213514 2020-06-23 07:19:56 -0700 Crash in InsertTextCommand::doApply 2021-03-30 20:01:28 -0700 1 1 1 Unclassified WebKit HTML Editing WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED https://bugs.webkit.org/show_bug.cgi?id=223980 InRadar P2 Normal --- 1 ajuma svillar bfulgham cgarcia darin eugenebut ews-feeder ews-watchlist fred.wang gpoo mifenton product-security rbuis rniwa svillar webkit-bug-importer wenson_hsieh oldest_to_newest 1665367 0 402555 ajuma 2020-06-23 07:19:56 -0700 Created attachment 402555 Minimal test case Filing this as a security bug since it was found using a fuzzer; there's no disclosure deadline for this bug. Crash stack: ================================================================= ==13664==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000018 (pc 0x00022018c591 bp 0x7ffee5b12160 sp 0x7ffee5b12160 T0) ==13664==The signal is caused by a READ memory access. ==13664==Hint: address points to the zero page. ==13664==WARNING: invalid path to external symbolizer! ==13664==WARNING: Failed to use and restart external symbolizer! #0 0x22018c590 in WebCore::Node::parentNode() const (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x18c590) #1 0x22340f0ca in WebCore::positionInParentBeforeNode(WebCore::Node*) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x340f0ca) #2 0x2235ea4af in WebCore::InsertTextCommand::doApply() (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x35ea4af) #3 0x223534c12 in WebCore::CompositeEditCommand::applyCommandToComposite(WTF::Ref<WebCore::CompositeEditCommand, WTF::DumbPtrTraits<WebCore::CompositeEditCommand> >&&, WebCore::VisibleSelection const&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x3534c12) #4 0x22364848f in WebCore::TypingCommand::insertTextRunWithoutNewlines(WTF::String const&, bool) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x364848f) #5 0x22366fedd in WebCore::TypingCommandLineOperation::operator()(unsigned long, unsigned long, bool) const (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x366fedd) #6 0x2236481a0 in WebCore::TypingCommand::insertText(WTF::String const&, bool) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x36481a0) #7 0x22364596c in WebCore::TypingCommand::insertTextAndNotifyAccessibility(WTF::String const&, bool) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x364596c) #8 0x223519bb6 in WebCore::CompositeEditCommand::apply() (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x3519bb6) #9 0x223629249 in WebCore::TextInsertionBaseCommand::applyTextInsertionCommand(WebCore::Frame*, WebCore::TextInsertionBaseCommand&, WebCore::VisibleSelection const&, WebCore::VisibleSelection const&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x3629249) #10 0x22364570c in WebCore::TypingCommand::insertText(WebCore::Document&, WTF::String const&, WebCore::VisibleSelection const&, unsigned int, WebCore::TypingCommand::TextCompositionType) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x364570c) #11 0x2235ce1ec in WebCore::executeInsertText(WebCore::Frame&, WebCore::Event*, WebCore::EditorCommandSource, WTF::String const&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x35ce1ec) #12 0x223244328 in WebCore::Document::execCommand(WTF::String const&, bool, WTF::String const&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x3244328) #13 0x2209ea44b in WebCore::jsDocumentPrototypeFunctionExecCommandBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSDocument*, JSC::ThrowScope&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x9ea44b) #14 0x220892095 in long long WebCore::IDLOperation<WebCore::JSDocument>::call<&(WebCore::jsDocumentPrototypeFunctionExecCommandBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSDocument*, JSC::ThrowScope&)), (WebCore::CastedThisErrorBehavior)0>(JSC::JSGlobalObject&, JSC::CallFrame&, char const*) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x892095) #15 0x50e466401177 (<unknown module>) #16 0x23cc00a3b in llint_entry (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0xb32a3b) #17 0x23cbe6f88 in vmEntryToJavaScript (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0xb18f88) #18 0x23e2a2d20 in JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x21d4d20) #19 0x23e95a4bf in JSC::call(JSC::JSGlobalObject*, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x288c4bf) #20 0x23e95a87b in JSC::profiledCall(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x288c87b) #21 0x222b66fb3 in WebCore::JSExecState::profiledCall(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x2b66fb3) #22 0x222b90a89 in WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext&, WebCore::Event&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x2b90a89) #23 0x223365bb2 in WebCore::EventTarget::innerInvokeEventListeners(WebCore::Event&, WTF::Vector<WTF::RefPtr<WebCore::RegisteredEventListener, WTF::DumbPtrTraits<WebCore::RegisteredEventListener> >, 1ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>, WebCore::EventTarget::EventInvokePhase) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x3365bb2) #24 0x22336070e in WebCore::EventTarget::fireEventListeners(WebCore::Event&, WebCore::EventTarget::EventInvokePhase) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x336070e) #25 0x22334d71d in WebCore::EventContext::handleLocalEvents(WebCore::Event&, WebCore::EventTarget::EventInvokePhase) const (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x334d71d) #26 0x22334e5e9 in WebCore::dispatchEventInDOM(WebCore::Event&, WebCore::EventPath const&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x334e5e9) #27 0x22334e06d in WebCore::EventDispatcher::dispatchEvent(WebCore::Node&, WebCore::Event&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x334e06d) #28 0x22343edb7 in WebCore::ScopedEventQueue::dispatchAllEvents() (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x343edb7) #29 0x223244343 in WebCore::Document::execCommand(WTF::String const&, bool, WTF::String const&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x3244343) #30 0x2209ea44b in WebCore::jsDocumentPrototypeFunctionExecCommandBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSDocument*, JSC::ThrowScope&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x9ea44b) #31 0x220892095 in long long WebCore::IDLOperation<WebCore::JSDocument>::call<&(WebCore::jsDocumentPrototypeFunctionExecCommandBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSDocument*, JSC::ThrowScope&)), (WebCore::CastedThisErrorBehavior)0>(JSC::JSGlobalObject&, JSC::CallFrame&, char const*) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x892095) #32 0x50e466401177 (<unknown module>) #33 0x23cc00a3b in llint_entry (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0xb32a3b) #34 0x23cbe6f88 in vmEntryToJavaScript (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0xb18f88) #35 0x23e2a2d20 in JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x21d4d20) #36 0x23e95a4bf in JSC::call(JSC::JSGlobalObject*, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x288c4bf) #37 0x23e95a87b in JSC::profiledCall(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x288c87b) #38 0x222b66fb3 in WebCore::JSExecState::profiledCall(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x2b66fb3) #39 0x222b90a89 in WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext&, WebCore::Event&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x2b90a89) #40 0x223365bb2 in WebCore::EventTarget::innerInvokeEventListeners(WebCore::Event&, WTF::Vector<WTF::RefPtr<WebCore::RegisteredEventListener, WTF::DumbPtrTraits<WebCore::RegisteredEventListener> >, 1ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>, WebCore::EventTarget::EventInvokePhase) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x3365bb2) #41 0x22336070e in WebCore::EventTarget::fireEventListeners(WebCore::Event&, WebCore::EventTarget::EventInvokePhase) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x336070e) #42 0x22334d71d in WebCore::EventContext::handleLocalEvents(WebCore::Event&, WebCore::EventTarget::EventInvokePhase) const (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x334d71d) #43 0x22334e5e9 in WebCore::dispatchEventInDOM(WebCore::Event&, WebCore::EventPath const&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x334e5e9) #44 0x22334e06d in WebCore::EventDispatcher::dispatchEvent(WebCore::Node&, WebCore::Event&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x334e06d) #45 0x22343eadf in WebCore::ScopedEventQueue::enqueueEvent(WTF::Ref<WebCore::Event, WTF::DumbPtrTraits<WebCore::Event> >&&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x343eadf) #46 0x22334db2d in WebCore::EventDispatcher::dispatchScopedEvent(WebCore::Node&, WebCore::Event&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x334db2d) #47 0x2231d0f13 in WebCore::dispatchChildRemovalEvents(WTF::Ref<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> >&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x31d0f13) #48 0x2231c29e5 in WebCore::ContainerNode::removeChild(WebCore::Node&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x31c29e5) #49 0x2231c1f4f in WebCore::ContainerNode::replaceChild(WebCore::Node&, WebCore::Node&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x31c1f4f) #50 0x22330d178 in WebCore::Element::setOuterHTML(WTF::String const&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x330d178) #51 0x220ad6c76 in WebCore::setJSElementOuterHTMLSetter(JSC::JSGlobalObject&, WebCore::JSElement&, JSC::JSValue, JSC::ThrowScope&)::'lambda'()::operator()() const (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0xad6c76) #52 0x220ad6b3b in std::__1::enable_if<!(std::is_same<void, decltype(fp1())>::value), void>::type WebCore::AttributeSetter::call<WebCore::setJSElementOuterHTMLSetter(JSC::JSGlobalObject&, WebCore::JSElement&, JSC::JSValue, JSC::ThrowScope&)::'lambda'()>(JSC::JSGlobalObject&, JSC::ThrowScope&, WebCore::setJSElementOuterHTMLSetter(JSC::JSGlobalObject&, WebCore::JSElement&, JSC::JSValue, JSC::ThrowScope&)::'lambda'()&&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0xad6b3b) #53 0x220ad68d0 in WebCore::setJSElementOuterHTMLSetter(JSC::JSGlobalObject&, WebCore::JSElement&, JSC::JSValue, JSC::ThrowScope&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0xad68d0) #54 0x220a214c7 in bool WebCore::IDLAttribute<WebCore::JSElement>::set<&(WebCore::setJSElementOuterHTMLSetter(JSC::JSGlobalObject&, WebCore::JSElement&, JSC::JSValue, JSC::ThrowScope&)), (WebCore::CastedThisErrorBehavior)0>(JSC::JSGlobalObject&, long long, long long, char const*) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0xa214c7) #55 0x23e9c5108 in JSC::callCustomSetter(JSC::JSGlobalObject*, bool (*)(JSC::JSGlobalObject*, long long, long long), bool, JSC::JSValue, JSC::JSValue) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x28f7108) #56 0x23e9c5245 in JSC::callCustomSetter(JSC::JSGlobalObject*, JSC::JSValue, bool, JSC::JSObject*, JSC::JSValue, JSC::JSValue) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x28f7245) #57 0x23ec15ae8 in JSC::JSObject::putInlineSlow(JSC::JSGlobalObject*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x2b47ae8) #58 0x23e5682fc in llint_slow_path_put_by_id (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x249a2fc) #59 0x23cbf0ac2 in llint_entry (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0xb22ac2) #60 0x23cbe6f88 in vmEntryToJavaScript (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0xb18f88) #61 0x23e2a2d20 in JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x21d4d20) #62 0x23e95a4bf in JSC::call(JSC::JSGlobalObject*, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x288c4bf) #63 0x23e95a87b in JSC::profiledCall(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x288c87b) #64 0x222b66fb3 in WebCore::JSExecState::profiledCall(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x2b66fb3) #65 0x222b90a89 in WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext&, WebCore::Event&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x2b90a89) #66 0x223365bb2 in WebCore::EventTarget::innerInvokeEventListeners(WebCore::Event&, WTF::Vector<WTF::RefPtr<WebCore::RegisteredEventListener, WTF::DumbPtrTraits<WebCore::RegisteredEventListener> >, 1ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>, WebCore::EventTarget::EventInvokePhase) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x3365bb2) #67 0x22336070e in WebCore::EventTarget::fireEventListeners(WebCore::Event&, WebCore::EventTarget::EventInvokePhase) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x336070e) #68 0x2241aa31d in WebCore::DOMWindow::dispatchEvent(WebCore::Event&, WebCore::EventTarget*) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x41aa31d) #69 0x2241bba08 in WebCore::DOMWindow::dispatchLoadEvent() (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x41bba08) #70 0x22322cf40 in WebCore::Document::dispatchWindowLoadEvent() (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x322cf40) #71 0x22322c9df in WebCore::Document::implicitClose() (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x322c9df) #72 0x223fdf2e2 in WebCore::FrameLoader::checkCompleted() (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x3fdf2e2) #73 0x223fdbb90 in WebCore::FrameLoader::finishedParsing() (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x3fdbb90) #74 0x22324a1b2 in WebCore::Document::finishedParsing() (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x324a1b2) #75 0x223ae24e0 in WebCore::HTMLDocumentParser::prepareToStopParsing() (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x3ae24e0) #76 0x223f6c70a in WebCore::DocumentWriter::end() (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x3f6c70a) #77 0x223f6b1f2 in WebCore::DocumentLoader::finishedLoading() (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x3f6b1f2) #78 0x223f6ab53 in WebCore::DocumentLoader::notifyFinished(WebCore::CachedResource&, WebCore::NetworkLoadMetrics const&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x3f6ab53) #79 0x22411137b in WebCore::CachedResource::checkNotify(WebCore::NetworkLoadMetrics const&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x411137b) #80 0x22410d22f in WebCore::CachedRawResource::finishLoading(WebCore::SharedBuffer*, WebCore::NetworkLoadMetrics const&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x410d22f) #81 0x22408b757 in WebCore::SubresourceLoader::didFinishLoading(WebCore::NetworkLoadMetrics const&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x408b757) #82 0x10ba5f6c6 in WebKit::WebResourceLoader::didFinishResourceLoad(WebCore::NetworkLoadMetrics const&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebKit.framework/Versions/A/WebKit:x86_64+0x19726c6) #83 0x10c12f896 in void IPC::handleMessage<Messages::WebResourceLoader::DidFinishResourceLoad, WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&)>(IPC::Decoder&, WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&)) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebKit.framework/Versions/A/WebKit:x86_64+0x2042896) #84 0x10c12ed0a in WebKit::WebResourceLoader::didReceiveWebResourceLoaderMessage(IPC::Connection&, IPC::Decoder&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebKit.framework/Versions/A/WebKit:x86_64+0x2041d0a) #85 0x10ba22ada in WebKit::NetworkProcessConnection::didReceiveMessage(IPC::Connection&, IPC::Decoder&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebKit.framework/Versions/A/WebKit:x86_64+0x1935ada) #86 0x10a172bce in IPC::Connection::dispatchMessage(IPC::Decoder&) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebKit.framework/Versions/A/WebKit:x86_64+0x85bce) #87 0x10a173898 in IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebKit.framework/Versions/A/WebKit:x86_64+0x86898) #88 0x10a174408 in IPC::Connection::dispatchOneIncomingMessage() (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebKit.framework/Versions/A/WebKit:x86_64+0x87408) #89 0x23c19426a in WTF::RunLoop::performWork() (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0xc626a) #90 0x23c194eaa