnQoSFRNTEZyYW1lT3duZXJFbGVtZW50KiBjb25zdCBvd25l
ckVsZW1lbnQpCit7CisgICAgaWYgKG93bmVyRWxlbWVudCAmJiBzX2xpdmluZ0ZyYW1lT3duZXJF
bGVtZW50cyAmJiAoIXNfbGl2aW5nRnJhbWVPd25lckVsZW1lbnRzLT5jb250YWlucyhvd25lckVs
ZW1lbnQpKSkgeworICAgICAgICBjaGFyKiBjb25zdCBwID0gcmVpbnRlcnByZXRfY2FzdDxjaGFy
Kj4oMHhCQUFEQkVBRik7CisgICAgICAgICpwID0gMDsKKyAgICB9Cit9CisKIEhUTUxGcmFtZU93
bmVyRWxlbWVudDo6SFRNTEZyYW1lT3duZXJFbGVtZW50KGNvbnN0IFF1YWxpZmllZE5hbWUmIHRh
Z05hbWUsIERvY3VtZW50KiBkb2N1bWVudCkKICAgICA6IEhUTUxFbGVtZW50KHRhZ05hbWUsIGRv
Y3VtZW50KQogICAgICwgbV9jb250ZW50RnJhbWUoMCkKICAgICAsIG1fY3JlYXRlZEJ5UGFyc2Vy
KGZhbHNlKQogeworICAgIGZyYW1lT3duZXJFbGVtZW50Q29uc3RydWN0ZWQodGhpcyk7CiB9CiAK
IHZvaWQgSFRNTEZyYW1lT3duZXJFbGVtZW50Ojp3aWxsUmVtb3ZlKCkKQEAgLTUzLDYgKzc2LDcg
QEAgSFRNTEZyYW1lT3duZXJFbGVtZW50Ojp+SFRNTEZyYW1lT3duZXJFbAogewogICAgIGlmICht
X2NvbnRlbnRGcmFtZSkKICAgICAgICAgbV9jb250ZW50RnJhbWUtPmRpc2Nvbm5lY3RPd25lckVs
ZW1lbnQoKTsKKyAgICBmcmFtZU93bmVyRWxlbWVudERlc3Ryb3llZCh0aGlzKTsKIH0KIAogRG9j
dW1lbnQqIEhUTUxGcmFtZU93bmVyRWxlbWVudDo6Y29udGVudERvY3VtZW50KCkgY29uc3QKSW5k
ZXg6IFdlYkNvcmUvcGFnZS9GcmFtZS5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gV2ViQ29yZS9wYWdlL0Zy
YW1lLmNwcAkocmV2aXNpb24gMzQ5NjIpCisrKyBXZWJDb3JlL3BhZ2UvRnJhbWUuY3BwCSh3b3Jr
aW5nIGNvcHkpCkBAIC0xMTgzLDggKzExODMsMTEgQEAgUmVuZGVyVmlldyogRnJhbWU6OmNvbnRl
bnRSZW5kZXJlcigpIGNvbgogICAgIHJldHVybiBzdGF0aWNfY2FzdDxSZW5kZXJWaWV3Kj4ob2Jq
ZWN0KTsKIH0KIAorZXh0ZXJuIHZvaWQgY3Jhc2hJZk5vdE93bmVyRWxlbWVudChIVE1MRnJhbWVP
d25lckVsZW1lbnQqIGNvbnN0IG93bmVyRWxlbWVudCk7CisKIEhUTUxGcmFtZU93bmVyRWxlbWVu
dCogRnJhbWU6Om93bmVyRWxlbWVudCgpIGNvbnN0CiB7CisgICAgY3Jhc2hJZk5vdE93bmVyRWxl
bWVudChkLT5tX293bmVyRWxlbWVudCk7CiAgICAgcmV0dXJuIGQtPm1fb3duZXJFbGVtZW50Owog
fQogCg==
</data>

          </attachment>
          <attachment
              isobsolete="0"
              ispatch="0"
              isprivate="0"
          >
            <attachid>22071</attachid>
            <date>2008-07-03 15:32:27 -0700</date>
            <delta_ts>2008-07-03 15:33:58 -0700</delta_ts>
            <desc>test case</desc>
            <filename>crash.html</filename>
            <type>text/html</type>
            <size>156</size>
            <attacher name="Chris Brichford">chrisb</attacher>
            
              <data encoding="base64">PGh0bWw+Cjxib2R5IG9ubG9hZD0id2luZG93LmRvY3VtZW50Lm9wZW4oKTsiPiAKPG9iamVjdCBk
YXRhPSIuL3BpeC90aGlzLmdpZi5kb2VzLm5vdC5leGlzdC5naWYiIGNvZGV0eXBlPSJpbWFnZS9n
aWYiIGhlaWdodD0iMTAiPjwvb2JqZWN0Pgo8L2JvZHk+CjwvaHRtbD4K
</data>

          </attachment>
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>22072</attachid>
            <date>2008-07-03 15:33:15 -0700</date>
            <delta_ts>2008-07-03 15:33:15 -0700</delta_ts>
