<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>201281</bug_id>
          
          <creation_ts>2019-08-28 20:31:14 -0700</creation_ts>
          <short_desc>DFG/FTL: We should prefetch structures and do a loadLoadFence before doing PrototypeChainIsSane checks.</short_desc>
          <delta_ts>2019-09-03 23:26:47 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>JavaScriptCore</component>
          <version>WebKit Nightly Build</version>
          <rep_platform>Unspecified</rep_platform>
          <op_sys>Unspecified</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          <see_also>https://bugs.webkit.org/show_bug.cgi?id=201449</see_also>
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>InRadar</keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Mark Lam">mark.lam</reporter>
          <assigned_to name="Mark Lam">mark.lam</assigned_to>
          <cc>fpizlo</cc>
    
    <cc>keith_miller</cc>
    
    <cc>msaboff</cc>
    
    <cc>rmorisset</cc>
    
    <cc>saam</cc>
    
    <cc>tzagallo</cc>
    
    <cc>webkit-bug-importer</cc>
    
    <cc>ysuzuki</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>1566074</commentid>
    <comment_count>0</comment_count>
    <who name="Mark Lam">mark.lam</who>
    <bug_when>2019-08-28 20:31:14 -0700</bug_when>
    <thetext>This is already the preferred idiom used in most places in our compiler, except for 2: DFG&apos;s SpeculativeJIT::compileGetByValOnString() and FTL&apos;s compileStringCharAt().  Consider the following:

    bool prototypeChainIsSane = false;
    if (globalObject-&gt;stringPrototypeChainIsSane()) {
        // FIXME: This could be captured using a Speculation mode that means
        // &quot;out-of-bounds loads return a trivial value&quot;, something like
        // SaneChainOutOfBounds.
        // https://bugs.webkit.org/show_bug.cgi?id=144668
        
        m_graph.registerAndWatchStructureTransition(globalObject-&gt;stringPrototype()-&gt;structure(vm()));
        m_graph.registerAndWatchStructureTransition(globalObject-&gt;objectPrototype()-&gt;structure(vm()));

        prototypeChainIsSane = globalObject-&gt;stringPrototypeChainIsSane();
    }

What&apos;s essential for correctness here is that the stringPrototype and objectPrototype structures be loaded before the loads in the second stringPrototypeChainIsSane() check.  Without a loadLoadFence before the second stringPrototypeChainIsSane() check, we can&apos;t guarantee that.  Elsewhere in the compiler, the preferred idiom for doing this right is to pre-load the structures first, do a loadLoadFence, and then do the IsSane check just once after e.g.

    Structure* arrayPrototypeStructure = globalObject-&gt;arrayPrototype()-&gt;structure(m_vm);
    Structure* objectPrototypeStructure = globalObject-&gt;objectPrototype()-&gt;structure(m_vm);

    if (arrayPrototypeStructure-&gt;transitionWatchpointSetIsStillValid() // has loadLoadFences.
        &amp;&amp; objectPrototypeStructure-&gt;transitionWatchpointSetIsStillValid() // has loadLoadFences.
        &amp;&amp; globalObject-&gt;arrayPrototypeChainIsSane()) {

        m_graph.registerAndWatchStructureTransition(arrayPrototypeStructure);
        m_graph.registerAndWatchStructureTransition(objectPrototypeStructure);
        ...
    }

We should change DFG&apos;s SpeculativeJIT::compileGetByValOnString() and FTL&apos;s compileStringCharAt() to follow the same idiom.

&lt;rdar://problem/54028228&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1566077</commentid>
    <comment_count>1</comment_count>
      <attachid>377543</attachid>
    <who name="Mark Lam">mark.lam</who>
    <bug_when>2019-08-28 20:43:10 -0700</bug_when>
    <thetext>Created attachment 377543
proposed patch.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1566093</commentid>
    <comment_count>2</comment_count>
      <attachid>377543</attachid>
    <who name="Yusuke Suzuki">ysuzuki</who>
    <bug_when>2019-08-28 22:17:23 -0700</bug_when>
    <thetext>Comment on attachment 377543
proposed patch.

r=me</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1566118</commentid>
    <comment_count>3</comment_count>
      <attachid>377543</attachid>
    <who name="Saam Barati">saam</who>
    <bug_when>2019-08-28 23:34:24 -0700</bug_when>
    <thetext>Comment on attachment 377543
proposed patch.

r=me too</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1566122</commentid>
    <comment_count>4</comment_count>
    <who name="Mark Lam">mark.lam</who>
    <bug_when>2019-08-28 23:50:22 -0700</bug_when>
    <thetext>Thanks for the reviews.  Landed in r249247: &lt;http://trac.webkit.org/r249247&gt;.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1567654</commentid>
    <comment_count>5</comment_count>
      <attachid>377543</attachid>
    <who name="Saam Barati">saam</who>
    <bug_when>2019-09-03 22:46:23 -0700</bug_when>
    <thetext>Comment on attachment 377543
proposed patch.