in WTF::RunLoop::performWork(void*) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0xc6eaa) #91 0x7fff3ca6c31a in __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64+0x5731a) #92 0x7fff3ca6c2c0 in __CFRunLoopDoSource0 (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64+0x572c0) #93 0x7fff3ca501ba in __CFRunLoopDoSources0 (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64+0x3b1ba) #94 0x7fff3ca4f782 in __CFRunLoopRun (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64+0x3a782) #95 0x7fff3ca4f084 in CFRunLoopRunSpecific (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64+0x3a084) #96 0x7fff3ecc3a9e in -[NSRunLoop(NSRunLoop) runMode:beforeDate:] (/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation:x86_64+0x1ca9e) #97 0x7fff3ecc3973 in -[NSRunLoop(NSRunLoop) run] (/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation:x86_64+0x1c973) #98 0x7fff6913b1d6 in _xpc_objc_main (/usr/lib/system/libxpc.dylib:x86_64+0x111d6) #99 0x7fff6913acd8 in xpc_main (/usr/lib/system/libxpc.dylib:x86_64+0x10cd8) #100 0x10aa2649d in WebKit::XPCServiceMain(int, char const**) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebKit.framework/Versions/A/WebKit:x86_64+0x93949d) #101 0x7fff68f083d4 in start (/usr/lib/system/libdyld.dylib:x86_64+0x163d4) ==13664==Register values: rax = 0x0000000000000003 rbx = 0x00007ffee5b124a0 rcx = 0x0000100000000003 rdx = 0x0000000000000000 rdi = 0x0000000000000018 rsi = 0x0000000000000000 rbp = 0x00007ffee5b12160 rsp = 0x00007ffee5b12160 r8 = 0x0000100000000000 r9 = 0x0000000000000000 r10 = 0xffffffffffffffff r11 = 0xffffffffffffff60 r12 = 0x00007ffee5b121c0 r13 = 0x000061100010ddc0 r14 = 0x00007ffee5b12280 r15 = 0x0000000000000000 1665368 1 webkit-bug-importer 2020-06-23 07:20:15 -0700 <rdar://problem/64642628> 1665429 2 darin 2020-06-23 09:59:09 -0700 Proximate cause of the crash is calling positionInParentBeforeNode on nullptr in InsertTextCommand::doApply. Side comment not really about the bug: If positionInParentBeforeNode can’t handle nullptr, then it should take a Node&, not a Node*. 1719867 3 417697 rbuis 2021-01-15 07:14:49 -0800 Created attachment 417697 More reduced testcase 1720898 4 svillar 2021-01-20 09:03:00 -0800 (In reply to Darin Adler from comment #2) > Proximate cause of the crash is calling positionInParentBeforeNode on > nullptr in InsertTextCommand::doApply. Side comment not really about the > bug: If positionInParentBeforeNode can’t handle nullptr, then it should take > a Node&, not a Node*. That's right. I have inspected the callers and most of them do a null check before calling that method, but there are a few cases (like this one) that do not. We should indeed use a reference instead of a pointer here. 1725067 5 419117 svillar 2021-02-03 02:21:45 -0800 Created attachment 419117 Patch 1725068 6 419118 svillar 2021-02-03 02:24:37 -0800 Created attachment 419118 Test case This is the reduced and polished test case for the bug. I think we should land it later as this seems a security issue. 1725502 7 419117 rniwa 2021-02-03 22:24:40 -0800 Comment on attachment 419117 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=419117&action=review > Source/WebCore/editing/InsertTextCommand.cpp:147 > - if (endingSelection().isNone()) > + if (endingSelection().isNoneOrOrphaned()) This ain't right. deleteSelection tries to adjust its ending selection so that it stays in the document. Why are we getting an orphaned selection? Also, this doesn't seem like a security bug? Please add a test. r- due to the lack of a test. 1726640 8 419117 svillar 2021-02-08 07:43:57 -0800 Comment on attachment 419117 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=419117&action=review >> Source/WebCore/editing/InsertTextCommand.cpp:147 >> + if (endingSelection().isNoneOrOrphaned()) > > This ain't right. deleteSelection tries to adjust its ending selection so that it stays in the document. > Why are we getting an orphaned selection? > Also, this doesn't seem like a security bug? Please add a test. > r- due to the lack of a test. The selection is orphaned because deleting the selection might delete nodes. In particular the selection becomes orphaned in this loop https://webkit-search.igalia.com/webkit/source/Source/WebCore/editing/DeleteSelectionCommand.cpp#602. In the test case I'm attaching the final document does only have a body and no other element. I didn't upload a test because we were accessing an already deleted node. I thought invalid memory accesses were considered as security issues but I don't mind adding the test to the patch. 1726643 9 419593 svillar 2021-02-08 07:52:01 -0800 Created attachment 419593 Patch 1726696 10 419604 svillar 2021-02-08 10:47:40 -0800 Created attachment 419604 Patch 1726777 11 rniwa 2021-02-08 13:44:21 -0800 (In reply to Sergio Villar Senin from comment #8) > Comment on attachment 419117 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=419117&action=review > > >> Source/WebCore/editing/InsertTextCommand.cpp:147 > >> + if (endingSelection().isNoneOrOrphaned()) > > > > This ain't right. deleteSelection tries to adjust its ending selection so that it stays in the document. > > Why are we getting an orphaned selection? > > Also, this doesn't seem like a security bug? Please add a test. > > r- due to the lack of a test. > > The selection is orphaned because deleting the selection might delete nodes. > In particular the selection becomes orphaned in this loop > https://webkit-search.igalia.com/webkit/source/Source/WebCore/editing/ > DeleteSelectionCommand.cpp#602. In the test case I'm attaching the final > document does only have a body and no other element. That shouldn't be happening. removeNode uses removeNodeUpdatingStates to update the endingSelection. 1727091 12 svillar 2021-02-09 09:43:50 -0800 (In reply to Ryosuke Niwa from comment #11) > (In reply to Sergio Villar Senin from comment #8) > > Comment on attachment 419117 [details] > > Patch > > > > View in context: > > https://bugs.webkit.org/attachment.cgi?id=419117&action=review > > > > >> Source/WebCore/editing/InsertTextCommand.cpp:147 > > >> + if (endingSelection().isNoneOrOrphaned()) > > > > > > This ain't right. deleteSelection tries to adjust its ending selection so that it stays in the document. > > > Why are we getting an orphaned selection? > > > Also, this doesn't seem like a security bug? Please add a test. > > > r- due to the lack of a test. > > > > The selection is orphaned because deleting the selection might delete nodes. > > In particular the selection becomes orphaned in this loop > > https://webkit-search.igalia.com/webkit/source/Source/WebCore/editing/ > > DeleteSelectionCommand.cpp#602. In the test case I'm attaching the final > > document does only have a body and no other element. > > That shouldn't be happening. removeNode uses removeNodeUpdatingStates to > update the endingSelection. Well I'll try to describe what's going on. I think there is nothing wrong but you're the editing expert here :). So the deleteSelection() call triggers a node removal: (lldb) bt 10 * thread #1, queue = 'com.apple.main-thread', stop reason = breakpoint 2.1 * frame #0: 0x00000002feeab53c WebCore`WebCore::RemoveNodeCommand::doApply(this=0x000061200004a2c0) at RemoveNodeCommand.cpp:54:5 frame #1: 0x00000002fed26e4d WebCore`WebCore::CompositeEditCommand::applyCommandToComposite(this=0x000061600012c080, command=0x00007ffeed945360) at CompositeEditCommand.cpp:466:14 frame #2: 0x00000002fed22acd WebCore`WebCore::CompositeEditCommand::removeNode(this=0x000061600012c080, node=0x000061100010bd40, shouldAssumeContentIsAlwaysEditable=DoNotAssumeContentIsAlwaysEditable) at CompositeEditCommand.cpp:602:5 frame #3: 0x00000002fed6844c WebCore`WebCore::DeleteSelectionCommand::removeNodeUpdatingStates(this=0x000061600012c080, node=0x000061100010bd40, shouldAssumeContentIsAlwaysEditable=DoNotAssumeContentIsAlwaysEditable) at DeleteSelectionCommand.cpp:425:27 frame #4: 0x00000002fed69005 