<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>221509</bug_id>
          
          <creation_ts>2021-02-05 17:29:14 -0800</creation_ts>
          <short_desc>Crash in makeBoundaryPoint via ReplaceSelectionCommand::insertedContentRange</short_desc>
          <delta_ts>2021-03-17 19:04:10 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>HTML Editing</component>
          <version>WebKit Nightly Build</version>
          <rep_platform>Unspecified</rep_platform>
          <op_sys>Unspecified</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>InRadar</keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Ryosuke Niwa">rniwa</reporter>
          <assigned_to name="Frédéric Wang Nélar">fred.wang</assigned_to>
          <cc>bfulgham</cc>
    
    <cc>cgarcia</cc>
    
    <cc>ews-feeder</cc>
    
    <cc>fred.wang</cc>
    
    <cc>gpoo</cc>
    
    <cc>product-security</cc>
    
    <cc>rbuis</cc>
    
    <cc>svillar</cc>
    
    <cc>webkit-bug-importer</cc>
    
    <cc>wenson_hsieh</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>1726334</commentid>
    <comment_count>0</comment_count>
    <who name="Ryosuke Niwa">rniwa</who>
    <bug_when>2021-02-05 17:29:14 -0800</bug_when>
    <thetext>e.g.

0   com.apple.WebCore             	0x00000005711127ff WebCore::Node::ref() const + 0 (Node.h:779) [inlined]
1   com.apple.WebCore             	0x00000005711127ff WTF::Ref&lt;WebCore::Node, WTF::RawPtrTraits&lt;WebCore::Node&gt; &gt;::Ref(WebCore::Node&amp;) + 0 (Ref.h:67) [inlined]
2   com.apple.WebCore             	0x00000005711127ff WTF::Ref&lt;WebCore::Node, WTF::RawPtrTraits&lt;WebCore::Node&gt; &gt;::Ref(WebCore::Node&amp;) + 0 (Ref.h:66) [inlined]
3   com.apple.WebCore             	0x00000005711127ff WebCore::makeBoundaryPoint(WebCore::Position const&amp;) + 63 (Position.cpp:1599)
4   com.apple.WebCore             	0x000000057116f57a decltype(makeBoundaryPoint(std::forward&lt;WebCore::Position const&amp;&gt;(fp))) WebCore::makeBoundaryPointHelper&lt;WebCore::Position const&amp;&gt;(WebCore::Position const&amp;) + 5 (SimpleRange.h:56) [inlined]
5   com.apple.WebCore             	0x000000057116f57a decltype(makeSimpleRangeHelper(makeBoundaryPointHelper(std::forward&lt;WebCore::Position const&amp;&gt;(fp)), makeBoundaryPointHelper(std::forward&lt;WebCore::Position const&amp;&gt;(fp)))) WebCore::makeSimpleRange&lt;WebCore::Position const&amp;, WebCore::Position const&amp;&gt;(WebCore::Position const&amp;, WebCore::Position const&amp;) + 26 (SimpleRange.h:58)
6   com.apple.WebCore             	0x00000005711e2d9f WebCore::ReplaceSelectionCommand::insertedContentRange() const + 31 (ReplaceSelectionCommand.cpp:1778)
7   com.apple.WebCore             	0x000000057119779e WebCore::Editor::replaceSelectionWithFragment(WebCore::DocumentFragment&amp;, WebCore::Editor::SelectReplacement, WebCore::Editor::SmartReplace, WebCore::Editor::MatchStyle, WebCore::EditAction, WebCore::MailBlockquoteHandling) + 990 (Editor.cpp:687)
8   com.apple.WebCore             	0x0000000571197ec6 WebCore::Editor::replaceSelectionWithText(WTF::String const&amp;, WebCore::Editor::SelectReplacement, WebCore::Editor::SmartReplace, WebCore::EditAction) + 118 (Editor.cpp:727)
9   com.apple.WebCore             	0x0000000571197359 WebCore::Editor::handleTextEvent(WebCore::TextEvent&amp;) + 201 (Editor.cpp:335)
10  com.apple.WebCore             	0x0000000571645f0f WebCore::EventHandler::defaultTextInputEventHandler(WebCore::TextEvent&amp;) + 31 (EventHandler.cpp:4117)
11  com.apple.WebCore             	0x00000005710d1994 WebCore::callDefaultEventHandlersInBubblingOrder(WebCore::Event&amp;, WebCore::EventPath const&amp;) + 39 (EventDispatcher.cpp:62) [inlined]
12  com.apple.WebCore             	0x00000005710d1994 WebCore::EventDispatcher::dispatchEvent(WebCore::Node&amp;, WebCore::Event&amp;) + 1684 (EventDispatcher.cpp:203)
13  com.apple.WebCore             	0x00000005711998a2 WebCore::Editor::pasteAsPlainText(WTF::String const&amp;, bool) + 194 (Editor.cpp:607)
14  com.apple.WebCore             	0x0000000571199c19 WebCore::Editor::pasteAsPlainTextWithPasteboard(WebCore::Pasteboard&amp;) + 361 (Editor.cpp:627)
15  com.apple.WebCore             	0x00000005711a0650 WebCore::Editor::pasteAsPlainText(WebCore::Editor::FromMenuOrKeyBinding) + 304 (Editor.cpp:1477)
16  com.apple.WebCore             	0x00000005711c1093 WebCore::executePasteAsPlainText(WebCore::Frame&amp;, WebCore::Event*, WebCore::EditorCommandSource, WTF::String const&amp;) + 51 (EditorCommand.cpp:949)
17  com.apple.WebCore             	0x000000057109502c WebCore::Document::execCommand(WTF::String const&amp;, bool, WTF::String const&amp;) + 76 (Document.cpp:5660)
18  com.apple.WebCore             	0x000000057039eca0 WebCore::jsDocumentPrototypeFunction_execCommandBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSDocument*) + 229 (JSDocument.cpp:5889) [inlined]
19  com.apple.WebCore             	0x000000057039eca0 long long WebCore::IDLOperation&lt;WebCore::JSDocument&gt;::call&lt;&amp;(WebCore::jsDocumentPrototypeFunction_execCommandBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSDocument*)), (WebCore::CastedThisErrorBehavior)0&gt;(JSC::JSGlobalObject&amp;, JSC::CallFrame&amp;, char const*) + 402 (JSDOMOperation.h:53) [inlined]
20  com.apple.WebCore             	0x000000057039eca0 WebCore::jsDocumentPrototypeFunction_execCommand(JSC::JSGlobalObject*, JSC::CallFrame*) + 432 (JSDocument.cpp:5894)
21  ???                           	0x000044b2f78011d8 0 + 75535447232984

