209251 2020-03-18 14:47:14 -0700 Nullptr crash in RenderObject::RenderObjectBitfields::isBox when current renderer is the RenderView 2020-03-21 21:59:14 -0700 1 1 1 Unclassified WebKit Accessibility WebKit Nightly Build All All RESOLVED FIXED InRadar P2 Normal --- 1 shihchieh_lee webkit-security-unassigned aboxhall apinheiro bfulgham cfleizach darin dmazzoni ews-feeder ews-watchlist jcraig jdiggs koivisto product-security rniwa samuel_white simon.fraser webkit-bug-importer zalan oldest_to_newest 1631371 0 shihchieh_lee 2020-03-18 14:47:14 -0700 <rdar://60103614> #0 0x60cb897fe in WebCore::RenderObject::RenderObjectBitfields::isBox() const+0x1e (/private/tmp/tmpdoy6g092/working/20383157-37ab-42c0-b3c9-11276d07b83e/targets/mnt/WebCore.framework/Versions/A/WebCore:x86_64+0x1c67fe) #1 0x60cb897c4 in WebCore::RenderObject::isText() const+0x14 (/private/tmp/tmpdoy6g092/working/20383157-37ab-42c0-b3c9-11276d07b83e/targets/mnt/WebCore.framework/Versions/A/WebCore:x86_64+0x1c67c4) #2 0x60cb897a8 in WebCore::RenderObject::isRenderElement() const+0x8 (/private/tmp/tmpdoy6g092/working/20383157-37ab-42c0-b3c9-11276d07b83e/targets/mnt/WebCore.framework/Versions/A/WebCore:x86_64+0x1c67a8) #3 0x60cb89798 in WTF::TypeCastTraits<WebCore::RenderElement const, WebCore::RenderObject const, false>::isType(WebCore::RenderObject const&)+0x8 (/private/tmp/tmpdoy6g092/working/20383157-37ab-42c0-b3c9-11276d07b83e/targets/mnt/WebCore.framework/Versions/A/WebCore:x86_64+0x1c6798) #4 0x60cb89788 in WTF::TypeCastTraits<WebCore::RenderElement const, WebCore::RenderObject const, false>::isOfType(WebCore::RenderObject const&)+0x8 (/private/tmp/tmpdoy6g092/working/20383157-37ab-42c0-b3c9-11276d07b83e/targets/mnt/WebCore.framework/Versions/A/WebCore:x86_64+0x1c6788) #5 0x60cb8b178 in bool WTF::is<WebCore::RenderElement, WebCore::RenderObject const>(WebCore::RenderObject const&)+0x8 (/private/tmp/tmpdoy6g092/working/20383157-37ab-42c0-b3c9-11276d07b83e/targets/mnt/WebCore.framework/Versions/A/WebCore:x86_64+0x1c8178) #6 0x60f419fed in WebCore::RenderObject::isRenderInline() const+0xd (/private/tmp/tmpdoy6g092/working/20383157-37ab-42c0-b3c9-11276d07b83e/targets/mnt/WebCore.framework/Versions/A/WebCore:x86_64+0x2a56fed) #7 0x60f420ae8 in WTF::TypeCastTraits<WebCore::RenderInline const, WebCore::RenderObject const, false>::isType(WebCore::RenderObject const&)+0x8 (/private/tmp/tmpdoy6g092/working/20383157-37ab-42c0-b3c9-11276d07b83e/targets/mnt/WebCore.framework/Versions/A/WebCore:x86_64+0x2a5dae8) #8 0x60f420ad8 in WTF::TypeCastTraits<WebCore::RenderInline const, WebCore::RenderObject const, false>::isOfType(WebCore::RenderObject const&)+0x8 (/private/tmp/tmpdoy6g092/working/20383157-37ab-42c0-b3c9-11276d07b83e/targets/mnt/WebCore.framework/Versions/A/WebCore:x86_64+0x2a5dad8) #9 0x60f401ed8 in bool WTF::is<WebCore::RenderInline, WebCore::RenderObject>(WebCore::RenderObject&)+0x8 (/private/tmp/tmpdoy6g092/working/20383157-37ab-42c0-b3c9-11276d07b83e/targets/mnt/WebCore.framework/Versions/A/WebCore:x86_64+0x2a3eed8) #10 0x60f3ebd3d in WebCore::isInlineWithContinuation(WebCore::RenderObject&)+0xd (/private/tmp/tmpdoy6g092/working/20383157-37ab-42c0-b3c9-11276d07b83e/targets/mnt/WebCore.framework/Versions/A/WebCore:x86_64+0x2a28d3d) #11 0x60f3eb9f4 in WebCore::AccessibilityRenderObject::nextSibling() const+0x144 (/private/tmp/tmpdoy6g092/working/20383157-37ab-42c0-b3c9-11276d07b83e/targets/mnt/WebCore.framework/Versions/A/WebCore:x86_64+0x2a289f4) #12 0x60f3cabea in WebCore::AccessibilityObject::nextSiblingUnignored(int) const+0x4a (/private/tmp/tmpdoy6g092/working/20383157-37ab-42c0-b3c9-11276d07b83e/targets/mnt/WebCore.framework/Versions/A/WebCore:x86_64+0x2a07bea) #13 0x60f35c6fa in WebCore::AXObjectCache::postTextStateChangeNotification(WebCore::Position const&, WebCore::AXTextStateChangeIntent const&, WebCore::VisibleSelection const&)+0x11a (/private/tmp/tmpdoy6g092/working/20383157-37ab-42c0-b3c9-11276d07b83e/targets/mnt/WebCore.framework/Versions/A/WebCore:x86_64+0x29996fa) #14 0x60d9533d2 in WebCore::FrameSelection::notifyAccessibilityForSelectionChange(WebCore::AXTextStateChangeIntent const&)+0x202 (/private/tmp/tmpdoy6g092/working/20383157-37ab-42c0-b3c9-11276d07b83e/targets/mnt/WebCore.framework/Versions/A/WebCore:x86_64+0xf903d2) #15 0x60ff8ff03 in WebCore::FrameSelection::updateAndRevealSelection(WebCore::AXTextStateChangeIntent const&)+0x223 (/private/tmp/tmpdoy6g092/working/20383157-37ab-42c0-b3c9-11276d07b83e/targets/mnt/WebCore.framework/Versions/A/WebCore:x86_64+0x35ccf03) #16 0x60ff9d02d in WebCore::FrameSelection::updateAppearanceAfterLayoutOrStyleChange()+0x7d (/private/tmp/tmpdoy6g092/working/20383157-37ab-42c0-b3c9-11276d07b83e/targets/mnt/WebCore.framework/Versions/A/WebCore:x86_64+0x35da02d) #17 0x60ff9cf9c in WebCore::FrameSelection::updateAppearanceAfterLayout()+0x1c (/private/tmp/tmpdoy6g092/working/20383157-37ab-42c0-b3c9-11276d07b83e/targets/mnt/WebCore.framework/Versions/A/WebCore:x86_64+0x35d9f9c) #18 