WebCore`WebCore::DeleteSelectionCommand::removeNode(this=0x000061600012c080, node=0x000061100010bd40, shouldAssumeContentIsAlwaysEditable=DoNotAssumeContentIsAlwaysEditable) at DeleteSelectionCommand.cpp:485:5 frame #5: 0x00000002fed6a4d6 WebCore`WebCore::DeleteSelectionCommand::handleGeneralDelete(this=0x000061600012c080) at DeleteSelectionCommand.cpp:611:17 frame #6: 0x00000002fed6fe2e WebCore`WebCore::DeleteSelectionCommand::doApply(this=0x000061600012c080) at DeleteSelectionCommand.cpp:939:5 That node removal, as you mentioned triggers a visible selection recalc: (lldb) bt 10 * thread #1, queue = 'com.apple.main-thread', stop reason = breakpoint 6.1 * frame #0: 0x00000002fef97a5f WebCore`WebCore::VisibleSelection::setWithoutValidation(this=0x0000613000080c30, anchor=0x00007ffeed944400, focus=0x00007ffeed944420) at VisibleSelection.cpp:434:5 frame #1: 0x00000002fee0f3b4 WebCore`WebCore::FrameSelection::respondToNodeModification(this=0x0000613000080c00, node=0x000061100010bd40, baseRemoved=true, extentRemoved=false, startRemoved=true, endRemoved=false) at FrameSelection.cpp:541:29 frame #2: 0x00000002fee0eeb8 WebCore`WebCore::FrameSelection::nodeWillBeRemoved(this=0x0000613000080c00, node=0x000061100010bd40) at FrameSelection.cpp:522:5 frame #3: 0x00000002fe633467 WebCore`WebCore::Document::nodeWillBeRemoved(this=0x000061f000069080, node=0x000061100010bd40) at Document.cpp:4761:28 frame #4: 0x00000002fe50d818 WebCore`WebCore::ContainerNode::removeNodeWithScriptAssertion(this=0x000060c0000e5d80, childToRemove=0x000061100010bd40, source=API) at ContainerNode.cpp:159:20 frame #5: 0x00000002fe50c78e WebCore`WebCore::ContainerNode::removeChild(this=0x000060c0000e5d80, oldChild=0x000061100010bd40) at ContainerNode.cpp:585:10 frame #6: 0x00000002fe9d18ea WebCore`WebCore::Node::remove(this=0x000061100010bd40) at Node.cpp:642:20 frame #7: 0x00000002feeab55b WebCore`WebCore::RemoveNodeCommand::doApply(this=0x000061200004a2c0) at RemoveNodeCommand.cpp:54:13 frame #8: 0x00000002fed26e4d WebCore`WebCore::CompositeEditCommand::applyCommandToComposite(this=0x000061600012c080, command=0x00007ffeed945360) at CompositeEditCommand.cpp:466:14 frame #9: 0x00000002fed22acd WebCore`WebCore::CompositeEditCommand::removeNode(this=0x000061600012c080, node=0x000061100010bd40, shouldAssumeContentIsAlwaysEditable=DoNotAssumeContentIsAlwaysEditable) at CompositeEditCommand.cpp:602:5 but as it can be seen the code is updating the FrameSelection::m_selection. The CompositeEditCommand::m_endingSelection is left untouched. So why the selection becomes orphan at that point? Basically because the anchorNode for the start position was removed from the tree by the deleteSelection() call above. So endingSelection().start().isOrphan() becomes true and thus endingSelection.isNoneOrOrphaned() becomes true too. I guess the question is now, is that behaviour correct, or should editor commands be notified about node removals as frame selection is? 1727457 13 rniwa 2021-02-10 00:50:29 -0800 (In reply to Sergio Villar Senin from comment #12) > > but as it can be seen the code is updating the FrameSelection::m_selection. > The CompositeEditCommand::m_endingSelection is left untouched. So why the > selection becomes orphan at that point? Basically because the anchorNode for > the start position was removed from the tree by the deleteSelection() call > above. So endingSelection().start().isOrphan() becomes true and thus > endingSelection.isNoneOrOrphaned() becomes true too. > > I guess the question is now, is that behaviour correct, or should editor > commands be notified about node removals as frame selection is? No, DeleteSelectionCommand::removeNode is supposed to be updating m_endingPosition not to be orphaned prior to deleting the node. See its definition: void DeleteSelectionCommand::removeNodeUpdatingStates(Node& node, ShouldAssumeContentIsAlwaysEditable shouldAssumeContentIsAlwaysEditable) { if (&node == m_startBlock && !isEndOfBlock(VisiblePosition(firstPositionInNode(m_startBlock.get())).previous())) m_needPlaceholder = true; else if (&node == m_endBlock && !isStartOfBlock(VisiblePosition(lastPositionInNode(m_startBlock.get())).next())) m_needPlaceholder = true; // FIXME: Update the endpoints of the range being deleted. updatePositionForNodeRemoval(m_endingPosition, node); // <- This is supposed to be adjusting m_endingPosition updatePositionForNodeRemoval(m_leadingWhitespace, node); updatePositionForNodeRemoval(m_trailingWhitespace, node); CompositeEditCommand::removeNode(node, shouldAssumeContentIsAlwaysEditable); } 1727699 14 419885 svillar 2021-02-10 12:09:58 -0800 Created attachment 419885 Patch 1727700 15 svillar 2021-02-10 12:12:36 -0800 Thanks for the good pointers Ryosuke, I think we're going now in the right direction because I can explain now why the test required a table with an empty row to reproduce the crash. There are another 2 raw calls to CompositeEditCommand::removeNode() in the same method. We'd likely want to replace them as well but the test case was not catching them. 1727918 16 419885 rniwa 2021-02-10 18:28:26 -0800 Comment on attachment 419885 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=419885&action=review > LayoutTests/ChangeLog:9 > + * editing/selection/insert-in-orphaned-selection-crash-expected.txt: Added. > + * editing/selection/insert-in-orphaned-selection-crash.html: Added. Please put this under editing/deleting. > LayoutTests/editing/selection/insert-in-orphaned-selection-crash-expected.txt:1 > +CONSOLE MESSAGE: NotFoundError: The object can not be found here. Can we spit out some text at the end of like this? PASS. WebKit didn't crash. 1727919 17 rniwa 2021-02-10 18:28:54 -0800 I don't think there is any security implication here. 1727992 18 419885 svillar 2021-02-11 00:57:02 -0800 Comment on attachment 419885 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=419885&action=review >> LayoutTests/ChangeLog:9 >> + * editing/selection/insert-in-orphaned-selection-crash.html: Added. > > Please put this under editing/deleting. OK >> LayoutTests/editing/selection/insert-in-orphaned-selection-crash-expected.txt:1 >> +CONSOLE MESSAGE: NotFoundError: The object can not be found here. > > Can we spit out some text at the end of like this? > PASS. WebKit didn't crash. I tried but the problem is that the test selects and deletes all the nodes of the sample. I can try to inject some test after the deletion happens. 1727997 19 rniwa 2021-02-11 01:11:08 -0800 (In reply to Sergio Villar Senin from comment #18) > Comment on attachment 419885 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=419885&action=review > > >> LayoutTests/ChangeLog:9 > >> + * editing/selection/insert-in-orphaned-selection-crash.html: Added. > > > > Please put this under editing/deleting. > > OK > > >> LayoutTests/editing/selection/insert-in-orphaned-selection-crash-expected.txt:1 > >> +CONSOLE MESSAGE: NotFoundError: The object can not be found here. > > > > Can we spit out some text at the end of like this? > > PASS. WebKit didn't crash. > > I tried but the problem is that the test selects and deletes all the nodes > of the sample. I can try to inject some test after the deletion happens. Yes, you can call waitUntilDone and just do: document.open/document.write to start afresh! 