218575 2020-11-04 11:18:14 -0800 Debug assert failure in RenderTable::layout() 2021-03-23 01:56:41 -0700 1 1 1 Unclassified WebKit Printing WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 rniwa webkit-unassigned bfulgham cgarcia ews-feeder fred.wang gpoo koivisto product-security rbuis rwlbuis simon.fraser svillar webkit-bug-importer zalan oldest_to_newest 1704523 0 rniwa 2020-11-04 11:18:14 -0800 e.g. ./rendering/RenderTable.cpp(586) : virtual void WebCore::RenderTable::layout() 1 0x3ccc632a9 WTFCrash 2 0x3ae461b8b WTFCrashWithInfo(int, char const*, char const*, int) 3 0x3b2b51640 WebCore::RenderTable::layout() 4 0x3b287396c WebCore::RenderElement::layoutIfNeeded() 5 0x3b2b515e7 WebCore::RenderTable::layout() 6 0x3b293ede2 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) 7 0x3b293d3a4 WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) 8 0x3b293c186 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) 9 0x3b291ee99 WebCore::RenderBlock::layout() 10 0x3b293ede2 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) 11 0x3b293d3a4 WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) 12 0x3b293c186 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) 13 0x3b291ee99 WebCore::RenderBlock::layout() 14 0x3b293ede2 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) 15 0x3b293d3a4 WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) 16 0x3b293c186 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) 17 0x3b291ee99 WebCore::RenderBlock::layout() 18 0x3b2bbdb93 WebCore::RenderView::layout() 19 0x3b2141181 WebCore::FrameViewLayoutContext::layout() 20 0x3b213d683 WebCore::FrameView::forceLayout(bool) 21 0x3b213d0d3 WebCore::FrameView::forceLayoutForPagination(WebCore::FloatSize const&, WebCore::FloatSize const&, float, WebCore::AdjustViewSizeOrNot) 22 0x3b213cc61 WebCore::Frame::setPrinting(bool, WebCore::FloatSize const&, WebCore::FloatSize const&, float, WebCore::AdjustViewSizeOrNot) 23 0x3b224862c WebCore::PrintContext::begin(float, float) 24 0x3a1bada4d WebKit::WebPage::beginPrinting(WTF::ObjectIdentifier<WebCore::FrameIdentifierType>, WebKit::PrintInfo const&) 25 0x3a1c5f31c void IPC::callMemberFunctionImpl<WebKit::WebPage, void (WebKit::WebPage::*)(WTF::ObjectIdentifier<WebCore::FrameIdentifierType>, WebKit::PrintInfo const&), std::__1::tuple<WTF::ObjectIdentifier<WebCore::FrameIdentifierType>, WebKit::PrintInfo>, 0ul, 1ul>(WebKit::WebPage*, void (WebKit::WebPage::*)(WTF::ObjectIdentifier<WebCore::FrameIdentifierType>, WebKit::PrintInfo const&), std::__1::tuple<WTF::ObjectIdentifier<WebCore::FrameIdentifierType>, WebKit::PrintInfo>&&, std::__1::integer_sequence<unsigned