0x610c1e799 in WebCore::FrameView::performPostLayoutTasks()+0x29 (/private/tmp/tmpdoy6g092/working/20383157-37ab-42c0-b3c9-11276d07b83e/targets/mnt/WebCore.framework/Versions/A/WebCore:x86_64+0x425b799) #19 0x610c628cd in WebCore::FrameViewLayoutContext::runAsynchronousTasks()+0x11d (/private/tmp/tmpdoy6g092/working/20383157-37ab-42c0-b3c9-11276d07b83e/targets/mnt/WebCore.framework/Versions/A/WebCore:x86_64+0x429f8cd) #20 0x610c63a43 in WebCore::FrameViewLayoutContext::runOrScheduleAsynchronousTasks()+0x83 (/private/tmp/tmpdoy6g092/working/20383157-37ab-42c0-b3c9-11276d07b83e/targets/mnt/WebCore.framework/Versions/A/WebCore:x86_64+0x42a0a43) #21 0x610c631de in WebCore::FrameViewLayoutContext::layout()+0x79e (/private/tmp/tmpdoy6g092/working/20383157-37ab-42c0-b3c9-11276d07b83e/targets/mnt/WebCore.framework/Versions/A/WebCore:x86_64+0x42a01de) #22 0x6118d6c8d in WebCore::RenderWidget::updateWidgetPosition()+0x17d (/private/tmp/tmpdoy6g092/working/20383157-37ab-42c0-b3c9-11276d07b83e/targets/mnt/WebCore.framework/Versions/A/WebCore:x86_64+0x4f13c8d) #23 0x610c1b3a5 in WebCore::FrameView::updateWidgetPositions()+0x115 (/private/tmp/tmpdoy6g092/working/20383157-37ab-42c0-b3c9-11276d07b83e/targets/mnt/WebCore.framework/Versions/A/WebCore:x86_64+0x42583a5) #24 0x610c1e837 in WebCore::FrameView::performPostLayoutTasks()+0xc7 (/private/tmp/tmpdoy6g092/working/20383157-37ab-42c0-b3c9-11276d07b83e/targets/mnt/WebCore.framework/Versions/A/WebCore:x86_64+0x425b837) #25 0x610c628cd in WebCore::FrameViewLayoutContext::runAsynchronousTasks()+0x11d (/private/tmp/tmpdoy6g092/working/20383157-37ab-42c0-b3c9-11276d07b83e/targets/mnt/WebCore.framework/Versions/A/WebCore:x86_64+0x429f8cd) #26 0x610c63a43 in WebCore::FrameViewLayoutContext::runOrScheduleAsynchronousTasks()+0x83 (/private/tmp/tmpdoy6g092/working/20383157-37ab-42c0-b3c9-11276d07b83e/targets/mnt/WebCore.framework/Versions/A/WebCore:x86_64+0x42a0a43) #27 0x610c631de in WebCore::FrameViewLayoutContext::layout()+0x79e (/private/tmp/tmpdoy6g092/working/20383157-37ab-42c0-b3c9-11276d07b83e/targets/mnt/WebCore.framework/Versions/A/WebCore:x86_64+0x42a01de) #28 0x60fbf9072 in WebCore::Document::updateLayout()+0x212 (/private/tmp/tmpdoy6g092/working/20383157-37ab-42c0-b3c9-11276d07b83e/targets/mnt/WebCore.framework/Versions/A/WebCore:x86_64+0x3236072) #29 0x60fbfb422 in WebCore::Document::updateLayoutIgnorePendingStylesheets(WebCore::Document::RunPostLayoutTasks)+0x92 (/private/tmp/tmpdoy6g092/working/20383157-37ab-42c0-b3c9-11276d07b83e/targets/mnt/WebCore.framework/Versions/A/WebCore:x86_64+0x3238422) #30 0x611fc047a in WebCore::SVGTextContentElement::getComputedTextLength()+0xba (/private/tmp/tmpdoy6g092/working/20383157-37ab-42c0-b3c9-11276d07b83e/targets/mnt/WebCore.framework/Versions/A/WebCore:x86_64+0x55fd47a) #31 0x60e1027f8 in WebCore::jsSVGTextContentElementPrototypeFunctionGetComputedTextLengthBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSSVGTextContentElement*, JSC::ThrowScope&)+0xb8 (/private/tmp/tmpdoy6g092/working/20383157-37ab-42c0-b3c9-11276d07b83e/targets/mnt/WebCore.framework/Versions/A/WebCore:x86_64+0x173f7f8) #32 0x60e0510f3 in long long WebCore::IDLOperation<WebCore::JSSVGTextContentElement>::call<&(WebCore::jsSVGTextContentElementPrototypeFunctionGetComputedTextLengthBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSSVGTextContentElement*, JSC::ThrowScope&)), (WebCore::CastedThisErrorBehavior)0>(JSC::JSGlobalObject&, JSC::CallFrame&, char const*)+0xf3 (/private/tmp/tmpdoy6g092/working/20383157-37ab-42c0-b3c9-11276d07b83e/targets/mnt/WebCore.framework/Versions/A/WebCore:x86_64+0x168e0f3) #33 0x60e050ff8 in WebCore::jsSVGTextContentElementPrototypeFunctionGetComputedTextLength(JSC::JSGlobalObject*, JSC::CallFrame*)+0x8 (/private/tmp/tmpdoy6g092/working/20383157-37ab-42c0-b3c9-11276d07b83e/targets/mnt/WebCore.framework/Versions/A/WebCore:x86_64+0x168dff8) #34 0x41021fa01177 (<unknown module>) #35 0x62916b6ba in llint_entry+0x170f3 (/private/tmp/tmpdoy6g092/working/20383157-37ab-42c0-b3c9-11276d07b83e/targets/mnt/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0xb046ba) #36 0x62916b53d in llint_entry+0x16f76 (/private/tmp/tmpdoy6g092/working/20383157-37ab-42c0-b3c9-11276d07b83e/targets/mnt/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0xb0453d) #37 0x629154418 in vmEntryToJavaScript 1631376 1 shihchieh_lee 2020-03-18 14:51:14 -0700 Should not have security implications since we are accessing the parent of renderView. 1631381 2 zalan 2020-03-18 15:15:16 -0700 Please remove the security classification. 