<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>212116</bug_id>
          
          <creation_ts>2020-05-19 17:53:30 -0700</creation_ts>
          <short_desc>Nullptr deref in WebCore::RenderTreeBuilder::Block::attachIgnoringContinuation when parent and beforeChild are siblings</short_desc>
          <delta_ts>2020-05-22 21:03:25 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>Layout and Rendering</component>
          <version>WebKit Nightly Build</version>
          <rep_platform>All</rep_platform>
          <op_sys>All</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>InRadar</keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Jack">shihchieh_lee</reporter>
          <assigned_to name="alan">zalan</assigned_to>
          <cc>bfulgham</cc>
    
    <cc>changseok</cc>
    
    <cc>esprehn+autocc</cc>
    
    <cc>ews-feeder</cc>
    
    <cc>ews-watchlist</cc>
    
    <cc>ggaren</cc>
    
    <cc>glenn</cc>
    
    <cc>kondapallykalyan</cc>
    
    <cc>pdr</cc>
    
    <cc>product-security</cc>
    
    <cc>simon.fraser</cc>
    
    <cc>webkit-bug-importer</cc>
    
    <cc>zalan</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>1654265</commentid>
    <comment_count>0</comment_count>
    <who name="Jack">shihchieh_lee</who>
    <bug_when>2020-05-19 17:53:30 -0700</bug_when>
    <thetext>&lt;rdar://62993844&gt;

0   com.apple.WebCore             	0x0000000107af46f3 WebCore::RenderTreeBuilder::Block::attachIgnoringContinuation(WebCore::RenderBlock&amp;, std::__1::unique_ptr&lt;WebCore::RenderObject, WebCore::RenderObjectDeleter&gt;, WebCore::RenderObject*) + 51
1   com.apple.WebCore             	0x0000000107af3e15 WebCore::RenderTreeBuilder::Block::attach(WebCore::RenderBlock&amp;, std::__1::unique_ptr&lt;WebCore::RenderObject, WebCore::RenderObjectDeleter&gt;, WebCore::RenderObject*) + 421
2   com.apple.WebCore             	0x0000000107af3bfa WebCore::RenderTreeBuilder::BlockFlow::attach(WebCore::RenderBlockFlow&amp;, std::__1::unique_ptr&lt;WebCore::RenderObject, WebCore::RenderObjectDeleter&gt;, WebCore::RenderObject*) + 426
3   com.apple.WebCore             	0x0000000107af3836 WebCore::RenderTreeBuilder::attachInternal(WebCore::RenderElement&amp;, std::__1::unique_ptr&lt;WebCore::RenderObject, WebCore::RenderObjectDeleter&gt;, WebCore::RenderObject*) + 2278
4   com.apple.WebCore             	0x0000000107af3b89 WebCore::RenderTreeBuilder::BlockFlow::attach(WebCore::RenderBlockFlow&amp;, std::__1::unique_ptr&lt;WebCore::RenderObject, WebCore::RenderObjectDeleter&gt;, WebCore::RenderObject*) + 313
5   com.apple.WebCore             	0x0000000107af3836 WebCore::RenderTreeBuilder::attachInternal(WebCore::RenderElement&amp;, std::__1::unique_ptr&lt;WebCore::RenderObject, WebCore::RenderObjectDeleter&gt;, WebCore::RenderObject*) + 2278
6   com.apple.WebCore             	0x0000000107afe8bc WebCore::RenderTreeBuilder::MultiColumn::multiColumnDescendantInserted(WebCore::RenderMultiColumnFlow&amp;, WebCore::RenderObject&amp;) + 2476
7   com.apple.WebCore             	0x0000000107af6ae3 WebCore::RenderTreeBuilder::attachToRenderElementInternal(WebCore::RenderElement&amp;, std::__1::unique_ptr&lt;WebCore::RenderObject, WebCore::RenderObjectDeleter&gt;, WebCore::RenderObject*) + 355
8   com.apple.WebCore             	0x0000000107af4071 WebCore::RenderTreeBuilder::attachToRenderElement(WebCore::RenderElement&amp;, std::__1::unique_ptr&lt;WebCore::RenderObject, WebCore::RenderObjectDeleter&gt;, WebCore::RenderObject*) + 353
9   com.apple.WebCore             	0x0000000107af48df WebCore::RenderTreeBuilder::Block::attachIgnoringContinuation(WebCore::RenderBlock&amp;, std::__1::unique_ptr&lt;WebCore::RenderObject, WebCore::RenderObjectDeleter&gt;, WebCore::RenderObject*) + 543
10  com.apple.WebCore             	0x0000000107af3e15 WebCore::RenderTreeBuilder::Block::attach(WebCore::RenderBlock&amp;, std::__1::unique_ptr&lt;WebCore::RenderObject, WebCore::RenderObjectDeleter&gt;, WebCore::RenderObject*) + 421
11  com.apple.WebCore             	0x0000000107af3bfa WebCore::RenderTreeBuilder::BlockFlow::attach(WebCore::RenderBlockFlow&amp;, std::__1::unique_ptr&lt;WebCore::RenderObject, WebCore::RenderObjectDeleter&gt;, WebCore::RenderObject*) + 426
12  com.apple.WebCore             	0x0000000107af3836 WebCore::RenderTreeBuilder::attachInternal(WebCore::RenderElement&amp;, std::__1::unique_ptr&lt;WebCore::RenderObject, WebCore::RenderObjectDeleter&gt;, WebCore::RenderObject*) + 2278
13  com.apple.WebCore             	0x0000000107afba88 WebCore::RenderTreeBuilder::Inline::splitFlow(WebCore::RenderInline&amp;, WebCore::RenderObject*, std::__1::unique_ptr&lt;WebCore::RenderBlock, WebCore::RenderObjectDeleter&gt;, std::__1::unique_ptr&lt;WebCore::RenderObject, WebCore::RenderObjectDeleter&gt;, WebCore::RenderBoxModelObject*) + 2200
14  com.apple.WebCore             	0x0000000107af742e WebCore::RenderTreeBuilder::normalizeTreeAfterStyleChange(WebCore::RenderElement&amp;, WebCore::RenderStyle&amp;) + 1166
15  com.apple.WebCore             	0x0000000107b05754 WebCore::RenderTreeUpdater::updateRendererStyle(WebCore::RenderElement&amp;, WebCore::RenderStyle&amp;&amp;, WebCore::StyleDifference) + 164
16  com.apple.WebCore             	0x0000000107b0508d WebCore::RenderTreeUpdater::updateElementRenderer(WebCore::Element&amp;, WebCore::Style::ElementUpdate const&amp;) + 1293
17  com.apple.WebCore             	0x0000000107b03634 WebCore::RenderTreeUpdater::commit(std::__1::unique_ptr&lt;WebCore::Style::Update const, std::__1::default_delete&lt;WebCore::Style::Update const&gt; &gt;) + 2404
18  com.apple.WebCore             	0x00000001070fa635 WebCore::Document::resolveStyle(WebCore::Document::ResolveStyleType) + 1381
19  com.apple.WebCore             	0x0000000105dd9154 WebCore::Document::updateStyleIfNeeded() + 468
20  com.apple.WebCore             	0x0000000105e4fc68 WebCore::Document::updateLayout() + 360</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1654266</commentid>
    <comment_count>1</comment_count>
    <who name="Jack">shihchieh_lee</who>
    <bug_when>2020-05-19 17:55:14 -0700</bug_when>
    <thetext>Test case:
&lt;style&gt;
ol { position: fixed; }
ol, body { -webkit-columns: 2; }
&lt;/style&gt;
&lt;script&gt;
function run() {
    q.appendChild(ol);
    window.requestIdleCallback(idleCallback);
}
function idleCallback() {
    range = document.createElement(&quot;main&quot;).ownerDocument.createRange();
    range.setEndBefore(li);
    range.extractContents();
}
&lt;/script&gt;
&lt;body onload=run()&gt;&lt;ol id=ol&gt;&lt;li id=li style=&quot;border-top-width: medium; column-span: all;&quot;&gt;&lt;/ol&gt;&lt;q id=q&gt;&lt;/q&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1654276</commentid>
    <comment_count>2</comment_count>
    <who name="Jack">shihchieh_lee</who>
    <bug_when>2020-05-19 18:29:36 -0700</bug_when>
    <thetext>Minimized test case:

&lt;style&gt;
ol { position: fixed; }
ol, body { -webkit-columns: 2; }
&lt;/style&gt;
&lt;script&gt;
function run() {
    range = document.createElement(&quot;main&quot;).ownerDocument.createRange();
    range.setEndBefore(li);
    range.extractContents();
}

&lt;/script&gt;
&lt;body onload=run()&gt;&lt;q&gt;&lt;ol&gt;&lt;li id=li style=&quot;column-span: all;&quot;&gt;&lt;/ol&gt;&lt;/q&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1654282</commentid>
    <comment_count>3</comment_count>
    <who name="Jack">shihchieh_lee</who>
    <bug_when>2020-05-19 18:56:58 -0700</bug_when>
    <thetext>Cause of the crash:
1. After the document is loaded, updateStyleIfNeeded is called and render tree is being updated.
2. When walking through the nodes in updateRenderTree(), we find that OL is not inline and needs to be splitter and be attached to a RenderBlock.
3. In RenderTreeBuilder::BlockFlow::attach() we find that OL has multiColumnFlow, so we call RenderTreeBuilder::Block::attachIgnoringContinuation() and pass the RenderMultiColumnFlowThread in OL as parent and RenderMultiColumnSet as before child.
4. In Block::attachIgnoringContinuation(), we try to find the immediate child of parent by looking at ancestors of RenderMultiColumnSet. 
5. However, since RenderMultiColumnFlowThread and RenderMultiColumnSet are siblings, the logic exhausts the render tree and deref nullptr.