long, 0ul, 1ul>) 26 0x3a1c5e2b0 void IPC::callMemberFunction<WebKit::WebPage, void (WebKit::WebPage::*)(WTF::ObjectIdentifier<WebCore::FrameIdentifierType>, WebKit::PrintInfo const&), std::__1::tuple<WTF::ObjectIdentifier<WebCore::FrameIdentifierType>, WebKit::PrintInfo>, std::__1::integer_sequence<unsigned long, 0ul, 1ul> >(std::__1::tuple<WTF::ObjectIdentifier<WebCore::FrameIdentifierType>, WebKit::PrintInfo>&&, WebKit::WebPage*, void (WebKit::WebPage::*)(WTF::ObjectIdentifier<WebCore::FrameIdentifierType>, WebKit::PrintInfo const&)) 27 0x3a1c0f4b9 void IPC::handleMessage<Messages::WebPage::BeginPrinting, WebKit::WebPage, void (WebKit::WebPage::*)(WTF::ObjectIdentifier<WebCore::FrameIdentifierType>, WebKit::PrintInfo const&)>(IPC::Decoder&, WebKit::WebPage*, void (WebKit::WebPage::*)(WTF::ObjectIdentifier<WebCore::FrameIdentifierType>, WebKit::PrintInfo const&)) 28 0x3a1c05756 WebKit::WebPage::didReceiveWebPageMessage(IPC::Connection&, IPC::Decoder&) 29 0x3a1bacd62 WebKit::WebPage::didReceiveMessage(IPC::Connection&, IPC::Decoder&) 30 0x3a0463591 IPC::MessageReceiverMap::dispatchMessage(IPC::Connection&, IPC::Decoder&) 31 0x3a16e4727 WebKit::WebProcess::didReceiveMessage(IPC::Connection&, IPC::Decoder&) <rdar://problem/69563902> 1704524 1 413187 rniwa 2020-11-04 11:18:33 -0800 Created attachment 413187 Reduced test case 1705170 2 svillar 2020-11-06 01:33:16 -0800 (In reply to Ryosuke Niwa from comment #1) > Created attachment 413187 [details] > Reduced test case Are we sure the reduced test case is correct?, it isn't hitting any assertion for me. 1705577 3 rniwa 2020-11-07 20:31:06 -0800 (In reply to Sergio Villar Senin from comment #2) > (In reply to Ryosuke Niwa from comment #1) > > Created attachment 413187 [details] > > Reduced test case > > Are we sure the reduced test case is correct?, it isn't hitting any > assertion for me. Yes. Are you testing it on macOS or GTK+? 1705665 4 svillar 2020-11-09 00:46:37 -0800 (In reply to Ryosuke Niwa from comment #3) > (In reply to Sergio Villar Senin from comment #2) > > (In reply to Ryosuke Niwa from comment #1) > > > Created attachment 413187 [details] > > > Reduced test case > > > > Are we sure the reduced test case is correct?, it isn't hitting any > > assertion for me. > > Yes. Are you testing it on macOS or GTK+? I've tried with both GTK and WPE. I'll try with macOS. 