            <desc>Patch to add ASSERT to catch problem sooner.</desc>
            <filename>frameOwnerAssert.patch</filename>
            <type>text/plain</type>
            <size>582</size>
            <attacher name="Chris Brichford">chrisb</attacher>
            
              <data encoding="base64">SW5kZXg6IFdlYkNvcmUvcGFnZS9GcmFtZS5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gV2ViQ29yZS9wYWdl
L0ZyYW1lLmNwcAkocmV2aXNpb24gMzQ4OTYpCisrKyBXZWJDb3JlL3BhZ2UvRnJhbWUuY3BwCSh3
b3JraW5nIGNvcHkpCkBAIC0xNDksNiArMTQ5LDggQEAgRnJhbWU6OkZyYW1lKFBhZ2UqIHBhZ2Us
IEhUTUxGcmFtZU93bmVyRQogICAgICAgICBwYWdlLT5zZXRNYWluRnJhbWUodGhpcyk7CiAgICAg
ZWxzZSB7CiAgICAgICAgIHBhZ2UtPmluY3JlbWVudEZyYW1lQ291bnQoKTsKKwkvLyBNYWtlIHN1
cmUgd2Ugd2lsbCBub3QgZW5kIHVwIHdpdGggdHdvIGZyYW1lcyByZWZlcmVuY2luZyB0aGUgc2Ft
ZSBvd25lciBlbGVtZW50LgorCUFTU0VSVCgoIShvd25lckVsZW1lbnQtPm1fY29udGVudEZyYW1l
KSkgfHwgKG93bmVyRWxlbWVudC0+bV9jb250ZW50RnJhbWUtPm93bmVyRWxlbWVudCgpICE9IG93
bmVyRWxlbWVudCkpOwogICAgICAgICBvd25lckVsZW1lbnQtPm1fY29udGVudEZyYW1lID0gdGhp
czsKICAgICB9CiAK
</data>

          </attachment>
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>22074</attachid>
            <date>2008-07-03 15:47:18 -0700</date>
            <delta_ts>2008-07-03 15:47:18 -0700</delta_ts>
            <desc>Patch to add debug code to make problem 100% reproducible in Debug and Release builds.</desc>
            <filename>trackHTMLFrameOwnerElements3.patch</filename>
            <type>text/plain</type>
            <size>2118</size>
            <attacher name="Chris Brichford">chrisb</attacher>
            
              <data encoding="base64">SW5kZXg6IFdlYkNvcmUvaHRtbC9IVE1MRnJhbWVPd25lckVsZW1lbnQuY3BwCj09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0K
LS0tIFdlYkNvcmUvaHRtbC9IVE1MRnJhbWVPd25lckVsZW1lbnQuY3BwCShyZXZpc2lvbiAzNDk2
MikKKysrIFdlYkNvcmUvaHRtbC9IVE1MRnJhbWVPd25lckVsZW1lbnQuY3BwCSh3b3JraW5nIGNv
cHkpCkBAIC0zMiwxMSArMzIsMzQgQEAKIAogbmFtZXNwYWNlIFdlYkNvcmUgewogCitzdGF0aWMg
V1RGOjpIYXNoU2V0PEhUTUxGcmFtZU93bmVyRWxlbWVudCo+KiBzX2xpdmluZ0ZyYW1lT3duZXJF
bGVtZW50cyA9IDA7Cit2b2lkIGZyYW1lT3duZXJFbGVtZW50Q29uc3RydWN0ZWQoSFRNTEZyYW1l
T3duZXJFbGVtZW50KiBjb25zdCBvd25lckVsZW1lbnQpCit7CisgICAgaWYgKCFzX2xpdmluZ0Zy
YW1lT3duZXJFbGVtZW50cykKKyAgICAgICAgc19saXZpbmdGcmFtZU93bmVyRWxlbWVudHMgPSBu
ZXcgV1RGOjpIYXNoU2V0PEhUTUxGcmFtZU93bmVyRWxlbWVudCo+KCk7CisgICAgc19saXZpbmdG
cmFtZU93bmVyRWxlbWVudHMtPmFkZChvd25lckVsZW1lbnQpOworfQorCit2b2lkIGZyYW1lT3du
ZXJFbGVtZW50RGVzdHJveWVkKEhUTUxGcmFtZU93bmVyRWxlbWVudCogY29uc3Qgb3duZXJFbGVt
ZW50KQoreworICAgIEFTU0VSVChzX2xpdmluZ0ZyYW1lT3duZXJFbGVtZW50cyk7CisgICAgc19s
aXZpbmdGcmFtZU93bmVyRWxlbWVudHMtPnJlbW92ZShvd25lckVsZW1lbnQpOworfQorCit2b2lk
IGNyYXNoSWZOb3RPd25lckVsZW1lbnQoSFRNTEZyYW1lT3duZXJFbGVtZW50KiBjb25zdCBvd25l