1631405 3 393913 shihchieh_lee 2020-03-18 16:12:48 -0700 Created attachment 393913 Patch 1631814 4 393913 zalan 2020-03-19 14:03:46 -0700 Comment on attachment 393913 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=393913&action=review > Source/WebCore/ChangeLog:9 > + Stop looking for sibling in AccessibilityRenderObject::nextSibling if the renderer of the AccessibilityObject is <RenderView>. This is where you should explain why it is ok to call this function on the RenderView. Also "stop looking" is a bit misleading since it's fine to look and not find any. 1631905 5 394043 shihchieh_lee 2020-03-19 16:38:17 -0700 Created attachment 394043 Patch 1631926 6 394043 rniwa 2020-03-19 17:40:23 -0700 Comment on attachment 394043 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=394043&action=review > Source/WebCore/ChangeLog:7 > + Reviewed by NOBODY (OOPS!). In this case, Antti already already reviewed the patch so you should fill this field with "Reviewed by Antti Koivisto" If you hadn't already uploaded this patch, you could have done: webkit-patch land-safely. That would have automatically carried Antti's r+ onto this patch and uploaded a new one for you. 1632036 7 ews-feeder 2020-03-20 02:27:38 -0700 Committed r258756: <https://trac.webkit.org/changeset/258756> All reviewed patches have been landed. Closing bug and clearing flags on attachment 394043. 1632234 8 394043 darin 2020-03-20 13:10:56 -0700 Comment on attachment 394043 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=394043&action=review > Source/WebCore/ChangeLog:9 > + It’s perfectly fine to call AccessibilityRenderObject::nextSibling on the RenderView (empty document) and since the RenderView has no sibling, let’s just early return with nullptr. This comment still does not explain why the code is needed. A casual reading of the function seems to indicate it would work, and return nullptr, if it was a RenderView. I would have expected the fix to be making the code that fails on RenderView guard itself better and make fewer assumptions rather than putting a check at the very top of this function. I don’t object to the code change, but I still find this to be a mysterious comment. 1632245 9 cfleizach 2020-03-20 13:30:21 -0700 should this fix be somewhere lower in the stack calling isInlineWithContinuation(WebCore::RenderObject&) on a valid renderObject doesn't seem like it should ever crash 1632252 10 darin 2020-03-20 13:39:47 -0700 (In reply to chris fleizach from comment #9) > isInlineWithContinuation(WebCore::RenderObject&) on a valid renderObject > doesn't seem like it should ever crash Exactly. 1632323 11 shihchieh_lee 2020-03-20 15:33:04 -0700 Darin, Chris, thanks for the comments. Yeah we had similar discussions about the fix. Putting a null check at isInlineWithContinuation(*m_renderer->parent()) works. However, the function "postTextStateChangeNotification" seems to be looking for any sibling that has "unignored" accessibility. Since renderView would fail the sibling search, handling it earlier may help avoid potential issues. We thought about checking renderView in postTextStateChangeNotification before looking for any sibling. However, it is indeed weird to only check for renderView but not other sibling-less cases. Should I create a new patch if a localized fix is preferred? 1632331 12 shihchieh_lee 2020-03-20 15:40:14 -0700 Reopen to improve the patch. 1632337 13 darin 2020-03-20 15:50:22 -0700 (In reply to Jack from comment #11) > Since renderView would > fail the sibling search, handling it earlier may help avoid potential > issues. I don’t know what "potential issues" you are talking about. 1632338 14 zalan 2020-03-20 15:53:07 -0700 (In reply to chris fleizach from comment #9) > should this fix be somewhere lower in the stack calling > > isInlineWithContinuation(WebCore::RenderObject&) on a valid renderObject > doesn't seem like it should ever crash I don't think so. We know that the RenderView can never have a sibling. It is a condition that we can early return on. 1632340 15 zalan 2020-03-20 15:56:03 -0700 (In reply to zalan from comment #14) > (In reply to chris fleizach from comment #9) > > should this fix be somewhere lower in the stack calling > > > > isInlineWithContinuation(WebCore::RenderObject&) on a valid renderObject > > doesn't seem like it should ever crash > I don't think so. We know that the RenderView can never have a sibling. It > is a condition that we can early return on. (the "I don't think so" was a reply to "should this fix be somewhere lower in the stack calling") 1632345 16 darin 2020-03-20 15:59:33 -0700 What was crashing without this check, and why was it crashing? 1632347 17 zalan 2020-03-20 16:04:06 -0700 (In reply to Darin Adler from comment #16) > What was crashing without this check, and why was it crashing? "if (!nextSibling && isInlineWithContinuation(*m_renderer->parent()))" nullptr deref. The logic further down in this function assumes that the current renderer always have a value parent (so it is attached to the render tree and we never call this function on the RenderView). 