211793 2020-05-12 12:17:27 -0700 Nullptr crash in DeleteSelectionCommand::doApply() when merge node is disconnected. 2021-04-06 07:46:08 -0700 1 1 1 Unclassified WebKit HTML Editing WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED https://bugs.webkit.org/show_bug.cgi?id=223753 InRadar P2 Normal --- 1 shihchieh_lee webkit-unassigned bfulgham ews-feeder ggaren product-security rniwa webkit-bug-importer wenson_hsieh oldest_to_newest 1651845 0 shihchieh_lee 2020-05-12 12:17:27 -0700 <rdar://62993645> 0 com.apple.WebCore 0x0000000771431195 WebCore::CompositeEditCommand::insertNodeAt(WTF::Ref<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> >&&, WebCore::Position const&) + 85 1 com.apple.WebCore 0x00000007701ca94b WebCore::DeleteSelectionCommand::doApply() + 13531 2 com.apple.WebCore 0x00000007714454ff WebCore::CompositeEditCommand::applyCommandToComposite(WTF::Ref<WebCore::EditCommand, WTF::DumbPtrTraits<WebCore::EditCommand> >&&) + 79 3 com.apple.WebCore 0x00000007701b3700 WebCore::InsertTextCommand::doApply() + 2336 4 com.apple.WebCore 0x0000000771445815 WebCore::CompositeEditCommand::applyCommandToComposite(WTF::Ref<WebCore::CompositeEditCommand, WTF::DumbPtrTraits<WebCore::CompositeEditCommand> >&&, WebCore::VisibleSelection const&) + 101 5 com.apple.WebCore 0x00000007701b2d1e WebCore::TypingCommand::insertTextRunWithoutNewlines(WTF::String const&, bool) + 222 6 com.apple.WebCore 0x00000007714f007d WebCore::TypingCommand::insertTextAndNotifyAccessibility(WTF::String const&, bool) + 365 7 com.apple.WebCore 0x00000007701b28fd WebCore::CompositeEditCommand::apply() + 397 8 com.apple.WebCore 0x00000007714efd53 WebCore::TypingCommand::insertText(WebCore::Document&, WTF::String const&, WebCore::VisibleSelection const&, unsigned int, WebCore::TypingCommand::TextCompositionType) + 1027 9 com.apple.WebCore 0x000000077149fc4f WebCore::executeInsertText(WebCore::Frame&, WebCore::Event*, WebCore::EditorCommandSource, WTF::String const&) + 143 10 com.apple.WebCore 0x00000007702195f1 WebCore::Document::execCommand(WTF::String const&, bool, WTF::String const&) + 81 11 com.apple.WebCore 0x00000007706121ca WebCore::jsDocumentPrototypeFunctionExecCommand(JSC::JSGlobalObject*, JSC::CallFrame*) + 426 12 1651846 1 shihchieh_lee 2020-05-12 12:17:45 -0700 <body contentEditable="true"><output></output><data style="writing-mode: vertical-lr;"><menu><table></table></menu><script> document.execCommand("selectAll", false); document.execCommand("insertText", "text"); </script> Root cause: 1. In this test case, we are processing InserText command and need to delete the selected range first. 