View in context: https://bugs.webkit.org/attachment.cgi?id=377543&amp;action=review

&gt; Source/JavaScriptCore/runtime/StructureInlines.h:111
&gt; +    ASSERT(!isMainThread() || object-&gt;structure() == this);

I think this should be isCompilationThread()

&gt; Source/JavaScriptCore/runtime/StructureInlines.h:119
&gt; +    ASSERT(!isMainThread() || object-&gt;structure() == this);

ditto</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1567664</commentid>
    <comment_count>6</comment_count>
    <who name="Mark Lam">mark.lam</who>
    <bug_when>2019-09-03 23:26:13 -0700</bug_when>
    <thetext>(In reply to Saam Barati from comment #5)
&gt; Comment on attachment 377543 [details]
&gt; proposed patch.
&gt; 
&gt; View in context:
&gt; https://bugs.webkit.org/attachment.cgi?id=377543&amp;action=review
&gt; 
&gt; &gt; Source/JavaScriptCore/runtime/StructureInlines.h:111
&gt; &gt; +    ASSERT(!isMainThread() || object-&gt;structure() == this);
&gt; 
&gt; I think this should be isCompilationThread()
&gt; 
&gt; &gt; Source/JavaScriptCore/runtime/StructureInlines.h:119
&gt; &gt; +    ASSERT(!isMainThread() || object-&gt;structure() == this);
&gt; 
&gt; ditto

The use of isMainThread() effectively disables the assertions for worker threads as well.  I don&apos;t think we call these methods from the GC threads.  Otherwise, using isCompilationThread() would be wrong too.  I&apos;ll do the test in a separate bug so that we can test it before landing.

See https://bugs.webkit.org/show_bug.cgi?id=201449.</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>377543</attachid>
            <date>2019-08-28 20:43:10 -0700</date>
            <delta_ts>2019-08-28 22:17:23 -0700</delta_ts>
            <desc>proposed patch.</desc>
            <filename>bug-201281.patch</filename>
            <type>text/plain</type>
            <size>10114</size>
            <attacher name="Mark Lam">mark.lam</attacher>
            