1632349 18 zalan 2020-03-20 16:04:30 -0700 (In reply to zalan from comment #17) > (In reply to Darin Adler from comment #16) > > What was crashing without this check, and why was it crashing? > > "if (!nextSibling && isInlineWithContinuation(*m_renderer->parent()))" > nullptr deref. The logic further down in this function assumes that the > current renderer always have a value parent (so it is attached to the render > tree and we never call this function on the RenderView). valid parent even. 1632359 19 shihchieh_lee 2020-03-20 16:15:17 -0700 Sorry I should rephrase it that we can prevent future issues if renderView is called in other functions (that eventually calls nextSibling). (In reply to Darin Adler from comment #13) > (In reply to Jack from comment #11) > > Since renderView would > > fail the sibling search, handling it earlier may help avoid potential > > issues. > > I don’t know what "potential issues" you are talking about. 1632360 20 shihchieh_lee 2020-03-20 16:15:28 -0700 Sorry I should rephrase it that we can prevent future issues if renderView is called in other functions (that eventually calls nextSibling). (In reply to Darin Adler from comment #13) > (In reply to Jack from comment #11) > > Since renderView would > > fail the sibling search, handling it earlier may help avoid potential > > issues. > > I don’t know what "potential issues" you are talking about. 1632361 21 shihchieh_lee 2020-03-20 16:18:11 -0700 Sorry, stale comment went out because weird collision. This is the new one: Is it okay to patch the function like this: if (!m_renderer || !m_renderer->parent()) return nullptr; Is it safe to say that there is no sibling if parent is null? 1632366 22 zalan 2020-03-20 16:24:13 -0700 (In reply to Jack from comment #21) > Sorry, stale comment went out because weird collision. This is the new one: > > Is it okay to patch the function like this: > > if (!m_renderer || !m_renderer->parent()) > return nullptr; This would be logically incorrect. It would certainly fix the null deref, but just because a renderer has no parent it does not necessarily mean it has no sibling either. The renderview (which is a very special renderer, it's the ICB) can never have a sibling and that's why it's okay to early return (and it happens to not have a parent either, but that's just implementation detail). 1632370 23 shihchieh_lee 2020-03-20 16:31:19 -0700 I see. Thanks. So there is no better way to check all the sibling-less cases.... hmm.... (In reply to zalan from comment #22) > (In reply to Jack from comment #21) > > Sorry, stale comment went out because weird collision. This is the new one: > > > > Is it okay to patch the function like this: > > > > if (!m_renderer || !m_renderer->parent()) > > return nullptr; > This would be logically incorrect. It would certainly fix the null deref, > but just because a renderer has no parent it does not necessarily mean it > has no sibling either. The renderview (which is a very special renderer, > it's the ICB) can never have a sibling and that's why it's okay to early > return (and it happens to not have a parent either, but that's just > implementation detail). 1632400 24 darin 2020-03-20 17:28:59 -0700 We should not dereference the parent pointer without checking it for null. Please add the missing null check. After adding that check for null, if you still want to have a special case for RenderView, that’s OK with me, although it doesn’t seem important or helpful. 1632405 25 zalan 2020-03-20 17:51:32 -0700 (In reply to Darin Adler from comment #24) > We should not dereference the parent pointer without checking it for null. > Please add the missing null check. > > After adding that check for null, if you still want to have a special case > for RenderView, that’s OK with me, although it doesn’t seem important or > helpful. That's fine, but then the null check should be moved to where the deref happens. A seemingly random check for parent at the beginning of the function is incorrect (and drop the RenderView check) 1632417 26 zalan 2020-03-20 19:40:55 -0700 (In reply to zalan from comment #25) > (In reply to Darin Adler from comment #24) > > We should not dereference the parent pointer without checking it for null. > > Please add the missing null check. > > > > After adding that check for null, if you still want to have a special case > > for RenderView, that’s OK with me, although it doesn’t seem important or > > helpful. > That's fine, but then the null check should be moved to where the deref > happens. A seemingly random check for parent at the beginning of the > function is incorrect (and drop the RenderView check) The reason why I thought checking against RenderView is the way to go was simply because how we can end up in the function with a nullptr parent: 1. m_renderer is the RenderView. 2. the m_renderer is detached from the tree. and while the #1 is perfectly fine, #2 looks suspicious and probably indicates that the caller made a mistake (and should probably ASSERT) but I can see why checking against nullptr is more robust and less error prone. 