&lt;rdar://problem/74021456&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1726335</commentid>
    <comment_count>1</comment_count>
      <attachid>419485</attachid>
    <who name="Ryosuke Niwa">rniwa</who>
    <bug_when>2021-02-05 17:29:29 -0800</bug_when>
    <thetext>Created attachment 419485
Test</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1730892</commentid>
    <comment_count>2</comment_count>
    <who name="Frédéric Wang Nélar">fred.wang</who>
    <bug_when>2021-02-18 09:27:51 -0800</bug_when>
    <thetext>The testcase hits the following assert in debug mode:

Thread 1 received signal SIGSEGV, Segmentation fault.
0x00007f8fd1fe0763 in WebCore::Node::ref (this=0x0)
    at DerivedSources/ForwardingHeaders/WebCore/Node.h:780
780	    ASSERT(!m_deletionHasBegun);
(rr) bt
#0  0x00007f8fd1fe0763 in WebCore::Node::ref() const (this=0x0)
    at DerivedSources/ForwardingHeaders/WebCore/Node.h:780
#1  0x00007f8fd1fe15f1 in WTF::Ref&lt;WebCore::Node, WTF::RawPtrTraits&lt;WebCore::Node&gt; &gt;::Ref(WebCore::Node&amp;) (this=0x7fffd6a188e8, object=...)
    at DerivedSources/ForwardingHeaders/wtf/Ref.h:67
#2  0x00007f8fd474ff85 in WebCore::makeBoundaryPoint(WebCore::Position const&amp;)
    (position=...) at ../../Source/WebCore/dom/Position.cpp:1599</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1731511</commentid>
    <comment_count>3</comment_count>
    <who name="Frédéric Wang Nélar">fred.wang</who>
    <bug_when>2021-02-19 12:28:14 -0800</bug_when>
    <thetext>The code involved seems very similar to bug 221387 and a similar patch works:

--- a/Source/WebCore/editing/markup.cpp
+++ b/Source/WebCore/editing/markup.cpp
@@ -1199,6 +1199,7 @@ Ref&lt;DocumentFragment&gt; createFragmentFromText(const SimpleRange&amp; context, const S
     bool useClonesOfEnclosingBlock = block
         &amp;&amp; !block-&gt;hasTagName(bodyTag)
         &amp;&amp; !block-&gt;hasTagName(htmlTag)
+        &amp;&amp; !block-&gt;hasTagName(inputTag)
         &amp;&amp; block != editableRootForPosition(start);
     bool useLineBreak = enclosingTextFormControl(start);

Not sure yet whether this is the right thing to do and probably this can happens with more tags.

The debugging session below shows that in Editor::replaceSelectionWithText(), we have a #document-fragment attached to an &lt;input&gt;, which looks a bit suspicious to me... This weird structure propagates all the way.

Thread 1 received signal SIGSEGV, Segmentation fault.
(rr) b Editor::replaceSelectionWithText
Breakpoint 1 at 0x7f6058157e70 (2 locations)
(rr) rc
(rr) 
https://webkit-search.igalia.com/webkit/rev/30faa6e9cea015b4d5e21fe19163ec12e80ca700/Source/WebCore/editing/Editor.cpp#724
(rr) p text.show()
\u000Aonload = () =&gt; { document.styleSheets[0].insertRule(`head, script, meta, input { display: block; }`); document.styleSheets[0].insertRule(`input { text-indent: 1px; }`); document.querySelector(&apos;meta&apos;).appendChild(document.createElement(&apos;input&apos;)); document.execCommand(&apos;SelectAll&apos;); document.designMode = &apos;on&apos;; document.execCommand(&apos;Copy&apos;); document.execCommand(&apos;PasteAsPlainText&apos;); };\u000A
$1 = void
(rr) n
(rr) n
(rr) p showTree(createLiveRange(range).get())
#document	0x7f603fd6ac70 (renderer 0x7f603fd69250) 
	HTML	0x7f603fd6ba80 (renderer 0x7f603fd696c0) 
		HEAD	0x7f603fd6bb10 (renderer 0x7f603fd5c350) 
S			META	0x7f603fd6bba0 (renderer 0x7f603fd5c470) 
				INPUT	0x7f603fd5c0a0 (renderer 0x7f603fd5c590) 
					#document-fragment	0x7f603fd5c1b0 (renderer (nil))  (needs style recalc) (child needs style recalc)
						DIV	0x7f603fd5c2c0 (renderer 0x7f603fd5c6b0) 
			#text	0x7f603fd6bc30 &quot;\n&quot;
			STYLE	0x7f603fd6bca0 (renderer (nil)) 
				#text	0x7f603fd6bd60 &quot;\n&quot;
			#text	0x7f603fd6bdd0 &quot;\n&quot;
			SCRIPT	0x7f603fd6be40 (renderer 0x7f603fd5c7d0) 
				#text	0x7f603fd6bf10 &quot;\n  onload = () =&gt; {\n    document.styleSheets[0].insertRule(`head, script, meta, input { display: block; }`);\n    document.styleSheets[0].insertRule(`input { text-indent: 1px; }`);\n    document.querySelector(&apos;meta&apos;).appendChild(document.createElement(&apos;input&apos;));\n    document.execCommand(&apos;SelectAll&apos;);\n    document.designMode = &apos;on&apos;;\n    document.execCommand(&apos;Copy&apos;);\n    document.execCommand(&apos;PasteAsPlainText&apos;);\n  };\n&quot;
			#text	0x7f603fd6bf80 &quot;\n&quot;
E		BODY	0x7f603fd5c010 (renderer 0x7f603fd697e0) 
start offset: 0, end offset: 0
$2 = void
(rr) b createFragmentFromText
(rr) c
(rr) 
https://webkit-search.igalia.com/webkit/rev/30faa6e9cea015b4d5e21fe19163ec12e80ca700/Source/WebCore/editing/markup.cpp#1159
(rr) b 1227
(rr) c
https://webkit-search.igalia.com/webkit/rev/30faa6e9cea015b4d5e21fe19163ec12e80ca700/Source/WebCore/editing/markup.cpp#1227
(rr) p showTree(&amp;fragment.get())
*#document-fragment	0x7f603fd5d1f0 (renderer (nil)) 
	INPUT	0x7f603fd5d270 (renderer (nil)) 
		#document-fragment	0x7f603fd5d380 (renderer (nil)) 
			DIV	0x7f603fd5d490 (renderer (nil)) 
		BR	0x7f603fd5d520 (renderer (nil)) 
	INPUT	0x7f603fd5d5b0 (renderer (nil)) 
		#document-fragment	0x7f603fd5d6c0 (renderer (nil)) 
			DIV	0x7f603fd5d7d0 (renderer (nil)) 
		#text	0x7f603fd5d860 &quot;onload = () =&gt; { document.styleSheets[0].insertRule(`head, script, meta, input { display: block; }`); document.styleSheets[0].insertRule(`input { text-indent: 1px; }`); document.querySelector(&apos;meta&apos;).appendChild(document.createElement(&apos;input&apos;)); document.execCommand(&apos;SelectAll&apos;); document.designMode = &apos;on&apos;; document.execCommand(&apos;Copy&apos;); document.execCommand(&apos;PasteAsPlainText&apos;); };&quot;
	BR	0x7f603fd5d8d0 (renderer (nil))  CLASS=Apple-interchange-newline
$3 = void</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1732435</commentid>
    <comment_count>4</comment_count>
    <who name="Ryosuke Niwa">rniwa</who>
    <bug_when>2021-02-22 19:58:01 -0800</bug_when>
    <thetext>That document fragment is probably a shadow root. It&apos;s expected that an input element has a shadow root and an editable div inside of it.