Step 2:
childBecameNonInline: parent=0x542fe00b0, child=0x542fe0400, beforeChild=0x542fe0c30

(B)lock/(I)nline/I(N)line-block, (A)bsolute/Fi(X)ed/(R)elative/Stic(K)y, (F)loating, (O)verflow clip, Anon(Y)mous, (G)enerated, has(L)ayer, (C)omposited, (+)Dirty style, (+)Dirty layout
B---YGLC -+  RenderView at (0,0) size 0x0 renderer-&gt;(0x542f5d210) layout-&gt;[normal child][positioned child]
B-----L- -+    HTML RenderBlock at (0,0) size 0x0 renderer-&gt;(0x542f5d6c0) node-&gt;(0x542f5f800) layout-&gt;[self][normal child]
B------- -+      BODY RenderBody at (0,0) size 0x0 renderer-&gt;(0x542f5d7f0) node-&gt;(0x542f5fc30) layout-&gt;[self][normal child]
B---YGL- -+        RenderMultiColumnFlowThread at (0,0) size 0x0 renderer-&gt;(0x542fe0f20) [Rs:0x0 Re:0x0] layout-&gt;[self][normal child]
I------- -+*         Q RenderInline renderer-&gt;(0x542fe00b0) node-&gt;(0x542f5fcc0) continuation-&gt;(0x542fe1610) layout-&gt;[self][normal child]
I----G-- -+            &lt;pseudo&gt; RenderInline renderer-&gt;(0x542fe0190) node-&gt;(0x542f5fee0) layout-&gt;[self][normal child]
I---YG-- -+              RenderQuote renderer-&gt;(0x542fe0270) layout-&gt;[self][normal child]
I---YG-- -+                RenderText renderer-&gt;(0x542fe0360) layout-&gt;[self]
B------- -+            OL RenderBlock at (0,0) size 0x0 renderer-&gt;(0x542fe0400) node-&gt;(0x542f5fd50) [Rs:0x0 Re:0x0] layout-&gt;[self][normal child]
B---YGL- -+              RenderMultiColumnFlowThread at (0,0) size 0x0 renderer-&gt;(0x542fe0790) [Rs:0x0 Re:0x0] layout-&gt;[self][normal child]
B---YG-- -+                RenderMultiColumnSpannerPlaceholder at (0,0) size 0x0 renderer-&gt;(0x542fe0980) [Rs:0x0 Re:0x0] layout-&gt;[self]
B------- -+              LI RenderListItem at (0,0) size 0x0 renderer-&gt;(0x542fe0530) node-&gt;(0x542f5fdf0) [Rs:0x0 Re:0x0] layout-&gt;[self][normal child]
I---YG-- -+                RenderListMarker at (0,0) size 0x0 renderer-&gt;(0x542fe0670) layout-&gt;[self]
B---YG-- -+              RenderMultiColumnSet at (0,0) size 0x0 renderer-&gt;(0x542fe0a90) [Rs:0x0 Re:0x0] layout-&gt;[self]
I----G-- -+            &lt;pseudo&gt; RenderInline renderer-&gt;(0x542fe0c30) node-&gt;(0x542fe0010) layout-&gt;[self][normal child]
I---YG-- -+              RenderQuote renderer-&gt;(0x542fe0d10) layout-&gt;[self][normal child]
I---YG-- -+                RenderText renderer-&gt;(0x542fe0e00) layout-&gt;[self]
I------- -+          #text RenderText renderer-&gt;(0x542fe0ea0) node-&gt;(0x542f5fe80) length-&gt;(1) &quot;\n&quot; layout-&gt;[self]
B---YG-- -+        RenderMultiColumnSet at (0,0) size 0x0 renderer-&gt;(0x542fe1110) layout-&gt;[self]

Step 3:
BlockFlow::attach: parent=0x542fe0400, child=0x542fe1a80, beforeChild=0x542fe0a90

(B)lock/(I)nline/I(N)line-block, (A)bsolute/Fi(X)ed/(R)elative/Stic(K)y, (F)loating, (O)verflow clip, Anon(Y)mous, (G)enerated, has(L)ayer, (C)omposited, (+)Dirty style, (+)Dirty layout
B---YGLC -+  RenderView at (0,0) size 0x0 renderer-&gt;(0x542f5d210) layout-&gt;[normal child][positioned child]
B-----L- -+    HTML RenderBlock at (0,0) size 0x0 renderer-&gt;(0x542f5d6c0) node-&gt;(0x542f5f800) layout-&gt;[self][normal child]
B------- -+      BODY RenderBody at (0,0) size 0x0 renderer-&gt;(0x542f5d7f0) node-&gt;(0x542f5fc30) layout-&gt;[self][normal child]
B---YGL- -+        RenderMultiColumnFlowThread at (0,0) size 0x0 renderer-&gt;(0x542fe0f20) [Rs:0x0 Re:0x0] layout-&gt;[self][normal child]
B---YG-- -+          RenderBlock at (0,0) size 0x0 renderer-&gt;(0x542fe1740) [Rs:0x0 Re:0x0] layout-&gt;[self][normal child]
I------- -+            Q RenderInline renderer-&gt;(0x542fe00b0) node-&gt;(0x542f5fcc0) continuation-&gt;(0x542fe1610) layout-&gt;[self][normal child]
I----G-- -+              &lt;pseudo&gt; RenderInline renderer-&gt;(0x542fe0190) node-&gt;(0x542f5fee0) layout-&gt;[self][normal child]
I---YG-- -+                RenderQuote renderer-&gt;(0x542fe0270) layout-&gt;[self][normal child]
I---YG-- -+                  RenderText renderer-&gt;(0x542fe0360) layout-&gt;[self]
B---YG-- -+          RenderBlock at (0,0) size 0x0 renderer-&gt;(0x542fe1610) continuation-&gt;(0x542fe19a0) [Rs:0x0 Re:0x0] layout-&gt;[self]
B------- -+            OL RenderBlock at (0,0) size 0x0 renderer-&gt;(0x542fe0400) node-&gt;(0x542f5fd50) [Rs:0x0 Re:0x0] layout-&gt;[self][normal child]
B---YGL- -+              RenderMultiColumnFlowThread at (0,0) size 0x0 renderer-&gt;(0x542fe0790) [Rs:0x0 Re:0x0] layout-&gt;[self][normal child]
B---YG-- -+                RenderMultiColumnSpannerPlaceholder at (0,0) size 0x0 renderer-&gt;(0x542fe0980) [Rs:0x0 Re:0x0] layout-&gt;[self]
B------- -+              LI RenderListItem at (0,0) size 0x0 renderer-&gt;(0x542fe0530) node-&gt;(0x542f5fdf0) [Rs:0x0 Re:0x0] layout-&gt;[self][normal child]
I---YG-- -+                RenderListMarker at (0,0) size 0x0 renderer-&gt;(0x542fe0670) [Rs:0x0 Re:0x0] layout-&gt;[self]
B---YG-- -+*             RenderMultiColumnSet at (0,0) size 0x0 renderer-&gt;(0x542fe0a90) [Rs:0x0 Re:0x0] layout-&gt;[self]
B---YG-- -+          RenderBlock at (0,0) size 0x0 renderer-&gt;(0x542fe1870) [Rs:0x0 Re:0x0] layout-&gt;[self][normal child]
I------- -+            Q RenderInline renderer-&gt;(0x542fe19a0) node-&gt;(0x542f5fcc0) layout-&gt;[self][normal child]
I----G-- -+              &lt;pseudo&gt; RenderInline renderer-&gt;(0x542fe0c30) node-&gt;(0x542fe0010) layout-&gt;[self][normal child]
I---YG-- -+                RenderQuote renderer-&gt;(0x542fe0d10) layout-&gt;[self][normal child]
I---YG-- -+                  RenderText renderer-&gt;(0x542fe0e00) layout-&gt;[self]
I------- -+            #text RenderText renderer-&gt;(0x542fe0ea0) node-&gt;(0x542f5fe80) length-&gt;(1) &quot;\n&quot; layout-&gt;[self]
B---YG-- -+        RenderMultiColumnSet at (0,0) size 0x0 renderer-&gt;(0x542fe1110) layout-&gt;[self]

Step 4:
beforeChildContainer = 0x0, parent = 0x542fe0790, beforeChild = 0x542fe0a90

(B)lock/(I)nline/I(N)line-block, (A)bsolute/Fi(X)ed/(R)elative/Stic(K)y, (F)loating, (O)verflow clip, Anon(Y)mous, (G)enerated, has(L)ayer, (C)omposited, (+)Dirty style, (+)Dirty layout
B---YGLC -+  RenderView at (0,0) size 0x0 renderer-&gt;(0x542f5d210) layout-&gt;[normal child][positioned child]
B-----L- -+    HTML RenderBlock at (0,0) size 0x0 renderer-&gt;(0x542f5d6c0) node-&gt;(0x542f5f800) layout-&gt;[self][normal child]
B------- -+      BODY RenderBody at (0,0) size 0x0 renderer-&gt;(0x542f5d7f0) node-&gt;(0x542f5fc30) layout-&gt;[self][normal child]
B---YGL- -+        RenderMultiColumnFlowThread at (0,0) size 0x0 renderer-&gt;(0x542fe0f20) [Rs:0x0 Re:0x0] layout-&gt;[self][normal child]
B---YG-- -+          RenderBlock at (0,0) size 0x0 renderer-&gt;(0x542fe1740) [Rs:0x0 Re:0x0] layout-&gt;[self][normal child]
I------- -+            Q RenderInline renderer-&gt;(0x542fe00b0) node-&gt;(0x542f5fcc0) continuation-&gt;(0x542fe1610) layout-&gt;[self][normal child]
I----G-- -+              &lt;pseudo&gt; RenderInline renderer-&gt;(0x542fe0190) node-&gt;(0x542f5fee0) layout-&gt;[self][normal child]
I---YG-- -+                RenderQuote renderer-&gt;(0x542fe0270) layout-&gt;[self][normal child]
I---YG-- -+                  RenderText renderer-&gt;(0x542fe0360) layout-&gt;[self]
B---YG-- -+          RenderBlock at (0,0) size 0x0 renderer-&gt;(0x542fe1610) continuation-&gt;(0x542fe19a0) [Rs:0x0 Re:0x0] layout-&gt;[self]
B------- -+            OL RenderBlock at (0,0) size 0x0 renderer-&gt;(0x542fe0400) node-&gt;(0x542f5fd50) [Rs:0x0 Re:0x0] layout-&gt;[self][normal child]
B---YGL- -+              RenderMultiColumnFlowThread at (0,0) size 0x0 renderer-&gt;(0x542fe0790) [Rs:0x0 Re:0x0] layout-&gt;[self][normal child]
B---YG-- -+                RenderMultiColumnSpannerPlaceholder at (0,0) size 0x0 renderer-&gt;(0x542fe0980) [Rs:0x0 Re:0x0] layout-&gt;[self]
B------- -+              LI RenderListItem at (0,0) size 0x0 renderer-&gt;(0x542fe0530) node-&gt;(0x542f5fdf0) [Rs:0x0 Re:0x0] layout-&gt;[self][normal child]
I---YG-- -+                RenderListMarker at (0,0) size 0x0 renderer-&gt;(0x542fe0670) [Rs:0x0 Re:0x0] layout-&gt;[self]
B---YG-- -+*             RenderMultiColumnSet at (0,0) size 0x0 renderer-&gt;(0x542fe0a90) [Rs:0x0 Re:0x0] layout-&gt;[self]
B---YG-- -+          RenderBlock at (0,0) size 0x0 renderer-&gt;(0x542fe1870) [Rs:0x0 Re:0x0] layout-&gt;[self][normal child]
I------- -+            Q RenderInline renderer-&gt;(0x542fe19a0) node-&gt;(0x542f5fcc0) layout-&gt;[self][normal child]
I----G-- -+              &lt;pseudo&gt; RenderInline renderer-&gt;(0x542fe0c30) node-&gt;(0x542fe0010) layout-&gt;[self][normal child]
I---YG-- -+                RenderQuote renderer-&gt;(0x542fe0d10) layout-&gt;[self][normal child]
I---YG-- -+                  RenderText renderer-&gt;(0x542fe0e00) layout-&gt;[self]
I------- -+            #text RenderText renderer-&gt;(0x542fe0ea0) node-&gt;(0x542f5fe80) length-&gt;(1) &quot;\n&quot; layout-&gt;[self]
B---YG-- -+        RenderMultiColumnSet at (0,0) size 0x0 renderer-&gt;(0x542fe1110) layout-&gt;[self]</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1654304</commentid>
    <comment_count>4</comment_count>
      <attachid>399802</attachid>
    <who name="Jack">shihchieh_lee</who>
    <bug_when>2020-05-19 20:45:34 -0700</bug_when>
    <thetext>Created attachment 399802
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1654305</commentid>
    <comment_count>5</comment_count>
    <who name="Jack">shihchieh_lee</who>
    <bug_when>2020-05-19 20:52:33 -0700</bug_when>
    <thetext>The patch is for discussion. In this patch, beforeChild is set to nullptr before calling m_builder.attach to avoid passing siblings as parent and beforeChild.