1706394 5 svillar 2020-11-11 01:40:15 -0800 (In reply to Sergio Villar Senin from comment #4) > (In reply to Ryosuke Niwa from comment #3) > > (In reply to Sergio Villar Senin from comment #2) > > > (In reply to Ryosuke Niwa from comment #1) > > > > Created attachment 413187 [details] > > > > Reduced test case > > > > > > Are we sure the reduced test case is correct?, it isn't hitting any > > > assertion for me. > > > > Yes. Are you testing it on macOS or GTK+? > > I've tried with both GTK and WPE. I'll try with macOS. Nevermind. I was testing with MiniBrowser and it was working fine, but it looks like it reliably crashes with RWT. 1706733 6 rniwa 2020-11-11 19:02:50 -0800 (In reply to Sergio Villar Senin from comment #5) > (In reply to Sergio Villar Senin from comment #4) > > (In reply to Ryosuke Niwa from comment #3) > > > (In reply to Sergio Villar Senin from comment #2) > > > > (In reply to Ryosuke Niwa from comment #1) > > > > > Created attachment 413187 [details] > > > > > Reduced test case > > > > > > > > Are we sure the reduced test case is correct?, it isn't hitting any > > > > assertion for me. > > > > > > Yes. Are you testing it on macOS or GTK+? > > > > I've tried with both GTK and WPE. I'll try with macOS. > > Nevermind. I was testing with MiniBrowser and it was working fine, but it > looks like it reliably crashes with RWT. Ah, makes sense. Yeah, most of these fuzzer bugs require WKTR to reproduce. 1706981 7 rbuis 2020-11-12 12:49:21 -0800 I do see the crash on OS X: SHOULD NEVER BE REACHED ./rendering/RenderTable.cpp(586) : virtual void WebCore::RenderTable::layout() 1 0x558117309 WTFCrash 2 0x51d275c40 canLoad_libAccessibility__AXSIsolatedTreeMode 3 0x528fa2613 WebCore::RenderTable::layout() 4 0x528624ed0 WebCore::RenderElement::layoutIfNeeded() etc... 1724648 8 fred.wang 2021-02-02 07:09:05 -0800 So apparently this is an instance of bug 174412, we are basically hitting the ASSERT added in bug 174413 to workaround infinite recursion. The patch uploaded to bug 174412 was landed in bug 176219. Would you be able to provide access to bug 176219, so that we have the full context on this issue? 1724731 9 rniwa 2021-02-02 10:18:24 -0800 (In reply to Frédéric Wang (:fredw) from comment #8) > So apparently this is an instance of bug 174412, we are basically hitting > the ASSERT added in bug 174413 to workaround infinite recursion. The patch > uploaded to bug 174412 was landed in bug 176219. Would you be able to > provide access to bug 176219, so that we have the full context on this issue? Done. 1725608 10 419275 fred.wang 2021-02-04 05:45:17 -0800 Created attachment 419275 Reduce test case with table cells satisfying !isBaselineAligned() This is the same as attachment 413187, but with table cells satisfying !isBaselineAligned() so that layoutBlock happens only once in RenderTableCell::layout(). It still allows to reproduce the issue. 