1728040 20 419977 svillar 2021-02-11 05:10:05 -0800 Created attachment 419977 Patch for landing 1728046 21 svillar 2021-02-11 05:48:39 -0800 (In reply to Ryosuke Niwa from comment #19) > (In reply to Sergio Villar Senin from comment #18) > > Comment on attachment 419885 [details] > > Patch > > > > View in context: > > https://bugs.webkit.org/attachment.cgi?id=419885&action=review > > > > >> LayoutTests/ChangeLog:9 > > >> + * editing/selection/insert-in-orphaned-selection-crash.html: Added. > > > > > > Please put this under editing/deleting. > > > > OK > > > > >> LayoutTests/editing/selection/insert-in-orphaned-selection-crash-expected.txt:1 > > >> +CONSOLE MESSAGE: NotFoundError: The object can not be found here. > > > > > > Can we spit out some text at the end of like this? > > > PASS. WebKit didn't crash. > > > > I tried but the problem is that the test selects and deletes all the nodes > > of the sample. I can try to inject some test after the deletion happens. > > Yes, you can call waitUntilDone and just do: document.open/document.write to > start afresh! Ah that's a good suggestion. I ended up doing a console.log(), would you like me to replace it? 1728490 22 rniwa 2021-02-12 01:32:07 -0800 (In reply to Sergio Villar Senin from comment #21) > (In reply to Ryosuke Niwa from comment #19) > > (In reply to Sergio Villar Senin from comment #18) > > > Comment on attachment 419885 [details] > > > Patch > > > > > > View in context: > > > https://bugs.webkit.org/attachment.cgi?id=419885&action=review > > > > > > >> LayoutTests/ChangeLog:9 > > > >> + * editing/selection/insert-in-orphaned-selection-crash.html: Added. > > > > > > > > Please put this under editing/deleting. > > > > > > OK > > > > > > >> LayoutTests/editing/selection/insert-in-orphaned-selection-crash-expected.txt:1 > > > >> +CONSOLE MESSAGE: NotFoundError: The object can not be found here. > > > > > > > > Can we spit out some text at the end of like this? > > > > PASS. WebKit didn't crash. > > > > > > I tried but the problem is that the test selects and deletes all the nodes > > > of the sample. I can try to inject some test after the deletion happens. > > > > Yes, you can call waitUntilDone and just do: document.open/document.write to > > start afresh! > > Ah that's a good suggestion. I ended up doing a console.log(), would you > like me to replace it? console.log is okay too. 1728525 23 svillar 2021-02-12 03:29:40 -0800 Committed r272779: <https://commits.webkit.org/r272779> 402555 2020-06-23 07:19:56 -0700 2020-06-23 07:19:56 -0700 Minimal test case inserted-text-command-do-apply.html text/html 1313 ajuma PHNjcmlwdCB0eXBlPSJ0ZXh0L2phdmFzY3JpcHQiPg0KZnVuY3Rpb24gZXZlbnRfaGFuZGxlcl8x MjUyX0RPTU5vZGVSZW1vdmVkKCkgew0KICBkb2N1bWVudC5kZXNpZ25Nb2RlID0gZG9jdW1lbnQu ZGVzaWduTW9kZSA9PSAib24iID8gIm9mZiIgOiAib24iOw0KICBkb2N1bWVudC5leGVjQ29tbWFu ZCgiU2VsZWN0QWxsIikNCn0NCmRvY3VtZW50LmFkZEV2ZW50TGlzdGVuZXIoIkRPTU5vZGVSZW1v dmVkIiwgZXZlbnRfaGFuZGxlcl8xMjUyX0RPTU5vZGVSZW1vdmVkKTsNCmZ1bmN0aW9uIGV2ZW50 X2hhbmRsZXJfMTI1M19ET01Gb2N1c0luKCkgew0KICBkb2N1bWVudC5leGVjQ29tbWFuZCgnSW5z ZXJ0VGV4dCcpOw0KfQ0KZG9jdW1lbnQuYWRkRXZlbnRMaXN0ZW5lcigiRE9NRm9jdXNJbiIsIGV2 ZW50X2hhbmRsZXJfMTI1M19ET01Gb2N1c0luKTsNCndpbmRvdy5vbmxvYWQ9ZnVuY3Rpb24oKXsN CiAgdmFyIG9FbGVtZW50ID1mdW5jdGlvbigpew0KICAgIHZhciBhb0VsZW1lbnRzID0gZG9jdW1l bnQuZ2V0RWxlbWVudHNCeVRhZ05hbWUoIioiKTsNCiAgICBpZiAoYW9FbGVtZW50cy5sZW5ndGgp IHJldHVybiBhb0VsZW1lbnRzWzU5ICUgYW9FbGVtZW50cy5sZW5ndGhdOw0KICB9KCk7DQpvRWxl bWVudC5vdXRlckhUTUwgPSAiIg0KfTsNCjwvc2NyaXB0Pg0KPHN0eWxlIHR5cGU9InRleHQvY3Nz IiB0aXRsZT0iQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFB QUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUEgQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFB QUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUEi IHhtbDpsYW5nPSJlbiI+DQoqe21pbi13aWR0aDppbnRyaW5zaWM7LXdlYmtpdC1hcHBlYXJhbmNl OmRlZmF1bHQtYnV0dG9uO2xpc3Qtc3R5bGUtdHlwZTpsb3dlci1yb21hbjtiYWNrZ3JvdW5kLW9y aWdpbjppbmhlcml0O21heC13aWR0aDppbml0aWFsO2Rpc3BsYXk6cnVuLWluOy13ZWJraXQtd3Jh cC10aHJvdWdoOmluaGVyaXQ7YmFja2dyb3VuZC1zaXplOmNvbnRhaW47LXdlYmtpdC1hbmltYXRp b24tZGlyZWN0aW9uOmFsdGVybmF0ZS1yZXZlcnNlOy13ZWJraXQtYW5pbWF0aW9uLWl0ZXJhdGlv bi1jb3VudDpwYXVzZWQ7fQ0KPC9zdHlsZT4NCjxoNCBjbGFzcyJwcmVzZXJ2ZSI+DQo8dGV4dGFy ZWE+DQo8L3RleHRhcmVhPg0KPC9oND4NCjx0YWJsZSBjbGFzcz0iQ0xBU1M3IiBkaXI9InJ0bCIg ZnJhbWU9InZzaWRlcyI+DQo8dHIgY2xhc3M9IkNMQVNTMTEgQ0xBU1M4IiBhbGlnbj0icmlnaHQi Pg0= 417697 2021-01-15 07:14:49 -0800 2021-02-03 02:24:37 -0800 More reduced testcase bug213514.html text/html 402 rbuis PHNjcmlwdD4NCmRvY3VtZW50LmFkZEV2ZW50TGlzdGVuZXIoIkRPTU5vZGVSZW1vdmVkIiwgZnVu Y3Rpb24gKCkgeyBkb2N1bWVudC5kZXNpZ25Nb2RlID0gIm9uIjsgZG9jdW1lbnQuZXhlY0NvbW1h bmQoIlNlbGVjdEFsbCIpOyB9KTsNCmRvY3VtZW50LmFkZEV2ZW50TGlzdGVuZXIoIkRPTUZvY3Vz SW4iLCBmdW5jdGlvbigpIHsgZG9jdW1lbnQuZXhlY0NvbW1hbmQoJ0luc2VydFRleHQnKTsgfSk7 DQp3aW5kb3cub25sb2FkPWZ1bmN0aW9uKCkgeyBkaXYub3V0ZXJIVE1MID0gIiI7IH07DQo8L3Nj cmlwdD4NCjxzdHlsZT4NCiogeyAtd2Via2l0LWFwcGVhcmFuY2U6ZGVmYXVsdC1idXR0b247IH0N Cjwvc3R5bGU+DQo8ZGl2IGlkPSJkaXYiPg0KPC9kaXY+DQo8dGFibGUgZGlyPSJydGwiPg0KPHRy Pg0K 419117 2021-02-03 02:21:45 -0800 2021-02-08 07:51:55 -0800 Patch bug-213514-20210203112144.patch text/plain 2059 svillar U3VidmVyc2lvbiBSZXZpc2lvbjogMjcyMjMwCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggNWFhYjAwNmQ4OTVhNGQz ZmNjNWRmZjRlZTc4ODc1N2U0YjAyZDY1Ny4uYTYzZWU4MWRkZjlhYjQxZjc4NDU0NjExNjc3MTAw MTQ1ZjI4YjBkYyAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE3IEBACisyMDIxLTAyLTAzICBTZXJn aW8gVmlsbGFyIFNlbmluICA8c3ZpbGxhckBpZ2FsaWEuY29tPgorCisgICAgICAgIERvIG5vdCBy dW4gSW5zZXJ0VGV4dENvbW1hbmQgaWYgdGhlIHNlbGVjdGlvbiBpcyBvdXQgb2YgYSB2YWxpZCBw b3NpdGlvbgorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9 MjEzNTE0CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAg VGhlIGZpcnN0IHRoaW5nIHRoZSBJbnNlcnRUZXh0IGNvbW1hbmQgZG9lcyBpdCB0byBkZWxldGUg dGhlIGN1cnJlbnQgc2VsZWN0aW9uLiBEZWxldGluZyB0aGUgc2VsZWN0aW9uCisgICAgICAgIG1p Z2h0IGxlYXZlIHRoZSBjdXJyZW50IHNlbGVjdGlvbiBvdXQgb2YgYSB2YWxpZCBwb3NpdGlvbiwg aS5lLiBvcnBoYW4gb2YgYSB0cmVlIE5vZGUuIEluIHRob3NlIGNhc2VzCisgICAgICAgIHdlIHNo b3VsZCBzaW1wbHkgYmFpbCBvdXQgYW5kIG5vdCB0cnkgdG8gcnVuIHRoZSBjb21tYW5kIGJlY2F1 c2UgdGhlIHNlbGVjdGVkIHBvc2l0aW9ucyB3aWxsIGJlIHdyb25nLgorCisgICAgICAgICogZWRp dGluZy9JbnNlcnRUZXh0Q29tbWFuZC5jcHA6IFJlcGxhY2Ugc2VsZWN0aW9uLmlzTm9uZSgpIGJ5 IHNlbGVjdGlvbi5pc05vbmVPck9ycGhhbmVkKCkuCisgICAgICAgIChXZWJDb3JlOjpJbnNlcnRU ZXh0Q29tbWFuZDo6ZG9BcHBseSk6CisKIDIwMjEtMDItMDIgIENocmlzIER1bWV6ICA8Y2R1bWV6 QGFwcGxlLmNvbT4KIAogICAgICAgICBBc3NlcnRpb24gZmFpbHVyZSB3aGVuIGNhbGxpbmcgbWF0 Y2hNZWRpYSgnYScucmVwZWF0KDIgKiogMzApKSBpbiBKUwpkaWZmIC0tZ2l0IGEvU291cmNlL1dl YkNvcmUvZWRpdGluZy9JbnNlcnRUZXh0Q29tbWFuZC5jcHAgYi9Tb3VyY2UvV2ViQ29yZS9lZGl0 aW5nL0luc2VydFRleHRDb21tYW5kLmNwcAppbmRleCBlNmE2YzllNDNlYTFkMzIwYTVmOTExZGE4 ZjdhN2NmMWM5ZmI0ZDg3Li4wYzI4NDdkMTMwMjdlYzZmNmJiMmU3YmMxZjZlZTQwODkyODNhMTli IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9lZGl0aW5nL0luc2VydFRleHRDb21tYW5kLmNw cAorKysgYi9Tb3VyY2UvV2ViQ29yZS9lZGl0aW5nL0luc2VydFRleHRDb21tYW5kLmNwcApAQCAt MTQ0LDcgKzE0NCw3IEBAIHZvaWQgSW5zZXJ0VGV4dENvbW1hbmQ6OmRvQXBwbHkoKQogICAgICAg ICAvLyBkZWxldGVTZWxlY3Rpb24gZXZlbnR1YWxseSBtYWtlcyBhIG5ldyBlbmRpbmdTZWxlY3Rp b24gb3V0IG9mIGEgUG9zaXRpb24uIElmIHRoYXQgUG9zaXRpb24gZG9lc24ndCBoYXZlCiAgICAg ICAgIC8vIGEgcmVuZGVyZXIgKGUuZy4gaXQgaXMgb24gYSA8ZnJhbWVzZXQ+IGluIHRoZSBET00p LCB0aGUgVmlzaWJsZVNlbGVjdGlvbiBjYW5ub3QgYmUgY2Fub25pY2FsaXplZCB0byAKICAgICAg ICAgLy8gYW55dGhpbmcgb3RoZXIgdGhhbiBOb1NlbGVjdGlvbi4gVGhlIHJlc3Qgb2YgdGhpcyBm dW5jdGlvbiByZXF1aXJlcyBhIHJlYWwgZW5kaW5nU2VsZWN0aW9uLCBzbyBiYWlsIG91dC4KLSAg ICAgICAgaWYgKGVuZGluZ1NlbGVjdGlvbigpLmlzTm9uZSgpKQorICAgICAgICBpZiAoZW5kaW5n U2VsZWN0aW9uKCkuaXNOb25lT3JPcnBoYW5lZCgpKQogICAgICAgICAgICAgcmV0dXJuOwogICAg IH0gZWxzZSBpZiAoZG9jdW1lbnQoKS5lZGl0b3IoKS5pc092ZXJ3cml0ZU1vZGVFbmFibGVkKCkp IHsKICAgICAgICAgaWYgKHBlcmZvcm1PdmVyd3JpdGUobV90ZXh0LCBtX3NlbGVjdEluc2VydGVk VGV4dCkpCg== 419118 2021-02-03 02:24:37 -0800 2021-02-03 02:24:37 -0800 Test case bug213514-quirks.html text/html 526 svillar PHN0eWxlPgogKiB7IC13ZWJraXQtYXBwZWFyYW5jZTpkZWZhdWx0LWJ1dHRvbjsgfQo8L3N0eWxl Pgo8c2NyaXB0PgogZG9jdW1lbnQuYWRkRXZlbnRMaXN0ZW5lcigiRE9NTm9kZVJlbW92ZWQiLCBm dW5jdGlvbiAoKSB7CiAgICAgZG9jdW1lbnQuZGVzaWduTW9kZSA9IGRvY3VtZW50LmRlc2lnbk1v ZGUgPT0gIm9uIiA/ICJvZmYiIDogIm9uIjsKICAgICBkb2N1bWVudC5leGVjQ29tbWFuZCgiU2Vs ZWN0QWxsIikKIH0pOwogZG9jdW1lbnQuYWRkRXZlbnRMaXN0ZW5lcigiRE9NRm9jdXNJbiIsIGZ1 bmN0aW9uICgpIHsKICAgICBkb2N1bWVudC5leGVjQ29tbWFuZCgnSW5zZXJ0VGV4dCcpOwogfSk7 CiB3aW5kb3cub25sb2FkID0gZnVuY3Rpb24oKXsKICAgICBkb2N1bWVudC5nZXRFbGVtZW50c0J5 VGFnTmFtZSgiZGl2IilbMF0ucmVtb3ZlKCk7CiB9Owo8L3NjcmlwdD4KPGRpdj4KICAgIDx0ZXh0 YXJlYT48L3RleHRhcmVhPgo8L2Rpdj4KPHRhYmxlIGZyYW1lPSJ2c2lkZXMiPgogICAgPHRyPjwv dHI+CjwvdGFibGU+Cg== 419593 2021-02-08 07:52:01 -0800 2021-02-08 10:47:33 -0800 Patch bug-213514-20210208165159.patch text/plain 