However, doing so triggers the assertion below:

ASSERTION FAILED: !flow.spannerMap().get(placeholder.spanner())
./rendering/updating/RenderTreeBuilderMultiColumn.cpp(270) : void WebCore::RenderTreeBuilder::MultiColumn::multiColumnDescendantInserted(WebCore::RenderMultiColumnFlow &amp;, WebCore::RenderObject &amp;)

If the code returns without calling m_builder.attach, there is no assertion or crash.

(In reply to Jack from comment #4)
&gt; Created attachment 399802 [details]
&gt; Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1654314</commentid>
    <comment_count>6</comment_count>
      <attachid>399802</attachid>
    <who name="Geoffrey Garen">ggaren</who>
    <bug_when>2020-05-19 21:13:30 -0700</bug_when>
    <thetext>Comment on attachment 399802
Patch

Looks like EWS tests are crashing.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1654324</commentid>
    <comment_count>7</comment_count>
      <attachid>399802</attachid>
    <who name="alan">zalan</who>
    <bug_when>2020-05-19 21:53:15 -0700</bug_when>
    <thetext>Comment on attachment 399802
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=399802&amp;action=review

&gt; Source/WebCore/rendering/updating/RenderTreeBuilderBlockFlow.cpp:47
&gt; +        if (beforeChild-&gt;parent() == &amp;parent)
&gt; +            beforeChild = nullptr;

This clearly needs some explanation. In many cases (probably the most common) the beforeChild&apos;s parent is the host for the insertion point.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1654461</commentid>
    <comment_count>8</comment_count>
    <who name="Jack">shihchieh_lee</who>
    <bug_when>2020-05-20 08:56:07 -0700</bug_when>
    <thetext>Thanks. Yeah, this patch is to demonstrate the test case. Please see the complete render tree dump in comment #3.

In this case we are passing parent.multiColumnFlow() and beforeChild to m_builder.attach.
    if (parent.multiColumnFlow() &amp;&amp; (!parent.isFieldset() || !child-&gt;isLegend())) {
        ...

        return m_builder.attach(*parent.multiColumnFlow(), WTFMove(child), beforeChild);
    }

And the render tree show that parent.multiColumnFlow() and beforeChild are siblings.
BlockFlow::attach: parent=0x542fe0400, child=0x542fe1a80, beforeChild=0x542fe0a90
B------- -+            OL RenderBlock at (0,0) size 0x0 renderer-&gt;(0x542fe0400) node-&gt;(0x542f5fd50) [Rs:0x0 Re:0x0] layout-&gt;[self][normal child]
B---YGL- -+              RenderMultiColumnFlowThread at (0,0) size 0x0 renderer-&gt;(0x542fe0790) [Rs:0x0 Re:0x0] layout-&gt;[self][normal child]
B---YG-- -+                RenderMultiColumnSpannerPlaceholder at (0,0) size 0x0 renderer-&gt;(0x542fe0980) [Rs:0x0 Re:0x0] layout-&gt;[self]
B------- -+              LI RenderListItem at (0,0) size 0x0 renderer-&gt;(0x542fe0530) node-&gt;(0x542f5fdf0) [Rs:0x0 Re:0x0] layout-&gt;[self][normal child]
I---YG-- -+                RenderListMarker at (0,0) size 0x0 renderer-&gt;(0x542fe0670) [Rs:0x0 Re:0x0] layout-&gt;[self]
B---YG-- -+*             RenderMultiColumnSet at (0,0) size 0x0 renderer-&gt;(0x542fe0a90) [Rs:0x0 Re:0x0] layout-&gt;[self]

And when the code enters RenderTreeBuilder::Block::attachIgnoringContinuation(), the following while loop will exhaust the ancestors and crashes when beforeChildContainer becomes nullptr.
    if (beforeChild &amp;&amp; beforeChild-&gt;parent() != &amp;parent) {
        RenderElement* beforeChildContainer = beforeChild-&gt;parent();
        while (beforeChildContainer-&gt;parent() != &amp;parent)
            beforeChildContainer = beforeChildContainer-&gt;parent();



(In reply to zalan from comment #7)
&gt; Comment on attachment 399802 [details]
&gt; Patch
&gt; 
&gt; View in context:
&gt; https://bugs.webkit.org/attachment.cgi?id=399802&amp;action=review
&gt; 
&gt; &gt; Source/WebCore/rendering/updating/RenderTreeBuilderBlockFlow.cpp:47
&gt; &gt; +        if (beforeChild-&gt;parent() == &amp;parent)
&gt; &gt; +            beforeChild = nullptr;
&gt; 
&gt; This clearly needs some explanation. In many cases (probably the most
&gt; common) the beforeChild&apos;s parent is the host for the insertion point.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1654474</commentid>
    <comment_count>9</comment_count>
    <who name="Jack">shihchieh_lee</who>
    <bug_when>2020-05-20 09:17:44 -0700</bug_when>
    <thetext>Besides, I was wondering if RenderTreeBuilder::attachInternal should move beforeChild to the RenderMultiColumnSpannerPlaceholder since it is the child of RenderMultiColumnFlowThread?
B------- -+            OL RenderBlock at (0,0) size 0x0 renderer-&gt;(0x542fe0400) node-&gt;(0x542f5fd50) [Rs:0x0 Re:0x0] layout-&gt;[self][normal child]
B---YGL- -+              RenderMultiColumnFlowThread at (0,0) size 0x0 renderer-&gt;(0x542fe0790) [Rs:0x0 Re:0x0] layout-&gt;[self][normal child]
B---YG-- -+                RenderMultiColumnSpannerPlaceholder at (0,0) size 0x0 renderer-&gt;(0x542fe0980) [Rs:0x0 Re:0x0] layout-&gt;[self]
B------- -+              LI RenderListItem at (0,0) size 0x0 renderer-&gt;(0x542fe0530) node-&gt;(0x542f5fdf0) [Rs:0x0 Re:0x0] layout-&gt;[self][normal child]
I---YG-- -+                RenderListMarker at (0,0) size 0x0 renderer-&gt;(0x542fe0670) [Rs:0x0 Re:0x0] layout-&gt;[self]
B---YG-- -+*             RenderMultiColumnSet at (0,0) size 0x0 renderer-&gt;(0x542fe0a90) [Rs:0x0 Re:0x0] layout-&gt;[self]

However, in the following code, findColumnSpannerPlaceholder cannot find the spanner in the spannerMap so return nullptr, therefore beforeChild is not moved to spannerPlaceholder.

    } else if (is&lt;RenderBox&gt;(beforeChild)) {
        // Adjust the beforeChild if it happens to be a spanner and the its actual location is inside the fragmented flow.
        auto&amp; beforeChildBox = downcast&lt;RenderBox&gt;(*beforeChild);
        if (auto* enclosingFragmentedFlow = parent.enclosingFragmentedFlow()) {
            auto columnSpannerPlaceholderForBeforeChild = [&amp;]() -&gt; RenderMultiColumnSpannerPlaceholder* {
                if (!is&lt;RenderMultiColumnFlow&gt;(enclosingFragmentedFlow))
                    return nullptr;
                auto&amp; multiColumnFlow = downcast&lt;RenderMultiColumnFlow&gt;(*enclosingFragmentedFlow);
                return multiColumnFlow.findColumnSpannerPlaceholder(&amp;beforeChildBox);
            };

            if (auto* spannerPlaceholder = columnSpannerPlaceholderForBeforeChild())
                beforeChild = spannerPlaceholder;
        }
    }</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1654482</commentid>
    <comment_count>10</comment_count>
    <who name="Jack">shihchieh_lee</who>
    <bug_when>2020-05-20 09:38:42 -0700</bug_when>
    <thetext>It seems there is something wrong when we pass siblings as parent and beforeChild into RenderTreeBuilder::Block::attachIgnoringContinuation since it assumes that parent needs to be an ancestor of beforeChild, otherwise many places in that function would assert or crash.