1725613 11 fred.wang 2021-02-04 06:19:08 -0800 (In reply to Ryosuke Niwa from comment #9) > (In reply to Frédéric Wang (:fredw) from comment #8) > > So apparently this is an instance of bug 174412, we are basically hitting > > the ASSERT added in bug 174413 to workaround infinite recursion. The patch > > uploaded to bug 174412 was landed in bug 176219. Would you be able to > > provide access to bug 176219, so that we have the full context on this issue? > > Done. Thanks. Bug 176219 does not seem to have much info either. Anyway, for the record this is what I've found so far for attachment 419275. Any advice would be welcome: When print() is called, WebCore::RenderTable::layout() is executed in paginated mode. It performs layout of each section at https://webkit-search.igalia.com/webkit/rev/5edc52e6a4c801295ad3cbf56569dd4a5b738f78/Source/WebCore/rendering/RenderTable.cpp#476 which ends up laying out the cell's section and setting its height at https://webkit-search.igalia.com/webkit/rev/5edc52e6a4c801295ad3cbf56569dd4a5b738f78/Source/WebCore/rendering/ComplexLineLayout.cpp#1955 The sections are then positioned at https://webkit-search.igalia.com/webkit/rev/5edc52e6a4c801295ad3cbf56569dd4a5b738f78/Source/WebCore/rendering/RenderTable.cpp#476 Since the table was previously laid out in non-paginated mode, this detects a section move and we arrive at the code I mentioned in comment 8: https://webkit-search.igalia.com/webkit/rev/5edc52e6a4c801295ad3cbf56569dd4a5b738f78/Source/WebCore/rendering/RenderTable.cpp#586 Then WebCore::RenderTable::layout() is executed a second time. A difference happens in ComplexLineLayout::determineStartPosition() : for the previous layout paginationDelta was 0 and the line's paginationStrut had been set accordingly ; for this new layout, the line's paginationStrut remains nonzero and so the calculated paginationDelta is no longer 0 : https://webkit-search.igalia.com/webkit/rev/5edc52e6a4c801295ad3cbf56569dd4a5b738f78/Source/WebCore/rendering/ComplexLineLayout.cpp#1855 The adjustBlockDirectionPosition call below then modifies the line's lineBoxBottom which at the end changes the calculated cell's height. Finally the sections are positioned again, a section move detected (due to at least one cell's height change) and the assertion failure triggered. I'm not familiar enough with the pagination code to really understand what this code is really doing. However, I see there are pagination-related FIXMEs all over the code, for example these ones (which don't seem to be involved in the current problem though): https://webkit-search.igalia.com/webkit/rev/5edc52e6a4c801295ad3cbf56569dd4a5b738f78/Source/WebCore/rendering/RenderTableSection.cpp#593 