2. In handleGeneralDelete(), OUTPUT is removed. 3. After the deletion is done, we call mergeParagraphs() and decide to move TABLE (start and end of paragraphToMove) to DATA (mergeDestination). 4. In CompositeEditCommand::moveParagraphs, TABLE is deleted and we call cleanupAfterDeletion and pass DATA to the function. 5. In removeNodeAndPruneAncestors, DATA is also removed when we prune the ancestors, making DATA a dangling node. 6. Later, DATA is used to set the endingSelection() which turns out to be an empty position becuase DATA fails the isCandidate() check, due to having null renderer from being removed. 7. At the end of DeleteSelectionCommand::mergeParagraphs, endingSelection is used to set m_endingPosition, which is used for inserting a BR element as a place holder. 8. Since m_endingPosition is empty, the insertion deref the null anchor node and crashes. Node tree of the above steps: 1. Node tree and initial selected range before handleGeneralDelete() is called: BODY 0x4181e3060 (renderer 0x4181e1490) S OUTPUT 0x4181e30e0 (renderer 0x4181e3450) DATA 0x4181e31a0 (renderer 0x4181e3510) STYLE=writing-mode: vertical-lr; MENU 0x4181e3220 (renderer 0x4181e3620) E TABLE 0x4181e32a0 (renderer 0x4181e3730) SCRIPT 0x4181e3330 (renderer 0x0) #text 0x4181e33f0 "\n document.execCommand("selectAll", false);\n document.execCommand("insertText", "text");\n" start: before, offset:0 end: before, offset:0 3. In mregeParagraphs(), both the start and end of ParagraphToMove is TABLE: BODY 0x4181e3060 (renderer 0x4181e1490) DATA 0x4181e31a0 (renderer 0x4181e3510) STYLE=writing-mode: vertical-lr; MENU 0x4181e3220 (renderer 0x4181e3620) * TABLE 0x4181e32a0 (renderer 0x4181e3730) SCRIPT 0x4181e3330 (renderer 0x0) #text 0x4181e33f0 "\n document.execCommand("selectAll", false);\n document.execCommand("insertText", "text");\n" before, offset:0 and the mergeDestination is found to be Data: BODY 0x4181e3060 (renderer 0x4181e1490) * DATA 0x4181e31a0 (renderer 0x4181e3510) STYLE=writing-mode: vertical-lr; MENU 0x4181e3220 (renderer 0x4181e3620) TABLE 0x4181e32a0 (renderer 0x4181e3730) SCRIPT 0x4181e3330 (renderer 0x0) #text 0x4181e33f0 "\n document.execCommand("selectAll", false);\n document.execCommand("insertText", "text");\n" offset, offset:0 5. After cleanupAfterDeletion