Does this seem like a case that we need to support, or just a corner case that a patch is enough? The simplest patch is to bail out in attachIgnoringContinuation when the while loop exhaust ancestors.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1654492</commentid>
    <comment_count>11</comment_count>
      <attachid>399848</attachid>
    <who name="Jack">shihchieh_lee</who>
    <bug_when>2020-05-20 09:55:36 -0700</bug_when>
    <thetext>Created attachment 399848
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1655435</commentid>
    <comment_count>12</comment_count>
      <attachid>399848</attachid>
    <who name="alan">zalan</who>
    <bug_when>2020-05-22 14:19:42 -0700</bug_when>
    <thetext>Comment on attachment 399848
Patch

This is papering over the real issue (not clearing the inner fragmented context when the column style gets unset).</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1655436</commentid>
    <comment_count>13</comment_count>
      <attachid>400075</attachid>
    <who name="alan">zalan</who>
    <bug_when>2020-05-22 14:20:27 -0700</bug_when>
    <thetext>Created attachment 400075
Test reduction</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1655497</commentid>
    <comment_count>14</comment_count>
    <who name="alan">zalan</who>
    <bug_when>2020-05-22 16:48:16 -0700</bug_when>
    <thetext>&lt;rdar://problem/62993844&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1655529</commentid>
    <comment_count>15</comment_count>
      <attachid>400095</attachid>
    <who name="alan">zalan</who>
    <bug_when>2020-05-22 17:25:13 -0700</bug_when>
    <thetext>Created attachment 400095
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1655551</commentid>
    <comment_count>16</comment_count>
      <attachid>400095</attachid>
    <who name="Simon Fraser (smfr)">simon.fraser</who>
    <bug_when>2020-05-22 18:42:02 -0700</bug_when>
    <thetext>Comment on attachment 400095
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=400095&amp;action=review

&gt; LayoutTests/fast/multicol/nested-multicol-with-spanner-and-continuation.html:3
&gt; +    -webkit-columns: 2;

Is the prefix required?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1655556</commentid>
    <comment_count>17</comment_count>
    <who name="alan">zalan</who>
    <bug_when>2020-05-22 19:07:05 -0700</bug_when>
    <thetext>(In reply to Simon Fraser (smfr) from comment #16)
&gt; Comment on attachment 400095 [details]
&gt; Patch
&gt; 
&gt; View in context:
&gt; https://bugs.webkit.org/attachment.cgi?id=400095&amp;action=review
&gt; 
&gt; &gt; LayoutTests/fast/multicol/nested-multicol-with-spanner-and-continuation.html:3
&gt; &gt; +    -webkit-columns: 2;
&gt; 
&gt; Is the prefix required?
Yeah, certainly not Thanks.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1655567</commentid>
    <comment_count>18</comment_count>
      <attachid>400105</attachid>
    <who name="alan">zalan</who>
    <bug_when>2020-05-22 20:30:54 -0700</bug_when>
    <thetext>Created attachment 400105
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1655570</commentid>
    <comment_count>19</comment_count>
    <who name="EWS">ews-feeder</who>
    <bug_when>2020-05-22 21:03:24 -0700</bug_when>
    <thetext>Committed r262093: &lt;https://trac.webkit.org/changeset/262093&gt;

All reviewed patches have been landed. Closing bug and clearing flags on attachment 400105.</thetext>
  </long_desc>
      
          <attachment
              isobsolete="1"
              ispatch="1"
              isprivate="0"
          >
            <attachid>399802</attachid>
            <date>2020-05-19 20:45:34 -0700</date>
            <delta_ts>2020-05-20 09:55:33 -0700</delta_ts>
            <desc>Patch</desc>
            <filename>bug-212116-20200519204533.patch</filename>
            <type>text/plain</type>
            <size>1710</size>
            <attacher name="Jack">shihchieh_lee</attacher>
            
              <data encoding="base64">U3VidmVyc2lvbiBSZXZpc2lvbjogMjYxNzA2CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D
aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggNWZhN2FhZjUwNDUxYWUx
OTYxMWQxNTRhNDFmOGNiMWI2NWVhODkzMy4uYzM0YTFkYWE2ZTgzOWY0ODQ2ODRlMmRmNDhiN2Mx
YjA2ZmM2ZTliZSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv
dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE1IEBACisyMDIwLTA1LTE5ICBKYWNr
IExlZSAgPHNoaWhjaGllaF9sZWVAYXBwbGUuY29tPgorCisgICAgICAgIE51bGxwdHIgZGVyZWYg
aW4gV2ViQ29yZTo6UmVuZGVyVHJlZUJ1aWxkZXI6OkJsb2NrOjphdHRhY2hJZ25vcmluZ0NvbnRp
bnVhdGlvbiB3aGVuIHBhcmVudCBhbmQgYmVmb3JlQ2hpbGQgYXJlIHNpYmxpbmdzCisgICAgICAg
IGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0yMTIxMTYKKworICAgICAg
ICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBObyBuZXcgdGVzdHMgKE9P
UFMhKS4KKworICAgICAgICAqIHJlbmRlcmluZy91cGRhdGluZy9SZW5kZXJUcmVlQnVpbGRlckJs
b2NrRmxvdy5jcHA6CisgICAgICAgIChXZWJDb3JlOjpSZW5kZXJUcmVlQnVpbGRlcjo6QmxvY2tG
bG93OjphdHRhY2gpOgorCiAyMDIwLTA1LTE0ICBBbmRyZXMgR29uemFsZXogIDxhbmRyZXNnXzIy
QGFwcGxlLmNvbT4KIAogICAgICAgICBBWENvcmVPYmplY3QgZm9udCBjb21wYXJpc29uIG1ldGhv
ZHMgc2hvdWxkIHRha2UgYW5vdGhlciBBWENvcmVPYmplY3QgaW5zdGVhZCBvZiBhIFJlbmRlck9i
amVjdC4KZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL3JlbmRlcmluZy91cGRhdGluZy9SZW5k
ZXJUcmVlQnVpbGRlckJsb2NrRmxvdy5jcHAgYi9Tb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvdXBk
YXRpbmcvUmVuZGVyVHJlZUJ1aWxkZXJCbG9ja0Zsb3cuY3BwCmluZGV4IGE2MTUxZTVjMDI0Nzli
NjZkNmMxMDRmOThjZjJlNjI2OTRkY2YyODcuLjQzYzBhM2EyNWNjZWUyNjk5MGQxZmE5OTc1NmYw
OGVkMDA4YzliMzIgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL3JlbmRlcmluZy91cGRhdGlu
Zy9SZW5kZXJUcmVlQnVpbGRlckJsb2NrRmxvdy5jcHAKKysrIGIvU291cmNlL1dlYkNvcmUvcmVu
ZGVyaW5nL3VwZGF0aW5nL1JlbmRlclRyZWVCdWlsZGVyQmxvY2tGbG93LmNwcApAQCAtNDMsNiAr
NDMsOSBAQCB2b2lkIFJlbmRlclRyZWVCdWlsZGVyOjpCbG9ja0Zsb3c6OmF0dGFjaChSZW5kZXJC
bG9ja0Zsb3cmIHBhcmVudCwgUmVuZGVyUHRyPFJlbgogICAgICAgICBpZiAocGFyZW50LmlzRmll
bGRzZXQoKSAmJiBiZWZvcmVDaGlsZCAmJiBiZWZvcmVDaGlsZC0+aXNMZWdlbmQoKSkKICAgICAg
ICAgICAgIHJldHVybiBtX2J1aWxkZXIuYmxvY2tCdWlsZGVyKCkuYXR0YWNoKCpwYXJlbnQubXVs
dGlDb2x1bW5GbG93KCksIFdURk1vdmUoY2hpbGQpLCBudWxscHRyKTsKIAorICAgICAgICBpZiAo
YmVmb3JlQ2hpbGQtPnBhcmVudCgpID09ICZwYXJlbnQpCisgICAgICAgICAgICBiZWZvcmVDaGls
ZCA9IG51bGxwdHI7CisKICAgICAgICAgcmV0dXJuIG1fYnVpbGRlci5hdHRhY2goKnBhcmVudC5t
dWx0aUNvbHVtbkZsb3coKSwgV1RGTW92ZShjaGlsZCksIGJlZm9yZUNoaWxkKTsKICAgICB9CiAK
</data>

          </attachment>
          <attachment
              isobsolete="1"
              ispatch="1"
              isprivate="0"
          >
            <attachid>399848</attachid>
            <date>2020-05-20 09:55:36 -0700</date>
            <delta_ts>2020-05-22 16:48:23 -0700</delta_ts>
            <desc>Patch</desc>
            <filename>bug-212116-20200520095535.patch</filename>
            <type>text/plain</type>
            <size>1777</size>
            <attacher name="Jack">shihchieh_lee</attacher>
            