1632419 27 shihchieh_lee 2020-03-20 19:46:19 -0700 Thank you all very much for the discussion. Browser is really complicated. Actually just a few lines down in this function, there are some potential null dereferences. I just don't know if any valid scenario exists that would trigger them. RenderElement* lastParent = endOfContinuations(*downcast<RenderBlock>(*m_renderer).lastChild())->parent(); //is it possible that lastChild() returns null? while (lastChildHasContinuation(*lastParent)) lastParent = endOfContinuations(*lastParent->lastChild())->parent(); //is it possible that lastChild() returns null? //is it possible that lastParent is null? I will only patch for this test case to avoid confusion though. 1632420 28 shihchieh_lee 2020-03-20 19:52:57 -0700 Thanks Alan. I see. Yeah, there are quite some assumptions in the code. I will add an ASSERTION for (m_renderer->parent() || is<RenderView>(*m_renderer)). This way if people hit null parent for invalid reason (#2), they can be warned. (In reply to zalan from comment #26)> 1. m_renderer is the RenderView. > 2. the m_renderer is detached from the tree. > and while the #1 is perfectly fine, #2 looks suspicious and probably > indicates that the caller made a mistake (and should probably ASSERT) > but I can see why checking against nullptr is more robust and less error > prone. 1632421 29 zalan 2020-03-20 19:59:57 -0700 (In reply to Jack from comment #28) > Thanks Alan. I see. Yeah, there are quite some assumptions in the code. > > I will add an ASSERTION for (m_renderer->parent() || > is<RenderView>(*m_renderer)). We usually don't do both (assert and check). 1632425 30 shihchieh_lee 2020-03-20 20:10:50 -0700 Oh, okay. I will just add the check. (In reply to zalan from comment #29) > (In reply to Jack from comment #28) > > Thanks Alan. I see. Yeah, there are quite some assumptions in the code. > > > > I will add an ASSERTION for (m_renderer->parent() || > > is<RenderView>(*m_renderer)). > We usually don't do both (assert and check). 1632428 31 394156 shihchieh_lee 2020-03-20 20:55:26 -0700 Created attachment 394156 Patch 1632429 32 394043 rniwa 2020-03-20 20:57:00 -0700 Comment on attachment 394043 Patch Let's not obsolete this patch since it got landed. 1632540 33 darin 2020-03-21 16:55:18 -0700 (In reply to zalan from comment #25) > (In reply to Darin Adler from comment #24) > > We should not dereference the parent pointer without checking it for null. > > Please add the missing null check. > > > > After adding that check for null, if you still want to have a special case > > for RenderView, that’s OK with me, although it doesn’t seem important or > > helpful. > > That's fine, but then the null check should be moved to where the deref > happens. A seemingly random check for parent at the beginning of the > function is incorrect (and drop the RenderView check) Yes, I wasn’t suggesting we add a check the top of the function. 1632582 34 ews-feeder 2020-03-21 21:59:12 -0700 Committed r258816: <https://trac.webkit.org/changeset/258816> All reviewed patches have been landed. Closing bug and clearing flags on attachment 394156. 393913 2020-03-18 16:12:48 -0700 2020-03-19 16:38:15 -0700 Patch bug-209251-20200318161248.patch text/plain 3822 shihchieh_lee U3VidmVyc2lvbiBSZXZpc2lvbjogMjU3Nzg5CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggMDJjYTIxYWZmMWNjMmEz NjVkMGMyYzA2NTQ5YTZlZmJmMDE4MTU5MC4uZTI5M2JkMWQyMDFkZTBlZDlhODRmMzY3ZTFlM2Zk OGE3MzEwN2MyNiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE4IEBACisyMDIwLTAzLTE4ICBKYWNr IExlZSAgPHNoaWhjaGllaF9sZWVAYXBwbGUuY29tPgorCisgICAgICAgIE51bGxwdHIgY3Jhc2gg aW4gUmVuZGVyT2JqZWN0OjpSZW5kZXJPYmplY3RCaXRmaWVsZHM6OmlzQm94IHdoZW4gY3VycmVu dCByZW5kZXJlciBpcyB0aGUgUmVuZGVyVmlldworICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0 Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjA5MjUxCisgICAgICAgIDxyZGFyOi8vcHJvYmxlbS82MDEw MzYxND4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBT dG9wIGxvb2tpbmcgZm9yIHNpYmxpbmcgaW4gQWNjZXNzaWJpbGl0eVJlbmRlck9iamVjdDo6bmV4 dFNpYmxpbmcgaWYgdGhlIHJlbmRlcmVyIG9mIHRoZSBBY2Nlc3NpYmlsaXR5T2JqZWN0IGlzIDxS ZW5kZXJWaWV3Pi4gCisKKyAgICAgICAgVGVzdDogZmFzdC9mcmFtZXMvaWZyYW1lLWVtcHR5LWRv Yy1jcmFzaC5odG1sCisKKyAgICAgICAgKiBhY2Nlc3NpYmlsaXR5L0FjY2Vzc2liaWxpdHlSZW5k ZXJPYmplY3QuY3BwOgorICAgICAgICAoV2ViQ29yZTo6QWNjZXNzaWJpbGl0eVJlbmRlck9iamVj dDo6bmV4dFNpYmxpbmcgY29uc3QpOgorCiAyMDIwLTAzLTAzICBXZW5zb24gSHNpZWggIDx3ZW5z b25faHNpZWhAYXBwbGUuY29tPgogCiAgICAgICAgIEFkZHJlc3MgcG9zdC1jb21taXQgZmVlZGJh Y2sgYWZ0ZXIgcjI1NzczMgpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvYWNjZXNzaWJpbGl0 eS9BY2Nlc3NpYmlsaXR5UmVuZGVyT2JqZWN0LmNwcCBiL1NvdXJjZS9XZWJDb3JlL2FjY2Vzc2li aWxpdHkvQWNjZXNzaWJpbGl0eVJlbmRlck9iamVjdC5jcHAKaW5kZXggNjg4YmIwMzllODQyOTY1 OTRmYzdhMWNlMjdiZjNjYmViM2I5NGI2Mi4uMjUyNTFiZjI2MWY0NmM1Y2YxNDU0NzczYWFiZjc5 OWJkMDZlOTE2NSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvYWNjZXNzaWJpbGl0eS9BY2Nl c3NpYmlsaXR5UmVuZGVyT2JqZWN0LmNwcAorKysgYi9Tb3VyY2UvV2ViQ29yZS9hY2Nlc3NpYmls aXR5L0FjY2Vzc2liaWxpdHlSZW5kZXJPYmplY3QuY3BwCkBAIC0zNTIsNyArMzUyLDcgQEAgc3Rh dGljIGlubGluZSBib29sIGxhc3RDaGlsZEhhc0NvbnRpbnVhdGlvbihSZW5kZXJFbGVtZW50JiBy