20512 2008-08-25 09:05:12 -0700 Invalid CSS code crashes Safari 2008-09-17 16:00:50 -0700 1 1 1 Unclassified WebKit WebKit Misc. 528+ (Nightly build) PC Windows XP RESOLVED FIXED http://alt.swiecki.net/s-crash6.html HasReduction, InRadar P2 Normal --- 1 robert.swiecki+wkbugs webkit-unassigned aroben bdakin gwilson oldest_to_newest 89289 0 robert.swiecki+wkbugs 2008-08-25 09:05:12 -0700 Hi, http://alt.swiecki.net/s-crash6.html crashes safari 3.1.2 (webkit: 35094) - sometimes it requires a few Ctrl+R Stackdumps: (994.1188): Access violation - code c0000005 (!!! second chance !!!) eax=7a420000 ebx=7fbabae0 ecx=00038276 edx=00000000 esi=7ff97fe0 edi=7a80c500 eip=781473c6 esp=0012db7c ebp=0012db84 iopl=0 nv up ei pl nz na po nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202 *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.1433_x-ww_5cf844d2\MSVCR80.dll - MSVCR80!strnicmp+0x16b: 781473c6 660f6f5620 movdqa xmm2,xmmword ptr [esi+20h] ds:0023:7ff98000=???????????????????????????????? 0:000> kb ChildEBP RetAddr Args to Child WARNING: Stack unwind information not available. Following frames may be wrong. 0012db84 78147476 7a420000 7fbabae0 02000000 MSVCR80!strnicmp+0x16b 0012dbb4 0086cd04 7a420000 7fbabae0 02000000 MSVCR80!strnicmp+0x21b 0012dbd4 0086cfc9 7fbabae0 01000000 7f8e0a80 WebKit!WebCore::StringImpl::StringImpl+0x34 [c:\cygwin\home\buildbot\slave\win32-release-archive\build\opensource\webcore\platform\text\stringimpl.cpp @ 80] 0012dbe8 0086aab2 0012dc08 7fbabae0 01000000 WebKit!WebCore::StringImpl::create+0x29 [c:\cygwin\home\buildbot\slave\win32-release-archive\build\opensource\webcore\platform\text\stringimpl.cpp @ 1019] 0012dc00 00808d9e 7fbabae0 01000000 0080e5e2 WebKit!WebCore::String::String+0x22 [c:\cygwin\home\buildbot\slave\win32-release-archive\build\opensource\webcore\platform\text\string.cpp @ 50] 0012dc0c 0080e5e2 0012dc2c 7f8e0a80 7fc34a60 WebKit!WebCore::CSSParserString::operator WebCore::String+0xe [c:\cygwin\home\buildbot\slave\win32-release-archive\build\opensource\webcore\css\cssparservalues.h @ 36] 0012dc30 008094cd 0012dcb4 00000000 0012f4f0 WebKit!WebCore::CSSParser::parseCounterContent+0x32 [c:\cygwin\home\buildbot\slave\win32-release-archive\build\opensource\webcore\css\cssparser.cpp @ 2659] 0012dcec 007e27d2 0012f4f0 0000040c 00000000 WebKit!WebCore::CSSParser::parseContent+0x16d [c:\cygwin\home\buildbot\slave\win32-release-archive\build\opensource\webcore\css\cssparser.cpp @ 1973] 0012deb0 00a29eac 0000040c 00000000 7f8bf7c0 WebKit!WebCore::CSSParser::parseValue+0xf72 [c:\cygwin\home\buildbot\slave\win32-release-archive\build\opensource\webcore\css\cssparser.cpp @ 619] 0012f4d4 007658b6 0012f4f0 007658f9 0012f650 WebKit!cssyyparse+0x1e3c [c:\home\buildbot\slave\win32-~3\build\openso~1\webcore\css\cssgrammar.y @ 1212] 0012f4dc 007658f9 0012f650 7f8d1bf0 7f8d1bf0 WebKit!WebCore::CSSParser::parseSheet+0x26 [c:\cygwin\home\buildbot\slave\win32-release-archive\build\opensource\webcore\css\cssparser.cpp @ 225] 0012f5c8 007630b5 0012f650 00000000 7f8d1ba0 WebKit!WebCore::CSSStyleSheet::parseString+0x29 [c:\cygwin\home\buildbot\slave\win32-release-archive\build\opensource\webcore\css\cssstylesheet.cpp @ 159] 0012f618 00801a74 7f8d1bec 7f8d1ba0 0012f650 WebKit!WebCore::StyleElement::createSheet+0x115 [c:\cygwin\home\buildbot\slave\win32-release-archive\build\opensource\webcore\dom\styleelement.cpp @ 93] 0012f648 0080930f 7f8e2390 7f8e2420 7f8e2420 WebKit!WebCore::StyleElement::process+0x84 [c:\cygwin\home\buildbot\slave\win32-release-archive\build\opensource\webcore\dom\styleelement.cpp @ 70] 0012f658 0078cafe 7feb7b28 7fef641c 7f8e2420 WebKit!WebCore::HTMLStyleElement::finishParsingChildren+0xf [c:\cygwin\home\buildbot\slave\win32-release-archive\build\opensource\webcore\html\htmlstyleelement.cpp @ 56] 0012f684 0078c940 7f8d1ba0 7fef641c 7feb7b01 WebKit!WebCore::HTMLParser::popBlock+0xbe [c:\cygwin\home\buildbot\slave\win32-release-archive\build\opensource\webcore\html\htmlparser.cpp @ 1341] 0012f6a0 00795456 7febf93c 7fef6400 7fef6414 WebKit!WebCore::HTMLParser::processCloseTag+0x60 [c:\cygwin\home\buildbot\slave\win32-release-archive\build\opensource\webcore\html\htmlparser.cpp @ 933] 0012f6c0 00794d18 0012f704 7fef6414 7fef6400 WebKit!WebCore::HTMLParser::parseToken+0x226 [c:\cygwin\home\buildbot\slave\win32-release-archive\build\opensource\webcore\html\htmlparser.cpp @ 211] 0012f704 00794857 0012f744 7fef6d68 7fef641c WebKit!WebCore::HTMLTokenizer::processToken+0xa8 [c:\cygwin\home\buildbot\slave\win32-release-archive\build\opensource\webcore\html\htmltokenizer.cpp @ 1918] 0012f738 00794302 0012f7ac 00000100 7fef6410 WebKit!WebCore::HTMLTokenizer::parseSpecial+0x447 [c:\cygwin\home\buildbot\slave\win32-release-archive\build\opensource\webcore\html\htmltokenizer.cpp @ 364] eax=7ffdf000 ebx=00000000 ecx=0012d6a8 edx=0012d6b0 esi=7c90de50 edi=00000003 eip=7c90e4f4 esp=0012d700 