is called in CompositeEditCommand::moveParagraphs, destination becomes dangling. *DATA 0x4181e31a0 (renderer 0x0) STYLE=writing-mode: vertical-lr; MENU 0x4181e3220 (renderer 0x0) SCRIPT 0x4181e3330 (renderer 0x0) #text 0x4181e33f0 "\n document.execCommand("selectAll", false);\n document.execCommand("insertText", "text");\n" offset, offset:0 1651852 2 shihchieh_lee 2020-05-12 12:23:03 -0700 Discussions with Geoff and Wenson: Observations: First of all, having same start and end positions in moveParagraphs() is weird. And with nothing to be deleted, what is there to be cleaned up? We also went through history and found that initially cleanupAfterDeletion doesn’t take in any argument. Later, destination was added to handle an infinite loop: https://bugs.webkit.org/attachment.cgi?id=85395&action=prettypatch. There was no mentioning how pruneAncestor would not remove destination. Questions: 1. Should we skip deleting and cleanup if start=end of paragraph? 2. Since the pruning of ancestor is done on endingSelection() node, is there a strong assumption that endingSelection() should have different ancestor or some boundary that walking the ancestor tree will not cross destination? 3. If so, does that mean the logic of finding destination is faulty? Next step, a few options and concerns: One way to patch this in cleanupAfterDeletion is to call highestNodeToRemoveInPruning before calling removeNodeAndPruneAncestors. However, it is going to impact performance as highestNodeToRemoveInPruning is again called in removeNodeAndPruneAncestors and it walks through all the nodes. Besides, doing so may change the behavior of another usage when destination is checked after the call and bail out (MoveSelectionCommand::doApply). And there is no effect for the other case in when destination is null (CompositeEditCommand::moveParagraphWithClones). Lastly, skipping delete and cleanup when start=end may also alter the behavior. 1651853 3 shihchieh_lee 2020-05-12 12:24:18 -0700 Solution: Check for disconnection after calling cleanupAfterDeletion(), since cleanupAfterDeletion() removes nodes from the document. In the long run, we probably want a design where either cleanupAfterDeletion() does not remove destination, or we select a destination after cleanup — so that editing commands are guaranteed to succeed. 