              <data encoding="base64">SW5kZXg6IEpTVGVzdHMvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIEpTVGVzdHMvQ2hhbmdlTG9n
CShyZXZpc2lvbiAyNDkyMzYpCisrKyBKU1Rlc3RzL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpA
QCAtMSwzICsxLDEzIEBACisyMDE5LTA4LTI4ICBNYXJrIExhbSAgPG1hcmsubGFtQGFwcGxlLmNv
bT4KKworICAgICAgICBERkcvRlRMOiBXZSBzaG91bGQgcHJlZmV0Y2ggc3RydWN0dXJlcyBhbmQg
ZG8gYSBsb2FkTG9hZEZlbmNlIGJlZm9yZSBkb2luZyBQcm90b3R5cGVDaGFpbklzU2FuZSBjaGVj
a3MuCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0yMDEy
ODEKKyAgICAgICAgPHJkYXI6Ly9wcm9ibGVtLzU0MDI4MjI4PgorCisgICAgICAgIFJldmlld2Vk
IGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgICogc3RyZXNzL3N0cnVjdHVyZS1zdG9yZWRQ
cm90b3R5cGUtc2hvdWxkLW9ubHktYXNzZXJ0LW9uLXRoZS1tdXRhdG9yLXRocmVhZC5qczogQWRk
ZWQuCisKIDIwMTktMDgtMjggIE1hcmsgTGFtICA8bWFyay5sYW1AYXBwbGUuY29tPgogCiAgICAg
ICAgIFBsYWNhdGUgZXhjZXB0aW9uIGNoZWNrIHZhbGlkYXRpb24gaW4gREZHJ3Mgb3BlcmF0aW9u
SGFzR2VuZXJpY1Byb3BlcnR5KCkuCkluZGV4OiBKU1Rlc3RzL3N0cmVzcy9zdHJ1Y3R1cmUtc3Rv
cmVkUHJvdG90eXBlLXNob3VsZC1vbmx5LWFzc2VydC1vbi10aGUtbXV0YXRvci10aHJlYWQuanMK
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PQotLS0gSlNUZXN0cy9zdHJlc3Mvc3RydWN0dXJlLXN0b3JlZFByb3RvdHlwZS1z
aG91bGQtb25seS1hc3NlcnQtb24tdGhlLW11dGF0b3ItdGhyZWFkLmpzCShub25leGlzdGVudCkK
KysrIEpTVGVzdHMvc3RyZXNzL3N0cnVjdHVyZS1zdG9yZWRQcm90b3R5cGUtc2hvdWxkLW9ubHkt
YXNzZXJ0LW9uLXRoZS1tdXRhdG9yLXRocmVhZC5qcwkod29ya2luZyBjb3B5KQpAQCAtMCwwICsx
LDIyIEBACisvL0Agc2tpcCBpZiBbImFybSIsICJtaXBzIl0uaW5jbHVkZT8oJGFyY2hpdGVjdHVy
ZSkKKy8vQCBzbG93IQorLy9AIHJ1bkRlZmF1bHQoIi0taml0UG9saWN5U2NhbGU9MCIpCisKKy8v
IFRoaXMgdGVzdCBzaG91bGQgbm90IGNyYXNoLgorCisvLyBJbmNyZWFzZSBpdGVyYXRpb25zIHRv
IDEwMDAwIGlmIHlvdSB3YW50IHRoZSByZWdyZXNzaW9uIHRvIHJlcHJvZHVjZSBtb3JlIHJlbGlh
Ymx5LgorLy8gSXQgY2FuIG1hbmlmZXN0IGluIGp1c3QgYSBmZXcgaXRlcmF0aW9ucyBvciBtYXkg
dGFrZSBhIGxvdCBtb3JlIGl0ZXJhdGlvbnMuIFdlJ3JlCisvLyByZWR1Y2luZyBpdGVyYXRpb25z
IGhlcmUgdG8gc2hvcnRlbiB0aGUgZXhlY3V0aW9uIHRpbWUgb2YgdGhpcyB0ZXN0IGZvciBub3Jt
YWwgcnVucywKKy8vIHdpdGggdGhlIHRyYWRlb2ZmIHRoYXQgc29tZSBydW5zIG1heSBub3QgdHJp
Z2dlciB0aGUgcmVncmVzc2lvbiAoaWYgcHJlc2VudCkuIFRoaXMgaXMKKy8vIHNvIHRoYXQgZml4
ZWQgYnVpbGRzICh3aGljaCBpcyB0aGUgbGlrZWx5IGNhc2UgZ29pbmcgZm9yd2FyZCkgd29uJ3Qg
aGF2ZSB0byB3YWl0IHRvbworLy8gbG9uZyBmb3IgdGhpcyB0ZXN0IHRvIGZpbmlzaC4KK2NvbnN0