ebp=0012d7fc iopl=0 nv up ei pl zr na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246 ntdll!KiFastSystemCallRet: 7c90e4f4 c3 ret 0:000> kb ChildEBP RetAddr Args to Child 0012d6fc 7c90de5c 7c81cab6 ffffffff 00000003 ntdll!KiFastSystemCallRet 0012d700 7c81cab6 ffffffff 00000003 00000000 ntdll!ZwTerminateProcess+0xc 0012d7fc 7c81cb0e 00000003 77e8f3b0 ffffffff kernel32!_ExitProcess+0x62 *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.1433_x-ww_5cf844d2\MSVCR80.dll - 0012d810 78131720 00000003 78131a04 00000003 kernel32!ExitProcess+0x14 WARNING: Stack unwind information not available. Following frames may be wrong. 0012d854 78131a5c 00000003 00000001 00000000 MSVCR80!amsg_exit+0x5e 0012d90c 7c9101bb 0000040f 00000000 0000040f MSVCR80!exit+0xd *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Program Files\Safari\CoreGraphics.dll - 0012db3c 6611d44d 000003d8 00001000 0012db68 ntdll!RtlAllocateHeap+0xeac 0012db50 00803365 00001000 00c47678 00c4cffc CoreGraphics!CGColorSpaceCreateWithDC+0x4ad 0012db68 008033b4 0012db84 00c47678 000cc4a3 WebKit!TCMalloc_SystemAlloc+0x55 [c:\cygwin\home\buildbot\slave\win32-release-archive\build\opensource\javascriptcore\wtf\tcsystemalloc.cpp @ 371] 0012db8c 007baa81 000cc4a3 8f7a14e0 00000000 WebKit!WTF::TCMalloc_PageHeap::GrowHeap+0x44 [c:\cygwin\home\buildbot\slave\win32-release-archive\build\opensource\javascriptcore\wtf\fastmalloc.cpp @ 1544] 0012db9c 00a6e587 cc4a23a8 7fbca870 0012dc30 WebKit!WTF::TCMalloc_PageHeap::New+0x51 [c:\cygwin\home\buildbot\slave\win32-release-archive\build\opensource\javascriptcore\wtf\fastmalloc.cpp @ 1241] 00000000 00000000 00000000 00000000 00000000 WebKit!WTF::fastMalloc+0x2a9f47 89294 1 22982 gwilson 2008-08-25 10:15:07 -0700 Created attachment 22982 Test reduction for bug 20512 Attached is a possible test reduction of this issue. I believe that this comes from the parsing of a CSS "counter" with invalid content....investigating further. This one line of CSS by itself will crash Safari, but not IE or FF3. 89295 2 robert.swiecki+wkbugs 2008-08-25 10:24:25 -0700 Then it might be a duplicate of: https://bugs.webkit.org/show_bug.cgi?id=20396 89301 3 mrowe 2008-08-25 12:13:10 -0700 <rdar://problem/6173832> 91517 4 23507 bdakin 2008-09-17 14:22:22 -0700 Created attachment 23507 Patch to prevent function input to counters I can imagine a number of different ways to fix this bug, but here is a simple one that comes to mind. It seems like we are crashing because we are trying to convert a function to a string. 