Additionally, I modified the tests to use 100 sections and noticed that the RenderTable layout does stabilize after ~50 recursions. For completeness, I can also mention that after commenting out the adjustBlockDirectionPosition call, the layout is similar to non-paginated mode and does not recurse/assert. NB: Similar behavior happens for attachment 413187, but it is a slightly more difficult to debug because RenderTableCell::layout() can lay out its content twice. 1733269 12 cgarcia 2021-02-25 02:36:16 -0800 The problem here is that moving one section affects the table layout, so in the next layout iteration, another section moves. I think this is valid case, it's really possible to recurse several times. The recursion check was introduced in r219394, but there's no much information nor a test case, so I don't know how this can end up in an infinite recursion. Instead of limiting to one recursion, we could allow to recurse for the amount of sections in the table? 1733274 13 421513 cgarcia 2021-02-25 03:08:15 -0800 Created attachment 421513 Patch 1739341 14 cgarcia 2021-03-15 03:10:38 -0700 Ping reviewers. 1741108 15 ews-feeder 2021-03-18 02:30:01 -0700 Committed r274627: <https://commits.webkit.org/r274627> All reviewed patches have been landed. Closing bug and clearing flags on attachment 421513. 1741258 16 rniwa 2021-03-18 10:55:41 -0700 Is this a security bug? 1741319 17 rniwa 2021-03-18 12:11:24 -0700 If it's not a security bug, can we also add a test? 1742164 18 cgarcia 2021-03-22 02:32:30 -0700 It doesn't look like a security issue to me, I'll submit a test. 1742199 19 cgarcia 2021-03-22 05:26:17 -0700 Reopening to attach a new patch. 1742200 20 423873 cgarcia 2021-03-22 05:31:04 -0700 Created attachment 423873 Patch to add test 1742721 21 ews-feeder 2021-03-23 01:56:38 -0700 Committed r274854: <https://commits.webkit.org/r274854> All reviewed patches have been landed. Closing bug and clearing flags on attachment 423873. 413187 2020-11-04 11:18:33 -0800 2020-11-04 11:18:33 -0800 Reduced test case bug218575.html text/html 239 rniwa PHNjcmlwdD4Kb25sb2FkID0gKCkgPT4gewogIGZ1bmN0aW9uIGluc2VydFRib2R5KCkgewogICAg bGV0IGQwID0gZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgndGJvZHknKTsKICAgIGQwLmlubmVyVGV4 dCA9ICdhJzsKICAgIGRvY3VtZW50LmJvZHkuYXBwZW5kQ2hpbGQoZDApOwogIH0KCiAgZm9yIChs ZXQgaT0wOyBpPDc7IGkrKykgewogICAgaW5zZXJ0VGJvZHkoKTsgCiAgfQoKICBwcmludCgpOwp9 Cjwvc2NyaXB0Pgo= 419275 2021-02-04 05:45:17 -0800 2021-02-04 05:45:17 -0800 Reduce test case with table cells satisfying !isBaselineAligned() bug218575.html text/html 285 fred.wang