1651975 4 399186 shihchieh_lee 2020-05-12 15:14:22 -0700 Created attachment 399186 Patch 1652441 5 399186 ggaren 2020-05-13 16:46:17 -0700 Comment on attachment 399186 Patch r=me 1652451 6 ews-feeder 2020-05-13 17:21:55 -0700 Committed r261664: <https://trac.webkit.org/changeset/261664> All reviewed patches have been landed. Closing bug and clearing flags on attachment 399186. 399186 2020-05-12 15:14:22 -0700 2020-05-13 17:21:56 -0700 Patch bug-211793-20200512151421.patch text/plain 5200 shihchieh_lee U3VidmVyc2lvbiBSZXZpc2lvbjogMjYxNDM4CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggMWNkYzdkY2Q4MzYzY2I5 MjFjZTBkODNjNDQ0M2I0NTZhOTY3M2MzYi4uOGRhM2QwMGY4YWU0M2M4YzZkNGFiZGY5ZGE2NDg3 ODcwMzU1MjQ0OCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDIxIEBACisyMDIwLTA1LTEyICBKYWNr IExlZSAgPHNoaWhjaGllaF9sZWVAYXBwbGUuY29tPgorCisgICAgICAgIE51bGxwdHIgY3Jhc2gg aW4gRGVsZXRlU2VsZWN0aW9uQ29tbWFuZDo6ZG9BcHBseSgpIHdoZW4gbWVyZ2Ugbm9kZSBpcyBk aXNjb25uZWN0ZWQuCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNn aT9pZD0yMTE3OTMKKyAgICAgICAgPHJkYXI6Ly9wcm9ibGVtLzYyOTkzNjQ1PgorCisgICAgICAg IFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIENoZWNrIGZvciBkaXNjb25u ZWN0ZWQgbWVyZ2UgZGVzdGluYXRpb24gYW5kIGVuZGluZ1NlbGVjdGlvbigpIGFmdGVyIG1lcmdl UGFyYWdyYXBoIGlzCisgICAgICAgIENhbGxlZCBhbmQgYmFpbCBvdXQgdG8gYXZvaWQgdXNpbmcg Y29ycnVwdGVkIHBvc2l0aW9ucyBmb3Igbm9kZSBpbnNlcnRpb24uCisKKyAgICAgICAgVGVzdDog ZWRpdGluZy9pbnNlcnRpbmcvaW5zZXJ0LXRleHQtbWVyZ2Utbm9kZS1yZW1vdmVkLWNyYXNoLmh0 bWwKKworICAgICAgICAqIGVkaXRpbmcvQ29tcG9zaXRlRWRpdENvbW1hbmQuY3BwOgorICAgICAg ICAoV2ViQ29yZTo6Q29tcG9zaXRlRWRpdENvbW1hbmQ6Om1vdmVQYXJhZ3JhcGhzKToKKyAgICAg ICAgKiBlZGl0aW5nL0RlbGV0ZVNlbGVjdGlvbkNvbW1hbmQuY3BwOgorICAgICAgICAoV2ViQ29y ZTo6RGVsZXRlU2VsZWN0aW9uQ29tbWFuZDo6bWVyZ2VQYXJhZ3JhcGhzKToKKwogMjAyMC0wNS0w OSAgRGFyaW4gQWRsZXIgIDxkYXJpbkBhcHBsZS5jb20+CiAKICAgICAgICAgQWRkIG1pc3Npbmcg bnVsbC1jaGVjayBvZiBwYWdlIGluIFJlc291cmNlTG9hZGVyOjpsb2FkRGF0YVVSTApkaWZmIC0t Z2l0IGEvU291cmNlL1dlYkNvcmUvZWRpdGluZy9Db21wb3NpdGVFZGl0Q29tbWFuZC5jcHAgYi9T b3VyY2UvV2ViQ29yZS9lZGl0aW5nL0NvbXBvc2l0ZUVkaXRDb21tYW5kLmNwcAppbmRleCBmMDhm NDAyYzRiMDIxOGMxNGQwYzZmZjQ5MmNmNjc3MDBkZThiMTc0Li45MGIyMWI4Y2ViMDhjYjA3Nzkz MDU0ZTU0MzVkMTZlNGFiY2FhNjI0IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9lZGl0aW5n L0NvbXBvc2l0ZUVkaXRDb21tYW5kLmNwcAorKysgYi9Tb3VyY2UvV2ViQ29yZS9lZGl0aW5nL0Nv bXBvc2l0ZUVkaXRDb21tYW5kLmNwcApAQCAtMTQ3Niw3ICsxNDc2LDEwIEBAIHZvaWQgQ29tcG9z aXRlRWRpdENvbW1hbmQ6Om1vdmVQYXJhZ3JhcGhzKGNvbnN0IFZpc2libGVQb3NpdGlvbiYgc3Rh cnRPZlBhcmFncmFwCiAKICAgICBBU1NFUlQoZGVzdGluYXRpb24uZGVlcEVxdWl2YWxlbnQoKS5h