91518 5 23507 aroben 2008-09-17 14:24:51 -0700 Comment on attachment 23507 Patch to prevent function input to counters Is it worthwhile to add another testcase that uses a function that WebKit's CSS parser knows about? Like -webkit-gradient or something like that? r=me 91519 6 bdakin 2008-09-17 14:28:01 -0700 Sure! I'll add one now. 91521 7 23507 darin 2008-09-17 14:33:41 -0700 Comment on attachment 23507 Patch to prevent function input to counters That seems a little backwards. Maybe a better check would be: if (i->unit != CSSPrimitiveValue::CSS_STRING) Is there a reason to not do it that way? 91524 8 bdakin 2008-09-17 14:35:39 -0700 Fixed with r36559. 91528 9 bdakin 2008-09-17 14:42:38 -0700 Hmmm…good question, Darin! I am running the layout tests with your recommended change now. 91542 10 23512 bdakin 2008-09-17 15:35:57 -0700 Created attachment 23512 Better fix Here's a better fix based on Darin's comment. Just checking against string is not sufficient since numbers are also okay. 91543 11 bdakin 2008-09-17 15:36:27 -0700 Re-opening bug since I have a new patch to be reviewed. 91547 12 23512 darin 2008-09-17 15:58:11 -0700 Comment on attachment 23512 Better fix r=me 91549 13 bdakin 2008-09-17 16:00:50 -0700 Fixed again with r36567. 22982 2008-08-25 10:15:07 -0700 2008-08-25 10:15:07 -0700 Test reduction for bug 20512 crash-bug-20512.html text/html 163 gwilson PGh0bWw+IA0KPGhlYWQ+DQo8c3R5bGUgdHlwZT0idGV4dC9jc3MiPiANCi50ZXN0IHsNCiAgICBj b250ZW50OiBjb3VudGVyKGV4cHJlc3Npb24oLXdlYmtpdC1pbmxpbmUtYm94KSk7DQp9DQo8L3N0 eWxlPg0KPC9oZWFkPiANCjxib2R5PiANCiBQQVNTDQo8L2JvZHk+DQo8L2h0bWw+IA== 23507 2008-09-17 14:22:22 -0700 2008-09-17 15:35:57 -0700 Patch to prevent function input to counters counter.txt text/plain 3023 bdakin SW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9n CShyZXZpc2lvbiAzNjU1MykKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA IC0xLDMgKzEsMTggQEAKKzIwMDgtMDktMTcgIEJldGggRGFraW4gIDxiZGFraW5AYXBwbGUuY29t PgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIEZpeCBm b3IgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIwNTEyIEludmFsaWQg Q1NTIAorICAgICAgICBjb2RlIGNyYXNoZXMgU2FmYXJpIAorICAgICAgICBhbmQgY29ycmVzcG9u ZGluZzogPHJkYXI6Ly9wcm9ibGVtLzYxNzM4MzI+CisKKyAgICAgICAgUmVhZGluZyB0aHJvdWdo IHRoZSBzcGVjLCBpdCBzZWVtcyBsaWtlIGEgZnVuY3Rpb24gaXMgbm90IHZhbGlkIAorICAgICAg ICBpbnB1dCBmb3IgYSBjb3VudGVyLiBTbyB0aGlzIHBhdGNoIGNoZWNrcyBmb3IgdGhhdCBhbmQg