IGl0ZXJhdGlvbnMgPSA1MDA7Citmb3IgKGxldCBpID0gMDsgaSA8IGl0ZXJhdGlvbnM7IGkrKykg
eworICAgIGxldCBjb2RlID0gYAorICAgICAgICBmb3IgKGxldCBpID0gMDsgaSA8IDEwMDA7IGkr
KykgeworICAgICAgICAgICAgU3RyaW5nLnByb3RvdHlwZS5fX3Byb3RvX18gPSBbXTsKKyAgICAg
ICAgICAgIGNvbnN0IHcgPSAnYWJjZGVmZydbLTJdOworICAgICAgICB9CisgICAgYDsKKyAgICBy
dW5TdHJpbmcoY29kZSk7Cit9CkluZGV4OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUvQ2hhbmdlTG9n
Cj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9u
IDI0OTIyNSkKKysrIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cJKHdvcmtpbmcgY29w
eSkKQEAgLTEsMyArMSw1OSBAQAorMjAxOS0wOC0yOCAgTWFyayBMYW0gIDxtYXJrLmxhbUBhcHBs
ZS5jb20+CisKKyAgICAgICAgREZHL0ZUTDogV2Ugc2hvdWxkIHByZWZldGNoIHN0cnVjdHVyZXMg
YW5kIGRvIGEgbG9hZExvYWRGZW5jZSBiZWZvcmUgZG9pbmcgUHJvdG90eXBlQ2hhaW5Jc1NhbmUg
Y2hlY2tzLgorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9
MjAxMjgxCisgICAgICAgIDxyZGFyOi8vcHJvYmxlbS81NDAyODIyOD4KKworICAgICAgICBSZXZp
ZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBUaGlzIChzZWUgdGl0bGUgYWJvdmUp
IGlzIGFscmVhZHkgdGhlIHByZWZlcnJlZCBpZGlvbSB1c2VkIGluIG1vc3QgcGxhY2VzIGluIG91
cgorICAgICAgICBjb21waWxlciwgZXhjZXB0IGZvciAyOiBERkcncyBTcGVjdWxhdGl2ZUpJVDo6
Y29tcGlsZUdldEJ5VmFsT25TdHJpbmcoKSBhbmQgRlRMJ3MKKyAgICAgICAgY29tcGlsZVN0cmlu
Z0NoYXJBdCgpLiAgQ29uc2lkZXIgdGhlIGZvbGxvd2luZzoKKworICAgICAgICAgICAgYm9vbCBw
cm90b3R5cGVDaGFpbklzU2FuZSA9IGZhbHNlOworICAgICAgICAgICAgaWYgKGdsb2JhbE9iamVj
dC0+c3RyaW5nUHJvdG90eXBlQ2hhaW5Jc1NhbmUoKSkgeworICAgICAgICAgICAgICAgIC4uLgor
ICAgICAgICAgICAgICAgIG1fZ3JhcGgucmVnaXN0ZXJBbmRXYXRjaFN0cnVjdHVyZVRyYW5zaXRp
b24oZ2xvYmFsT2JqZWN0LT5zdHJpbmdQcm90b3R5cGUoKS0+c3RydWN0dXJlKHZtKCkpKTsKKyAg
ICAgICAgICAgICAgICBtX2dyYXBoLnJlZ2lzdGVyQW5kV2F0Y2hTdHJ1Y3R1cmVUcmFuc2l0aW9u
KGdsb2JhbE9iamVjdC0+b2JqZWN0UHJvdG90eXBlKCktPnN0cnVjdHVyZSh2bSgpKSk7CisKKyAg
ICAgICAgICAgICAgICBwcm90b3R5cGVDaGFpbklzU2FuZSA9IGdsb2JhbE9iamVjdC0+c3RyaW5n
UHJvdG90eXBlQ2hhaW5Jc1NhbmUoKTsKKyAgICAgICAgICAgIH0KKworICAgICAgICBXaGF0J3Mg
ZXNzZW50aWFsIGZvciBjb3JyZWN0bmVzcyBoZXJlIGlzIHRoYXQgdGhlIHN0cmluZ1Byb3RvdHlw
ZSBhbmQgb2JqZWN0UHJvdG90eXBlCisgICAgICAgIHN0cnVjdHVyZXMgYmUgbG9hZGVkIGJlZm9y
ZSB0aGUgbG9hZHMgaW4gdGhlIHNlY29uZCBzdHJpbmdQcm90b3R5cGVDaGFpbklzU2FuZSgpCisg
ICAgICAgIGNoZWNrLiAgV2l0aG91dCBhIGxvYWRMb2FkRmVuY2UgYmVmb3JlIHRoZSBzZWNvbmQg