PHNjcmlwdD4Kb25sb2FkID0gKCkgPT4gewogIGZ1bmN0aW9uIGluc2VydFRib2R5KCkgewogICAg bGV0IGQwID0gZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgndGJvZHknKTsKICAgIGQwLmlubmVySFRN TCA9IGA8dHI+PHRkIHN0eWxlPSJ2ZXJ0aWNhbC1hbGlnbjogdG9wIj5hPC90ZD48L3RyPmA7CiAg ICBkb2N1bWVudC5ib2R5LmFwcGVuZENoaWxkKGQwKTsKICB9CgogIGZvciAobGV0IGk9MDsgaTw3 OyBpKyspIHsKICAgIGluc2VydFRib2R5KCk7IAogIH0KCiAgcHJpbnQoKTsKfQo8L3NjcmlwdD4K 421513 2021-02-25 03:08:15 -0800 2021-03-18 02:30:02 -0700 Patch wcore-table-layout-recursion.diff text/plain 3562 cgarcia ZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZyBiL1NvdXJjZS9XZWJDb3JlL0No YW5nZUxvZwppbmRleCBkMmE5MDZjMGFhMjQuLjAwYTI1NDIzNDY2MyAxMDA2NDQKLS0tIGEvU291 cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAt MSwzICsxLDE5IEBACisyMDIxLTAyLTI1ICBDYXJsb3MgR2FyY2lhIENhbXBvcyAgPGNnYXJjaWFA aWdhbGlhLmNvbT4KKworICAgICAgICBQYWdpbmF0aW9uIG1vZGU6IEluY3JlYXNlIHRoZSBhbW91 bnQgb2YgcmVjdXJzaW9ucyBhbGxvd2VkIGJ5IFJlbmRlclRhYmxlOjpsYXlvdXQoKQorICAgICAg ICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjE4NTc1CisKKyAgICAg ICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgSW4gcjIxOTM5NCBhIHJl Y3Vyc2lvbiBjaGVjayB3YXMgaW50cm9kdWNlZCB0byBhdm9pZCBpbmZpbml0ZSByZWN1cnNpb24g d2hlbiBhIHNlY3Rpb24gaXMgYWx3YXlzIG1vdmVkIG9uCisgICAgICAgIFJlbmRlclRhYmxlOjps YXlvdXQoKS4gQnV0IHNvbWV0aW1lcyBpdCdzIG5lZWRlZCB0byByZWN1cnNlIG1vcmUgdGhhbiBv bmNlIHRvIGxheW91dCB0aGUgdGFibGUgd2hlbiBzZWN0aW9uIG1vdmUKKyAgICAgICAgZHVlIHRv IHRoZSBwYWdpbmF0aW9uLiBUaGlzIHBhdGNoIGxpbWl0cyB0aGUgcmVjdXJzaW9uIGxldmVsIHRv IHRoZSBhbW91bnQgb2Ygc2VjdGlvbnMgaW4gdGhlIHRhYmxlLCBpbnN0ZWFkIG9mCisgICAgICAg IGp1c3Qgb25lLgorCisgICAgICAgICogcmVuZGVyaW5nL1JlbmRlclRhYmxlLmNwcDoKKyAgICAg ICAgKFdlYkNvcmU6OlJlbmRlclRhYmxlOjpsYXlvdXQpOgorICAgICAgICAqIHJlbmRlcmluZy9S ZW5kZXJUYWJsZS5oOgorCiAyMDIxLTAyLTI0ICBGcmVkZXJpYyBXYW5nICA8ZndhbmdAaWdhbGlh LmNvbT4KIAogICAgICAgICBOdWxscHRyIGNyYXNoIGluIENvbXBvc2l0ZUVkaXRDb21tYW5kOjpz cGxpdFRyZWVUb05vZGUgdmlhIEluc2VydFBhcmFncmFwaFNlcGFyYXRvckNvbW1hbmQ6OmRvQXBw bHkKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL3JlbmRlcmluZy9SZW5kZXJUYWJsZS5jcHAg Yi9Tb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyVGFibGUuY3BwCmluZGV4IDAyNWE0MzI0 YjkwZS4uYTIxNDhjMjNmNTE2IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcv UmVuZGVyVGFibGUuY3BwCisrKyBiL1NvdXJjZS9XZWJDb3JlL3JlbmRlcmluZy9SZW5kZXJUYWJs ZS5jcHAKQEAgLTQzNyw2ICs0MzcsNyBAQCB2b2lkIFJlbmRlclRhYmxlOjpsYXlvdXQoKQogICAg IHJlY2FsY0JvcmRlcnNJblJvd0RpcmVjdGlvbigpOwogICAgIGJvb2wgc2VjdGlvbk1vdmVkID0g ZmFsc2U7CiAgICAgTGF5b3V0VW5pdCBtb3ZlZFNlY3Rpb25Mb2dpY2FsVG9wOworICAgIHVuc2ln bmVkIHNlY3Rpb25Db3VudCA9IDA7CiAKICAgICBMYXlvdXRSZXBhaW50ZXIgcmVwYWludGVyKCp0 