YmFpbHMgaW4gdGhlIAorICAgICAgICBjYXNlIG9mIGludmFsaWQgaW5wdXQuIAorCisgICAgICAg ICogY3NzL0NTU1BhcnNlci5jcHA6CisgICAgICAgIChXZWJDb3JlOjpDU1NQYXJzZXI6OnBhcnNl Q291bnRlckNvbnRlbnQpOgorCiAyMDA4LTA5LTE3ICBEYXZpZCBIeWF0dCAgPGh5YXR0QGFwcGxl LmNvbT4KIAogICAgICAgICBNYWtlIHRoZSBub3Rpb24gb2YgaGF2aW5nIGEgbmF0aXZlIHdpZGdl dCBiYWNraW5nIGEgV2lkZ2V0IGNyb3NzLXBsYXRmb3JtLgpJbmRleDogV2ViQ29yZS9jc3MvQ1NT UGFyc2VyLmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09Ci0tLSBXZWJDb3JlL2Nzcy9DU1NQYXJzZXIuY3BwCShyZXZp c2lvbiAzNjU0MSkKKysrIFdlYkNvcmUvY3NzL0NTU1BhcnNlci5jcHAJKHdvcmtpbmcgY29weSkK QEAgLTI2NTcsNiArMjY1Nyw4IEBAIFBhc3NSZWZQdHI8Q1NTVmFsdWU+IENTU1BhcnNlcjo6cGFy c2VDb3UKICAgICAgICAgcmV0dXJuIDA7CiAgICAgCiAgICAgQ1NTUGFyc2VyVmFsdWUqIGkgPSBh cmdzLT5jdXJyZW50KCk7CisgICAgaWYgKGktPnVuaXQgPT0gQ1NTUGFyc2VyVmFsdWU6OkZ1bmN0 aW9uKQorICAgICAgICByZXR1cm4gMDsKICAgICBSZWZQdHI8Q1NTUHJpbWl0aXZlVmFsdWU+IGlk ZW50aWZpZXIgPSBDU1NQcmltaXRpdmVWYWx1ZTo6Y3JlYXRlKGktPnN0cmluZywgQ1NTUHJpbWl0 aXZlVmFsdWU6OkNTU19TVFJJTkcpOwogCiAgICAgUmVmUHRyPENTU1ByaW1pdGl2ZVZhbHVlPiBz ZXBhcmF0b3I7CkluZGV4OiBMYXlvdXRUZXN0cy9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5 b3V0VGVzdHMvQ2hhbmdlTG9nCShyZXZpc2lvbiAzNjU1NSkKKysrIExheW91dFRlc3RzL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE0IEBACisyMDA4LTA5LTE3ICBCZXRoIERh a2luICA8YmRha2luQGFwcGxlLmNvbT4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9P UFMhKS4KKworICAgICAgICBUZXN0IGZvciBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1 Zy5jZ2k/aWQ9MjA1MTIgSW52YWxpZCBDU1MgCisgICAgICAgIGNvZGUgY3Jhc2hlcyBTYWZhcmkg CisgICAgICAgIGFuZCBjb3JyZXNwb25kaW5nOiA8cmRhcjovL3Byb2JsZW0vNjE3MzgzMj4KKwor ICAgICAgICAqIGZhc3QvY3NzL2NvdW50ZXJzL2NvdW50ZXItZnVuY3Rpb24taW5wdXQtZXhwZWN0 ZWQudHh0OiBBZGRlZC4KKyAgICAgICAgKiBmYXN0L2Nzcy9jb3VudGVycy9jb3VudGVyLWZ1bmN0 aW9uLWlucHV0Lmh0bWw6IEFkZGVkLgorCiAyMDA4LTA5LTE2ICBDYW1lcm9uIFp3YXJpY2ggIDxj d3p3YXJpY2hAdXdhdGVybG9vLmNhPgogCiAgICAgICAgIFJldmlld2VkIGJ5IE1hY2llaiBTdGFj aG93aWFrLgpJbmRleDogTGF5b3V0VGVzdHMvZmFzdC9jc3MvY291bnRlcnMvY291bnRlci1mdW5j dGlvbi1pbnB1dC1leHBlY3RlZC50eHQKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvZmFzdC9j c3MvY291bnRlcnMvY291bnRlci1mdW5jdGlvbi1pbnB1dC1leHBlY3RlZC50eHQJKHJldmlzaW9u IDApCisrKyBMYXlvdXRUZXN0cy9mYXN0L2Nzcy9jb3VudGVycy9jb3VudGVyLWZ1bmN0aW9uLWlu cHV0LWV4cGVjdGVkLnR4dAkocmV2aXNpb24gMCkKQEAgLTAsMCArMSBAQAorVGhpcyB0ZXN0IHBh c3NlcyBpZiBpdCBkb2VzIG5vdCBjcmFzaC4KSW5kZXg6IExheW91dFRlc3RzL2Zhc3QvY3NzL2Nv