c3RyaW5nUHJvdG90eXBlQ2hhaW5Jc1NhbmUoKQorICAgICAgICBjaGVjaywgd2UgY2FuJ3QgZ3Vh
cmFudGVlIHRoYXQuICBFbHNld2hlcmUgaW4gdGhlIGNvbXBpbGVyLCB0aGUgcHJlZmVycmVkIGlk
aW9tCisgICAgICAgIGZvciBkb2luZyB0aGlzIHJpZ2h0IGlzIHRvIHByZS1sb2FkIHRoZSBzdHJ1
Y3R1cmVzIGZpcnN0LCBkbyBhIGxvYWRMb2FkRmVuY2UsIGFuZAorICAgICAgICB0aGVuIGRvIHRo
ZSBJc1NhbmUgY2hlY2sganVzdCBvbmNlIGFmdGVyIGUuZy4KKworICAgICAgICAgICAgU3RydWN0
dXJlKiBhcnJheVByb3RvdHlwZVN0cnVjdHVyZSA9IGdsb2JhbE9iamVjdC0+YXJyYXlQcm90b3R5
cGUoKS0+c3RydWN0dXJlKG1fdm0pOworICAgICAgICAgICAgU3RydWN0dXJlKiBvYmplY3RQcm90
b3R5cGVTdHJ1Y3R1cmUgPSBnbG9iYWxPYmplY3QtPm9iamVjdFByb3RvdHlwZSgpLT5zdHJ1Y3R1
cmUobV92bSk7CisKKyAgICAgICAgICAgIGlmIChhcnJheVByb3RvdHlwZVN0cnVjdHVyZS0+dHJh
bnNpdGlvbldhdGNocG9pbnRTZXRJc1N0aWxsVmFsaWQoKSAvLyBoYXMgbG9hZExvYWRGZW5jZXMu
CisgICAgICAgICAgICAgICAgJiYgb2JqZWN0UHJvdG90eXBlU3RydWN0dXJlLT50cmFuc2l0aW9u
V2F0Y2hwb2ludFNldElzU3RpbGxWYWxpZCgpIC8vIGhhcyBsb2FkTG9hZEZlbmNlcy4KKyAgICAg
ICAgICAgICAgICAmJiBnbG9iYWxPYmplY3QtPmFycmF5UHJvdG90eXBlQ2hhaW5Jc1NhbmUoKSkg
eworCisgICAgICAgICAgICAgICAgbV9ncmFwaC5yZWdpc3RlckFuZFdhdGNoU3RydWN0dXJlVHJh
bnNpdGlvbihhcnJheVByb3RvdHlwZVN0cnVjdHVyZSk7CisgICAgICAgICAgICAgICAgbV9ncmFw
aC5yZWdpc3RlckFuZFdhdGNoU3RydWN0dXJlVHJhbnNpdGlvbihvYmplY3RQcm90b3R5cGVTdHJ1
Y3R1cmUpOworICAgICAgICAgICAgICAgIC4uLgorICAgICAgICAgICAgfQorCisgICAgICAgIFRo
aXMgcGF0Y2ggY2hhbmdlcyBERkcncyBTcGVjdWxhdGl2ZUpJVDo6Y29tcGlsZUdldEJ5VmFsT25T
dHJpbmcoKSBhbmQgRlRMJ3MKKyAgICAgICAgY29tcGlsZVN0cmluZ0NoYXJBdCgpIHRvIGZvbGxv
dyB0aGUgc2FtZSBpZGlvbS4KKworICAgICAgICBXZSBhbHNvIGZpeCBhIGJhZCBhc3NlcnRpb24g
aW4gU3RydWN0dXJlOjpzdG9yZWRQcm90b3R5cGUoKSBhbmQKKyAgICAgICAgU3RydWN0dXJlOjpz
dG9yZWRQcm90b3R5cGVPYmplY3QoKS4gIFRoZSBhc3NlcnRpb24gaXMgb25seSBjb3JyZWN0IHdo
ZW4gdGhvc2UKKyAgICAgICAgbWV0aG9kcyBhcmUgY2FsbGVkIGZyb20gdGhlIG11dGF0b3IgdGhy
ZWFkLiAgVGhlIGFzc2VydGlvbiBoYXMgYmVlbiB1cGRhdGVkIHRvCisgICAgICAgIG9ubHkgY2hl
Y2sgaXRzIHRlc3QgY29uZGl0aW9uIGlmIHRoZSBjdXJyZW50IHRocmVhZCBpcyB0aGUgbXV0YXRv
ciB0aHJlYWQuCisKKyAgICAgICAgKiBkZmcvREZHU3BlY3VsYXRpdmVKSVQuY3BwOgorICAgICAg
ICAoSlNDOjpERkc6OlNwZWN1bGF0aXZlSklUOjpjb21waWxlR2V0QnlWYWxPblN0cmluZyk6Cisg
ICAgICAgICogZnRsL0ZUTExvd2VyREZHVG9CMy5jcHA6CisgICAgICAgIChKU0M6OkZUTDo6REZH
OjpMb3dlckRGR1RvQjM6OmNvbXBpbGVTdHJpbmdDaGFyQXQpOgorICAgICAgICAqIHJ1bnRpbWUv
U3RydWN0dXJlSW5saW5lcy5oOgorICAgICAgICAoSlNDOjpTdHJ1Y3R1cmU6OnN0b3JlZFByb3Rv