bmNob3JOb2RlKCktPmlzQ29ubmVjdGVkKCkpOwogICAgIGNsZWFudXBBZnRlckRlbGV0aW9uKGRl c3RpbmF0aW9uKTsKLSAgICBBU1NFUlQoZGVzdGluYXRpb24uZGVlcEVxdWl2YWxlbnQoKS5hbmNo b3JOb2RlKCktPmlzQ29ubmVjdGVkKCkpOworCisgICAgLy8gRklYTUUgKEJ1ZyAyMTE3OTMpOiBX ZSBzaG91bGQgcmVkZXNpZ24gY2xlYW51cEFmdGVyRGVsZXRpb24gb3IgZmluZCBhbm90aGVyIGRl c3RpbmF0aW9uIHdoZW4gaXQgaXMgcmVtb3ZlZC4KKyAgICBpZiAoIWRlc3RpbmF0aW9uLmRlZXBF cXVpdmFsZW50KCkuYW5jaG9yTm9kZSgpLT5pc0Nvbm5lY3RlZCgpKQorICAgICAgICByZXR1cm47 CiAKICAgICAvLyBBZGQgYSBiciBpZiBwcnVuaW5nIGFuIGVtcHR5IGJsb2NrIGxldmVsIGVsZW1l bnQgY2F1c2VkIGEgY29sbGFwc2UuIEZvciBleGFtcGxlOgogICAgIC8vIGZvb14KZGlmZiAtLWdp dCBhL1NvdXJjZS9XZWJDb3JlL2VkaXRpbmcvRGVsZXRlU2VsZWN0aW9uQ29tbWFuZC5jcHAgYi9T b3VyY2UvV2ViQ29yZS9lZGl0aW5nL0RlbGV0ZVNlbGVjdGlvbkNvbW1hbmQuY3BwCmluZGV4IGUy MGE4ZDhkYTZlNDhiMzk2YmE2NDhlOWFjMjQwODFjMTczMTc5MzUuLmI0YWU4YmU1NmM3MWRkMGJi ZjY3ZTAyNThiNjkzYTE0MDJkOGYwM2UgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL2VkaXRp bmcvRGVsZXRlU2VsZWN0aW9uQ29tbWFuZC5jcHAKKysrIGIvU291cmNlL1dlYkNvcmUvZWRpdGlu Zy9EZWxldGVTZWxlY3Rpb25Db21tYW5kLmNwcApAQCAtNzU0LDcgKzc1NCwxMCBAQCB2b2lkIERl bGV0ZVNlbGVjdGlvbkNvbW1hbmQ6Om1lcmdlUGFyYWdyYXBocygpCiAgICAgbW92ZVBhcmFncmFw aChzdGFydE9mUGFyYWdyYXBoVG9Nb3ZlLCBlbmRPZlBhcmFncmFwaFRvTW92ZSwgbWVyZ2VEZXN0 aW5hdGlvbiwgZmFsc2UsICFwYXJhZ3JhcGhUb01lcmdlSXNFbXB0eSk7CiAgICAgbV9uZWVkUGxh Y2Vob2xkZXIgPSBuZWVkUGxhY2Vob2xkZXI7CiAgICAgLy8gVGhlIGVuZGluZ1Bvc2l0aW9uIHdh cyBsaWtlbHkgY2xvYmJlcmVkIGJ5IHRoZSBtb3ZlLCBzbyByZWNvbXB1dGUgaXQgKG1vdmVQYXJh Z3JhcGggc2VsZWN0cyB0aGUgbW92ZWQgcGFyYWdyYXBoKS4KLSAgICBtX2VuZGluZ1Bvc2l0aW9u ID0gZW5kaW5nU2VsZWN0aW9uKCkuc3RhcnQoKTsKKworICAgIC8vIEZJWE1FIChCdWcgMjExNzkz KTogZW5kaW5nU2VsZWN0aW9uKCkgYmVjb21lcyBkaXNjb25uZWN0ZWQgaW4gbW92ZVBhcmFncmFw aAorICAgIGlmIChlbmRpbmdTZWxlY3Rpb24oKS5zdGFydCgpLmFuY2hvck5vZGUoKS0+aXNDb25u ZWN0ZWQoKSkKKyAgICAgICAgbV9lbmRpbmdQb3NpdGlvbiA9IGVuZGluZ1NlbGVjdGlvbigpLnN0 YXJ0KCk7CiB9CiAKIHZvaWQgRGVsZXRlU2VsZWN0aW9uQ29tbWFuZDo6cmVtb3ZlUHJldmlvdXNs eVNlbGVjdGVkRW1wdHlUYWJsZVJvd3MoKQpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvQ2hhbmdl TG9nIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCmluZGV4IDBhNWQ4YjYzNzY4Y2YzYmZlYzg3NDJk NTQ0Yjg4MGU0MmNkNDJhODYuLmZjNmViYTNjYzA0Y2MzMmQ4M2RkZmVlOTE1OTA1ZGE5M2E5N2Fm MmQgMTAwNjQ0Ci0tLSBhL0xheW91dFRlc3RzL0NoYW5nZUxvZworKysgYi9MYXlvdXRUZXN0cy9D aGFuZ2VMb2cKQEAgLTEsMyArMSwxNiBAQAorMjAyMC0wNS0xMiAgSmFjayBMZWUgIDxzaGloY2hp ZWhfbGVlQGFwcGxlLmNvbT4KKworICAgICAgICBOdWxscHRyIGNyYXNoIGluIERlbGV0ZVNlbGVj