dW50ZXJzL2NvdW50ZXItZnVuY3Rpb24taW5wdXQuaHRtbAo9PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRU ZXN0cy9mYXN0L2Nzcy9jb3VudGVycy9jb3VudGVyLWZ1bmN0aW9uLWlucHV0Lmh0bWwJKHJldmlz aW9uIDApCisrKyBMYXlvdXRUZXN0cy9mYXN0L2Nzcy9jb3VudGVycy9jb3VudGVyLWZ1bmN0aW9u LWlucHV0Lmh0bWwJKHJldmlzaW9uIDApCkBAIC0wLDAgKzEsMTYgQEAKKzxodG1sPiAKKzxoZWFk PgorPHNjcmlwdD4KKyAgICBpZiAod2luZG93LmxheW91dFRlc3RDb250cm9sbGVyKQorICAgICAg ICBsYXlvdXRUZXN0Q29udHJvbGxlci5kdW1wQXNUZXh0KCk7Cis8L3NjcmlwdD4KKzxzdHlsZSB0 eXBlPSJ0ZXh0L2NzcyI+IAorLnRlc3QgeworICAgIGNvbnRlbnQ6IGNvdW50ZXIoZXhwcmVzc2lv bigtd2Via2l0LWlubGluZS1ib3gpKTsKK30KKzwvc3R5bGU+Cis8L2hlYWQ+IAorPGJvZHk+IAor IFRoaXMgdGVzdCBwYXNzZXMgaWYgaXQgZG9lcyBub3QgY3Jhc2guCis8L2JvZHk+Cis8L2h0bWw+ IAo= 23512 2008-09-17 15:35:57 -0700 2008-09-17 15:58:11 -0700 Better fix counter2.txt text/plain 1330 bdakin SW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9n CShyZXZpc2lvbiAzNjU2NSkKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA IC0xLDMgKzEsMTYgQEAKKzIwMDgtMDktMTcgIEJldGggRGFraW4gIDxiZGFraW5AYXBwbGUuY29t PgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIFRoaXMg aXMgYSBiZXR0ZXIgZml4IGZvcjogSW52YWxpZCBDU1MgY29kZSBjcmFzaGVzIFNhZmFyaQorICAg ICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjA1MTIKKworICAg ICAgICBUaGUgc3BlYyBpbmRpY2F0ZXMgdGhhdCB0aGUgb25seSB2YWxpZCBpbnB1dCBmb3IgYSBj b3VudGVyIGlzIGEgCisgICAgICAgIG51bWJlciBvciBhbiBpZGVudGlmaWVyLiBTbyB0aGF0IGlz IGV4YWN0bHkgd2hhdCB3ZSBhbGxvdy4KKworICAgICAgICAqIGNzcy9DU1NQYXJzZXIuY3BwOgor ICAgICAgICAoV2ViQ29yZTo6Q1NTUGFyc2VyOjpwYXJzZUNvdW50ZXJDb250ZW50KToKKwogMjAw OC0wOS0xNyAgQWxwIFRva2VyICA8YWxwQG51YW50aS5jb20+CiAKICAgICAgICAgR1RLKyBidWls ZCBmaXguIEFkYXB0IHRvIHVzZSBQbGF0Zm9ybVdpZGdldCBmdW5jdGlvbnMuCkluZGV4OiBXZWJD b3JlL2Nzcy9DU1NQYXJzZXIuY3BwCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvY3NzL0NTU1BhcnNl ci5jcHAJKHJldmlzaW9uIDM2NTU5KQorKysgV2ViQ29yZS9jc3MvQ1NTUGFyc2VyLmNwcAkod29y a2luZyBjb3B5KQpAQCAtMjY1Nyw3ICsyNjU3LDcgQEAgUGFzc1JlZlB0cjxDU1NWYWx1ZT4gQ1NT UGFyc2VyOjpwYXJzZUNvdQogICAgICAgICByZXR1cm4gMDsKICAgICAKICAgICBDU1NQYXJzZXJW YWx1ZSogaSA9IGFyZ3MtPmN1cnJlbnQoKTsKLSAgICBpZiAoaS0+dW5pdCA9PSBDU1NQYXJzZXJW YWx1ZTo6RnVuY3Rpb24pCisgICAgaWYgKCEoaS0+dW5pdCA9PSBDU1NQcmltaXRpdmVWYWx1ZTo6 Q1NTX0lERU5UIHx8IGktPnVuaXQgPT0gQ1NTUHJpbWl0aXZlVmFsdWU6OkNTU19OVU1CRVIpKQog ICAgICAgICByZXR1cm4gMDsKICAgICBSZWZQdHI8Q1NTUHJpbWl0aXZlVmFsdWU+IGlkZW50aWZp ZXIgPSBDU1NQcmltaXRpdmVWYWx1ZTo6Y3JlYXRlKGktPnN0cmluZywgQ1NTUHJpbWl0aXZlVmFs dWU6OkNTU19TVFJJTkcpOwogCg==