dHlwZSBjb25zdCk6CisgICAgICAgIChKU0M6OlN0cnVjdHVyZTo6c3RvcmVkUHJvdG90eXBlT2Jq
ZWN0IGNvbnN0KToKKwogMjAxOS0wOC0yOCAgTWFyayBMYW0gIDxtYXJrLmxhbUBhcHBsZS5jb20+
CiAKICAgICAgICAgUGxhY2F0ZSBleGNlcHRpb24gY2hlY2sgdmFsaWRhdGlvbiBpbiBERkcncyBv
cGVyYXRpb25IYXNHZW5lcmljUHJvcGVydHkoKS4KSW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29y
ZS9kZmcvREZHU3BlY3VsYXRpdmVKSVQuY3BwCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9KYXZhU2Ny
aXB0Q29yZS9kZmcvREZHU3BlY3VsYXRpdmVKSVQuY3BwCShyZXZpc2lvbiAyNDkyMjQpCisrKyBT
b3VyY2UvSmF2YVNjcmlwdENvcmUvZGZnL0RGR1NwZWN1bGF0aXZlSklULmNwcAkod29ya2luZyBj
b3B5KQpAQCAtMjIzMSw3ICsyMjMxLDEwIEBAIHZvaWQgU3BlY3VsYXRpdmVKSVQ6OmNvbXBpbGVH
ZXRCeVZhbE9uU3QKICNlbmRpZgogCiAgICAgICAgIEpTR2xvYmFsT2JqZWN0KiBnbG9iYWxPYmpl
Y3QgPSBtX2ppdC5nbG9iYWxPYmplY3RGb3Iobm9kZS0+b3JpZ2luLnNlbWFudGljKTsKLSAgICAg
ICAgYm9vbCBwcm90b3R5cGVDaGFpbklzU2FuZSA9IGZhbHNlOworICAgICAgICBTdHJ1Y3R1cmUq
IHN0cmluZ1Byb3RvdHlwZVN0cnVjdHVyZSA9IGdsb2JhbE9iamVjdC0+c3RyaW5nUHJvdG90eXBl
KCktPnN0cnVjdHVyZSh2bSk7CisgICAgICAgIFN0cnVjdHVyZSogb2JqZWN0UHJvdG90eXBlU3Ry
dWN0dXJlID0gZ2xvYmFsT2JqZWN0LT5vYmplY3RQcm90b3R5cGUoKS0+c3RydWN0dXJlKHZtKTsK
KyAgICAgICAgV1RGOjpsb2FkTG9hZEZlbmNlKCk7CisKICAgICAgICAgaWYgKGdsb2JhbE9iamVj
dC0+c3RyaW5nUHJvdG90eXBlQ2hhaW5Jc1NhbmUoKSkgewogICAgICAgICAgICAgLy8gRklYTUU6
IFRoaXMgY291bGQgYmUgY2FwdHVyZWQgdXNpbmcgYSBTcGVjdWxhdGlvbiBtb2RlIHRoYXQgbWVh
bnMgIm91dC1vZi1ib3VuZHMKICAgICAgICAgICAgIC8vIGxvYWRzIHJldHVybiBhIHRyaXZpYWwg
dmFsdWUiLiBTb21ldGhpbmcgbGlrZSBTYW5lQ2hhaW5PdXRPZkJvdW5kcy4gVGhpcyBzaG91bGQK
QEAgLTIyMzksMTEgKzIyNDIsOSBAQCB2b2lkIFNwZWN1bGF0aXZlSklUOjpjb21waWxlR2V0QnlW
YWxPblN0CiAgICAgICAgICAgICAvLyBvbiBhIHN0cmluZ1Byb3RvdHlwZUNoYWluSXNTYW5lKCkg
Z3VhcmFudGVlaW5nIHRoYXQgdGhlIHByb3RvdHlwZXMgaGF2ZSBubyBuZWdhdGl2ZQogICAgICAg
ICAgICAgLy8gaW5kZXhlZCBwcm9wZXJ0aWVzIGVpdGhlci4KICAgICAgICAgICAgIC8vIGh0dHBz
Oi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNDQ2NjgKLSAgICAgICAgICAgIG1f
aml0LmdyYXBoKCkucmVnaXN0ZXJBbmRXYXRjaFN0cnVjdHVyZVRyYW5zaXRpb24oZ2xvYmFsT2Jq
ZWN0LT5zdHJpbmdQcm90b3R5cGUoKS0+c3RydWN0dXJlKHZtKSk7Ci0gICAgICAgICAgICBtX2pp
dC5ncmFwaCgpLnJlZ2lzdGVyQW5kV2F0Y2hTdHJ1Y3R1cmVUcmFuc2l0aW9uKGdsb2JhbE9iamVj
dC0+b2JqZWN0UHJvdG90eXBlKCktPnN0cnVjdHVyZSh2bSkpOwotICAgICAgICAgICAgcHJvdG90
eXBlQ2hhaW5Jc1NhbmUgPSBnbG9iYWxPYmplY3QtPnN0cmluZ1Byb3RvdHlwZUNoYWluSXNTYW5l