What&apos;s rather unexpected is that the fragment in createFragmentFromText has an input element in it based on your second output. How are those input elements end up being placed there?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1732488</commentid>
    <comment_count>5</comment_count>
    <who name="Frédéric Wang Nélar">fred.wang</who>
    <bug_when>2021-02-23 04:35:54 -0800</bug_when>
    <thetext>(In reply to Ryosuke Niwa from comment #4)
&gt; That document fragment is probably a shadow root. It&apos;s expected that an
&gt; input element has a shadow root and an editable div inside of it.
&gt; 

OK, that makes sense.

&gt; What&apos;s rather unexpected is that the fragment in createFragmentFromText has
&gt; an input element in it based on your second output. How are those input
&gt; elements end up being placed there?

So as I mentioned in comment 3, this is generally very similar to bug 221387, where a &quot;bad&quot; enclosing block is selected, cloned for each line break by createFragmentFromText and causes issues later in the code. A patch to force useClonesOfEnclosingBlock to false allows to work around the issue here too, but we probably want a more general approach (I haven&apos;t investigated yet why the &lt;input&gt; tag is causing issues later in the code).

In this particular case, the start context is the &lt;meta&gt; tag, to which the test appends an &lt;input&gt; child. Additionally, the test forces `display: block;` on that input tag, so it is selected as the enclosing block. See more debug output below.