aGlzLCBjaGVja0ZvclJlcGFpbnREdXJpbmdMYXlvdXQoKSk7CiAgICAgewpAQCAtNTM3LDYgKzUz OCw3IEBAIHZvaWQgUmVuZGVyVGFibGU6OmxheW91dCgpCiAgICAgICAgIC8vIHBvc2l0aW9uIHRo ZSB0YWJsZSBzZWN0aW9ucwogICAgICAgICBSZW5kZXJUYWJsZVNlY3Rpb24qIHNlY3Rpb24gPSB0 b3BTZWN0aW9uKCk7CiAgICAgICAgIHdoaWxlIChzZWN0aW9uKSB7CisgICAgICAgICAgICBzZWN0 aW9uQ291bnQrKzsKICAgICAgICAgICAgIGlmICghc2VjdGlvbk1vdmVkICYmIHNlY3Rpb24tPmxv Z2ljYWxUb3AoKSAhPSBsb2dpY2FsSGVpZ2h0KCkpIHsKICAgICAgICAgICAgICAgICBzZWN0aW9u TW92ZWQgPSB0cnVlOwogICAgICAgICAgICAgICAgIG1vdmVkU2VjdGlvbkxvZ2ljYWxUb3AgPSBz dGQ6Om1pbihsb2dpY2FsSGVpZ2h0KCksIHNlY3Rpb24tPmxvZ2ljYWxUb3AoKSkgKyAoc3R5bGUo KS5pc0hvcml6b250YWxXcml0aW5nTW9kZSgpID8gc2VjdGlvbi0+dmlzdWFsT3ZlcmZsb3dSZWN0 KCkueSgpIDogc2VjdGlvbi0+dmlzdWFsT3ZlcmZsb3dSZWN0KCkueCgpKTsKQEAgLTU4NSw4ICs1 ODcsOCBAQCB2b2lkIFJlbmRlclRhYmxlOjpsYXlvdXQoKQogICAgIGJvb2wgcGFnaW5hdGVkID0g bGF5b3V0U3RhdGUgJiYgbGF5b3V0U3RhdGUtPmlzUGFnaW5hdGVkKCk7CiAgICAgaWYgKHNlY3Rp b25Nb3ZlZCAmJiBwYWdpbmF0ZWQpIHsKICAgICAgICAgLy8gRklYTUU6IFRhYmxlIGxheW91dCBz aG91bGQgYWx3YXlzIHN0YWJpbGl6ZSBldmVuIHdoZW4gc2VjdGlvbiBtb3ZlcyAoc2VlIHdlYmtp dC5vcmcvYi8xNzQ0MTIpLgotICAgICAgICBpZiAoIW1faW5SZWN1cnNpdmVTZWN0aW9uTW92ZWRX aXRoUGFnaW5hdGlvbikgewotICAgICAgICAgICAgU2V0Rm9yU2NvcGU8Ym9vbD4gcGFnaW5hdGVk U2VjdGlvbk1vdmVkKG1faW5SZWN1cnNpdmVTZWN0aW9uTW92ZWRXaXRoUGFnaW5hdGlvbiwgdHJ1 ZSk7CisgICAgICAgIGlmIChtX3JlY3Vyc2l2ZVNlY3Rpb25Nb3ZlZFdpdGhQYWdpbmF0aW9uTGV2 ZWwgPCBzZWN0aW9uQ291bnQpIHsKKyAgICAgICAgICAgIFNldEZvclNjb3BlPHVuc2lnbmVkPiBy ZWN1cnNpdmVTZWN0aW9uTW92ZWRXaXRoUGFnaW5hdGlvbkxldmVsKG1fcmVjdXJzaXZlU2VjdGlv bk1vdmVkV2l0aFBhZ2luYXRpb25MZXZlbCwgbV9yZWN1cnNpdmVTZWN0aW9uTW92ZWRXaXRoUGFn aW5hdGlvbkxldmVsICsgMSk7CiAgICAgICAgICAgICBtYXJrRm9yUGFnaW5hdGlvblJlbGF5b3V0 SWZOZWVkZWQoKTsKICAgICAgICAgICAgIGxheW91dElmTmVlZGVkKCk7CiAgICAgICAgIH0gZWxz ZQpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvcmVuZGVyaW5nL1JlbmRlclRhYmxlLmggYi9T b3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyVGFibGUuaAppbmRleCBhZTU5OGNmZGNmNGUu LjZmZTBjYWQyNTNkZSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvcmVuZGVyaW5nL1JlbmRl clRhYmxlLmgKKysrIGIvU291cmNlL1dlYkNvcmUvcmVuZGVyaW5nL1JlbmRlclRhYmxlLmgKQEAg LTM2OSw3ICszNjksNyBAQCBwcml2YXRlOgogICAgIExheW91dFVuaXQgbV9ib3JkZXJFbmQ7CiAg ICAgbXV0YWJsZSBMYXlvdXRVbml0IG1fY29sdW1uT2Zmc2V0VG9wOwogICAgIG11dGFibGUgTGF5 b3V0VW5pdCBtX2NvbHVtbk9mZnNldEhlaWdodDsKLSAgICBib29sIG1faW5SZWN1cnNpdmVTZWN0 aW9uTW92ZWRXaXRoUGFnaW5hdGlvbiB7IGZhbHNlIH07CisgICAgdW5zaWduZWQgbV9yZWN1cnNp dmVTZWN0aW9uTW92ZWRXaXRoUGFnaW5hdGlvbkxldmVsIHsgMCB9OwogfTsKIAogaW5saW5lIGJv b2wgaXNEaXJlY3Rpb25TYW1lKGNvbnN0IFJlbmRlckJveCogdGFibGVJdGVtLCBjb25zdCBSZW5k ZXJCb3gqIG90aGVyVGFibGVJdGVtKSB7IHJldHVybiB0YWJsZUl0ZW0gJiYgb3RoZXJUYWJsZUl0 