ZW5kZXJlcikKIAogQWNjZXNzaWJpbGl0eU9iamVjdCogQWNjZXNzaWJpbGl0eVJlbmRlck9iamVj dDo6bmV4dFNpYmxpbmcoKSBjb25zdAogewotICAgIGlmICghbV9yZW5kZXJlcikKKyAgICBpZiAo IW1fcmVuZGVyZXIgfHwgaXM8UmVuZGVyVmlldz4oKm1fcmVuZGVyZXIpKQogICAgICAgICByZXR1 cm4gbnVsbHB0cjsKIAogICAgIFJlbmRlck9iamVjdCogbmV4dFNpYmxpbmcgPSBudWxscHRyOwpk aWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9n CmluZGV4IGY4MTU1NjgwOWJlZmRjYWFhMDA4ZmFmYTJhYTNjYmE4NDZhZWZmNmUuLjVmZDg4ZGJk ZTk5NjZlNThhMDVjNjdjOTZiYTdlZTk2ZjkzNGFlMWQgMTAwNjQ0Ci0tLSBhL0xheW91dFRlc3Rz L0NoYW5nZUxvZworKysgYi9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKQEAgLTEsMyArMSwxNiBAQAor MjAyMC0wMy0xOCAgSmFjayBMZWUgIDxzaGloY2hpZWhfbGVlQGFwcGxlLmNvbT4KKworICAgICAg ICBOdWxscHRyIGNyYXNoIGluIFJlbmRlck9iamVjdDo6UmVuZGVyT2JqZWN0Qml0ZmllbGRzOjpp c0JveCB3aGVuIGN1cnJlbnQgcmVuZGVyZXIgaXMgdGhlIFJlbmRlclZpZXcKKyAgICAgICAgaHR0 cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIwOTI1MQorICAgICAgICA8cmRh cjovL3Byb2JsZW0vNjAxMDM2MTQ+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BT ISkuCisKKyAgICAgICAgU3RvcCBsb29raW5nIGZvciBzaWJsaW5nIGluIEFjY2Vzc2liaWxpdHlS ZW5kZXJPYmplY3Q6Om5leHRTaWJsaW5nIGlmIHRoZSByZW5kZXJlciBvZiB0aGUgQWNjZXNzaWJp bGl0eU9iamVjdCBpcyA8UmVuZGVyVmlldz4uIAorCisgICAgICAgICogZmFzdC9mcmFtZXMvaWZy YW1lLWVtcHR5LWRvYy1jcmFzaC1leHBlY3RlZC50eHQ6IEFkZGVkLgorICAgICAgICAqIGZhc3Qv ZnJhbWVzL2lmcmFtZS1lbXB0eS1kb2MtY3Jhc2guaHRtbDogQWRkZWQuCisKIDIwMjAtMDMtMDMg IEphc29uIExhd3JlbmNlICA8bGF3cmVuY2UuakBhcHBsZS5jb20+CiAKICAgICAgICAgWyBpT1Mg d2syIF0gaHR0cC90ZXN0cy9zZWN1cml0eS9jb29raWVzL3RoaXJkLXBhcnR5LWNvb2tpZS1ibG9j a2luZy1yZWRpcmVjdC5odG1sIGlzIGZsYWt5IHRpbWluZyBvdXQuCmRpZmYgLS1naXQgYS9MYXlv dXRUZXN0cy9mYXN0L2ZyYW1lcy9pZnJhbWUtZW1wdHktZG9jLWNyYXNoLWV4cGVjdGVkLnR4dCBi L0xheW91dFRlc3RzL2Zhc3QvZnJhbWVzL2lmcmFtZS1lbXB0eS1kb2MtY3Jhc2gtZXhwZWN0ZWQu dHh0Cm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAuLjU4MmI0MmE4NjBlYzljZWY4Mjg3ZDRhZTQ5N2E0ZTFlNmRhNjdmZGYK LS0tIC9kZXYvbnVsbAorKysgYi9MYXlvdXRUZXN0cy9mYXN0L2ZyYW1lcy9pZnJhbWUtZW1wdHkt ZG9jLWNyYXNoLWV4cGVjdGVkLnR4dApAQCAtMCwwICsxLDMgQEAKK1Rlc3QgbW92aW5nIGFsbCBl bGVtZW50cyBpbiBpZnJhbWUuIFRoZSB0ZXN0IHBhc3NlcyBpZiBXZWJLaXQgZG9lc24ndCBjcmFz aCBvciBoaXQgYW4gYXNzZXJ0aW9uLgorCisKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL2Zhc3Qv ZnJhbWVzL2lmcmFtZS1lbXB0eS1kb2MtY3Jhc2guaHRtbCBiL0xheW91dFRlc3RzL2Zhc3QvZnJh bWVzL2lmcmFtZS1lbXB0eS1kb2MtY3Jhc2guaHRtbApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRl eCAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwLi40ZWY3OTg3OTUzZGQ5 MjU0MDEzODAxYjY0NTQ0MDkyMGJkNDFiYThhCi0tLSAvZGV2L251bGwKKysrIGIvTGF5b3V0VGVz dHMvZmFzdC9mcmFtZXMvaWZyYW1lLWVtcHR5LWRvYy1jcmFzaC5odG1sCkBAIC0wLDAgKzEsOSBA QAorPHNwYW4+VGVzdCBtb3ZpbmcgYWxsIGVsZW1lbnRzIGluIGlmcmFtZS4gVGhlIHRlc3QgcGFz c2VzIGlmIFdlYktpdCBkb2Vzbid0IGNyYXNoIG9yIGhpdCBhbiBhc3NlcnRpb24uPC9zcGFuPjxk aXYgaWQ9bmV3UGFyZW50IHJvbGU9InRleHQiPjxpZnJhbWUgaWQ9c3ViZnJhbWU+PC9pZnJhbWU+ PC9kaXY+Cis8c2NyaXB0PgorICAgIGlmICh3aW5kb3cudGVzdFJ1bm5lcikKKyAgICAgICAgdGVz dFJ1bm5lci5kdW1wQXNUZXh0KCk7CisKKyAgICBkb2N1bWVudC5ib2R5Lm9mZnNldEhlaWdodDsK KyAgICBzdWJmcmFtZS5jb250ZW50V2luZG93LmRvY3VtZW50LmV4ZWNDb21tYW5kKCJzZWxlY3RB bGwiLCBmYWxzZSk7CisgICAgbmV3UGFyZW50LmFwcGVuZENoaWxkKHN1YmZyYW1lLmNvbnRlbnRX aW5kb3cuZG9jdW1lbnQuZ2V0RWxlbWVudHNCeVRhZ05hbWUoIkhUTUwiKVswXSk7Cis8L3Njcmlw dD4K 394043 2020-03-19 16:38:17 -0700 2020-03-20 20:57:00 -0700 Patch bug-209251-20200319163816.patch text/plain 3937 shihchieh_lee U3VidmVyc2lvbiBSZXZpc2lvbjogMjU3Nzg5CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggMDJjYTIxYWZmMWNjMmEz NjVkMGMyYzA2NTQ5YTZlZmJmMDE4MTU5MC4uMTM2N2ZmZGRkN2EzYTNlZjAxYzE2MDY4MjVmMzJh Mjg2NDkyYWZiYyAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE4IEBACisyMDIwLTAzLTE4ICBKYWNr IExlZSAgPHNoaWhjaGllaF9sZWVAYXBwbGUuY29tPgorCisgICAgICAgIE51bGxwdHIgY3Jhc2gg aW4gUmVuZGVyT2JqZWN0OjpSZW5kZXJPYmplY3RCaXRmaWVsZHM6OmlzQm94IHdoZW4gY3VycmVu dCByZW5kZXJlciBpcyB0aGUgUmVuZGVyVmlldworICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0 Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjA5MjUxCisgICAgICAgIDxyZGFyOi8vcHJvYmxlbS82MDEw MzYxND4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBJ dOKAmXMgcGVyZmVjdGx5IGZpbmUgdG8gY2FsbCBBY2Nlc3NpYmlsaXR5UmVuZGVyT2JqZWN0Ojpu ZXh0U2libGluZyBvbiB0aGUgUmVuZGVyVmlldyAoZW1wdHkgZG9jdW1lbnQpIGFuZCBzaW5jZSB0 aGUgUmVuZGVyVmlldyBoYXMgbm8gc2libGluZywgbGV04oCZcyBqdXN0IGVhcmx5IHJldHVybiB3 aXRoIG51bGxwdHIuCisKKyAgICAgICAgVGVzdDogZmFzdC9mcmFtZXMvaWZyYW1lLWVtcHR5LWRv Yy1jcmFzaC5odG1sCisKKyAgICAgICAgKiBhY2Nlc3NpYmlsaXR5L0FjY2Vzc2liaWxpdHlSZW5k ZXJPYmplY3QuY3BwOgorICAgICAgICAoV2ViQ29yZTo6QWNjZXNzaWJpbGl0eVJlbmRlck9iamVj dDo6bmV4dFNpYmxpbmcgY29uc3QpOgorCiAyMDIwLTAzLTAzICBXZW5zb24gSHNpZWggIDx3ZW5z b25faHNpZWhAYXBwbGUuY29tPgogCiAgICAgICAgIEFkZHJlc3MgcG9zdC1jb21taXQgZmVlZGJh Y2sgYWZ0ZXIgcjI1NzczMgpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvYWNjZXNzaWJpbGl0 eS9BY2Nlc3NpYmlsaXR5UmVuZGVyT2JqZWN0LmNwcCBiL1NvdXJjZS9XZWJDb3JlL2FjY2Vzc2li aWxpdHkvQWNjZXNzaWJpbGl0eVJlbmRlck9iamVjdC5jcHAKaW5kZXggNjg4YmIwMzllODQyOTY1 