https://webkit-search.igalia.com/webkit/rev/5040394ad2b060de17f12aa8f84018147f22b4f4/Source/WebCore/editing/markup.cpp#1203
(rr) p showTree(start.firstNode().get())
#document	0x7fa43f156c70 (renderer 0x7fa43f155250) 
	HTML	0x7fa43f157a80 (renderer 0x7fa43f1556c0) 
		HEAD	0x7fa43f157b10 (renderer 0x7fa43f148350) 
			META	0x7fa43f157ba0 (renderer 0x7fa43f148470) 
*				INPUT	0x7fa43f1480a0 (renderer 0x7fa43f148590) 
					#document-fragment	0x7fa43f1481b0 (renderer (nil))  (needs style recalc) (child needs style recalc)
						DIV	0x7fa43f1482c0 (renderer 0x7fa43f1486b0) 
			#text	0x7fa43f157c30 &quot;\n&quot;
			STYLE	0x7fa43f157ca0 (renderer (nil)) 
				#text	0x7fa43f157d60 &quot;\n&quot;
			#text	0x7fa43f157dd0 &quot;\n&quot;
			SCRIPT	0x7fa43f157e40 (renderer 0x7fa43f1487d0) 
				#text	0x7fa43f157f10 &quot;\n  onload = () =&gt; {\n    document.styleSheets[0].insertRule(`head, script, meta, input { display: block; }`);\n    document.styleSheets[0].insertRule(`input { text-indent: 1px; }`);\n    document.querySelector(&apos;meta&apos;).appendChild(document.createElement(&apos;input&apos;));\n    document.execCommand(&apos;SelectAll&apos;);\n    document.designMode = &apos;on&apos;;\n    document.execCommand(&apos;Copy&apos;);\n    document.execCommand(&apos;PasteAsPlainText&apos;);\n  };\n&quot;
			#text	0x7fa43f157f80 &quot;\n&quot;
		BODY	0x7fa43f148010 (renderer 0x7fa43f1557e0) 
$1 = void
(rr) p start.firstNode().get()==block
$2 = true</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1732519</commentid>
    <comment_count>6</comment_count>
    <who name="Frédéric Wang Nélar">fred.wang</who>
    <bug_when>2021-02-23 07:20:00 -0800</bug_when>
    <thetext>(In reply to Frédéric Wang (:fredw) from comment #5)
&gt; (I haven&apos;t investigated yet why the &lt;input&gt; tag is causing issues later in the code).

So here is what&apos;s happening. The &lt;input&gt; tag is initially a child of &lt;body&gt; when WebCore::ReplaceSelectionCommand::doApply() calculates m_startOfInsertedContent. But at the end of that method, the call to ReplaceSelectionCommand::completeHTMLReplacement() ends up executing moveParagraphContentsToNewBlockIfNecessary() which wraps copies of the &lt;input&gt; elements into a new &lt;div&gt; tag. The original &lt;input&gt; elements are detached from the tree. When we later try to access the container node of m_startOfInsertedContent, we obtain a null pointer, causing a nullptr dereference.