ckVsZW1lbnQpCit7CisgICAgaWYgKG93bmVyRWxlbWVudCAmJiAoKCFzX2xpdmluZ0ZyYW1lT3du
ZXJFbGVtZW50cykgfHwgKCFzX2xpdmluZ0ZyYW1lT3duZXJFbGVtZW50cy0+Y29udGFpbnMob3du
ZXJFbGVtZW50KSkpKSB7CisgICAgICAgIGNoYXIqIGNvbnN0IHAgPSByZWludGVycHJldF9jYXN0
PGNoYXIqPigweEJBQURCRUFGKTsKKyAgICAgICAgKnAgPSAwOworICAgIH0KK30KKwogSFRNTEZy
YW1lT3duZXJFbGVtZW50OjpIVE1MRnJhbWVPd25lckVsZW1lbnQoY29uc3QgUXVhbGlmaWVkTmFt
ZSYgdGFnTmFtZSwgRG9jdW1lbnQqIGRvY3VtZW50KQogICAgIDogSFRNTEVsZW1lbnQodGFnTmFt
ZSwgZG9jdW1lbnQpCiAgICAgLCBtX2NvbnRlbnRGcmFtZSgwKQogICAgICwgbV9jcmVhdGVkQnlQ
YXJzZXIoZmFsc2UpCiB7CisgICAgZnJhbWVPd25lckVsZW1lbnRDb25zdHJ1Y3RlZCh0aGlzKTsK
IH0KIAogdm9pZCBIVE1MRnJhbWVPd25lckVsZW1lbnQ6OndpbGxSZW1vdmUoKQpAQCAtNTMsNiAr
NzYsNyBAQCBIVE1MRnJhbWVPd25lckVsZW1lbnQ6On5IVE1MRnJhbWVPd25lckVsCiB7CiAgICAg
aWYgKG1fY29udGVudEZyYW1lKQogICAgICAgICBtX2NvbnRlbnRGcmFtZS0+ZGlzY29ubmVjdE93
bmVyRWxlbWVudCgpOworICAgIGZyYW1lT3duZXJFbGVtZW50RGVzdHJveWVkKHRoaXMpOwogfQog
CiBEb2N1bWVudCogSFRNTEZyYW1lT3duZXJFbGVtZW50Ojpjb250ZW50RG9jdW1lbnQoKSBjb25z
dApJbmRleDogV2ViQ29yZS9wYWdlL0ZyYW1lLmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBXZWJDb3JlL3Bh
Z2UvRnJhbWUuY3BwCShyZXZpc2lvbiAzNDk2MikKKysrIFdlYkNvcmUvcGFnZS9GcmFtZS5jcHAJ
KHdvcmtpbmcgY29weSkKQEAgLTExODMsOCArMTE4MywxMSBAQCBSZW5kZXJWaWV3KiBGcmFtZTo6
Y29udGVudFJlbmRlcmVyKCkgY29uCiAgICAgcmV0dXJuIHN0YXRpY19jYXN0PFJlbmRlclZpZXcq
PihvYmplY3QpOwogfQogCitleHRlcm4gdm9pZCBjcmFzaElmTm90T3duZXJFbGVtZW50KEhUTUxG
cmFtZU93bmVyRWxlbWVudCogY29uc3Qgb3duZXJFbGVtZW50KTsKKwogSFRNTEZyYW1lT3duZXJF
bGVtZW50KiBGcmFtZTo6b3duZXJFbGVtZW50KCkgY29uc3QKIHsKKyAgICBjcmFzaElmTm90T3du
ZXJFbGVtZW50KGQtPm1fb3duZXJFbGVtZW50KTsKICAgICByZXR1cm4gZC0+bV9vd25lckVsZW1l
bnQ7CiB9CiAK
</data>

          </attachment>
          <attachment
              isobsolete="1"
              ispatch="1"
              isprivate="0"
          >
            <attachid>22469</attachid>
            <date>2008-07-24 13:45:04 -0700</date>
            <delta_ts>2008-07-26 22:11:59 -0700</delta_ts>
            <desc>Proposed fix</desc>
            <filename>fix.patch</filename>
            <type>text/plain</type>
            <size>2162</size>
            <attacher name="Chris Brichford">chrisb</attacher>
            
              <data encoding="base64">SW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9n
CShyZXZpc2lvbiAzNTMyOSkKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA
IC0xLDMgKzEsMTggQEAKKzIwMDgtMDctMjQgIENocmlzdG9waGVyIEJyaWNoZm9yZCAgPGNocmlz
YkBhZG9iZS5jb20+CisJRml4IGZvciBidWcgMTk4OTEsIEJyb2tlbiBIVE1MIG9iamVjdCBlbGVt
ZW50cyBjYXVzZSBkZS1yZWZlcmVuY2Ugb2YgcG9pbnRlciB0byBmcmVlZCBtZW1vcnkuCisJSWYg
d2UgZmFpbCB0byBsb2FkIGFuIGltYWdlIGZvciBhbiBvYmplY3QgdGFnIGFuZCB3ZSBubyBsb25n