OTRmYzdhMWNlMjdiZjNjYmViM2I5NGI2Mi4uMjUyNTFiZjI2MWY0NmM1Y2YxNDU0NzczYWFiZjc5 OWJkMDZlOTE2NSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvYWNjZXNzaWJpbGl0eS9BY2Nl c3NpYmlsaXR5UmVuZGVyT2JqZWN0LmNwcAorKysgYi9Tb3VyY2UvV2ViQ29yZS9hY2Nlc3NpYmls aXR5L0FjY2Vzc2liaWxpdHlSZW5kZXJPYmplY3QuY3BwCkBAIC0zNTIsNyArMzUyLDcgQEAgc3Rh dGljIGlubGluZSBib29sIGxhc3RDaGlsZEhhc0NvbnRpbnVhdGlvbihSZW5kZXJFbGVtZW50JiBy ZW5kZXJlcikKIAogQWNjZXNzaWJpbGl0eU9iamVjdCogQWNjZXNzaWJpbGl0eVJlbmRlck9iamVj dDo6bmV4dFNpYmxpbmcoKSBjb25zdAogewotICAgIGlmICghbV9yZW5kZXJlcikKKyAgICBpZiAo IW1fcmVuZGVyZXIgfHwgaXM8UmVuZGVyVmlldz4oKm1fcmVuZGVyZXIpKQogICAgICAgICByZXR1 cm4gbnVsbHB0cjsKIAogICAgIFJlbmRlck9iamVjdCogbmV4dFNpYmxpbmcgPSBudWxscHRyOwpk aWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9n CmluZGV4IGY4MTU1NjgwOWJlZmRjYWFhMDA4ZmFmYTJhYTNjYmE4NDZhZWZmNmUuLjZmODM1NjIx NGJmZDczNWQ4N2ZkNTJiNzVlNmE1ZjA3OTkwM2ZiNGYgMTAwNjQ0Ci0tLSBhL0xheW91dFRlc3Rz L0NoYW5nZUxvZworKysgYi9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKQEAgLTEsMyArMSwxNiBAQAor MjAyMC0wMy0xOCAgSmFjayBMZWUgIDxzaGloY2hpZWhfbGVlQGFwcGxlLmNvbT4KKworICAgICAg ICBOdWxscHRyIGNyYXNoIGluIFJlbmRlck9iamVjdDo6UmVuZGVyT2JqZWN0Qml0ZmllbGRzOjpp c0JveCB3aGVuIGN1cnJlbnQgcmVuZGVyZXIgaXMgdGhlIFJlbmRlclZpZXcKKyAgICAgICAgaHR0 cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIwOTI1MQorICAgICAgICA8cmRh cjovL3Byb2JsZW0vNjAxMDM2MTQ+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BT ISkuCisKKyAgICAgICAgSXTigJlzIHBlcmZlY3RseSBmaW5lIHRvIGNhbGwgQWNjZXNzaWJpbGl0 eVJlbmRlck9iamVjdDo6bmV4dFNpYmxpbmcgb24gdGhlIFJlbmRlclZpZXcgKGVtcHR5IGRvY3Vt ZW50KSBhbmQgc2luY2UgdGhlIFJlbmRlclZpZXcgaGFzIG5vIHNpYmxpbmcsIGxldOKAmXMganVz dCBlYXJseSByZXR1cm4gd2l0aCBudWxscHRyLiAKKworICAgICAgICAqIGZhc3QvZnJhbWVzL2lm cmFtZS1lbXB0eS1kb2MtY3Jhc2gtZXhwZWN0ZWQudHh0OiBBZGRlZC4KKyAgICAgICAgKiBmYXN0 L2ZyYW1lcy9pZnJhbWUtZW1wdHktZG9jLWNyYXNoLmh0bWw6IEFkZGVkLgorCiAyMDIwLTAzLTAz ICBKYXNvbiBMYXdyZW5jZSAgPGxhd3JlbmNlLmpAYXBwbGUuY29tPgogCiAgICAgICAgIFsgaU9T IHdrMiBdIGh0dHAvdGVzdHMvc2VjdXJpdHkvY29va2llcy90aGlyZC1wYXJ0eS1jb29raWUtYmxv Y2tpbmctcmVkaXJlY3QuaHRtbCBpcyBmbGFreSB0aW1pbmcgb3V0LgpkaWZmIC0tZ2l0IGEvTGF5 b3V0VGVzdHMvZmFzdC9mcmFtZXMvaWZyYW1lLWVtcHR5LWRvYy1jcmFzaC1leHBlY3RlZC50eHQg Yi9MYXlvdXRUZXN0cy9mYXN0L2ZyYW1lcy9pZnJhbWUtZW1wdHktZG9jLWNyYXNoLWV4cGVjdGVk LnR4dApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwLi41ODJiNDJhODYwZWM5Y2VmODI4N2Q0YWU0OTdhNGUxZTZkYTY3ZmRm Ci0tLSAvZGV2L251bGwKKysrIGIvTGF5b3V0VGVzdHMvZmFzdC9mcmFtZXMvaWZyYW1lLWVtcHR5 LWRvYy1jcmFzaC1leHBlY3RlZC50eHQKQEAgLTAsMCArMSwzIEBACitUZXN0IG1vdmluZyBhbGwg ZWxlbWVudHMgaW4gaWZyYW1lLiBUaGUgdGVzdCBwYXNzZXMgaWYgV2ViS2l0IGRvZXNuJ3QgY3Jh c2ggb3IgaGl0IGFuIGFzc2VydGlvbi4KKworCmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9mYXN0 L2ZyYW1lcy9pZnJhbWUtZW1wdHktZG9jLWNyYXNoLmh0bWwgYi9MYXlvdXRUZXN0cy9mYXN0L2Zy YW1lcy9pZnJhbWUtZW1wdHktZG9jLWNyYXNoLmh0bWwKbmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5k ZXggMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMC4uNGVmNzk4Nzk1M2Rk OTI1NDAxMzgwMWI2NDU0NDA5MjBiZDQxYmE4YQotLS0gL2Rldi9udWxsCisrKyBiL0xheW91dFRl c3RzL2Zhc3QvZnJhbWVzL2lmcmFtZS1lbXB0eS1kb2MtY3Jhc2guaHRtbApAQCAtMCwwICsxLDkg QEAKKzxzcGFuPlRlc3QgbW92aW5nIGFsbCBlbGVtZW50cyBpbiBpZnJhbWUuIFRoZSB0ZXN0IHBh c3NlcyBpZiBXZWJLaXQgZG9lc24ndCBjcmFzaCBvciBoaXQgYW4gYXNzZXJ0aW9uLjwvc3Bhbj48 ZGl2IGlkPW5ld1BhcmVudCByb2xlPSJ0ZXh0Ij48aWZyYW1lIGlkPXN1YmZyYW1lPjwvaWZyYW1l PjwvZGl2PgorPHNjcmlwdD4KKyAgICBpZiAod2luZG93LnRlc3RSdW5uZXIpCisgICAgICAgIHRl c3RSdW5uZXIuZHVtcEFzVGV4dCgpOworCisgICAgZG9jdW1lbnQuYm9keS5vZmZzZXRIZWlnaHQ7 CisgICAgc3ViZnJhbWUuY29udGVudFdpbmRvdy5kb2N1bWVudC5leGVjQ29tbWFuZCgic2VsZWN0 QWxsIiwgZmFsc2UpOworICAgIG5ld1BhcmVudC5hcHBlbmRDaGlsZChzdWJmcmFtZS5jb250ZW50 V2luZG93LmRvY3VtZW50LmdldEVsZW1lbnRzQnlUYWdOYW1lKCJIVE1MIilbMF0pOworPC9zY3Jp cHQ+Cg== 394156 2020-03-20 20:55:26 -0700 2020-03-21 21:59:13 -0700 Patch bug-209251-20200320205525.patch text/plain 4531 shihchieh_lee U3VidmVyc2lvbiBSZXZpc2lvbjogMjU3Nzg5CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggMDJjYTIxYWZmMWNjMmEz NjVkMGMyYzA2NTQ5YTZlZmJmMDE4MTU5MC4uMzcwOGY3Zjc0MTUyN2VjYmQwNGEyNDY5NTNkNzUz MGEyMmI4ZTQ0MCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE4IEBACisyMDIwLTAzLTE4ICBKYWNr IExlZSAgPHNoaWhjaGllaF9sZWVAYXBwbGUuY29tPgorCisgICAgICAgIE51bGxwdHIgY3Jhc2gg aW4gUmVuZGVyT2JqZWN0OjpSZW5kZXJPYmplY3RCaXRmaWVsZHM6OmlzQm94IHdoZW4gY3VycmVu dCByZW5kZXJlciBpcyB0aGUgUmVuZGVyVmlldworICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0 Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjA5MjUxCisgICAgICAgIDxyZGFyOi8vcHJvYmxlbS82MDEw MzYxND4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBJ biB0aGlzIGNhc2UsIHdoaWNoIGlzIGEgdmFsaWQgc2NlbmFyaW8sIHdlIGFyZSBsb29raW5nIGZv ciBzaWJsaW5nIG9mIGFuIEFjY2Vzc2liaWxpdHlSZW5kZXJPYmplY3QgdGhyb3VnaCB0aGUgcGFy ZW50IG9mIGl0cyByZW5kZXJlciwgd2hpY2ggaGFwcGVucyB0byBiZSBvZiA8UmVuZGVyVmlldz4u IFNpbmNlIDxSZW5kZXJWaWV3PiBoYXMgbm8gcGFyZW50LCB3ZSBuZWVkIHRvIHNraXAgY2FsbGlu ZyBpc0lubGluZVdpdGhDb250aW51YXRpb24gd2l0aCBhIG51bGwgcGFyZW50LCBieSBhZGRpbmcg