              <data encoding="base64">U3VidmVyc2lvbiBSZXZpc2lvbjogMjYxNzc5CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D
aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggZDBmNmMyMTJiZDY4ZTc4
MTE0YWEyODE2NzAxMGE0NDQyNjAzYWYzOS4uMTM5OWVlNDk5MTU5ZmVkMTA4YzRlMTdhM2QxOWU4
NGY3MTU1N2I3ZCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv
dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE1IEBACisyMDIwLTA1LTIwICBKYWNr
IExlZSAgPHNoaWhjaGllaF9sZWVAYXBwbGUuY29tPgorCisgICAgICAgIE51bGxwdHIgZGVyZWYg
aW4gV2ViQ29yZTo6UmVuZGVyVHJlZUJ1aWxkZXI6OkJsb2NrOjphdHRhY2hJZ25vcmluZ0NvbnRp
bnVhdGlvbiB3aGVuIHBhcmVudCBhbmQgYmVmb3JlQ2hpbGQgYXJlIHNpYmxpbmdzCisgICAgICAg
IGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0yMTIxMTYKKworICAgICAg
ICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBObyBuZXcgdGVzdHMgKE9P
UFMhKS4KKworICAgICAgICAqIHJlbmRlcmluZy91cGRhdGluZy9SZW5kZXJUcmVlQnVpbGRlckJs
b2NrLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OlJlbmRlclRyZWVCdWlsZGVyOjpCbG9jazo6YXR0
YWNoSWdub3JpbmdDb250aW51YXRpb24pOgorCiAyMDIwLTA1LTE1ICBBbnR0aSBLb2l2aXN0byAg
PGFudHRpQGFwcGxlLmNvbT4KIAogICAgICAgICBOdWxscHRyIGNyYXNoIGluIE1lZGlhUXVlcnlN
YXRjaGVyOjpldmFsdWF0ZUFsbApkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvcmVuZGVyaW5n
L3VwZGF0aW5nL1JlbmRlclRyZWVCdWlsZGVyQmxvY2suY3BwIGIvU291cmNlL1dlYkNvcmUvcmVu
ZGVyaW5nL3VwZGF0aW5nL1JlbmRlclRyZWVCdWlsZGVyQmxvY2suY3BwCmluZGV4IDJlMmM4MmEy
MzliZmQ3YjA3MGJmZmQ1NDY5MGRjOTgwODk3NGVhM2QuLmRmODEyZTc4NmRkZDJkOTE0NWY1OGMx
OTZjYTFmZWY3NjUyMWM2ZTYgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL3JlbmRlcmluZy91
cGRhdGluZy9SZW5kZXJUcmVlQnVpbGRlckJsb2NrLmNwcAorKysgYi9Tb3VyY2UvV2ViQ29yZS9y
ZW5kZXJpbmcvdXBkYXRpbmcvUmVuZGVyVHJlZUJ1aWxkZXJCbG9jay5jcHAKQEAgLTE2MSw4ICsx
NjEsMTEgQEAgdm9pZCBSZW5kZXJUcmVlQnVpbGRlcjo6QmxvY2s6OmF0dGFjaElnbm9yaW5nQ29u
dGludWF0aW9uKFJlbmRlckJsb2NrJiBwYXJlbnQsIFIKIHsKICAgICBpZiAoYmVmb3JlQ2hpbGQg
JiYgYmVmb3JlQ2hpbGQtPnBhcmVudCgpICE9ICZwYXJlbnQpIHsKICAgICAgICAgUmVuZGVyRWxl
bWVudCogYmVmb3JlQ2hpbGRDb250YWluZXIgPSBiZWZvcmVDaGlsZC0+cGFyZW50KCk7Ci0gICAg
ICAgIHdoaWxlIChiZWZvcmVDaGlsZENvbnRhaW5lci0+cGFyZW50KCkgIT0gJnBhcmVudCkKKyAg
ICAgICAgd2hpbGUgKGJlZm9yZUNoaWxkQ29udGFpbmVyLT5wYXJlbnQoKSAhPSAmcGFyZW50KSB7
CiAgICAgICAgICAgICBiZWZvcmVDaGlsZENvbnRhaW5lciA9IGJlZm9yZUNoaWxkQ29udGFpbmVy
LT5wYXJlbnQoKTsKKyAgICAgICAgICAgIGlmICghYmVmb3JlQ2hpbGRDb250YWluZXIpCisgICAg
ICAgICAgICAgICAgcmV0dXJuOworICAgICAgICB9CiAgICAgICAgIEFTU0VSVChiZWZvcmVDaGls
ZENvbnRhaW5lcik7CiAKICAgICAgICAgaWYgKGJlZm9yZUNoaWxkQ29udGFpbmVyLT5pc0Fub255
bW91cygpKSB7Cg==
</data>
<flag name="review"
          id="415263"
          type_id="1"
          status="-"
          setter="zalan"
    />
          </attachment>
          <attachment
              isobsolete="0"
              ispatch="0"
              isprivate="0"
          >
            <attachid>400075</attachid>
            <date>2020-05-22 14:20:27 -0700</date>
            <delta_ts>2020-05-22 14:20:27 -0700</delta_ts>
            <desc>Test reduction</desc>
            <filename>62993844-reduction.html</filename>
            <type>text/html</type>
            <size>356</size>
            <attacher name="alan">zalan</attacher>
            
              <data encoding="base64">PHN0eWxlPgouY29udGFpbmVyIHsgCiAgLXdlYmtpdC1jb2x1bW5zOiAyOwp9CiNpbm5lckNvbnRh
aW5lciB7IAogIHBvc2l0aW9uOiBhYnNvbHV0ZTsKICAtd2Via2l0LWNvbHVtbnM6IDI7Cn0KPC9z
dHlsZT48ZGl2IGNsYXNzPWNvbnRhaW5lcj48c3Bhbj48ZGl2IGlkPWlubmVyQ29udGFpbmVyPjxk
aXYgc3R5bGU9ImNvbHVtbi1zcGFuOiBhbGw7Ij48L2Rpdj48L2Rpdj48L3NwYW4+PC9kaXY+PHNj
cmlwdD4KZG9jdW1lbnQuYm9keS5vZmZzZXRIZWlnaHQ7CmlubmVyQ29udGFpbmVyLnN0eWxlLnBv
c2l0aW9uID0gInN0YXRpYyI7CmlubmVyQ29udGFpbmVyLnN0eWxlLndlYmtpdENvbHVtbnMgPSAi
MSI7Cjwvc2NyaXB0Pgo=
</data>

          </attachment>
          <attachment
              isobsolete="1"
              ispatch="1"
              isprivate="0"
          >
            <attachid>400095</attachid>
            <date>2020-05-22 17:25:13 -0700</date>
            <delta_ts>2020-05-22 20:30:52 -0700</delta_ts>
            <desc>Patch</desc>
            <filename>bug-212116-20200522172512.patch</filename>
            <type>text/plain</type>
            <size>6083</size>
            <attacher name="alan">zalan</attacher>
            