ZXIgYmVsaWV2ZSB0aGUgb2JqZWN0IHRhZyBwb2ludHMgYXQKKwlhbiBpbWFnZSwgdGhlbiBjbGVh
ciBtX2ltYWdlTG9hZGVyIGluIHRoZSBIVE1MT2JqZWN0RWxlbWVudCBzbyB0aGF0IHdlIGF0dGVt
cHQgdG8gcmVuZGVyIHRoZQorCWZhbGwgYmFjayBjb250ZW50LgorCisgICAgICAgIFJldmlld2Vk
IGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIFdBUk5JTkc6IE5PIFRFU1QgQ0FTRVMgQURE
RUQgT1IgQ0hBTkdFRAorCisgICAgICAgICogaHRtbC9IVE1MT2JqZWN0RWxlbWVudC5jcHA6Cisg
ICAgICAgIChXZWJDb3JlOjpIVE1MT2JqZWN0RWxlbWVudDo6cmVuZGVyRmFsbGJhY2tDb250ZW50
KToKKyAgICAgICAgKiBwYWdlL0ZyYW1lLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OkZyYW1lOjpG
cmFtZSk6CisKIDIwMDgtMDctMjQgIERhdmlkIEh5YXR0ICA8aHlhdHRAYXBwbGUuY29tPgogCiAg
ICAgICAgIEZpeCBmb3IgYnVnIDE4NjczLCBjcmFzaCB3aGVuIHVzaW5nIGZ1bGwgcGFnZSB6b29t
IG9uIGdlbmVyYXRlZCBjb250ZW50LiAgRG9uJ3QgY2FsbApJbmRleDogV2ViQ29yZS9odG1sL0hU
TUxPYmplY3RFbGVtZW50LmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBXZWJDb3JlL2h0bWwvSFRNTE9iamVj
dEVsZW1lbnQuY3BwCShyZXZpc2lvbiAzNTMyNikKKysrIFdlYkNvcmUvaHRtbC9IVE1MT2JqZWN0
RWxlbWVudC5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTI4Nyw2ICsyODcsOCBAQCB2b2lkIEhUTUxP
YmplY3RFbGVtZW50OjpyZW5kZXJGYWxsYmFja0NvCiAgICAgaWYgKG1faW1hZ2VMb2FkZXIgJiYg
bV9pbWFnZUxvYWRlci0+aW1hZ2UoKSkgewogICAgICAgICBtX3NlcnZpY2VUeXBlID0gbV9pbWFn
ZUxvYWRlci0+aW1hZ2UoKS0+cmVzcG9uc2UoKS5taW1lVHlwZSgpOwogICAgICAgICBpZiAoIWlz
SW1hZ2VUeXBlKCkpIHsKKyAgICAgICAgICAgIC8vIElmIHdlIGRvbid0IHRoaW5rIHdlIGhhdmUg
YW4gaW1hZ2UgdHlwZSBhbnltb3JlLCB0aGVuIGRpdGNoIHRoZSBpbWFnZSBsb2FkZXIuCisgICAg
ICAgICAgICBtX2ltYWdlTG9hZGVyLmNsZWFyKCk7CiAgICAgICAgICAgICBkZXRhY2goKTsKICAg
ICAgICAgICAgIGF0dGFjaCgpOwogICAgICAgICAgICAgcmV0dXJuOwpJbmRleDogV2ViQ29yZS9w
YWdlL0ZyYW1lLmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBXZWJDb3JlL3BhZ2UvRnJhbWUuY3BwCShyZXZp
c2lvbiAzNTMyNikKKysrIFdlYkNvcmUvcGFnZS9GcmFtZS5jcHAJKHdvcmtpbmcgY29weSkKQEAg
LTEzOSw2ICsxMzksOCBAQCBGcmFtZTo6RnJhbWUoUGFnZSogcGFnZSwgSFRNTEZyYW1lT3duZXJF
CiAgICAgICAgIHBhZ2UtPnNldE1haW5GcmFtZSh0aGlzKTsKICAgICBlbHNlIHsKICAgICAgICAg
cGFnZS0+aW5jcmVtZW50RnJhbWVDb3VudCgpOworCS8vIE1ha2Ugc3VyZSB3ZSB3aWxsIG5vdCBl
bmQgdXAgd2l0aCB0d28gZnJhbWVzIHJlZmVyZW5jaW5nIHRoZSBzYW1lIG93bmVyIGVsZW1lbnQu
CisJQVNTRVJUKCghKG93bmVyRWxlbWVudC0+bV9jb250ZW50RnJhbWUpKSB8fCAob3duZXJFbGVt
ZW50LT5tX2NvbnRlbnRGcmFtZS0+b3duZXJFbGVtZW50KCkgIT0gb3duZXJFbGVtZW50KSk7CiAg
ICAgICAgIG93bmVyRWxlbWVudC0+bV9jb250ZW50RnJhbWUgPSB0aGlzOwogICAgIH0KIAo=
</data>

          </attachment>
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>22484</attachid>
            <date>2008-07-25 16:23:23 -0700</date>
            <delta_ts>2008-07-26 22:12:40 -0700</delta_ts>
            <desc>proposed fix with test</desc>
            <filename>fixWithTest.patch</filename>
            <type>text/plain</type>
            <size>4143</size>