4244 svillar U3VidmVyc2lvbiBSZXZpc2lvbjogMjcyNDg3CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggNTYzOTVlNzY5ZDk5Yjhk NDM2NWRmOWUyOTUwM2NjZmY0NGU0MTQ5ZC4uZDgxNzMzOTc3YzczNGY2NmY3NmE2MjQzODdlMDMy ZGM2MzdkMTkzYSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE3IEBACisyMDIxLTAyLTA4ICBTZXJn aW8gVmlsbGFyIFNlbmluICA8c3ZpbGxhckBpZ2FsaWEuY29tPgorCisgICAgICAgIERvIG5vdCBy dW4gSW5zZXJ0VGV4dENvbW1hbmQgaWYgdGhlIHNlbGVjdGlvbiBpcyBvdXQgb2YgYSB2YWxpZCBw b3NpdGlvbgorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9 MjEzNTE0CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAg VGhlIGZpcnN0IHRoaW5nIHRoZSBJbnNlcnRUZXh0IGNvbW1hbmQgZG9lcyBpdCB0byBkZWxldGUg dGhlIGN1cnJlbnQgc2VsZWN0aW9uLiBEZWxldGluZyB0aGUgc2VsZWN0aW9uCisgICAgICAgIG1p Z2h0IGxlYXZlIHRoZSBjdXJyZW50IHNlbGVjdGlvbiBvdXQgb2YgYSB2YWxpZCBwb3NpdGlvbiwg aS5lLiBvcnBoYW4gb2YgYSB0cmVlIE5vZGUuIEluIHRob3NlIGNhc2VzCisgICAgICAgIHdlIHNo b3VsZCBzaW1wbHkgYmFpbCBvdXQgYW5kIG5vdCB0cnkgdG8gcnVuIHRoZSBjb21tYW5kIGJlY2F1 c2UgdGhlIHNlbGVjdGVkIHBvc2l0aW9ucyB3aWxsIGJlIHdyb25nLgorCisgICAgICAgICogZWRp dGluZy9JbnNlcnRUZXh0Q29tbWFuZC5jcHA6IFJlcGxhY2Ugc2VsZWN0aW9uLmlzTm9uZSgpIGJ5 IHNlbGVjdGlvbi5pc05vbmVPck9ycGhhbmVkKCkuCisgICAgICAgIChXZWJDb3JlOjpJbnNlcnRU ZXh0Q29tbWFuZDo6ZG9BcHBseSk6CisKIDIwMjEtMDItMDggIEFudG9pbmUgUXVpbnQgIDxncmFv dXRzQHdlYmtpdC5vcmc+CiAKICAgICAgICAgRGVwcmVjYXRpb24gd2FybmluZ3MgZm9yIE5TSW1h Z2VIaW50U3ltYm9sRm9udCBhbmQgTlNJbWFnZUhpbnRTeW1ib2xTY2FsZQpkaWZmIC0tZ2l0IGEv U291cmNlL1dlYkNvcmUvZWRpdGluZy9JbnNlcnRUZXh0Q29tbWFuZC5jcHAgYi9Tb3VyY2UvV2Vi Q29yZS9lZGl0aW5nL0luc2VydFRleHRDb21tYW5kLmNwcAppbmRleCBlNmE2YzllNDNlYTFkMzIw YTVmOTExZGE4ZjdhN2NmMWM5ZmI0ZDg3Li4wYzI4NDdkMTMwMjdlYzZmNmJiMmU3YmMxZjZlZTQw ODkyODNhMTliIDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9lZGl0aW5nL0luc2VydFRleHRD b21tYW5kLmNwcAorKysgYi9Tb3VyY2UvV2ViQ29yZS9lZGl0aW5nL0luc2VydFRleHRDb21tYW5k LmNwcApAQCAtMTQ0LDcgKzE0NCw3IEBAIHZvaWQgSW5zZXJ0VGV4dENvbW1hbmQ6OmRvQXBwbHko KQogICAgICAgICAvLyBkZWxldGVTZWxlY3Rpb24gZXZlbnR1YWxseSBtYWtlcyBhIG5ldyBlbmRp bmdTZWxlY3Rpb24gb3V0IG9mIGEgUG9zaXRpb24uIElmIHRoYXQgUG9zaXRpb24gZG9lc24ndCBo YXZlCiAgICAgICAgIC8vIGEgcmVuZGVyZXIgKGUuZy4gaXQgaXMgb24gYSA8ZnJhbWVzZXQ+IGlu IHRoZSBET00pLCB0aGUgVmlzaWJsZVNlbGVjdGlvbiBjYW5ub3QgYmUgY2Fub25pY2FsaXplZCB0 byAKICAgICAgICAgLy8gYW55dGhpbmcgb3RoZXIgdGhhbiBOb1NlbGVjdGlvbi4gVGhlIHJlc3Qg b2YgdGhpcyBmdW5jdGlvbiByZXF1aXJlcyBhIHJlYWwgZW5kaW5nU2VsZWN0aW9uLCBzbyBiYWls IG91dC4KLSAgICAgICAgaWYgKGVuZGluZ1NlbGVjdGlvbigpLmlzTm9uZSgpKQorICAgICAgICBp ZiAoZW5kaW5nU2VsZWN0aW9uKCkuaXNOb25lT3JPcnBoYW5lZCgpKQogICAgICAgICAgICAgcmV0 dXJuOwogICAgIH0gZWxzZSBpZiAoZG9jdW1lbnQoKS5lZGl0b3IoKS5pc092ZXJ3cml0ZU1vZGVF bmFibGVkKCkpIHsKICAgICAgICAgaWYgKHBlcmZvcm1PdmVyd3JpdGUobV90ZXh0LCBtX3NlbGVj dEluc2VydGVkVGV4dCkpCmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cgYi9MYXlv dXRUZXN0cy9DaGFuZ2VMb2cKaW5kZXggNzNlODg1MzQ2YWY4NGNlNWVmNDI0YTYzNmFhOGIxNWNi MDlkZTM5MS4uMjAwNGRkZmY2M2ViODIyOTUzOWZmMWI3ODRjOTFmNjY1ZmQ0ZDRkOSAxMDA2NDQK LS0tIGEvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCisrKyBiL0xheW91dFRlc3RzL0NoYW5nZUxvZwpA QCAtMSwzICsxLDEzIEBACisyMDIxLTAyLTA4ICBTZXJnaW8gVmlsbGFyIFNlbmluICA8c3ZpbGxh ckBpZ2FsaWEuY29tPgorCisgICAgICAgIERvIG5vdCBydW4gSW5zZXJ0VGV4dENvbW1hbmQgaWYg dGhlIHNlbGVjdGlvbiBpcyBvdXQgb2YgYSB2YWxpZCBwb3NpdGlvbgorICAgICAgICBodHRwczov L2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjEzNTE0CisKKyAgICAgICAgUmV2aWV3 ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgKiBlZGl0aW5nL3NlbGVjdGlvbi9pbnNl cnQtaW4tb3JwaGFuZWQtc2VsZWN0aW9uLWNyYXNoLWV4cGVjdGVkLnR4dDogQWRkZWQuCisgICAg ICAgICogZWRpdGluZy9zZWxlY3Rpb24vaW5zZXJ0LWluLW9ycGhhbmVkLXNlbGVjdGlvbi1jcmFz aC5odG1sOiBBZGRlZC4KKwogMjAyMS0wMi0wOCAgUGhpbGlwcGUgTm9ybWFuZCAgPHBub3JtYW5k QGlnYWxpYS5jb20+CiAKICAgICAgICAgUGVybWlzc2lvbiByZXF1ZXN0IEFQSSBmb3IgTWVkaWFL ZXlTeXN0ZW0gYWNjZXNzIHN1cHBvcnQKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL2VkaXRpbmcv c2VsZWN0aW9uL2luc2VydC1pbi1vcnBoYW5lZC1zZWxlY3Rpb24tY3Jhc2gtZXhwZWN0ZWQudHh0 IGIvTGF5b3V0VGVzdHMvZWRpdGluZy9zZWxlY3Rpb24vaW5zZXJ0LWluLW9ycGhhbmVkLXNlbGVj dGlvbi1jcmFzaC1leHBlY3RlZC50eHQKbmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMC4uZGM5MDBkZjVlMDg3ODNlZjljY2Ri NjRiOTFiNmNjNjRmMmNlMGIzYgotLS0gL2Rldi9udWxsCisrKyBiL0xheW91dFRlc3RzL2VkaXRp bmcvc2VsZWN0aW9uL2luc2VydC1pbi1vcnBoYW5lZC1zZWxlY3Rpb24tY3Jhc2gtZXhwZWN0ZWQu dHh0CkBAIC0wLDAgKzEgQEAKK0NPTlNPTEUgTUVTU0FHRTogTm90Rm91bmRFcnJvcjogVGhlIG9i amVjdCBjYW4gbm90IGJlIGZvdW5kIGhlcmUuCmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9lZGl0 aW5nL3NlbGVjdGlvbi9pbnNlcnQtaW4tb3JwaGFuZWQtc2VsZWN0aW9uLWNyYXNoLmh0bWwgYi9M YXlvdXRUZXN0cy9lZGl0aW5nL3NlbGVjdGlvbi9pbnNlcnQtaW4tb3JwaGFuZWQtc2VsZWN0aW9u LWNyYXNoLmh0bWwKbmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMC4uMDkwZDJjOTU3ZGYwNDk5OTQzZmZiZjJkZWNkODNkMTcw YTRjZmMzOAotLS0gL2Rldi9udWxsCisrKyBiL0xheW91dFRlc3RzL2VkaXRpbmcvc2VsZWN0aW9u L2luc2VydC1pbi1vcnBoYW5lZC1zZWxlY3Rpb24tY3Jhc2guaHRtbApAQCAtMCwwICsxLDIzIEBA Cis8c3R5bGU+CisgKiB7IC13ZWJraXQtYXBwZWFyYW5jZTpkZWZhdWx0LWJ1dHRvbjsgfQorPC9z dHlsZT4KKzxzY3JpcHQ+CitpZiAod2luZG93LnRlc3RSdW5uZXIpCisgICAgdGVzdFJ1bm5lci5k dW1wQXNUZXh0KCk7Citkb2N1bWVudC5hZGRFdmVudExpc3RlbmVyKCJET01Ob2RlUmVtb3ZlZCIs ICBmdW5jdGlvbiAoKSB7CisgICAgZG9jdW1lbnQuZGVzaWduTW9kZSA9IGRvY3VtZW50LmRlc2ln bk1vZGUgPT0gIm9uIiA/ICJvZmYiIDogIm9uIjsKKyAgICBkb2N1bWVudC5leGVjQ29tbWFuZCgi U2VsZWN0QWxsIik7Cit9KTsKK2RvY3VtZW50LmFkZEV2ZW50TGlzdGVuZXIoIkRPTUZvY3VzSW4i LCAgZnVuY3Rpb24gKCkgeworICAgIGRvY3VtZW50LmV4ZWNDb21tYW5kKCdJbnNlcnRUZXh0Jyk7 Cit9KTsKK3dpbmRvdy5vbmxvYWQgPSBmdW5jdGlvbigpIHsKKyAgICBkb2N1bWVudC5nZXRFbGVt ZW50c0J5VGFnTmFtZSgiZGl2IilbMF0ucmVtb3ZlKCk7Cit9OworPC9zY3JpcHQ+Cis8ZGl2Pgor ICAgIDx0ZXh0YXJlYT48L3RleHRhcmVhPgorPC9kaXY+Cis8dGFibGUgZnJhbWU9InZzaWRlcyI+ CisgICAgPHRyPjwvdHI+Cis8L3RhYmxlPgo= 419604 2021-02-08 10:47:40 -0800 2021-02-10 12:09:52 -0800 Patch bug-213514-20210208194738.patch text/plain 4248 svillar U3VidmVyc2lvbiBSZXZpc2lvbjogMjcyNDg3CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggNTYzOTVlNzY5ZDk5Yjhk NDM2NWRmOWUyOTUwM2NjZmY0NGU0MTQ5ZC4uZDgxNzMzOTc3YzczNGY2NmY3NmE2MjQzODdlMDMy ZGM2MzdkMTkzYSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE3IEBACisyMDIxLTAyLTA4ICBTZXJn aW8gVmlsbGFyIFNlbmluICA8c3ZpbGxhckBpZ2FsaWEuY29tPgorCisgICAgICAgIERvIG5vdCBy dW4gSW5zZXJ0VGV4dENvbW1hbmQgaWYgdGhlIHNlbGVjdGlvbiBpcyBvdXQgb2YgYSB2YWxpZCBw b3NpdGlvbgorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9 MjEzNTE0CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAg VGhlIGZpcnN0IHRoaW5nIHRoZSBJbnNlcnRUZXh0IGNvbW1hbmQgZG9lcyBpdCB0byBkZWxldGUg dGhlIGN1cnJlbnQgc2VsZWN0aW9uLiBEZWxldGluZyB0aGUgc2VsZWN0aW9uCisgICAgICAgIG1p Z2h0IGxlYXZlIHRoZSBjdXJyZW50IHNlbGVjdGlvbiBvdXQgb2YgYSB2YWxpZCBwb3NpdGlvbiwg aS5lLiBvcnBoYW4gb2YgYSB0cmVlIE5vZGUuIEluIHRob3NlIGNhc2VzCisgICAgICAgIHdlIHNo b3VsZCBzaW1wbHkgYmFpbCBvdXQgYW5kIG5vdCB0cnkgdG8gcnVuIHRoZSBjb21tYW5kIGJlY2F1 c2UgdGhlIHNlbGVjdGVkIHBvc2l0aW9ucyB3aWxsIGJlIHdyb25nLgorCisgICAgICAgICogZWRp dGluZy9JbnNlcnRUZXh0Q29tbWFuZC5jcHA6IFJlcGxhY2Ugc2VsZWN0aW9uLmlzTm9uZSgpIGJ5 IHNlbGVjdGlvbi5pc05vbmVPck9ycGhhbmVkKCkuCisgICAgICAgIChXZWJDb3JlOjpJbnNlcnRU ZXh0Q29tbWFuZDo6ZG9BcHBseSk6CisKIDIwMjEtMDItMDggIEFudG9pbmUgUXVpbnQgIDxncmFv dXRzQHdlYmtpdC5vcmc+CiAKICAgICAgICAgRGVwcmVjYXRpb24gd2FybmluZ3MgZm9yIE5TSW1h Z2VIaW50U3ltYm9sRm9udCBhbmQgTlNJbWFnZUhpbnRTeW1ib2xTY2FsZQpkaWZmIC0tZ2l0IGEv U291cmNlL1dlYkNvcmUvZWRpdGluZy9JbnNlcnRUZXh0Q29tbWFuZC5jcHAgYi9Tb3VyY2UvV2Vi Q29yZS9lZGl0aW5nL0luc2VydFRleHRDb21tYW5kLmNwcAppbmRleCBlNmE2YzllNDNlYTFkMzIw YTVmOTExZGE4ZjdhN2NmMWM5ZmI0ZDg3Li4wYzI4NDdkMTMwMjdlYzZmNmJiMmU3YmMxZjZlZTQw ODkyODNhMTliIDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9lZGl0aW5nL0luc2VydFRleHRD b21tYW5kLmNwcAorKysgYi9Tb3VyY2UvV2ViQ29yZS9lZGl0aW5nL0luc2VydFRleHRDb21tYW5k LmNwcApAQCAtMTQ0LDcgKzE0NCw3IEBAIHZvaWQgSW5zZXJ0VGV4dENvbW1hbmQ6OmRvQXBwbHko KQogICAgICAgICAvLyBkZWxldGVTZWxlY3Rpb24gZXZlbnR1YWxseSBtYWtlcyBhIG5ldyBlbmRp bmdTZWxlY3Rpb24gb3V0IG9mIGEgUG9zaXRpb24uIElmIHRoYXQgUG9zaXRpb24gZG9lc24ndCBo YXZlCiAgICAgICAgIC8vIGEgcmVuZGVyZXIgKGUuZy4gaXQgaXMgb24gYSA8ZnJhbWVzZXQ+IGlu IHRoZSBET00pLCB0aGUgVmlzaWJsZVNlbGVjdGlvbiBjYW5ub3QgYmUgY2Fub25pY2FsaXplZCB0 