              <data encoding="base64">U3VidmVyc2lvbiBSZXZpc2lvbjogMjYyMDI2CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D
aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggZTM5YzEyODA4ZDQyNmEx
YTk3MWY1MGY3ZjdkNjUxMTNhYWRjNGEyNS4uMjNkOWJlMzNiZTljZmE1NTQzYjk2MTM3M2UxYjcz
ZTkwZDVlZGQyOCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv
dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDI5IEBACisyMDIwLTA1LTIyICBaYWxh
biBCdWp0YXMgIDx6YWxhbkBhcHBsZS5jb20+CisKKyAgICAgICAgTnVsbHB0ciBkZXJlZiBpbiBX
ZWJDb3JlOjpSZW5kZXJUcmVlQnVpbGRlcjo6QmxvY2s6OmF0dGFjaElnbm9yaW5nQ29udGludWF0
aW9uIHdoZW4gcGFyZW50IGFuZCBiZWZvcmVDaGlsZCBhcmUgc2libGluZ3MKKyAgICAgICAgaHR0
cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIxMjExNgorICAgICAgICA8cmRh
cjovL3Byb2JsZW0vNjI5OTM4NDQ+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BT
ISkuCisKKyAgICAgICAgVGhpcyBwYXRjaCBmaXhlcyB0aGUgY2FzZSB3aGVuIGEgbmVzdGVkIGZy
YWdtZW50ZWQgY29udGV4dCBoYXMgYSBzcGFubmVyIGFuZCB3ZSB0cnkgdG8gZm9ybSBhIGNvbnRp
bnVhdGlvbiB3aGlsZSB0aGlzIG5lc3RlZCBmcmFnbWVudGVkIGNvbnRleHQgaXMgYmVpbmcgZGVz
dHJveWVkLgorCisgICAgICAgIDEuIFRoZSBjb250aW51YXRpb24gaXMgdHJpZ2dlcmVkIGJ5IGEg
c3R5bGUgY2hhbmdlIHRoYXQgdHVybnMgYSBwcmV2aW91c2x5IG91dC1vZi1mbG93IGJsb2NrIGNv
bnRhaW5lciBpbnRvIGFuIGluZmxvdyBib3gKKyAgICAgICAgKGFuZCB0aGUgcGFyZW50IGlubGlu
ZSBsZXZlbCBjb250YWluZXIgY2FuJ3QgaGF2ZSB0aGUgYm94IGFzIGEgZGlyZWN0IGNoaWxkIGFu
eW1vcmUpLgorICAgICAgICAyLiBBbiB1bnJlbGF0ZWQgc3R5bGUgY2hhbmdlIG51a2VzIHRoZSBu
ZXN0ZWQgZnJhZ21lbnRlZCBjb250ZXh0LiBXZSBuZWVkIHRvICJyZS1hc3NpZ24iIHRoZSBzcGFu
bmVyIHRvIHRoZSBwYXJlbnQgZnJhZ21lbnQuCisKKyAgICAgICAgVGhlc2UgMiBjaGFuZ2VzIGFy
ZSBzcGxpdCBpbnRvIDIgcGhhc2VzOyBmaXJzdCB3ZSB0YWtlIGNhcmUgb2YgdGhlIHRyZWUgbXV0
YXRpb24gdHJpZ2dlcmVkIGJ5IHRoZSBjb250aW51YXRpb24gKHVwZGF0ZVJlbmRlcmVyU3R5bGUp
LCB3aGlsZQorICAgICAgICB3ZSBkbyB0aGUgZnJhZ21lbnRlZCBjb250ZXh0IGNsZWFudXAgKHVw
ZGF0ZUFmdGVyRGVzY2VuZGFudHMpIGluIGEgc2VwYXJhdGUgc3RlcC4KKyAgICAgICAgVGhpcyAy
IHBoYXNlIHNldHVwIGNvbmZ1c2VzIHRoZSAid2hlcmUgdG8gcHV0IHRoaXMgc3Bhbm5lciIgbG9n
aWMuCisKKyAgICAgICAgVGhpcyBwYXRjaCBhZGRyZXNzZXMgdGhlIGlzc3VlIGJ5IGtlZXBpbmcg
dGhlIHNwYW5uZXIgaW5zaWRlIHRoZSBhYm91dC10by1iZS1kZXN0cm95ZWQgZnJhZ21lbnRlZCBj
b250ZXh0IHdoaWxlIGZvcm1pbmcgdGhlIGNvbnRpbnVhdGlvbiAocGhhc2UgIzEpIGFuZCBsZXQg
dGhlIHNlY29uZCBwaGFzZSAodXBkYXRlQWZ0ZXJEZXNjZW5kYW50cykKKyAgICAgICAgZGVhbCB3
aXRoIHRoZSBzcGFubmVyIG1vdmluZy4KKworICAgICAgICBUZXN0OiBmYXN0L211bHRpY29sL25l
c3RlZC1tdWx0aWNvbC13aXRoLXNwYW5uZXItYW5kLWNvbnRpbnVhdGlvbi5odG1sCisKKyAgICAg
ICAgKiByZW5kZXJpbmcvdXBkYXRpbmcvUmVuZGVyVHJlZUJ1aWxkZXJNdWx0aUNvbHVtbi5jcHA6
CisgICAgICAgIChXZWJDb3JlOjppc1ZhbGlkQ29sdW1uU3Bhbm5lcik6CisKIDIwMjAtMDUtMjEg
IFlvdWVubiBGYWJsZXQgIDx5b3Vlbm5AYXBwbGUuY29tPgogCiAgICAgICAgIEluY29ycmVjdCBs
b2NhdGlvbi5vcmlnaW4gaW4gYmxvYiB3b3JrZXJzCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29y
ZS9yZW5kZXJpbmcvdXBkYXRpbmcvUmVuZGVyVHJlZUJ1aWxkZXJNdWx0aUNvbHVtbi5jcHAgYi9T
b3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvdXBkYXRpbmcvUmVuZGVyVHJlZUJ1aWxkZXJNdWx0aUNv
bHVtbi5jcHAKaW5kZXggOGMxY2YwNjAyYjhhYzIyYWYyMzc3NzIwZTY4ODFiMjAyNzI0ZjczMS4u
ZmI2OTU2NzJlYTcwMjU1OWQ3Yjg5MzAyNjMwYjc1OTY1MmY1NjhlOSAxMDA2NDQKLS0tIGEvU291
cmNlL1dlYkNvcmUvcmVuZGVyaW5nL3VwZGF0aW5nL1JlbmRlclRyZWVCdWlsZGVyTXVsdGlDb2x1
bW4uY3BwCisrKyBiL1NvdXJjZS9XZWJDb3JlL3JlbmRlcmluZy91cGRhdGluZy9SZW5kZXJUcmVl
QnVpbGRlck11bHRpQ29sdW1uLmNwcApAQCAtMTA3LDkgKzEwNywxOCBAQCBzdGF0aWMgYm9vbCBp
c1ZhbGlkQ29sdW1uU3Bhbm5lcihjb25zdCBSZW5kZXJNdWx0aUNvbHVtbkZsb3cmIGZyYWdtZW50
ZWRGbG93LCBjbwogICAgICAgICAgICAgLy8gaW1wbGVtZW50IChub3QgdG8gbWVudGlvbiBzcGVj
aWZ5IGJlaGF2aW9yKS4KICAgICAgICAgICAgIHJldHVybiBhbmNlc3RvciA9PSAmZnJhZ21lbnRl
ZEZsb3c7CiAgICAgICAgIH0KLSAgICAgICAgLy8gVGhpcyBhbmNlc3RvciAoZGVzY2VuZGVudCBv
ZiB0aGUgZnJhZ21lbnRlZEZsb3cpIHdpbGwgY3JlYXRlIGNvbHVtbnMgbGF0ZXIuIFRoZSBzcGFu
bmVyIGJlbG9uZ3MgdG8gaXQuCi0gICAgICAgIGlmIChpczxSZW5kZXJCbG9ja0Zsb3c+KCphbmNl
c3RvcikgJiYgZG93bmNhc3Q8UmVuZGVyQmxvY2tGbG93PigqYW5jZXN0b3IpLndpbGxDcmVhdGVD
b2x1bW5zKCkpCi0gICAgICAgICAgICByZXR1cm4gZmFsc2U7CisgICAgICAgIGlmIChpczxSZW5k
ZXJCbG9ja0Zsb3c+KCphbmNlc3RvcikpIHsKKyAgICAgICAgICAgIGF1dG8mIGJsb2NrRmxvd0Fu
Y2VzdG9yID0gZG93bmNhc3Q8UmVuZGVyQmxvY2tGbG93PigqYW5jZXN0b3IpOworICAgICAgICAg
ICAgaWYgKGJsb2NrRmxvd0FuY2VzdG9yLndpbGxDcmVhdGVDb2x1bW5zKCkpIHsKKyAgICAgICAg
ICAgICAgICAvLyBUaGlzIGFuY2VzdG9yIChkZXNjZW5kZW50IG9mIHRoZSBmcmFnbWVudGVkRmxv
dykgd2lsbCBjcmVhdGUgY29sdW1ucyBsYXRlci4gVGhlIHNwYW5uZXIgYmVsb25ncyB0byBpdC4K
KyAgICAgICAgICAgICAgICByZXR1cm4gZmFsc2U7CisgICAgICAgICAgICB9CisgICAgICAgICAg
ICBpZiAoYmxvY2tGbG93QW5jZXN0b3IubXVsdGlDb2x1bW5GbG93KCkpIHsKKyAgICAgICAgICAg
ICAgICAvLyBXaGlsZSB0aGlzIGFuY2VzdG9yIChkZXNjZW5kZW50IG9mIHRoZSBmcmFnbWVudGVk
RmxvdykgaGFzIGEgZnJhZ21lbnRlZCBmbG93IGNvbnRleHQsIHRoaXMgY29udGV4dCBpcyBiZWlu
ZyBkZXN0cm95ZWQuCisgICAgICAgICAgICAgICAgLy8gSG93ZXZlciB0aGUgc3Bhbm5lciBzdGls
bCBiZWxvbmdzIHRvIGl0ICh3aWxsIG1vc3QgbGlrZWx5IGJlIG1vdmVkIHRvIHRoZSBwYXJlbnQg
ZnJhZ21lbnRlZCBjb250ZXh0IGFzIHRoZSBuZXh0IHN0ZXApLgorICAgICAgICAgICAgICAgIHJl
dHVybiBmYWxzZTsKKyAgICAgICAgICAgIH0KKyAgICAgICAgfQogICAgICAgICBBU1NFUlQoYW5j
ZXN0b3ItPnN0eWxlKCkuY29sdW1uU3BhbigpICE9IENvbHVtblNwYW46OkFsbCB8fCAhaXNWYWxp
ZENvbHVtblNwYW5uZXIoZnJhZ21lbnRlZEZsb3csICphbmNlc3RvcikpOwogICAgICAgICBpZiAo
YW5jZXN0b3ItPmlzVW5zcGxpdHRhYmxlRm9yUGFnaW5hdGlvbigpKQogICAgICAgICAgICAgcmV0
dXJuIGZhbHNlOwpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nIGIvTGF5b3V0VGVz
dHMvQ2hhbmdlTG9nCmluZGV4IGU0YjI2Y2M0MGMxYzEwOTIyYzExYmMyZDIwZTBiYzJlOWM1ODRl
NjIuLjFkOTFkZGI0YWNjNGY4ZTYwMTFkOTM3M2FjMTU0MzAxNWE0ODkwMjAgMTAwNjQ0Ci0tLSBh
L0xheW91dFRlc3RzL0NoYW5nZUxvZworKysgYi9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKQEAgLTEs
MyArMSwxNCBAQAorMjAyMC0wNS0yMiAgWmFsYW4gQnVqdGFzICA8emFsYW5AYXBwbGUuY29tPgor
CisgICAgICAgIE51bGxwdHIgZGVyZWYgaW4gV2ViQ29yZTo6UmVuZGVyVHJlZUJ1aWxkZXI6OkJs
b2NrOjphdHRhY2hJZ25vcmluZ0NvbnRpbnVhdGlvbiB3aGVuIHBhcmVudCBhbmQgYmVmb3JlQ2hp
bGQgYXJlIHNpYmxpbmdzCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVn
LmNnaT9pZD0yMTIxMTYKKyAgICAgICAgPHJkYXI6Ly9wcm9ibGVtLzYyOTkzODQ0PgorCisgICAg
ICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgICogZmFzdC9tdWx0aWNv
bC9uZXN0ZWQtbXVsdGljb2wtd2l0aC1zcGFubmVyLWFuZC1jb250aW51YXRpb24tZXhwZWN0ZWQu
dHh0OiBBZGRlZC4KKyAgICAgICAgKiBmYXN0L211bHRpY29sL25lc3RlZC1tdWx0aWNvbC13aXRo
LXNwYW5uZXItYW5kLWNvbnRpbnVhdGlvbi5odG1sOiBBZGRlZC4KKwogMjAyMC0wNS0yMSAgWW91
ZW5uIEZhYmxldCAgPHlvdWVubkBhcHBsZS5jb20+CiAKICAgICAgICAgSW5jb3JyZWN0IGxvY2F0
aW9uLm9yaWdpbiBpbiBibG9iIHdvcmtlcnMKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL2Zhc3Qv
bXVsdGljb2wvbmVzdGVkLW11bHRpY29sLXdpdGgtc3Bhbm5lci1hbmQtY29udGludWF0aW9uLWV4
cGVjdGVkLnR4dCBiL0xheW91dFRlc3RzL2Zhc3QvbXVsdGljb2wvbmVzdGVkLW11bHRpY29sLXdp
dGgtc3Bhbm5lci1hbmQtY29udGludWF0aW9uLWV4cGVjdGVkLnR4dApuZXcgZmlsZSBtb2RlIDEw
MDY0NAppbmRleCAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwLi40MTc5
ZjU5MzdlNmM0ZjY2OWZhNjc0YjAwOWM3ZDRmMjcxODI4ZmQ3Ci0tLSAvZGV2L251bGwKKysrIGIv
TGF5b3V0VGVzdHMvZmFzdC9tdWx0aWNvbC9uZXN0ZWQtbXVsdGljb2wtd2l0aC1zcGFubmVyLWFu
ZC1jb250aW51YXRpb24tZXhwZWN0ZWQudHh0CkBAIC0wLDAgKzEsMiBAQAorUEFTUyBpZiBubyBj
cmFzaCB3aGVuIHRoZSBuZXN0ZWQgZnJhZ21lbnRlZCBjb250ZXh0IGlzIGJlaW5nIGRlc3Ryb3ll
ZCB3aXRoIGEgc3Bhbm5lciBpbiBpdCB3aGlsZSBmb3JtaW5nIGEgbmV3IGNvbnRpbnVhdGlvbi4K
KwpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvZmFzdC9tdWx0aWNvbC9uZXN0ZWQtbXVsdGljb2wt
d2l0aC1zcGFubmVyLWFuZC1jb250aW51YXRpb24uaHRtbCBiL0xheW91dFRlc3RzL2Zhc3QvbXVs
dGljb2wvbmVzdGVkLW11bHRpY29sLXdpdGgtc3Bhbm5lci1hbmQtY29udGludWF0aW9uLmh0bWwK
bmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw
MDAwMDAwMDAwMC4uNGE1YjAzNmM0NjcwNmU0OTJiODdmOWEwMDcxYWU2OTZjMjZmNjk2YgotLS0g
L2Rldi9udWxsCisrKyBiL0xheW91dFRlc3RzL2Zhc3QvbXVsdGljb2wvbmVzdGVkLW11bHRpY29s
LXdpdGgtc3Bhbm5lci1hbmQtY29udGludWF0aW9uLmh0bWwKQEAgLTAsMCArMSwxNyBAQAorPHN0
eWxlPgorLmNvbnRhaW5lciB7IAorICAgIC13ZWJraXQtY29sdW1uczogMjsKK30KKyNpbm5lckNv
bnRhaW5lciB7IAorICAgIHBvc2l0aW9uOiBhYnNvbHV0ZTsKKyAgICAtd2Via2l0LWNvbHVtbnM6
IDI7Cit9Cis8L3N0eWxlPgorUEFTUyBpZiBubyBjcmFzaCB3aGVuIHRoZSBuZXN0ZWQgZnJhZ21l
bnRlZCBjb250ZXh0IGlzIGJlaW5nIGRlc3Ryb3llZCB3aXRoIGEgc3Bhbm5lciBpbiBpdCB3aGls
ZSBmb3JtaW5nIGEgbmV3IGNvbnRpbnVhdGlvbi4KKzxkaXYgY2xhc3M9Y29udGFpbmVyPjxzcGFu
PjxkaXYgaWQ9aW5uZXJDb250YWluZXI+PGRpdiBzdHlsZT0iY29sdW1uLXNwYW46IGFsbDsiPjwv
ZGl2PjwvZGl2Pjwvc3Bhbj48L2Rpdj48c2NyaXB0PgoraWYgKHdpbmRvdy50ZXN0UnVubmVyKQor
ICAgIHRlc3RSdW5uZXIuZHVtcEFzVGV4dCgpOworZG9jdW1lbnQuYm9keS5vZmZzZXRIZWlnaHQ7
Citpbm5lckNvbnRhaW5lci5zdHlsZS5wb3NpdGlvbiA9ICJzdGF0aWMiOworaW5uZXJDb250YWlu
ZXIuc3R5bGUud2Via2l0Q29sdW1ucyA9ICIxIjsKKzwvc2NyaXB0Pgo=
</data>