ZW0gPyB0YWJsZUl0ZW0tPnN0eWxlKCkuZGlyZWN0aW9uKCkgPT0gb3RoZXJUYWJsZUl0ZW0tPnN0 eWxlKCkuZGlyZWN0aW9uKCkgOiB0cnVlOyB9Cg== 423873 2021-03-22 05:31:04 -0700 2021-03-23 01:56:39 -0700 Patch to add test wk-page-break-table-sections-crash.diff text/plain 1696 cgarcia ZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL0NoYW5nZUxvZyBiL0xheW91dFRlc3RzL0NoYW5nZUxv ZwppbmRleCA1NjdiYTQ4MzYwYWQuLjcxMTY1MDE1OGM4ZSAxMDA2NDQKLS0tIGEvTGF5b3V0VGVz dHMvQ2hhbmdlTG9nCisrKyBiL0xheW91dFRlc3RzL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE1IEBA CisyMDIxLTAzLTIyICBDYXJsb3MgR2FyY2lhIENhbXBvcyAgPGNnYXJjaWFAaWdhbGlhLmNvbT4K KworICAgICAgICBEZWJ1ZyBhc3NlcnQgZmFpbHVyZSBpbiBSZW5kZXJUYWJsZTo6bGF5b3V0KCkK KyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIxODU3NQor CisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIEFkZCBhIHRl c3QgZm9yIHIyNzQ2MjcuCisKKyAgICAgICAgKiBwcmludGluZy9wYWdlLWJyZWFrLXRhYmxlLXNl Y3Rpb25zLWNyYXNoLWV4cGVjdGVkLnR4dDogQWRkZWQuCisgICAgICAgICogcHJpbnRpbmcvcGFn ZS1icmVhay10YWJsZS1zZWN0aW9ucy1jcmFzaC5odG1sOiBBZGRlZC4KKwogMjAyMS0wMy0xOSAg Q2hyaXMgRHVtZXogIDxjZHVtZXpAYXBwbGUuY29tPgogCiAgICAgICAgIFJlc3luYyB3ZWJhdWRp byB3ZWItcGxhdGZvcm0tdGVzdHMgZnJvbSB1cHN0cmVhbQpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVz dHMvcHJpbnRpbmcvcGFnZS1icmVhay10YWJsZS1zZWN0aW9ucy1jcmFzaC1leHBlY3RlZC50eHQg Yi9MYXlvdXRUZXN0cy9wcmludGluZy9wYWdlLWJyZWFrLXRhYmxlLXNlY3Rpb25zLWNyYXNoLWV4 cGVjdGVkLnR4dApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwMDAwMDAuLmZkMjZm ZTg4MzM2YwotLS0gL2Rldi9udWxsCisrKyBiL0xheW91dFRlc3RzL3ByaW50aW5nL3BhZ2UtYnJl YWstdGFibGUtc2VjdGlvbnMtY3Jhc2gtZXhwZWN0ZWQudHh0CkBAIC0wLDAgKzEsNCBAQAorUAor QQorUworUwpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvcHJpbnRpbmcvcGFnZS1icmVhay10YWJs ZS1zZWN0aW9ucy1jcmFzaC5odG1sIGIvTGF5b3V0VGVzdHMvcHJpbnRpbmcvcGFnZS1icmVhay10 YWJsZS1zZWN0aW9ucy1jcmFzaC5odG1sCm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAw MDAwMDAwMC4uMDhiMzQ2NzE3ZmI3Ci0tLSAvZGV2L251bGwKKysrIGIvTGF5b3V0VGVzdHMvcHJp bnRpbmcvcGFnZS1icmVhay10YWJsZS1zZWN0aW9ucy1jcmFzaC5odG1sCkBAIC0wLDAgKzEsMTUg QEAKKzx0YWJsZT4KKyAgPHRib2R5Pjx0cj48dGQgc3R5bGU9InZlcnRpY2FsLWFsaWduOiB0b3Ai PlA8L3RkPjwvdHI+PC90Ym9keT4KKyAgPHRib2R5Pjx0cj48dGQgc3R5bGU9InZlcnRpY2FsLWFs aWduOiB0b3AiPkE8L3RkPjwvdHI+PC90Ym9keT4KKyAgPHRib2R5Pjx0cj48dGQgc3R5bGU9InZl cnRpY2FsLWFsaWduOiB0b3AiPlM8L3RkPjwvdHI+PC90Ym9keT4KKyAgPHRib2R5Pjx0cj48dGQg c3R5bGU9InZlcnRpY2FsLWFsaWduOiB0b3AiPlM8L3RkPjwvdHI+PC90Ym9keT4KKzwvdGFibGU+ Cis8c2NyaXB0PgoraWYgKHdpbmRvdy50ZXN0UnVubmVyKQorICAgIHRlc3RSdW5uZXIuZHVtcEFz VGV4dCgpOworCitpZiAod2luZG93LmludGVybmFscykKKyAgICBpbnRlcm5hbHMuc2V0UHJpbnRp bmcoMjEsIDI5KTsKK2Vsc2UKKyAgICBwcmludCgpOworPC9zY3JpcHQ+Cg==