            <attacher name="Chris Brichford">chrisb</attacher>
            
              <data encoding="base64">SW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9n
CShyZXZpc2lvbiAzNTM1OSkKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA
IC0xLDMgKzEsMTkgQEAKKzIwMDgtMDctMjUgIENocmlzdG9waGVyIEJyaWNoZm9yZCAgPGNocmlz
YkBhZG9iZS5jb20+CisKKyAgICAgICAgRml4IGZvciBidWcgMTk4OTEsIEJyb2tlbiBIVE1MIG9i
amVjdCBlbGVtZW50cyBjYXVzZSBkZS1yZWZlcmVuY2Ugb2YgcG9pbnRlciB0byBmcmVlZCBtZW1v
cnkuCisgICAgICAgIElmIHdlIGZhaWwgdG8gbG9hZCBhbiBpbWFnZSBmb3IgYW4gb2JqZWN0IHRh
ZyBhbmQgd2Ugbm8gbG9uZ2VyIGJlbGlldmUgdGhlIG9iamVjdCB0YWcgcG9pbnRzIGF0CisgICAg
ICAgIGFuIGltYWdlLCB0aGVuIGNsZWFyIG1faW1hZ2VMb2FkZXIgaW4gdGhlIEhUTUxPYmplY3RF
bGVtZW50IHNvIHRoYXQgd2UgYXR0ZW1wdCB0byByZW5kZXIgdGhlCisgICAgICAgIGZhbGwgYmFj
ayBjb250ZW50LgorICAgICAgICAKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISku
CisKKyAgICAgICAgVGVzdDogaHR0cC90ZXN0cy9taXNjL29iamVjdC1pbWFnZS1lcnJvci13aXRo
LW9ubG9hZC5odG1sCisKKyAgICAgICAgKiBodG1sL0hUTUxPYmplY3RFbGVtZW50LmNwcDoKKyAg
ICAgICAgKFdlYkNvcmU6OkhUTUxPYmplY3RFbGVtZW50OjpyZW5kZXJGYWxsYmFja0NvbnRlbnQp
OgorICAgICAgICAqIHBhZ2UvRnJhbWUuY3BwOgorICAgICAgICAoV2ViQ29yZTo6RnJhbWU6OkZy
YW1lKToKKwogMjAwOC0wNy0yNSAgY2hyaXMgZmxlaXphY2ggIDxjZmxlaXphY2hAYXBwbGUuY29t
PgogCiAgICAgICAgIFJldmlld2VkIGJ5IEJldGggRGFraW4KSW5kZXg6IFdlYkNvcmUvaHRtbC9I
VE1MT2JqZWN0RWxlbWVudC5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gV2ViQ29yZS9odG1sL0hUTUxPYmpl
Y3RFbGVtZW50LmNwcAkocmV2aXNpb24gMzUzMjYpCisrKyBXZWJDb3JlL2h0bWwvSFRNTE9iamVj
dEVsZW1lbnQuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC0yODcsNiArMjg3LDggQEAgdm9pZCBIVE1M
T2JqZWN0RWxlbWVudDo6cmVuZGVyRmFsbGJhY2tDbwogICAgIGlmIChtX2ltYWdlTG9hZGVyICYm
IG1faW1hZ2VMb2FkZXItPmltYWdlKCkpIHsKICAgICAgICAgbV9zZXJ2aWNlVHlwZSA9IG1faW1h
Z2VMb2FkZXItPmltYWdlKCktPnJlc3BvbnNlKCkubWltZVR5cGUoKTsKICAgICAgICAgaWYgKCFp
c0ltYWdlVHlwZSgpKSB7CisgICAgICAgICAgICAvLyBJZiB3ZSBkb24ndCB0aGluayB3ZSBoYXZl
IGFuIGltYWdlIHR5cGUgYW55bW9yZSwgdGhlbiBkaXRjaCB0aGUgaW1hZ2UgbG9hZGVyLgorICAg
ICAgICAgICAgbV9pbWFnZUxvYWRlci5jbGVhcigpOwogICAgICAgICAgICAgZGV0YWNoKCk7CiAg
ICAgICAgICAgICBhdHRhY2goKTsKICAgICAgICAgICAgIHJldHVybjsKSW5kZXg6IFdlYkNvcmUv
cGFnZS9GcmFtZS5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gV2ViQ29yZS9wYWdlL0ZyYW1lLmNwcAkocmV2
aXNpb24gMzUzMjYpCisrKyBXZWJDb3JlL3BhZ2UvRnJhbWUuY3BwCSh3b3JraW5nIGNvcHkpCkBA
IC0xMzksNiArMTM5LDggQEAgRnJhbWU6OkZyYW1lKFBhZ2UqIHBhZ2UsIEhUTUxGcmFtZU93bmVy
RQogICAgICAgICBwYWdlLT5zZXRNYWluRnJhbWUodGhpcyk7CiAgICAgZWxzZSB7CiAgICAgICAg
IHBhZ2UtPmluY3JlbWVudEZyYW1lQ291bnQoKTsKKwkvLyBNYWtlIHN1cmUgd2Ugd2lsbCBub3Qg
ZW5kIHVwIHdpdGggdHdvIGZyYW1lcyByZWZlcmVuY2luZyB0aGUgc2FtZSBvd25lciBlbGVtZW50
LgorCUFTU0VSVCgoIShvd25lckVsZW1lbnQtPm1fY29udGVudEZyYW1lKSkgfHwgKG93bmVyRWxl