dGlvbkNvbW1hbmQ6OmRvQXBwbHkoKSB3aGVuIG1lcmdlIG5vZGUgaXMgZGlzY29ubmVjdGVkLgor ICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjExNzkzCisg ICAgICAgIDxyZGFyOi8vcHJvYmxlbS82Mjk5MzY0NT4KKworICAgICAgICBSZXZpZXdlZCBieSBO T0JPRFkgKE9PUFMhKS4KKworICAgICAgICBBZGRlZCBhIHJlZ3Jlc3Npb24gdGVzdCBmb3IgdGhl IGNyYXNoLgorCisgICAgICAgICogZWRpdGluZy9pbnNlcnRpbmcvaW5zZXJ0LXRleHQtbWVyZ2Ut bm9kZS1yZW1vdmVkLWNyYXNoLWV4cGVjdGVkLnR4dDogQWRkZWQuCisgICAgICAgICogZWRpdGlu Zy9pbnNlcnRpbmcvaW5zZXJ0LXRleHQtbWVyZ2Utbm9kZS1yZW1vdmVkLWNyYXNoLmh0bWw6IEFk ZGVkLgorCiAyMDIwLTA1LTA5ICBEaWVnbyBQaW5vIEdhcmNpYSAgPGRwaW5vQGlnYWxpYS5jb20+ CiAKICAgICAgICAgW0dUS10gR2FyZGVuaW5nLCB1cGRhdGUgdGVzdCBleHBlY3RhdGlvbnMKZGlm ZiAtLWdpdCBhL0xheW91dFRlc3RzL2VkaXRpbmcvaW5zZXJ0aW5nL2luc2VydC10ZXh0LW1lcmdl LW5vZGUtcmVtb3ZlZC1jcmFzaC1leHBlY3RlZC50eHQgYi9MYXlvdXRUZXN0cy9lZGl0aW5nL2lu c2VydGluZy9pbnNlcnQtdGV4dC1tZXJnZS1ub2RlLXJlbW92ZWQtY3Jhc2gtZXhwZWN0ZWQudHh0 Cm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAuLjFiZDlhYjE0Y2U0ZGVhNDYwY2UzM2IxMGM2ZGQ2MWE5Mzc5NDY3NjIKLS0t IC9kZXYvbnVsbAorKysgYi9MYXlvdXRUZXN0cy9lZGl0aW5nL2luc2VydGluZy9pbnNlcnQtdGV4 dC1tZXJnZS1ub2RlLXJlbW92ZWQtY3Jhc2gtZXhwZWN0ZWQudHh0CkBAIC0wLDAgKzEgQEAKK1Rl c3RzIGluc2VydGluZyB0ZXh0IHdoZW4gbWVyZ2Ugbm9kZSBpcyByZW1vdmVkLiBUaGUgdGVzdCBw YXNzZXMgaWYgV2ViS2l0IGRvZXNuJ3QgY3Jhc2ggb3IgaGl0IGFuIHNzZXJ0aW9uLgpkaWZmIC0t Z2l0IGEvTGF5b3V0VGVzdHMvZWRpdGluZy9pbnNlcnRpbmcvaW5zZXJ0LXRleHQtbWVyZ2Utbm9k ZS1yZW1vdmVkLWNyYXNoLmh0bWwgYi9MYXlvdXRUZXN0cy9lZGl0aW5nL2luc2VydGluZy9pbnNl cnQtdGV4dC1tZXJnZS1ub2RlLXJlbW92ZWQtY3Jhc2guaHRtbApuZXcgZmlsZSBtb2RlIDEwMDY0 NAppbmRleCAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwLi5jZTRmNzMw Mjc0ODE1MWEzNDAyMzk2OWE3YjgxY2NiYWViOWZkYjdkCi0tLSAvZGV2L251bGwKKysrIGIvTGF5 b3V0VGVzdHMvZWRpdGluZy9pbnNlcnRpbmcvaW5zZXJ0LXRleHQtbWVyZ2Utbm9kZS1yZW1vdmVk LWNyYXNoLmh0bWwKQEAgLTAsMCArMSw5IEBACis8Ym9keSBjb250ZW50RWRpdGFibGU9InRydWUi PjxvdXRwdXQ+PC9vdXRwdXQ+PGRhdGEgc3R5bGU9IndyaXRpbmctbW9kZTogdmVydGljYWwtbHI7 Ij48bWVudT48dGFibGU+PC90YWJsZT48L21lbnU+Cis8c2NyaXB0PgorICAgIGlmICh3aW5kb3cu dGVzdFJ1bm5lcikKKyAgICAgICAgdGVzdFJ1bm5lci5kdW1wQXNUZXh0KCk7CisKKyAgICBkb2N1 bWVudC5leGVjQ29tbWFuZCgic2VsZWN0QWxsIiwgZmFsc2UpOworICAgIGRvY3VtZW50LmV4ZWND b21tYW5kKCJpbnNlcnRUZXh0IiwgInRleHQiKTsKKyAgICBkb2N1bWVudC5ib2R5LmlubmVyVGV4 dCA9ICJUZXN0cyBpbnNlcnRpbmcgdGV4dCB3aGVuIG1lcmdlIG5vZGUgaXMgcmVtb3ZlZC4gVGhl IHRlc3QgcGFzc2VzIGlmIFdlYktpdCBkb2Vzbid0IGNyYXNoIG9yIGhpdCBhbiBzc2VydGlvbi4i OworPC9zY3JpcHQ+Cg==