          </attachment>
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>400105</attachid>
            <date>2020-05-22 20:30:54 -0700</date>
            <delta_ts>2020-05-22 21:03:25 -0700</delta_ts>
            <desc>Patch</desc>
            <filename>bug-212116-20200522203053.patch</filename>
            <type>text/plain</type>
            <size>6063</size>
            <attacher name="alan">zalan</attacher>
            
              <data encoding="base64">U3VidmVyc2lvbiBSZXZpc2lvbjogMjYyMDI2CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D
aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggZTM5YzEyODA4ZDQyNmEx
YTk3MWY1MGY3ZjdkNjUxMTNhYWRjNGEyNS4uNWM3ZjQ5YjU2NTlkNjE0YTZhNGZkYjNiYmI0NDZm
NmM1MGRhOTk2NCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv
dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDI5IEBACisyMDIwLTA1LTIyICBaYWxh
biBCdWp0YXMgIDx6YWxhbkBhcHBsZS5jb20+CisKKyAgICAgICAgTnVsbHB0ciBkZXJlZiBpbiBX
ZWJDb3JlOjpSZW5kZXJUcmVlQnVpbGRlcjo6QmxvY2s6OmF0dGFjaElnbm9yaW5nQ29udGludWF0
aW9uIHdoZW4gcGFyZW50IGFuZCBiZWZvcmVDaGlsZCBhcmUgc2libGluZ3MKKyAgICAgICAgaHR0
cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIxMjExNgorICAgICAgICA8cmRh
cjovL3Byb2JsZW0vNjI5OTM4NDQ+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgU2ltb24gRnJhc2Vy
LgorCisgICAgICAgIFRoaXMgcGF0Y2ggZml4ZXMgdGhlIGNhc2Ugd2hlbiBhIG5lc3RlZCBmcmFn
bWVudGVkIGNvbnRleHQgaGFzIGEgc3Bhbm5lciBhbmQgd2UgdHJ5IHRvIGZvcm0gYSBjb250aW51
YXRpb24gd2hpbGUgdGhpcyBuZXN0ZWQgZnJhZ21lbnRlZCBjb250ZXh0IGlzIGJlaW5nIGRlc3Ry
b3llZC4KKworICAgICAgICAxLiBUaGUgY29udGludWF0aW9uIGlzIHRyaWdnZXJlZCBieSBhIHN0
eWxlIGNoYW5nZSB0aGF0IHR1cm5zIGEgcHJldmlvdXNseSBvdXQtb2YtZmxvdyBibG9jayBjb250
YWluZXIgaW50byBhbiBpbmZsb3cgYm94CisgICAgICAgIChhbmQgdGhlIHBhcmVudCBpbmxpbmUg
bGV2ZWwgY29udGFpbmVyIGNhbid0IGhhdmUgdGhlIGJveCBhcyBhIGRpcmVjdCBjaGlsZCBhbnlt
b3JlKS4KKyAgICAgICAgMi4gQW4gdW5yZWxhdGVkIHN0eWxlIGNoYW5nZSBudWtlcyB0aGUgbmVz
dGVkIGZyYWdtZW50ZWQgY29udGV4dC4gV2UgbmVlZCB0byAicmUtYXNzaWduIiB0aGUgc3Bhbm5l
ciB0byB0aGUgcGFyZW50IGZyYWdtZW50LgorCisgICAgICAgIFRoZXNlIDIgY2hhbmdlcyBhcmUg
c3BsaXQgaW50byAyIHBoYXNlczsgZmlyc3Qgd2UgdGFrZSBjYXJlIG9mIHRoZSB0cmVlIG11dGF0
aW9uIHRyaWdnZXJlZCBieSB0aGUgY29udGludWF0aW9uICh1cGRhdGVSZW5kZXJlclN0eWxlKSwg
d2hpbGUKKyAgICAgICAgd2UgZG8gdGhlIGZyYWdtZW50ZWQgY29udGV4dCBjbGVhbnVwICh1cGRh
dGVBZnRlckRlc2NlbmRhbnRzKSBpbiBhIHNlcGFyYXRlIHN0ZXAuCisgICAgICAgIFRoaXMgMiBw
aGFzZSBzZXR1cCBjb25mdXNlcyB0aGUgIndoZXJlIHRvIHB1dCB0aGlzIHNwYW5uZXIiIGxvZ2lj
LgorCisgICAgICAgIFRoaXMgcGF0Y2ggYWRkcmVzc2VzIHRoZSBpc3N1ZSBieSBrZWVwaW5nIHRo
ZSBzcGFubmVyIGluc2lkZSB0aGUgYWJvdXQtdG8tYmUtZGVzdHJveWVkIGZyYWdtZW50ZWQgY29u
dGV4dCB3aGlsZSBmb3JtaW5nIHRoZSBjb250aW51YXRpb24gKHBoYXNlICMxKSBhbmQgbGV0IHRo
ZSBzZWNvbmQgcGhhc2UgKHVwZGF0ZUFmdGVyRGVzY2VuZGFudHMpCisgICAgICAgIGRlYWwgd2l0
aCB0aGUgc3Bhbm5lciBtb3ZpbmcuCisKKyAgICAgICAgVGVzdDogZmFzdC9tdWx0aWNvbC9uZXN0
ZWQtbXVsdGljb2wtd2l0aC1zcGFubmVyLWFuZC1jb250aW51YXRpb24uaHRtbAorCisgICAgICAg
ICogcmVuZGVyaW5nL3VwZGF0aW5nL1JlbmRlclRyZWVCdWlsZGVyTXVsdGlDb2x1bW4uY3BwOgor
ICAgICAgICAoV2ViQ29yZTo6aXNWYWxpZENvbHVtblNwYW5uZXIpOgorCiAyMDIwLTA1LTIxICBZ
b3Vlbm4gRmFibGV0ICA8eW91ZW5uQGFwcGxlLmNvbT4KIAogICAgICAgICBJbmNvcnJlY3QgbG9j
YXRpb24ub3JpZ2luIGluIGJsb2Igd29ya2VycwpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUv
cmVuZGVyaW5nL3VwZGF0aW5nL1JlbmRlclRyZWVCdWlsZGVyTXVsdGlDb2x1bW4uY3BwIGIvU291
cmNlL1dlYkNvcmUvcmVuZGVyaW5nL3VwZGF0aW5nL1JlbmRlclRyZWVCdWlsZGVyTXVsdGlDb2x1
bW4uY3BwCmluZGV4IDhjMWNmMDYwMmI4YWMyMmFmMjM3NzcyMGU2ODgxYjIwMjcyNGY3MzEuLmZi
Njk1NjcyZWE3MDI1NTlkN2I4OTMwMjYzMGI3NTk2NTJmNTY4ZTkgMTAwNjQ0Ci0tLSBhL1NvdXJj
ZS9XZWJDb3JlL3JlbmRlcmluZy91cGRhdGluZy9SZW5kZXJUcmVlQnVpbGRlck11bHRpQ29sdW1u
LmNwcAorKysgYi9Tb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvdXBkYXRpbmcvUmVuZGVyVHJlZUJ1
aWxkZXJNdWx0aUNvbHVtbi5jcHAKQEAgLTEwNyw5ICsxMDcsMTggQEAgc3RhdGljIGJvb2wgaXNW
YWxpZENvbHVtblNwYW5uZXIoY29uc3QgUmVuZGVyTXVsdGlDb2x1bW5GbG93JiBmcmFnbWVudGVk
RmxvdywgY28KICAgICAgICAgICAgIC8vIGltcGxlbWVudCAobm90IHRvIG1lbnRpb24gc3BlY2lm
eSBiZWhhdmlvcikuCiAgICAgICAgICAgICByZXR1cm4gYW5jZXN0b3IgPT0gJmZyYWdtZW50ZWRG
bG93OwogICAgICAgICB9Ci0gICAgICAgIC8vIFRoaXMgYW5jZXN0b3IgKGRlc2NlbmRlbnQgb2Yg
dGhlIGZyYWdtZW50ZWRGbG93KSB3aWxsIGNyZWF0ZSBjb2x1bW5zIGxhdGVyLiBUaGUgc3Bhbm5l
ciBiZWxvbmdzIHRvIGl0LgotICAgICAgICBpZiAoaXM8UmVuZGVyQmxvY2tGbG93PigqYW5jZXN0
b3IpICYmIGRvd25jYXN0PFJlbmRlckJsb2NrRmxvdz4oKmFuY2VzdG9yKS53aWxsQ3JlYXRlQ29s
dW1ucygpKQotICAgICAgICAgICAgcmV0dXJuIGZhbHNlOworICAgICAgICBpZiAoaXM8UmVuZGVy