Thread 1 received signal SIGSEGV, Segmentation fault.
(rr) reverse-f
(rr) 
(rr) 
https://webkit-search.igalia.com/webkit/rev/5040394ad2b060de17f12aa8f84018147f22b4f4/Source/WebCore/dom/Position.cpp#1599
(rr)  p position.containerNode()
$1 = (WebCore::Node *) 0x0
(rr) reverse-f
(rr) 
(rr) 
https://webkit-search.igalia.com/webkit/rev/5040394ad2b060de17f12aa8f84018147f22b4f4/Source/WebCore/editing/ReplaceSelectionCommand.cpp#1778
(rr) p showTree(m_startOfInsertedContent-&gt;m_anchorNode.get())
*INPUT	0x7f0596461270 (renderer (nil)) 
	#document-fragment	0x7f0596461380 (renderer (nil))  (needs style recalc) (child needs style recalc)
		DIV	0x7f0596461490 (renderer (nil)) 
	BR	0x7f0596461520 (renderer (nil))  (needs style recalc)
$2 = void
(rr) watch -l m_startOfInsertedContent
(rr) rc
(rr) finish
(rr) 
https://webkit-search.igalia.com/webkit/rev/5040394ad2b060de17f12aa8f84018147f22b4f4/Source/WebCore/editing/ReplaceSelectionCommand.cpp#1325
(rr) p showTree(m_startOfInsertedContent-&gt;m_anchorNode.get())
BODY	0x7f0596460010 (renderer 0x7f059646d7e0) 
*	INPUT	0x7f0596461270 (renderer 0x7f0596460590) 
		#document-fragment	0x7f0596461380 (renderer (nil))  (needs style recalc) (child needs style recalc)
			DIV	0x7f0596461490 (renderer 0x7f05964606b0) 
		BR	0x7f0596461520 (renderer (nil))  (needs style recalc)
	INPUT	0x7f05964615b0 (renderer 0x7f0596461a30) 
		#document-fragment	0x7f05964616c0 (renderer (nil))  (needs style recalc) (child needs style recalc)
			DIV	0x7f05964617d0 (renderer 0x7f0596461b50) 
			STYLE	0x7f059646fca0 (renderer (nil)) 
				#text	0x7f059646fd60 &quot;\n&quot;
$4 = void
(rr) watch -l ((Node*) 0x7f0596461270)-&gt;m_parentNode
(rr) c
(rr) delete
(rr) reverse-f
(rr) 
(rr) 
(rr) 
(rr) 
(rr) 
(rr) 
(rr) 
(rr) 
(rr) 
(rr) 
(rr) 
(rr) 
https://webkit-search.igalia.com/webkit/rev/5040394ad2b060de17f12aa8f84018147f22b4f4/Source/WebCore/editing/ApplyStyleCommand.cpp#263
(rr) p showTree(block.get())
*BODY	0x7f0596460010 (renderer 0x7f059646d7e0) 
	INPUT	0x7f0596461270 (renderer 0x7f0596460590) 
		#document-fragment	0x7f0596461380 (renderer (nil))  (needs style recalc) (child needs style recalc)
			DIV	0x7f0596461490 (renderer 0x7f05964606b0) 
		BR	0x7f0596461520 (renderer (nil))  (needs style recalc)
	INPUT	0x7f05964615b0 (renderer 0x7f0596461a30) 
		#document-fragment	0x7f05964616c0 (renderer (nil))  (needs style recalc) (child needs style recalc)
			DIV	0x7f05964617d0 (renderer 0x7f0596461b50) 
	DIV	0x7f0596461d10 (renderer 0x7f0596460350) 
		BR	0x7f0596462710 (renderer 0x7f05964627a0) 
			STYLE	0x7f059646fca0 (renderer (nil)) 
				#text	0x7f059646fd60 &quot;\n&quot;
$5 = void
(rr) n
(rr) p showTree(newBlock.get())
BODY	0x7f0596460010 (renderer 0x7f059646d7e0) 
*	DIV	0x7f0596463050 (renderer 0x7f05964607d0) 
		INPUT	0x7f0596463b30 (renderer 0x7f0596460590) 
			#document-fragment	0x7f0596463c40 (renderer (nil))  (needs style recalc) (child needs style recalc)
				DIV	0x7f0596463d50 (renderer 0x7f05964606b0) 
		INPUT	0x7f0596463de0 (renderer 0x7f0596461a30) 
			#document-fragment	0x7f0596463ef0 (renderer (nil))  (needs style recalc) (child needs style recalc)
				DIV	0x7f05963ec010 (renderer 0x7f0596461b50) 
	DIV	0x7f0596461d10 (renderer 0x7f0596460350) 
		BR	0x7f0596462710 (renderer 0x7f05964627a0) 
			STYLE	0x7f059646fca0 (renderer (nil)) 
				#text	0x7f059646fd60 &quot;\n&quot;
$6 = void
(rr) bt
#0  WebCore::ApplyStyleCommand::applyBlockStyle(WebCore::EditingStyle&amp;)
    (this=0x7f0596719b00, style=...) at ../../Source/WebCore/editing/ApplyStyleCommand.cpp:264
#1  0x00007f05b416bada in WebCore::ApplyStyleCommand::doApply() (this=0x7f0596719b00)
    at ../../Source/WebCore/editing/ApplyStyleCommand.cpp:209
#2  0x00007f05b4177292 in WebCore::CompositeEditCommand::applyCommandToComposite(WTF::Ref&lt;WebCore::EditCommand, WTF::RawPtrTraits&lt;WebCore::EditCommand&gt; &gt;&amp;&amp;) (this=0x7f05967a3ae0, command=...)
    at ../../Source/WebCore/editing/CompositeEditCommand.cpp:466
#3  0x00007f05b4177531 in WebCore::CompositeEditCommand::applyStyle(WebCore::EditingStyle const*, WebCore::Position const&amp;, WebCore::Position const&amp;, WebCore::EditAction)
    (this=0x7f05967a3ae0, style=0x7f0544297450, start=..., end=..., editingAction=WebCore::EditAction::ChangeAttributes) at ../../Source/WebCore/editing/CompositeEditCommand.cpp:492
#4  0x00007f05b24ebcb2 in WebCore::ReplaceSelectionCommand::completeHTMLReplacement(WebCore::Position const&amp;) (this=0x7f05967a3ae0, lastPositionToSelect=...)
    at ../../Source/WebCore/editing/ReplaceSelectionCommand.cpp:1586
#5  0x00007f05b24ea845 in WebCore::ReplaceSelectionCommand::doApply() (this=0x7f05967a3ae0)
    at https://webkit-search.igalia.com/webkit/rev/5040394ad2b060de17f12aa8f84018147f22b4f4/Source/WebCore/editing/ReplaceSelectionCommand.cpp#1411</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1733268</commentid>
    <comment_count>7</comment_count>
      <attachid>421512</attachid>
    <who name="Frédéric Wang Nélar">fred.wang</who>
    <bug_when>2021-02-25 02:01:46 -0800</bug_when>
    <thetext>Created attachment 421512
Patch