bWVudC0+bV9jb250ZW50RnJhbWUtPm93bmVyRWxlbWVudCgpICE9IG93bmVyRWxlbWVudCkpOwog
ICAgICAgICBvd25lckVsZW1lbnQtPm1fY29udGVudEZyYW1lID0gdGhpczsKICAgICB9CiAKSW5k
ZXg6IExheW91dFRlc3RzL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9DaGFu
Z2VMb2cJKHJldmlzaW9uIDM1MzU5KQorKysgTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCSh3b3JraW5n
IGNvcHkpCkBAIC0xLDMgKzEsMTYgQEAKKzIwMDgtMDctMjUgIENocmlzdG9waGVyIEJyaWNoZm9y
ZCAgPGNocmlzYkBhZG9iZS5jb20+CisKKyAgICAgICAgRml4IGZvciBidWcgMTk4OTEsIEJyb2tl
biBIVE1MIG9iamVjdCBlbGVtZW50cyBjYXVzZSBkZS1yZWZlcmVuY2Ugb2YgcG9pbnRlciB0byBm
cmVlZCBtZW1vcnkuCisgICAgICAgIElmIHdlIGZhaWwgdG8gbG9hZCBhbiBpbWFnZSBmb3IgYW4g
b2JqZWN0IHRhZyBhbmQgd2Ugbm8gbG9uZ2VyIGJlbGlldmUgdGhlIG9iamVjdCB0YWcgcG9pbnRz
IGF0CisgICAgICAgIGFuIGltYWdlLCB0aGVuIGNsZWFyIG1faW1hZ2VMb2FkZXIgaW4gdGhlIEhU
TUxPYmplY3RFbGVtZW50IHNvIHRoYXQgd2UgYXR0ZW1wdCB0byByZW5kZXIgdGhlCisgICAgICAg
IGZhbGwgYmFjayBjb250ZW50LgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEp
LgorCisgICAgICAgICogY3NzMy9zdXBwb3J0OiBBZGRlZC4KKyAgICAgICAgKiBodHRwL3Rlc3Rz
L21pc2Mvb2JqZWN0LWltYWdlLWVycm9yLXdpdGgtb25sb2FkLWV4cGVjdGVkLnR4dDogQWRkZWQu
CisgICAgICAgICogaHR0cC90ZXN0cy9taXNjL29iamVjdC1pbWFnZS1lcnJvci13aXRoLW9ubG9h
ZC5odG1sOiBBZGRlZC4KKwogMjAwOC0wNy0yNSAgQW5kZXJzIENhcmxzc29uICA8YW5kZXJzY2FA
YXBwbGUuY29tPgogCiAgICAgICAgIFJldmlld2VkIGJ5IE1pdHouCkluZGV4OiBMYXlvdXRUZXN0
cy9odHRwL3Rlc3RzL21pc2Mvb2JqZWN0LWltYWdlLWVycm9yLXdpdGgtb25sb2FkLWV4cGVjdGVk
LnR4dAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09CkluZGV4OiBMYXlvdXRUZXN0cy9odHRwL3Rlc3RzL21pc2Mvb2JqZWN0
LWltYWdlLWVycm9yLXdpdGgtb25sb2FkLmh0bWwKPT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMv
aHR0cC90ZXN0cy9taXNjL29iamVjdC1pbWFnZS1lcnJvci13aXRoLW9ubG9hZC5odG1sCShyZXZp
c2lvbiAwKQorKysgTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy9taXNjL29iamVjdC1pbWFnZS1lcnJv
ci13aXRoLW9ubG9hZC5odG1sCShyZXZpc2lvbiAwKQpAQCAtMCwwICsxLDE4IEBACis8aHRtbD4K
KzxzY3JpcHQ+CisgICAgaWYgKHdpbmRvdy5sYXlvdXRUZXN0Q29udHJvbGxlcikgeworICAgICAg
ICBsYXlvdXRUZXN0Q29udHJvbGxlci5kdW1wQXNUZXh0KCkKKyAgICAgICAgbGF5b3V0VGVzdENv
bnRyb2xsZXIud2FpdFVudGlsRG9uZSgpOworICAgIH0KKworICAgIGZ1bmN0aW9uIGZpbmlzaGVk
KCkKKyAgICB7CisgICAgICAgIGlmICh3aW5kb3cubGF5b3V0VGVzdENvbnRyb2xsZXIpCisgICAg
ICAgICAgICBsYXlvdXRUZXN0Q29udHJvbGxlci5ub3RpZnlEb25lKCk7CisgICAgfQorPC9zY3Jp
cHQ+Cis8Ym9keSBvbmxvYWQ9IndpbmRvdy5kb2N1bWVudC5vcGVuKCk7IGZpbmlzaGVkKCk7Ij4g
Cis8b2JqZWN0IGRhdGE9InRoaXMuaW1hZ2UuZG9lcy5ub3QuZXhpc3QuZ2lmIiBjb2RldHlwZT0i
aW1hZ2UvZ2lmIiBoZWlnaHQ9IjEwIj48L29iamVjdD4KK1Rlc3QgZm9yIDxhIGhyZWY9Imh0dHBz
Oi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xOTg5MSI+QnVnIGh0dHBzOi8vYnVn
cy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xOTg5MTwvYT4uICBQYXNzIGlmIHRoZXJlIGlz