QmxvY2tGbG93PigqYW5jZXN0b3IpKSB7CisgICAgICAgICAgICBhdXRvJiBibG9ja0Zsb3dBbmNl
c3RvciA9IGRvd25jYXN0PFJlbmRlckJsb2NrRmxvdz4oKmFuY2VzdG9yKTsKKyAgICAgICAgICAg
IGlmIChibG9ja0Zsb3dBbmNlc3Rvci53aWxsQ3JlYXRlQ29sdW1ucygpKSB7CisgICAgICAgICAg
ICAgICAgLy8gVGhpcyBhbmNlc3RvciAoZGVzY2VuZGVudCBvZiB0aGUgZnJhZ21lbnRlZEZsb3cp
IHdpbGwgY3JlYXRlIGNvbHVtbnMgbGF0ZXIuIFRoZSBzcGFubmVyIGJlbG9uZ3MgdG8gaXQuCisg
ICAgICAgICAgICAgICAgcmV0dXJuIGZhbHNlOworICAgICAgICAgICAgfQorICAgICAgICAgICAg
aWYgKGJsb2NrRmxvd0FuY2VzdG9yLm11bHRpQ29sdW1uRmxvdygpKSB7CisgICAgICAgICAgICAg
ICAgLy8gV2hpbGUgdGhpcyBhbmNlc3RvciAoZGVzY2VuZGVudCBvZiB0aGUgZnJhZ21lbnRlZEZs
b3cpIGhhcyBhIGZyYWdtZW50ZWQgZmxvdyBjb250ZXh0LCB0aGlzIGNvbnRleHQgaXMgYmVpbmcg
ZGVzdHJveWVkLgorICAgICAgICAgICAgICAgIC8vIEhvd2V2ZXIgdGhlIHNwYW5uZXIgc3RpbGwg
YmVsb25ncyB0byBpdCAod2lsbCBtb3N0IGxpa2VseSBiZSBtb3ZlZCB0byB0aGUgcGFyZW50IGZy
YWdtZW50ZWQgY29udGV4dCBhcyB0aGUgbmV4dCBzdGVwKS4KKyAgICAgICAgICAgICAgICByZXR1
cm4gZmFsc2U7CisgICAgICAgICAgICB9CisgICAgICAgIH0KICAgICAgICAgQVNTRVJUKGFuY2Vz
dG9yLT5zdHlsZSgpLmNvbHVtblNwYW4oKSAhPSBDb2x1bW5TcGFuOjpBbGwgfHwgIWlzVmFsaWRD
b2x1bW5TcGFubmVyKGZyYWdtZW50ZWRGbG93LCAqYW5jZXN0b3IpKTsKICAgICAgICAgaWYgKGFu
Y2VzdG9yLT5pc1Vuc3BsaXR0YWJsZUZvclBhZ2luYXRpb24oKSkKICAgICAgICAgICAgIHJldHVy
biBmYWxzZTsKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL0NoYW5nZUxvZyBiL0xheW91dFRlc3Rz
L0NoYW5nZUxvZwppbmRleCBlNGIyNmNjNDBjMWMxMDkyMmMxMWJjMmQyMGUwYmMyZTljNTg0ZTYy
Li4yMWVlZmQwYWI5ZDE2MGVlMGFhZGIxMzZkYjc4MWFmZjhjMWRjNjZlIDEwMDY0NAotLS0gYS9M
YXlvdXRUZXN0cy9DaGFuZ2VMb2cKKysrIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCkBAIC0xLDMg
KzEsMTQgQEAKKzIwMjAtMDUtMjIgIFphbGFuIEJ1anRhcyAgPHphbGFuQGFwcGxlLmNvbT4KKwor
ICAgICAgICBOdWxscHRyIGRlcmVmIGluIFdlYkNvcmU6OlJlbmRlclRyZWVCdWlsZGVyOjpCbG9j
azo6YXR0YWNoSWdub3JpbmdDb250aW51YXRpb24gd2hlbiBwYXJlbnQgYW5kIGJlZm9yZUNoaWxk
IGFyZSBzaWJsaW5ncworICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5j
Z2k/aWQ9MjEyMTE2CisgICAgICAgIDxyZGFyOi8vcHJvYmxlbS82Mjk5Mzg0ND4KKworICAgICAg
ICBSZXZpZXdlZCBieSBTaW1vbiBGcmFzZXIuCisKKyAgICAgICAgKiBmYXN0L211bHRpY29sL25l
c3RlZC1tdWx0aWNvbC13aXRoLXNwYW5uZXItYW5kLWNvbnRpbnVhdGlvbi1leHBlY3RlZC50eHQ6
IEFkZGVkLgorICAgICAgICAqIGZhc3QvbXVsdGljb2wvbmVzdGVkLW11bHRpY29sLXdpdGgtc3Bh
bm5lci1hbmQtY29udGludWF0aW9uLmh0bWw6IEFkZGVkLgorCiAyMDIwLTA1LTIxICBZb3Vlbm4g
RmFibGV0ICA8eW91ZW5uQGFwcGxlLmNvbT4KIAogICAgICAgICBJbmNvcnJlY3QgbG9jYXRpb24u
b3JpZ2luIGluIGJsb2Igd29ya2VycwpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvZmFzdC9tdWx0
aWNvbC9uZXN0ZWQtbXVsdGljb2wtd2l0aC1zcGFubmVyLWFuZC1jb250aW51YXRpb24tZXhwZWN0
ZWQudHh0IGIvTGF5b3V0VGVzdHMvZmFzdC9tdWx0aWNvbC9uZXN0ZWQtbXVsdGljb2wtd2l0aC1z
cGFubmVyLWFuZC1jb250aW51YXRpb24tZXhwZWN0ZWQudHh0Cm5ldyBmaWxlIG1vZGUgMTAwNjQ0
CmluZGV4IDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAuLjQxNzlmNTkz
N2U2YzRmNjY5ZmE2NzRiMDA5YzdkNGYyNzE4MjhmZDcKLS0tIC9kZXYvbnVsbAorKysgYi9MYXlv
dXRUZXN0cy9mYXN0L211bHRpY29sL25lc3RlZC1tdWx0aWNvbC13aXRoLXNwYW5uZXItYW5kLWNv
bnRpbnVhdGlvbi1leHBlY3RlZC50eHQKQEAgLTAsMCArMSwyIEBACitQQVNTIGlmIG5vIGNyYXNo
IHdoZW4gdGhlIG5lc3RlZCBmcmFnbWVudGVkIGNvbnRleHQgaXMgYmVpbmcgZGVzdHJveWVkIHdp
dGggYSBzcGFubmVyIGluIGl0IHdoaWxlIGZvcm1pbmcgYSBuZXcgY29udGludWF0aW9uLgorCmRp
ZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9mYXN0L211bHRpY29sL25lc3RlZC1tdWx0aWNvbC13aXRo
LXNwYW5uZXItYW5kLWNvbnRpbnVhdGlvbi5odG1sIGIvTGF5b3V0VGVzdHMvZmFzdC9tdWx0aWNv
bC9uZXN0ZWQtbXVsdGljb2wtd2l0aC1zcGFubmVyLWFuZC1jb250aW51YXRpb24uaHRtbApuZXcg
ZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw
MDAwMDAwLi5iYzI0MzE4OWM1Yzk3NjVlNDc2ZjQzNzg3NmI5NzZmZmE1MjFiNThiCi0tLSAvZGV2
L251bGwKKysrIGIvTGF5b3V0VGVzdHMvZmFzdC9tdWx0aWNvbC9uZXN0ZWQtbXVsdGljb2wtd2l0
aC1zcGFubmVyLWFuZC1jb250aW51YXRpb24uaHRtbApAQCAtMCwwICsxLDE3IEBACis8c3R5bGU+
CisuY29udGFpbmVyIHsgCisgICAgY29sdW1uczogMjsKK30KKyNpbm5lckNvbnRhaW5lciB7IAor
ICAgIHBvc2l0aW9uOiBhYnNvbHV0ZTsKKyAgICBjb2x1bW5zOiAyOworfQorPC9zdHlsZT4KK1BB
U1MgaWYgbm8gY3Jhc2ggd2hlbiB0aGUgbmVzdGVkIGZyYWdtZW50ZWQgY29udGV4dCBpcyBiZWlu
ZyBkZXN0cm95ZWQgd2l0aCBhIHNwYW5uZXIgaW4gaXQgd2hpbGUgZm9ybWluZyBhIG5ldyBjb250
aW51YXRpb24uCis8ZGl2IGNsYXNzPWNvbnRhaW5lcj48c3Bhbj48ZGl2IGlkPWlubmVyQ29udGFp
bmVyPjxkaXYgc3R5bGU9ImNvbHVtbi1zcGFuOiBhbGw7Ij48L2Rpdj48L2Rpdj48L3NwYW4+PC9k
aXY+PHNjcmlwdD4KK2lmICh3aW5kb3cudGVzdFJ1bm5lcikKKyAgICB0ZXN0UnVubmVyLmR1bXBB
c1RleHQoKTsKK2RvY3VtZW50LmJvZHkub2Zmc2V0SGVpZ2h0OworaW5uZXJDb250YWluZXIuc3R5
bGUucG9zaXRpb24gPSAic3RhdGljIjsKK2lubmVyQ29udGFpbmVyLnN0eWxlLndlYmtpdENvbHVt
bnMgPSAiMSI7Cis8L3NjcmlwdD4K
</data>

          </attachment>
      

    </bug>

</bugzilla>