byAKICAgICAgICAgLy8gYW55dGhpbmcgb3RoZXIgdGhhbiBOb1NlbGVjdGlvbi4gVGhlIHJlc3Qg b2YgdGhpcyBmdW5jdGlvbiByZXF1aXJlcyBhIHJlYWwgZW5kaW5nU2VsZWN0aW9uLCBzbyBiYWls IG91dC4KLSAgICAgICAgaWYgKGVuZGluZ1NlbGVjdGlvbigpLmlzTm9uZSgpKQorICAgICAgICBp ZiAoZW5kaW5nU2VsZWN0aW9uKCkuaXNOb25lT3JPcnBoYW5lZCgpKQogICAgICAgICAgICAgcmV0 dXJuOwogICAgIH0gZWxzZSBpZiAoZG9jdW1lbnQoKS5lZGl0b3IoKS5pc092ZXJ3cml0ZU1vZGVF bmFibGVkKCkpIHsKICAgICAgICAgaWYgKHBlcmZvcm1PdmVyd3JpdGUobV90ZXh0LCBtX3NlbGVj dEluc2VydGVkVGV4dCkpCmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cgYi9MYXlv dXRUZXN0cy9DaGFuZ2VMb2cKaW5kZXggNzNlODg1MzQ2YWY4NGNlNWVmNDI0YTYzNmFhOGIxNWNi MDlkZTM5MS4uMjAwNGRkZmY2M2ViODIyOTUzOWZmMWI3ODRjOTFmNjY1ZmQ0ZDRkOSAxMDA2NDQK LS0tIGEvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCisrKyBiL0xheW91dFRlc3RzL0NoYW5nZUxvZwpA QCAtMSwzICsxLDEzIEBACisyMDIxLTAyLTA4ICBTZXJnaW8gVmlsbGFyIFNlbmluICA8c3ZpbGxh ckBpZ2FsaWEuY29tPgorCisgICAgICAgIERvIG5vdCBydW4gSW5zZXJ0VGV4dENvbW1hbmQgaWYg dGhlIHNlbGVjdGlvbiBpcyBvdXQgb2YgYSB2YWxpZCBwb3NpdGlvbgorICAgICAgICBodHRwczov L2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjEzNTE0CisKKyAgICAgICAgUmV2aWV3 ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgKiBlZGl0aW5nL3NlbGVjdGlvbi9pbnNl cnQtaW4tb3JwaGFuZWQtc2VsZWN0aW9uLWNyYXNoLWV4cGVjdGVkLnR4dDogQWRkZWQuCisgICAg ICAgICogZWRpdGluZy9zZWxlY3Rpb24vaW5zZXJ0LWluLW9ycGhhbmVkLXNlbGVjdGlvbi1jcmFz aC5odG1sOiBBZGRlZC4KKwogMjAyMS0wMi0wOCAgUGhpbGlwcGUgTm9ybWFuZCAgPHBub3JtYW5k QGlnYWxpYS5jb20+CiAKICAgICAgICAgUGVybWlzc2lvbiByZXF1ZXN0IEFQSSBmb3IgTWVkaWFL ZXlTeXN0ZW0gYWNjZXNzIHN1cHBvcnQKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL2VkaXRpbmcv c2VsZWN0aW9uL2luc2VydC1pbi1vcnBoYW5lZC1zZWxlY3Rpb24tY3Jhc2gtZXhwZWN0ZWQudHh0 IGIvTGF5b3V0VGVzdHMvZWRpdGluZy9zZWxlY3Rpb24vaW5zZXJ0LWluLW9ycGhhbmVkLXNlbGVj dGlvbi1jcmFzaC1leHBlY3RlZC50eHQKbmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMC4uNjMzNmFkZDBiYTE1Njk1YjhmNjJl M2E4NzdjODhmYWU4OWUxN2UwZgotLS0gL2Rldi9udWxsCisrKyBiL0xheW91dFRlc3RzL2VkaXRp bmcvc2VsZWN0aW9uL2luc2VydC1pbi1vcnBoYW5lZC1zZWxlY3Rpb24tY3Jhc2gtZXhwZWN0ZWQu dHh0CkBAIC0wLDAgKzEsMiBAQAorQ09OU09MRSBNRVNTQUdFOiBOb3RGb3VuZEVycm9yOiBUaGUg b2JqZWN0IGNhbiBub3QgYmUgZm91bmQgaGVyZS4KKwpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMv ZWRpdGluZy9zZWxlY3Rpb24vaW5zZXJ0LWluLW9ycGhhbmVkLXNlbGVjdGlvbi1jcmFzaC5odG1s IGIvTGF5b3V0VGVzdHMvZWRpdGluZy9zZWxlY3Rpb24vaW5zZXJ0LWluLW9ycGhhbmVkLXNlbGVj dGlvbi1jcmFzaC5odG1sCm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAuLjA5MGQyYzk1N2RmMDQ5OTk0M2ZmYmYyZGVjZDgz ZDE3MGE0Y2ZjMzgKLS0tIC9kZXYvbnVsbAorKysgYi9MYXlvdXRUZXN0cy9lZGl0aW5nL3NlbGVj dGlvbi9pbnNlcnQtaW4tb3JwaGFuZWQtc2VsZWN0aW9uLWNyYXNoLmh0bWwKQEAgLTAsMCArMSwy MyBAQAorPHN0eWxlPgorICogeyAtd2Via2l0LWFwcGVhcmFuY2U6ZGVmYXVsdC1idXR0b247IH0K Kzwvc3R5bGU+Cis8c2NyaXB0PgoraWYgKHdpbmRvdy50ZXN0UnVubmVyKQorICAgIHRlc3RSdW5u ZXIuZHVtcEFzVGV4dCgpOworZG9jdW1lbnQuYWRkRXZlbnRMaXN0ZW5lcigiRE9NTm9kZVJlbW92 ZWQiLCAgZnVuY3Rpb24gKCkgeworICAgIGRvY3VtZW50LmRlc2lnbk1vZGUgPSBkb2N1bWVudC5k ZXNpZ25Nb2RlID09ICJvbiIgPyAib2ZmIiA6ICJvbiI7CisgICAgZG9jdW1lbnQuZXhlY0NvbW1h bmQoIlNlbGVjdEFsbCIpOworfSk7Citkb2N1bWVudC5hZGRFdmVudExpc3RlbmVyKCJET01Gb2N1 c0luIiwgIGZ1bmN0aW9uICgpIHsKKyAgICBkb2N1bWVudC5leGVjQ29tbWFuZCgnSW5zZXJ0VGV4 dCcpOworfSk7Cit3aW5kb3cub25sb2FkID0gZnVuY3Rpb24oKSB7CisgICAgZG9jdW1lbnQuZ2V0 RWxlbWVudHNCeVRhZ05hbWUoImRpdiIpWzBdLnJlbW92ZSgpOworfTsKKzwvc2NyaXB0PgorPGRp dj4KKyAgICA8dGV4dGFyZWE+PC90ZXh0YXJlYT4KKzwvZGl2PgorPHRhYmxlIGZyYW1lPSJ2c2lk ZXMiPgorICAgIDx0cj48L3RyPgorPC90YWJsZT4K 419885 2021-02-10 12:09:58 -0800 2021-02-10 18:28:26 -0800 Patch bug-213514-20210210210957.patch text/plain 4520 svillar U3VidmVyc2lvbiBSZXZpc2lvbjogMjcyNjY2CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggZTYwZTQ0YzE2MGU5M2Qy NTExOTViYzgxYmNmODA0ZmE1NWJjMDhmOC4uYmM3Y2JhNDk4NjI5OGM1YTA1YWIwM2JjYzJhMzE2 Njc0Y2I3MjE3YSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDIyIEBACisyMDIxLTAyLTEwICBTZXJn aW8gVmlsbGFyIFNlbmluICA8c3ZpbGxhckBpZ2FsaWEuY29tPgorCisgICAgICAgIENyYXNoIGlu IEluc2VydFRleHRDb21tYW5kOjpkb0FwcGx5CisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQu b3JnL3Nob3dfYnVnLmNnaT9pZD0yMTM1MTQKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkg KE9PUFMhKS4KKworICAgICAgICBUaGUgSW5zZXJ0VGV4dENvbW1hbmQgbWlnaHQgZGVsZXRlIHRo ZSBjdXJyZW50IHNlbGVjdGlvbiBiZWZvcmUgaW5zZXJ0aW5nIHRoZSB0ZXh0LiBJbiB0aGF0IGNh c2UgYW5kIHdoZW4KKyAgICAgICAgdGhlIHNlbGVjdGlvbiB3YXMgZW5kaW5nIGluc2lkZSBhbiBl bXB0eSByb3cgb2YgYSB0YWJsZSB0aGUgY29kZSB3YXMgY2FsbGluZyBDb21wb3NpdGVFZGl0Q29t bWFuZDo6cmVtb3ZlTm9kZSgpCisgICAgICAgIGRpcmVjdGx5IHRvIGRlbGV0ZSB0aGUgZW1wdHkg cm93LiBUaGF0IG1ldGhvZCBob3dldmVyIGRvZXMgbm90IHByb3Blcmx5IHVwZGF0ZSB0aGUgbV9l bmRpbmdQb3NpdGlvbiBvZgorICAgICAgICB0aGUgQ29tcG9zaXRlRWRpdENvbW1hbmQgbGVhdmlu ZyB0aGUgY3VycmVudCBzZWxlY3Rpb24gaW4gYW4gaW5jb25zaXN0ZW50IHN0YXRlLiBSZXBsYWNl ZCB0aGF0IGNhbGwgYnkKKyAgICAgICAgcmVtb3ZlTm9kZVVwZGF0aW5nU3RhdGVzKCkgd2hpY2gg ZW5kcyB1cCBjYWxsaW5nIHJlbW92ZU5vZGUoKSBidXQgb25seSBhZnRlciB1cGRhdGluZyB0aGUg c2VsZWN0aW9uIHN0YXRlLgorCisgICAgICAgIFRlc3Q6IGVkaXRpbmcvc2VsZWN0aW9uL2luc2Vy dC1pbi1vcnBoYW5lZC1zZWxlY3Rpb24tY3Jhc2guaHRtbAorCisgICAgICAgICogZWRpdGluZy9E ZWxldGVTZWxlY3Rpb25Db21tYW5kLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OkRlbGV0ZVNlbGVj dGlvbkNvbW1hbmQ6OnJlbW92ZVByZXZpb3VzbHlTZWxlY3RlZEVtcHR5VGFibGVSb3dzKTogUmVw bGFjZWQKKyAgICAgICAgQ29tcG9zaXRlRWRpdENvbW1hbmQ6OnJlbW92ZU5vZGUoKSBieSByZW1v dmVOb2RlVXBkYXRpbmdTdGF0ZXMoKS4KKwogMjAyMS0wMi0xMCAgQWRpdHlhIEtlZXJ0aGkgIDxh a2VlcnRoaUBhcHBsZS5jb20+CiAKICAgICAgICAgW2lPU11bRkNSXSBBZGQgcmVkdWNlZCBtb3Rp b24gYW5pbWF0aW9uIGZvciBpbmRldGVybWluYXRlIHByb2dyZXNzIGJhcnMKZGlmZiAtLWdpdCBh L1NvdXJjZS9XZWJDb3JlL2VkaXRpbmcvRGVsZXRlU2VsZWN0aW9uQ29tbWFuZC5jcHAgYi9Tb3Vy Y2UvV2ViQ29yZS9lZGl0aW5nL0RlbGV0ZVNlbGVjdGlvbkNvbW1hbmQuY3BwCmluZGV4IDEwMzBm NWMxMDJlODA3OWNlZDA4N2JiNzMxMTU3OGFjYTllYTUxMDIuLjYxMmVhYWZiNGRlMTE2MmNhNWQw MmU4Y2U1M2NiYzA0ODU1MmMxODcgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL2VkaXRpbmcv RGVsZXRlU2VsZWN0aW9uQ29tbWFuZC5jcHAKKysrIGIvU291cmNlL1dlYkNvcmUvZWRpdGluZy9E ZWxldGVTZWxlY3Rpb25Db21tYW5kLmNwcApAQCAtNzk3LDcgKzc5Nyw3IEBAIHZvaWQgRGVsZXRl U2VsZWN0aW9uQ29tbWFuZDo6cmVtb3ZlUHJldmlvdXNseVNlbGVjdGVkRW1wdHlUYWJsZVJvd3Mo KQogICAgICAgICAgICAgICAgIC8vIEZJWE1FOiBXZSBwcm9iYWJseSBzaG91bGRuJ3QgcmVtb3Zl IG1fZW5kVGFibGVSb3cgdW5sZXNzIGl0J3MgZnVsbHkgc2VsZWN0ZWQsIGV2ZW4gaWYgaXQgaXMg ZW1wdHkuCiAgICAgICAgICAgICAgICAgLy8gV2UnbGwgbmVlZCB0byBzdGFydCBhZGp1c3Rpbmcg dGhlIHNlbGVjdGlvbiBlbmRwb2ludHMgZHVyaW5nIGRlbGV0aW9uIHRvIGtub3cgd2hldGhlciBv ciBub3QgbV9lbmRUYWJsZVJvdwogICAgICAgICAgICAgICAgIC8vIHdhcyBmdWxseSBzZWxlY3Rl ZCBoZXJlLgotICAgICAgICAgICAgICAgIENvbXBvc2l0ZUVkaXRDb21tYW5kOjpyZW1vdmVOb2Rl KCptX2VuZFRhYmxlUm93KTsKKyAgICAgICAgICAgICAgICByZW1vdmVOb2RlVXBkYXRpbmdTdGF0 ZXMoKm1fZW5kVGFibGVSb3csIERvTm90QXNzdW1lQ29udGVudElzQWx3YXlzRWRpdGFibGUpOwog ICAgICAgICAgICAgfQogICAgICAgICB9CiAgICAgfQpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMv Q2hhbmdlTG9nIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCmluZGV4IGMyYjhlMmU3NGYwZWJkNTFj NTJjMzg2OTM1YjdlYjJlMDIxYWVmZWYuLjU5ZTM2MzRkMTY1YTZiY2QxMTA3MjQ1YTM3MDZlY2Rl MDFlMWM0YmQgMTAwNjQ0Ci0tLSBhL0xheW91dFRlc3RzL0NoYW5nZUxvZworKysgYi9MYXlvdXRU ZXN0cy9DaGFuZ2VMb2cKQEAgLTEsMyArMSwxMyBAQAorMjAyMS0wMi0xMCAgU2VyZ2lvIFZpbGxh ciBTZW5pbiAgPHN2aWxsYXJAaWdhbGlhLmNvbT4KKworICAgICAgICBDcmFzaCBpbiBJbnNlcnRU ZXh0Q29tbWFuZDo6ZG9BcHBseQorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93 X2J1Zy5jZ2k/aWQ9MjEzNTE0CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISku CisKKyAgICAgICAgKiBlZGl0aW5nL3NlbGVjdGlvbi9pbnNlcnQtaW4tb3JwaGFuZWQtc2VsZWN0 aW9uLWNyYXNoLWV4cGVjdGVkLnR4dDogQWRkZWQuCisgICAgICAgICogZWRpdGluZy9zZWxlY3Rp b24vaW5zZXJ0LWluLW9ycGhhbmVkLXNlbGVjdGlvbi1jcmFzaC5odG1sOiBBZGRlZC4KKwogMjAy MS0wMi0xMCAgQW50dGkgS29pdmlzdG8gIDxhbnR0aUBhcHBsZS5jb20+CiAKICAgICAgICAgW0xG Q11bSW50ZWdyYXRpb25dIFBhaW50IGludmFsaWRhdGlvbiBmb3IgaW5saW5lIGVsZW1lbnQgc3R5 bGUgY2hhbmdlcwpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvZWRpdGluZy9zZWxlY3Rpb24vaW5z ZXJ0LWluLW9ycGhhbmVkLXNlbGVjdGlvbi1jcmFzaC1leHBlY3RlZC50eHQgYi9MYXlvdXRUZXN0 cy9lZGl0aW5nL3NlbGVjdGlvbi9pbnNlcnQtaW4tb3JwaGFuZWQtc2VsZWN0aW9uLWNyYXNoLWV4 