IG5vIGNyYXNoIG9yIEFTU0VSVC4KKzwvYm9keT4KKzwvaHRtbD4K
</data>
<flag name="review"
          id="9917"
          type_id="1"
          status="-"
          setter="mrowe"
    />
          </attachment>
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>22683</attachid>
            <date>2008-08-06 10:36:54 -0700</date>
            <delta_ts>2008-08-10 07:54:19 -0700</delta_ts>
            <desc>Patch for bug 19891</desc>
            <filename>PatchBug19891.txt</filename>
            <type>text/plain</type>
            <size>3599</size>
            <attacher name="Mihnea Ovidenie">mihnea</attacher>
            
              <data encoding="base64">SW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9n
CShyZXZpc2lvbiAzNTYwNikKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA
IC0xLDMgKzEsMzUgQEAKKzIwMDgtMDgtMDYgIE1paG5lYSBPdmlkZW5pZSAgPG1paG5lYUBhZG9i
ZS5jb20+CisKKyAgICAgICAgRml4IGZvciBidWcgMTk4OTE6IGh0dHBzOi8vYnVncy53ZWJraXQu
b3JnL3Nob3dfYnVnLmNnaT9pZD0xOTk2NAorICAgICAgICBCcm9rZW4gSFRNTCBvYmplY3QgZWxl
bWVudHMgY2F1c2UgZGUtcmVmZXJlbmNlIG9mIHBvaW50ZXIgdG8gZnJlZWQgbWVtb3J5LgorICAg
ICAgICBJZiB3ZSBmYWlsIHRvIGxvYWQgYW4gaW1hZ2UgZm9yIGFuIG9iamVjdCB0YWcgYW5kIHdl
IG5vIGxvbmdlciBiZWxpZXZlIHRoZSBvYmplY3QgdGFnIHBvaW50cyBhdAorICAgICAgICBhbiBp
bWFnZSwgdGhlbiBjbGVhciBtX2ltYWdlTG9hZGVyIGluIHRoZSBIVE1MT2JqZWN0RWxlbWVudCBz
byB0aGF0IHdlIGF0dGVtcHQgdG8gcmVuZGVyIHRoZQorICAgICAgICBmYWxsIGJhY2sgY29udGVu
dC4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBUZXN0
czogaHR0cC90ZXN0cy9taXNjL29iamVjdC1pbWFnZS1lcnJvci13aXRoLW9ubG9hZC5odG1sCisK
KyAgICAgICAgKiBDaGFuZ2VMb2c6CisgICAgICAgICogaHRtbC9IVE1MT2JqZWN0RWxlbWVudC5j
cHA6CisgICAgICAgIChXZWJDb3JlOjpIVE1MT2JqZWN0RWxlbWVudDo6cmVuZGVyRmFsbGJhY2tD
b250ZW50KToKKyAgICAgICAgKiBwYWdlL0ZyYW1lLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OkZy
YW1lOjpGcmFtZSk6CisKIDIwMDgtMDctMDIgIERhdmlkIEtpbHplciAgPGRka2lsemVyQGFwcGxl
LmNvbT4KIAogICAgICAgICBJbWFnZXMgdXNpbmcgUVQgcGx1Z2luIGRvIG5vdCBkaXNwbGF5IGNv
cnJlY3RseQpJbmRleDogV2ViQ29yZS9odG1sL0hUTUxPYmplY3RFbGVtZW50LmNwcAo9PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09Ci0tLSBXZWJDb3JlL2h0bWwvSFRNTE9iamVjdEVsZW1lbnQuY3BwCShyZXZpc2lvbiAzNTYw
NCkKKysrIFdlYkNvcmUvaHRtbC9IVE1MT2JqZWN0RWxlbWVudC5jcHAJKHdvcmtpbmcgY29weSkK
QEAgLTI2NSw2ICsyNjUsOCBAQCB2b2lkIEhUTUxPYmplY3RFbGVtZW50OjpyZW5kZXJGYWxsYmFj
a0NvCiAgICAgaWYgKG1faW1hZ2VMb2FkZXIgJiYgbV9pbWFnZUxvYWRlci0+aW1hZ2UoKSkgewog
ICAgICAgICBtX3NlcnZpY2VUeXBlID0gbV9pbWFnZUxvYWRlci0+aW1hZ2UoKS0+cmVzcG9uc2Uo
KS5taW1lVHlwZSgpOwogICAgICAgICBpZiAoIWlzSW1hZ2VUeXBlKCkpIHsKKyAgICAgICAgICAg
IC8vIElmIHdlIGRvbid0IHRoaW5rIHdlIGhhdmUgYW4gaW1hZ2UgdHlwZSBhbnltb3JlLCB0aGVu
IGRpdGNoIHRoZSBpbWFnZSBsb2FkZXIuCisgICAgICAgICAgICBtX2ltYWdlTG9hZGVyLmNsZWFy