bnVsbCBjaGVjay4KKworICAgICAgICBUZXN0OiBmYXN0L2ZyYW1lcy9pZnJhbWUtZW1wdHktZG9j LWNyYXNoLmh0bWwKKworICAgICAgICAqIGFjY2Vzc2liaWxpdHkvQWNjZXNzaWJpbGl0eVJlbmRl ck9iamVjdC5jcHA6CisgICAgICAgIChXZWJDb3JlOjpBY2Nlc3NpYmlsaXR5UmVuZGVyT2JqZWN0 OjpuZXh0U2libGluZyBjb25zdCk6CisKIDIwMjAtMDMtMDMgIFdlbnNvbiBIc2llaCAgPHdlbnNv bl9oc2llaEBhcHBsZS5jb20+CiAKICAgICAgICAgQWRkcmVzcyBwb3N0LWNvbW1pdCBmZWVkYmFj ayBhZnRlciByMjU3NzMyCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9hY2Nlc3NpYmlsaXR5 L0FjY2Vzc2liaWxpdHlSZW5kZXJPYmplY3QuY3BwIGIvU291cmNlL1dlYkNvcmUvYWNjZXNzaWJp bGl0eS9BY2Nlc3NpYmlsaXR5UmVuZGVyT2JqZWN0LmNwcAppbmRleCA2ODhiYjAzOWU4NDI5NjU5 NGZjN2ExY2UyN2JmM2NiZWIzYjk0YjYyLi5kYzkwNDIyYzNiMjc1M2UwZWZiNmRlOTA0NTBkZmEw NDg1Y2EwZWNjIDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9hY2Nlc3NpYmlsaXR5L0FjY2Vz c2liaWxpdHlSZW5kZXJPYmplY3QuY3BwCisrKyBiL1NvdXJjZS9XZWJDb3JlL2FjY2Vzc2liaWxp dHkvQWNjZXNzaWJpbGl0eVJlbmRlck9iamVjdC5jcHAKQEAgLTM4NCw3ICszODQsNyBAQCBBY2Nl c3NpYmlsaXR5T2JqZWN0KiBBY2Nlc3NpYmlsaXR5UmVuZGVyT2JqZWN0OjpuZXh0U2libGluZygp IGNvbnN0CiAKICAgICAvLyBDYXNlIDU6IG5vZGUgaGFzIG5vIG5leHQgc2libGluZywgYW5kIGl0 cyBwYXJlbnQgaXMgYW4gaW5saW5lIHdpdGggYSBjb250aW51YXRpb24uCiAgICAgLy8gQ2FzZSA1 LjE6IEFmdGVyIGNhc2UgNCwgKHRoZSBlbGVtZW50IHdhcyBpbmxpbmUgdy8gY29udGludWF0aW9u IGJ1dCBoYWQgbm8gc2libGluZyksIHRoZW4gY2hlY2sgaXQncyBwYXJlbnQuCi0gICAgaWYgKCFu ZXh0U2libGluZyAmJiBpc0lubGluZVdpdGhDb250aW51YXRpb24oKm1fcmVuZGVyZXItPnBhcmVu dCgpKSkgeworICAgIGlmICghbmV4dFNpYmxpbmcgJiYgbV9yZW5kZXJlci0+cGFyZW50KCkgJiYg aXNJbmxpbmVXaXRoQ29udGludWF0aW9uKCptX3JlbmRlcmVyLT5wYXJlbnQoKSkpIHsKICAgICAg ICAgYXV0byYgY29udGludWF0aW9uID0gKmRvd25jYXN0PFJlbmRlcklubGluZT4oKm1fcmVuZGVy ZXItPnBhcmVudCgpKS5jb250aW51YXRpb24oKTsKICAgICAgICAgCiAgICAgICAgIC8vIENhc2Ug NWE6IGNvbnRpbnVhdGlvbiBpcyBhIGJsb2NrIC0gaW4gdGhpcyBjYXNlIHRoZSBibG9jayBpdHNl bGYgaXMgdGhlIG5leHQgc2libGluZy4KZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL0NoYW5nZUxv ZyBiL0xheW91dFRlc3RzL0NoYW5nZUxvZwppbmRleCBmODE1NTY4MDliZWZkY2FhYTAwOGZhZmEy YWEzY2JhODQ2YWVmZjZlLi45Nzg1NTc0NzI3YTMzYzhhM2M3ZWFiZGY5MzM2OWI4ZmNiNzI1ODZh IDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKKysrIGIvTGF5b3V0VGVzdHMvQ2hh bmdlTG9nCkBAIC0xLDMgKzEsMTYgQEAKKzIwMjAtMDMtMTggIEphY2sgTGVlICA8c2hpaGNoaWVo X2xlZUBhcHBsZS5jb20+CisKKyAgICAgICAgTnVsbHB0ciBjcmFzaCBpbiBSZW5kZXJPYmplY3Q6 OlJlbmRlck9iamVjdEJpdGZpZWxkczo6aXNCb3ggd2hlbiBjdXJyZW50IHJlbmRlcmVyIGlzIHRo ZSBSZW5kZXJWaWV3CisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNn aT9pZD0yMDkyNTEKKyAgICAgICAgPHJkYXI6Ly9wcm9ibGVtLzYwMTAzNjE0PgorCisgICAgICAg IFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIEluIHRoaXMgY2FzZSwgd2hp Y2ggaXMgYSB2YWxpZCBzY2VuYXJpbywgd2UgYXJlIGxvb2tpbmcgZm9yIHNpYmxpbmcgb2YgYW4g QWNjZXNzaWJpbGl0eVJlbmRlck9iamVjdCB0aHJvdWdoIHRoZSBwYXJlbnQgb2YgaXRzIHJlbmRl cmVyLCB3aGljaCBoYXBwZW5zIHRvIGJlIG9mIDxSZW5kZXJWaWV3Pi4gU2luY2UgPFJlbmRlclZp ZXc+IGhhcyBubyBwYXJlbnQsIHdlIG5lZWQgdG8gc2tpcCBjYWxsaW5nIGlzSW5saW5lV2l0aENv bnRpbnVhdGlvbiB3aXRoIGEgbnVsbCBwYXJlbnQsIGJ5IGFkZGluZyBudWxsIGNoZWNrLiAKKwor ICAgICAgICAqIGZhc3QvZnJhbWVzL2lmcmFtZS1lbXB0eS1kb2MtY3Jhc2gtZXhwZWN0ZWQudHh0 OiBBZGRlZC4KKyAgICAgICAgKiBmYXN0L2ZyYW1lcy9pZnJhbWUtZW1wdHktZG9jLWNyYXNoLmh0 bWw6IEFkZGVkLgorCiAyMDIwLTAzLTAzICBKYXNvbiBMYXdyZW5jZSAgPGxhd3JlbmNlLmpAYXBw bGUuY29tPgogCiAgICAgICAgIFsgaU9TIHdrMiBdIGh0dHAvdGVzdHMvc2VjdXJpdHkvY29va2ll cy90aGlyZC1wYXJ0eS1jb29raWUtYmxvY2tpbmctcmVkaXJlY3QuaHRtbCBpcyBmbGFreSB0aW1p bmcgb3V0LgpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvZmFzdC9mcmFtZXMvaWZyYW1lLWVtcHR5 LWRvYy1jcmFzaC1leHBlY3RlZC50eHQgYi9MYXlvdXRUZXN0cy9mYXN0L2ZyYW1lcy9pZnJhbWUt ZW1wdHktZG9jLWNyYXNoLWV4cGVjdGVkLnR4dApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwLi41ODJiNDJhODYwZWM5Y2Vm ODI4N2Q0YWU0OTdhNGUxZTZkYTY3ZmRmCi0tLSAvZGV2L251bGwKKysrIGIvTGF5b3V0VGVzdHMv ZmFzdC9mcmFtZXMvaWZyYW1lLWVtcHR5LWRvYy1jcmFzaC1leHBlY3RlZC50eHQKQEAgLTAsMCAr MSwzIEBACitUZXN0IG1vdmluZyBhbGwgZWxlbWVudHMgaW4gaWZyYW1lLiBUaGUgdGVzdCBwYXNz ZXMgaWYgV2ViS2l0IGRvZXNuJ3QgY3Jhc2ggb3IgaGl0IGFuIGFzc2VydGlvbi4KKworCmRpZmYg LS1naXQgYS9MYXlvdXRUZXN0cy9mYXN0L2ZyYW1lcy9pZnJhbWUtZW1wdHktZG9jLWNyYXNoLmh0 bWwgYi9MYXlvdXRUZXN0cy9mYXN0L2ZyYW1lcy9pZnJhbWUtZW1wdHktZG9jLWNyYXNoLmh0bWwK bmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMC4uNGVmNzk4Nzk1M2RkOTI1NDAxMzgwMWI2NDU0NDA5MjBiZDQxYmE4YQotLS0g L2Rldi9udWxsCisrKyBiL0xheW91dFRlc3RzL2Zhc3QvZnJhbWVzL2lmcmFtZS1lbXB0eS1kb2Mt Y3Jhc2guaHRtbApAQCAtMCwwICsxLDkgQEAKKzxzcGFuPlRlc3QgbW92aW5nIGFsbCBlbGVtZW50 cyBpbiBpZnJhbWUuIFRoZSB0ZXN0IHBhc3NlcyBpZiBXZWJLaXQgZG9lc24ndCBjcmFzaCBvciBo aXQgYW4gYXNzZXJ0aW9uLjwvc3Bhbj48ZGl2IGlkPW5ld1BhcmVudCByb2xlPSJ0ZXh0Ij48aWZy YW1lIGlkPXN1YmZyYW1lPjwvaWZyYW1lPjwvZGl2PgorPHNjcmlwdD4KKyAgICBpZiAod2luZG93 LnRlc3RSdW5uZXIpCisgICAgICAgIHRlc3RSdW5uZXIuZHVtcEFzVGV4dCgpOworCisgICAgZG9j dW1lbnQuYm9keS5vZmZzZXRIZWlnaHQ7CisgICAgc3ViZnJhbWUuY29udGVudFdpbmRvdy5kb2N1 bWVudC5leGVjQ29tbWFuZCgic2VsZWN0QWxsIiwgZmFsc2UpOworICAgIG5ld1BhcmVudC5hcHBl bmRDaGlsZChzdWJmcmFtZS5jb250ZW50V2luZG93LmRvY3VtZW50LmdldEVsZW1lbnRzQnlUYWdO YW1lKCJIVE1MIilbMF0pOworPC9zY3JpcHQ+Cg==