cGVjdGVkLnR4dApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwLi42MzM2YWRkMGJhMTU2OTViOGY2MmUzYTg3N2M4OGZhZTg5 ZTE3ZTBmCi0tLSAvZGV2L251bGwKKysrIGIvTGF5b3V0VGVzdHMvZWRpdGluZy9zZWxlY3Rpb24v aW5zZXJ0LWluLW9ycGhhbmVkLXNlbGVjdGlvbi1jcmFzaC1leHBlY3RlZC50eHQKQEAgLTAsMCAr MSwyIEBACitDT05TT0xFIE1FU1NBR0U6IE5vdEZvdW5kRXJyb3I6IFRoZSBvYmplY3QgY2FuIG5v dCBiZSBmb3VuZCBoZXJlLgorCmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9lZGl0aW5nL3NlbGVj dGlvbi9pbnNlcnQtaW4tb3JwaGFuZWQtc2VsZWN0aW9uLWNyYXNoLmh0bWwgYi9MYXlvdXRUZXN0 cy9lZGl0aW5nL3NlbGVjdGlvbi9pbnNlcnQtaW4tb3JwaGFuZWQtc2VsZWN0aW9uLWNyYXNoLmh0 bWwKbmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMC4uMDkwZDJjOTU3ZGYwNDk5OTQzZmZiZjJkZWNkODNkMTcwYTRjZmMzOAot LS0gL2Rldi9udWxsCisrKyBiL0xheW91dFRlc3RzL2VkaXRpbmcvc2VsZWN0aW9uL2luc2VydC1p bi1vcnBoYW5lZC1zZWxlY3Rpb24tY3Jhc2guaHRtbApAQCAtMCwwICsxLDIzIEBACis8c3R5bGU+ CisgKiB7IC13ZWJraXQtYXBwZWFyYW5jZTpkZWZhdWx0LWJ1dHRvbjsgfQorPC9zdHlsZT4KKzxz Y3JpcHQ+CitpZiAod2luZG93LnRlc3RSdW5uZXIpCisgICAgdGVzdFJ1bm5lci5kdW1wQXNUZXh0 KCk7Citkb2N1bWVudC5hZGRFdmVudExpc3RlbmVyKCJET01Ob2RlUmVtb3ZlZCIsICBmdW5jdGlv biAoKSB7CisgICAgZG9jdW1lbnQuZGVzaWduTW9kZSA9IGRvY3VtZW50LmRlc2lnbk1vZGUgPT0g Im9uIiA/ICJvZmYiIDogIm9uIjsKKyAgICBkb2N1bWVudC5leGVjQ29tbWFuZCgiU2VsZWN0QWxs Iik7Cit9KTsKK2RvY3VtZW50LmFkZEV2ZW50TGlzdGVuZXIoIkRPTUZvY3VzSW4iLCAgZnVuY3Rp b24gKCkgeworICAgIGRvY3VtZW50LmV4ZWNDb21tYW5kKCdJbnNlcnRUZXh0Jyk7Cit9KTsKK3dp bmRvdy5vbmxvYWQgPSBmdW5jdGlvbigpIHsKKyAgICBkb2N1bWVudC5nZXRFbGVtZW50c0J5VGFn TmFtZSgiZGl2IilbMF0ucmVtb3ZlKCk7Cit9OworPC9zY3JpcHQ+Cis8ZGl2PgorICAgIDx0ZXh0 YXJlYT48L3RleHRhcmVhPgorPC9kaXY+Cis8dGFibGUgZnJhbWU9InZzaWRlcyI+CisgICAgPHRy PjwvdHI+Cis8L3RhYmxlPgo= 419977 2021-02-11 05:10:05 -0800 2021-02-11 23:01:19 -0800 Patch for landing bug-213514-20210211141003.patch text/plain 4621 svillar U3VidmVyc2lvbiBSZXZpc2lvbjogMjcyNjY2CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggZTYwZTQ0YzE2MGU5M2Qy NTExOTViYzgxYmNmODA0ZmE1NWJjMDhmOC4uZTQ0NDQ4MWMyMzIzNjhkMDIxMTQ1NmUzYTcwMWRl OGQ2MDE5ZWM5OCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDIyIEBACisyMDIxLTAyLTEwICBTZXJn aW8gVmlsbGFyIFNlbmluICA8c3ZpbGxhckBpZ2FsaWEuY29tPgorCisgICAgICAgIENyYXNoIGlu IEluc2VydFRleHRDb21tYW5kOjpkb0FwcGx5CisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQu b3JnL3Nob3dfYnVnLmNnaT9pZD0yMTM1MTQKKworICAgICAgICBSZXZpZXdlZCBieSBSeW9zdWtl IE5pd2EuCisKKyAgICAgICAgVGhlIEluc2VydFRleHRDb21tYW5kIG1pZ2h0IGRlbGV0ZSB0aGUg Y3VycmVudCBzZWxlY3Rpb24gYmVmb3JlIGluc2VydGluZyB0aGUgdGV4dC4gSW4gdGhhdCBjYXNl IGFuZCB3aGVuCisgICAgICAgIHRoZSBzZWxlY3Rpb24gd2FzIGVuZGluZyBpbnNpZGUgYW4gZW1w dHkgcm93IG9mIGEgdGFibGUgdGhlIGNvZGUgd2FzIGNhbGxpbmcgQ29tcG9zaXRlRWRpdENvbW1h bmQ6OnJlbW92ZU5vZGUoKQorICAgICAgICBkaXJlY3RseSB0byBkZWxldGUgdGhlIGVtcHR5IHJv dy4gVGhhdCBtZXRob2QgaG93ZXZlciBkb2VzIG5vdCBwcm9wZXJseSB1cGRhdGUgdGhlIG1fZW5k aW5nUG9zaXRpb24gb2YKKyAgICAgICAgdGhlIENvbXBvc2l0ZUVkaXRDb21tYW5kIGxlYXZpbmcg dGhlIGN1cnJlbnQgc2VsZWN0aW9uIGluIGFuIGluY29uc2lzdGVudCBzdGF0ZS4gUmVwbGFjZWQg dGhhdCBjYWxsIGJ5CisgICAgICAgIHJlbW92ZU5vZGVVcGRhdGluZ1N0YXRlcygpIHdoaWNoIGVu ZHMgdXAgY2FsbGluZyByZW1vdmVOb2RlKCkgYnV0IG9ubHkgYWZ0ZXIgdXBkYXRpbmcgdGhlIHNl bGVjdGlvbiBzdGF0ZS4KKworICAgICAgICBUZXN0OiBlZGl0aW5nL3NlbGVjdGlvbi9pbnNlcnQt aW4tb3JwaGFuZWQtc2VsZWN0aW9uLWNyYXNoLmh0bWwKKworICAgICAgICAqIGVkaXRpbmcvRGVs ZXRlU2VsZWN0aW9uQ29tbWFuZC5jcHA6CisgICAgICAgIChXZWJDb3JlOjpEZWxldGVTZWxlY3Rp b25Db21tYW5kOjpyZW1vdmVQcmV2aW91c2x5U2VsZWN0ZWRFbXB0eVRhYmxlUm93cyk6IFJlcGxh Y2VkCisgICAgICAgIENvbXBvc2l0ZUVkaXRDb21tYW5kOjpyZW1vdmVOb2RlKCkgYnkgcmVtb3Zl Tm9kZVVwZGF0aW5nU3RhdGVzKCkuCisKIDIwMjEtMDItMTAgIEFkaXR5YSBLZWVydGhpICA8YWtl ZXJ0aGlAYXBwbGUuY29tPgogCiAgICAgICAgIFtpT1NdW0ZDUl0gQWRkIHJlZHVjZWQgbW90aW9u IGFuaW1hdGlvbiBmb3IgaW5kZXRlcm1pbmF0ZSBwcm9ncmVzcyBiYXJzCmRpZmYgLS1naXQgYS9T b3VyY2UvV2ViQ29yZS9lZGl0aW5nL0RlbGV0ZVNlbGVjdGlvbkNvbW1hbmQuY3BwIGIvU291cmNl L1dlYkNvcmUvZWRpdGluZy9EZWxldGVTZWxlY3Rpb25Db21tYW5kLmNwcAppbmRleCAxMDMwZjVj MTAyZTgwNzljZWQwODdiYjczMTE1NzhhY2E5ZWE1MTAyLi42MTJlYWFmYjRkZTExNjJjYTVkMDJl OGNlNTNjYmMwNDg1NTJjMTg3IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9lZGl0aW5nL0Rl bGV0ZVNlbGVjdGlvbkNvbW1hbmQuY3BwCisrKyBiL1NvdXJjZS9XZWJDb3JlL2VkaXRpbmcvRGVs ZXRlU2VsZWN0aW9uQ29tbWFuZC5jcHAKQEAgLTc5Nyw3ICs3OTcsNyBAQCB2b2lkIERlbGV0ZVNl bGVjdGlvbkNvbW1hbmQ6OnJlbW92ZVByZXZpb3VzbHlTZWxlY3RlZEVtcHR5VGFibGVSb3dzKCkK ICAgICAgICAgICAgICAgICAvLyBGSVhNRTogV2UgcHJvYmFibHkgc2hvdWxkbid0IHJlbW92ZSBt X2VuZFRhYmxlUm93IHVubGVzcyBpdCdzIGZ1bGx5IHNlbGVjdGVkLCBldmVuIGlmIGl0IGlzIGVt cHR5LgogICAgICAgICAgICAgICAgIC8vIFdlJ2xsIG5lZWQgdG8gc3RhcnQgYWRqdXN0aW5nIHRo ZSBzZWxlY3Rpb24gZW5kcG9pbnRzIGR1cmluZyBkZWxldGlvbiB0byBrbm93IHdoZXRoZXIgb3Ig bm90IG1fZW5kVGFibGVSb3cKICAgICAgICAgICAgICAgICAvLyB3YXMgZnVsbHkgc2VsZWN0ZWQg aGVyZS4KLSAgICAgICAgICAgICAgICBDb21wb3NpdGVFZGl0Q29tbWFuZDo6cmVtb3ZlTm9kZSgq bV9lbmRUYWJsZVJvdyk7CisgICAgICAgICAgICAgICAgcmVtb3ZlTm9kZVVwZGF0aW5nU3RhdGVz KCptX2VuZFRhYmxlUm93LCBEb05vdEFzc3VtZUNvbnRlbnRJc0Fsd2F5c0VkaXRhYmxlKTsKICAg ICAgICAgICAgIH0KICAgICAgICAgfQogICAgIH0KZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL0No YW5nZUxvZyBiL0xheW91dFRlc3RzL0NoYW5nZUxvZwppbmRleCBjMmI4ZTJlNzRmMGViZDUxYzUy YzM4NjkzNWI3ZWIyZTAyMWFlZmVmLi42OGRjMmEwYjBiMGEzMTEwYjQ4MjAzNGY4OWY2ZDA0ZTJi NTE2NTU0IDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKKysrIGIvTGF5b3V0VGVz dHMvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTMgQEAKKzIwMjEtMDItMTAgIFNlcmdpbyBWaWxsYXIg U2VuaW4gIDxzdmlsbGFyQGlnYWxpYS5jb20+CisKKyAgICAgICAgQ3Jhc2ggaW4gSW5zZXJ0VGV4 dENvbW1hbmQ6OmRvQXBwbHkKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19i dWcuY2dpP2lkPTIxMzUxNAorCisgICAgICAgIFJldmlld2VkIGJ5IFJ5b3N1a2UgTml3YS4KKwor ICAgICAgICAqIGVkaXRpbmcvc2VsZWN0aW9uL2luc2VydC1pbi1vcnBoYW5lZC1zZWxlY3Rpb24t Y3Jhc2gtZXhwZWN0ZWQudHh0OiBBZGRlZC4KKyAgICAgICAgKiBlZGl0aW5nL3NlbGVjdGlvbi9p bnNlcnQtaW4tb3JwaGFuZWQtc2VsZWN0aW9uLWNyYXNoLmh0bWw6IEFkZGVkLgorCiAyMDIxLTAy LTEwICBBbnR0aSBLb2l2aXN0byAgPGFudHRpQGFwcGxlLmNvbT4KIAogICAgICAgICBbTEZDXVtJ bnRlZ3JhdGlvbl0gUGFpbnQgaW52YWxpZGF0aW9uIGZvciBpbmxpbmUgZWxlbWVudCBzdHlsZSBj aGFuZ2VzCmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9lZGl0aW5nL2RlbGV0aW5nL2luc2VydC1p bi1vcnBoYW5lZC1zZWxlY3Rpb24tY3Jhc2gtZXhwZWN0ZWQudHh0IGIvTGF5b3V0VGVzdHMvZWRp dGluZy9kZWxldGluZy9pbnNlcnQtaW4tb3JwaGFuZWQtc2VsZWN0aW9uLWNyYXNoLWV4cGVjdGVk LnR4dApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwLi40YTY3MDE3ZmI2MWZhYzQzNzQ2YWU1YWU5MGU2MjA5OWNiZWQ1ZGJl Ci0tLSAvZGV2L251bGwKKysrIGIvTGF5b3V0VGVzdHMvZWRpdGluZy9kZWxldGluZy9pbnNlcnQt aW4tb3JwaGFuZWQtc2VsZWN0aW9uLWNyYXNoLWV4cGVjdGVkLnR4dApAQCAtMCwwICsxLDMgQEAK K0NPTlNPTEUgTUVTU0FHRTogVGhlIHRlc3QgUEFTUyBpZiBpdCBkb2VzIG5vdCBDUkFTSC4KK0NP TlNPTEUgTUVTU0FHRTogTm90Rm91bmRFcnJvcjogVGhlIG9iamVjdCBjYW4gbm90IGJlIGZvdW5k IGhlcmUuCisKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL2VkaXRpbmcvZGVsZXRpbmcvaW5zZXJ0 LWluLW9ycGhhbmVkLXNlbGVjdGlvbi1jcmFzaC5odG1sIGIvTGF5b3V0VGVzdHMvZWRpdGluZy9k ZWxldGluZy9pbnNlcnQtaW4tb3JwaGFuZWQtc2VsZWN0aW9uLWNyYXNoLmh0bWwKbmV3IGZpbGUg bW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MC4uYzI2MmJjMjYzM2MxMGQ1Y2E4NjRjZWNlYWNlOWJjY2YyMTkwZGM2MwotLS0gL2Rldi9udWxs CisrKyBiL0xheW91dFRlc3RzL2VkaXRpbmcvZGVsZXRpbmcvaW5zZXJ0LWluLW9ycGhhbmVkLXNl bGVjdGlvbi1jcmFzaC5odG1sCkBAIC0wLDAgKzEsMjQgQEAKKzxzdHlsZT4KKyAqIHsgLXdlYmtp dC1hcHBlYXJhbmNlOmRlZmF1bHQtYnV0dG9uOyB9Cis8L3N0eWxlPgorPHNjcmlwdD4KK2lmICh3 aW5kb3cudGVzdFJ1bm5lcikKKyAgICB0ZXN0UnVubmVyLmR1bXBBc1RleHQoKTsKK2RvY3VtZW50 LmFkZEV2ZW50TGlzdGVuZXIoIkRPTU5vZGVSZW1vdmVkIiwgIGZ1bmN0aW9uICgpIHsKKyAgICBk b2N1bWVudC5kZXNpZ25Nb2RlID0gZG9jdW1lbnQuZGVzaWduTW9kZSA9PSAib24iID8gIm9mZiIg OiAib24iOworICAgIGRvY3VtZW50LmV4ZWNDb21tYW5kKCJTZWxlY3RBbGwiKTsKK30pOworZG9j dW1lbnQuYWRkRXZlbnRMaXN0ZW5lcigiRE9NRm9jdXNJbiIsICBmdW5jdGlvbiAoKSB7CisgICAg ZG9jdW1lbnQuZXhlY0NvbW1hbmQoJ0luc2VydFRleHQnKTsKKyAgICBjb25zb2xlLmxvZygiVGhl IHRlc3QgUEFTUyBpZiBpdCBkb2VzIG5vdCBDUkFTSC4iKTsKK30pOword2luZG93Lm9ubG9hZCA9 IGZ1bmN0aW9uKCkgeworICAgIGRvY3VtZW50LmdldEVsZW1lbnRzQnlUYWdOYW1lKCJkaXYiKVsw XS5yZW1vdmUoKTsKK307Cis8L3NjcmlwdD4KKzxkaXY+CisgICAgPHRleHRhcmVhPjwvdGV4dGFy ZWE+Cis8L2Rpdj4KKzx0YWJsZSBmcmFtZT0idnNpZGVzIj4KKyAgICA8dHI+PC90cj4KKzwvdGFi bGU+Cg==