KCk7ICAgICAgICAKICAgICAgICAgICAgIGRldGFjaCgpOwogICAgICAgICAgICAgYXR0YWNoKCk7
CiAgICAgICAgICAgICByZXR1cm47CkluZGV4OiBXZWJDb3JlL3BhZ2UvRnJhbWUuY3BwCj09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT0KLS0tIFdlYkNvcmUvcGFnZS9GcmFtZS5jcHAJKHJldmlzaW9uIDM1NjA0KQorKysgV2Vi
Q29yZS9wYWdlL0ZyYW1lLmNwcAkod29ya2luZyBjb3B5KQpAQCAtMTI4LDYgKzEyOCw4IEBAIEZy
YW1lOjpGcmFtZShQYWdlKiBwYWdlLCBIVE1MRnJhbWVPd25lckUKICAgICAgICAgcGFnZS0+c2V0
TWFpbkZyYW1lKHRoaXMpOwogICAgIGVsc2UgewogICAgICAgICBwYWdlLT5pbmNyZW1lbnRGcmFt
ZUNvdW50KCk7CisgICAgICAgIC8vIE1ha2Ugc3VyZSB3ZSB3aWxsIG5vdCBlbmQgdXAgd2l0aCB0
d28gZnJhbWVzIHJlZmVyZW5jaW5nIHRoZSBzYW1lIG93bmVyIGVsZW1lbnQuCisgICAgICAgIEFT
U0VSVCgoIShvd25lckVsZW1lbnQtPm1fY29udGVudEZyYW1lKSkgfHwgKG93bmVyRWxlbWVudC0+
bV9jb250ZW50RnJhbWUtPm93bmVyRWxlbWVudCgpICE9IG93bmVyRWxlbWVudCkpOyAgICAgICAg
CiAgICAgICAgIG93bmVyRWxlbWVudC0+bV9jb250ZW50RnJhbWUgPSB0aGlzOwogICAgIH0KIApJ
bmRleDogTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy9taXNjL29iamVjdC1pbWFnZS1lcnJvci13aXRo
LW9ubG9hZC1leHBlY3RlZC50eHQKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvaHR0cC90ZXN0
cy9taXNjL29iamVjdC1pbWFnZS1lcnJvci13aXRoLW9ubG9hZC1leHBlY3RlZC50eHQJKHJldmlz
aW9uIDApCisrKyBMYXlvdXRUZXN0cy9odHRwL3Rlc3RzL21pc2Mvb2JqZWN0LWltYWdlLWVycm9y
LXdpdGgtb25sb2FkLWV4cGVjdGVkLnR4dAkocmV2aXNpb24gMCkKQEAgLTAsMCArMSwzIEBACitU
ZXN0IGZvciBCdWcgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE5ODkx
IEJyb2tlbiBIVE1MIG9iamVjdCBlbGVtZW50cyBjYXVzZSBkZS1yZWZlcmVuY2Ugb2YgcG9pbnRl
ciB0byBmcmVlZCBtZW1vcnkKKworUGFzcyBpZiB0aGVyZSBpcyBubyBjcmFzaCBvciBBU1NFUlQu
CkluZGV4OiBMYXlvdXRUZXN0cy9odHRwL3Rlc3RzL21pc2Mvb2JqZWN0LWltYWdlLWVycm9yLXdp
dGgtb25sb2FkLmh0bWwKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy9taXNj
L29iamVjdC1pbWFnZS1lcnJvci13aXRoLW9ubG9hZC5odG1sCShyZXZpc2lvbiAwKQorKysgTGF5
b3V0VGVzdHMvaHR0cC90ZXN0cy9taXNjL29iamVjdC1pbWFnZS1lcnJvci13aXRoLW9ubG9hZC5o
dG1sCShyZXZpc2lvbiAwKQpAQCAtMCwwICsxLDE1IEBACis8aHRtbD4KKzxzY3JpcHQ+CisgICAg
aWYgKHdpbmRvdy5sYXlvdXRUZXN0Q29udHJvbGxlcikgeworICAgICAgICBsYXlvdXRUZXN0Q29u
dHJvbGxlci5kdW1wQXNUZXh0KCkKKyAgICB9Cis8L3NjcmlwdD4KKzxib2R5PiAKKzxwPgorVGVz
dCBmb3IgPGk+PGEgaHJlZj0iaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lk
PTE5ODkxIj5CdWcgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE5ODkx
PC9hPjwvaT4KK0Jyb2tlbiBIVE1MIG9iamVjdCBlbGVtZW50cyBjYXVzZSBkZS1yZWZlcmVuY2Ug
b2YgcG9pbnRlciB0byBmcmVlZCBtZW1vcnkKKzwvcD4KKzxvYmplY3QgZGF0YT0idGhpcy5vYmpl
Y3QuZG9lcy5ub3QuZXhpc3QuZ2lmIiBjb2RldHlwZT0iaW1hZ2UvZ2lmIiBoZWlnaHQ9IjEwIj48
L29iamVjdD4KK1Bhc3MgaWYgdGhlcmUgaXMgbm8gY3Jhc2ggb3IgQVNTRVJULgorPC9ib2R5Pgor
PC9odG1sPgo=
</data>
<flag name="review"
          id="10050"
          type_id="1"
          status="+"
          setter="ap"
    />
          </attachment>
      

    </bug>

</bugzilla>