KCk7Ci0gICAgICAgIH0KLSAgICAgICAgaWYgKHByb3RvdHlwZUNoYWluSXNTYW5lKSB7CisgICAg
ICAgICAgICBtX2ppdC5ncmFwaCgpLnJlZ2lzdGVyQW5kV2F0Y2hTdHJ1Y3R1cmVUcmFuc2l0aW9u
KHN0cmluZ1Byb3RvdHlwZVN0cnVjdHVyZSk7CisgICAgICAgICAgICBtX2ppdC5ncmFwaCgpLnJl
Z2lzdGVyQW5kV2F0Y2hTdHJ1Y3R1cmVUcmFuc2l0aW9uKG9iamVjdFByb3RvdHlwZVN0cnVjdHVy
ZSk7CisKICNpZiBVU0UoSlNWQUxVRTY0KQogICAgICAgICAgICAgYWRkU2xvd1BhdGhHZW5lcmF0
b3IobWFrZVVuaXF1ZTxTYW5lU3RyaW5nR2V0QnlWYWxTbG93UGF0aEdlbmVyYXRvcj4oCiAgICAg
ICAgICAgICAgICAgb3V0T2ZCb3VuZHMsIHRoaXMsIEpTVmFsdWVSZWdzKHNjcmF0Y2hSZWcpLCBi
YXNlUmVnLCBwcm9wZXJ0eVJlZykpOwpJbmRleDogU291cmNlL0phdmFTY3JpcHRDb3JlL2Z0bC9G
VExMb3dlckRGR1RvQjMuY3BwCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9m
dGwvRlRMTG93ZXJERkdUb0IzLmNwcAkocmV2aXNpb24gMjQ5MjI0KQorKysgU291cmNlL0phdmFT
Y3JpcHRDb3JlL2Z0bC9GVExMb3dlckRGR1RvQjMuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC02OTc4
LDIwICs2OTc4LDE5IEBAIHByaXZhdGU6CiAgICAgICAgICAgICByZXN1bHRzLmFwcGVuZChtX291
dC5hbmNob3IobV9vdXQuaW50UHRyWmVybykpOwogICAgICAgICB9IGVsc2UgewogICAgICAgICAg
ICAgSlNHbG9iYWxPYmplY3QqIGdsb2JhbE9iamVjdCA9IG1fZ3JhcGguZ2xvYmFsT2JqZWN0Rm9y
KG1fbm9kZS0+b3JpZ2luLnNlbWFudGljKTsKLSAgICAgICAgICAgIAotICAgICAgICAgICAgYm9v
bCBwcm90b3R5cGVDaGFpbklzU2FuZSA9IGZhbHNlOworICAgICAgICAgICAgU3RydWN0dXJlKiBz
dHJpbmdQcm90b3R5cGVTdHJ1Y3R1cmUgPSBnbG9iYWxPYmplY3QtPnN0cmluZ1Byb3RvdHlwZSgp
LT5zdHJ1Y3R1cmUodm0oKSk7CisgICAgICAgICAgICBTdHJ1Y3R1cmUqIG9iamVjdFByb3RvdHlw
ZVN0cnVjdHVyZSA9IGdsb2JhbE9iamVjdC0+b2JqZWN0UHJvdG90eXBlKCktPnN0cnVjdHVyZSh2
bSgpKTsKKyAgICAgICAgICAgIFdURjo6bG9hZExvYWRGZW5jZSgpOworCiAgICAgICAgICAgICBp
ZiAoZ2xvYmFsT2JqZWN0LT5zdHJpbmdQcm90b3R5cGVDaGFpbklzU2FuZSgpKSB7CiAgICAgICAg
ICAgICAgICAgLy8gRklYTUU6IFRoaXMgY291bGQgYmUgY2FwdHVyZWQgdXNpbmcgYSBTcGVjdWxh
dGlvbiBtb2RlIHRoYXQgbWVhbnMKICAgICAgICAgICAgICAgICAvLyAib3V0LW9mLWJvdW5kcyBs
b2FkcyByZXR1cm4gYSB0cml2aWFsIHZhbHVlIiwgc29tZXRoaW5nIGxpa2UKICAgICAgICAgICAg
ICAgICAvLyBTYW5lQ2hhaW5PdXRPZkJvdW5kcy4KICAgICAgICAgICAgICAgICAvLyBodHRwczov
L2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTQ0NjY4CiAgICAgICAgICAgICAgICAg
Ci0gICAgICAgICAgICAgICAgbV9ncmFwaC5yZWdpc3RlckFuZFdhdGNoU3RydWN0dXJlVHJhbnNp
dGlvbihnbG9iYWxPYmplY3QtPnN0cmluZ1Byb3RvdHlwZSgpLT5zdHJ1Y3R1cmUodm0oKSkpOwot
ICAgICAgICAgICAgICAgIG1fZ3JhcGgucmVnaXN0ZXJBbmRXYXRjaFN0cnVjdHVyZVRyYW5zaXRp
b24oZ2xvYmFsT2JqZWN0LT5vYmplY3RQcm90b3R5cGUoKS0+c3RydWN0dXJlKHZtKCkpKTsKKyAg
ICAgICAgICAgICAgICBtX2dyYXBoLnJlZ2lzdGVyQW5kV2F0Y2hTdHJ1Y3R1cmVUcmFuc2l0aW9u
KHN0cmluZ1Byb3RvdHlwZVN0cnVjdHVyZSk7CisgICAgICAgICAgICAgICAgbV9ncmFwaC5yZWdp
c3RlckFuZFdhdGNoU3RydWN0dXJlVHJhbnNpdGlvbihvYmplY3RQcm90b3R5cGVTdHJ1Y3R1cmUp
OwogCi0gICAgICAgICAgICAgICAgcHJvdG90eXBlQ2hhaW5Jc1NhbmUgPSBnbG9iYWxPYmplY3Qt
PnN0cmluZ1Byb3RvdHlwZUNoYWluSXNTYW5lKCk7Ci0gICAgICAgICAgICB9Ci0gICAgICAgICAg
ICBpZiAocHJvdG90eXBlQ2hhaW5Jc1NhbmUpIHsKICAgICAgICAgICAgICAgICBMQmFzaWNCbG9j
ayBuZWdhdGl2ZUluZGV4ID0gbV9vdXQubmV3QmxvY2soKTsKICAgICAgICAgICAgICAgICAgICAg
CiAgICAgICAgICAgICAgICAgcmVzdWx0cy5hcHBlbmQobV9vdXQuYW5jaG9yKG1fb3V0LmNvbnN0
SW50NjQoSlNWYWx1ZTo6ZW5jb2RlKGpzVW5kZWZpbmVkKCkpKSkpOwpJbmRleDogU291cmNlL0ph
dmFTY3JpcHRDb3JlL3J1bnRpbWUvU3RydWN0dXJlSW5saW5lcy5oCj09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNv
dXJjZS9KYXZhU2NyaXB0Q29yZS9ydW50aW1lL1N0cnVjdHVyZUlubGluZXMuaAkocmV2aXNpb24g
MjQ5MjI0KQorKysgU291cmNlL0phdmFTY3JpcHRDb3JlL3J1bnRpbWUvU3RydWN0dXJlSW5saW5l
cy5oCSh3b3JraW5nIGNvcHkpCkBAIC0xMDgsNyArMTA4LDcgQEAgaW5saW5lIFN0cnVjdHVyZSog
U3RydWN0dXJlOjpzdG9yZWRQcm90bwogCiBBTFdBWVNfSU5MSU5FIEpTVmFsdWUgU3RydWN0dXJl
OjpzdG9yZWRQcm90b3R5cGUoY29uc3QgSlNPYmplY3QqIG9iamVjdCkgY29uc3QKIHsKLSAgICBB
U1NFUlQob2JqZWN0LT5zdHJ1Y3R1cmUoKSA9PSB0aGlzKTsKKyAgICBBU1NFUlQoIWlzTWFpblRo
cmVhZCgpIHx8IG9iamVjdC0+c3RydWN0dXJlKCkgPT0gdGhpcyk7CiAgICAgaWYgKGhhc01vbm9Q
cm90bygpKQogICAgICAgICByZXR1cm4gc3RvcmVkUHJvdG90eXBlKCk7CiAgICAgcmV0dXJuIG9i
amVjdC0+Z2V0RGlyZWN0KGtub3duUG9seVByb3RvT2Zmc2V0KTsKQEAgLTExNiw3ICsxMTYsNyBA
QCBBTFdBWVNfSU5MSU5FIEpTVmFsdWUgU3RydWN0dXJlOjpzdG9yZWRQCiAKIEFMV0FZU19JTkxJ
TkUgSlNPYmplY3QqIFN0cnVjdHVyZTo6c3RvcmVkUHJvdG90eXBlT2JqZWN0KGNvbnN0IEpTT2Jq
ZWN0KiBvYmplY3QpIGNvbnN0CiB7Ci0gICAgQVNTRVJUKG9iamVjdC0+c3RydWN0dXJlKCkgPT0g
dGhpcyk7CisgICAgQVNTRVJUKCFpc01haW5UaHJlYWQoKSB8fCBvYmplY3QtPnN0cnVjdHVyZSgp
ID09IHRoaXMpOwogICAgIGlmIChoYXNNb25vUHJvdG8oKSkKICAgICAgICAgcmV0dXJuIHN0b3Jl
ZFByb3RvdHlwZU9iamVjdCgpOwogICAgIEpTVmFsdWUgcHJvdG8gPSBvYmplY3QtPmdldERpcmVj
dChrbm93blBvbHlQcm90b09mZnNldCk7Cg==
</data>
<flag name="review"
          id="393255"
          type_id="1"
          status="+"
          setter="ysuzuki"
    />
          </attachment>
      

    </bug>

</bugzilla>