Just for completeness, the patch from comment 3.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1733325</commentid>
    <comment_count>8</comment_count>
      <attachid>421526</attachid>
    <who name="Frédéric Wang Nélar">fred.wang</who>
    <bug_when>2021-02-25 07:56:58 -0800</bug_when>
    <thetext>Created attachment 421526
Patch

PTAL.

I don&apos;t know how much effort we want to put in order to fix that crash.

I tried to save the start/end position before calling applyStyle(), which is closer to the desired semantics, but I don&apos;t think that can be done in a simple &amp; concise way.

Another alternative would be use some placeholders to save start/end positions https://webkit-search.igalia.com/webkit/rev/488c0b1edd37ad487a55f25b92a624a5d3564858/Source/WebCore/editing/ReplaceSelectionCommand.cpp#966

Finally, we could probably just modify ReplaceSelectionCommand::insertedContentRange() to return an empty range or something when the m_startOfInsertedContent or m_endOfInsertedContent are orphan.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1736249</commentid>
    <comment_count>9</comment_count>
      <attachid>421526</attachid>
    <who name="Ryosuke Niwa">rniwa</who>
    <bug_when>2021-03-05 01:48:18 -0800</bug_when>
    <thetext>Comment on attachment 421526
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=421526&amp;action=review

&gt; Source/WebCore/editing/ReplaceSelectionCommand.cpp:1590
&gt; +            // applyStyle may clone content to new block wrappers and make anchor nodes orphan.
&gt; +            // FIXME: Ideally, start/end should be set on the cloned content instead.
&gt; +            if (start.isOrphan() || end.isOrphan()) {
&gt; +                start = end = { };

Can we use endingSelection().start() / endingSelection().end() instead?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1738437</commentid>
    <comment_count>10</comment_count>
      <attachid>422928</attachid>
    <who name="Frédéric Wang Nélar">fred.wang</who>
    <bug_when>2021-03-11 07:01:04 -0800</bug_when>
    <thetext>Created attachment 422928
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1738438</commentid>
    <comment_count>11</comment_count>
      <attachid>421526</attachid>
    <who name="Frédéric Wang Nélar">fred.wang</who>
    <bug_when>2021-03-11 07:01:37 -0800</bug_when>
    <thetext>Comment on attachment 421526
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=421526&amp;action=review

&gt;&gt; Source/WebCore/editing/ReplaceSelectionCommand.cpp:1590
&gt;&gt; +                start = end = { };
&gt; 
&gt; Can we use endingSelection().start() / endingSelection().end() instead?

Yes we can. Done in the latest patch.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1738768</commentid>
    <comment_count>12</comment_count>
      <attachid>422928</attachid>
    <who name="Ryosuke Niwa">rniwa</who>
    <bug_when>2021-03-11 21:10:44 -0800</bug_when>
    <thetext>Comment on attachment 422928
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=422928&amp;action=review

&gt; Source/WebCore/editing/ReplaceSelectionCommand.cpp:1588
&gt; +            // FIXME: Ideally, start/end should be set on the cloned content instead.

This FIXME isn&apos;t accurate. Please remove.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1738769</commentid>
    <comment_count>13</comment_count>
      <attachid>422928</attachid>
    <who name="Ryosuke Niwa">rniwa</who>
    <bug_when>2021-03-11 21:11:21 -0800</bug_when>
    <thetext>Comment on attachment 422928
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=422928&amp;action=review

&gt; LayoutTests/ChangeLog:9
&gt; +        * fast/editing/replace-selection-and-apply-style-crash.html: Added.
&gt; +

Looks like this is missing the entry for -expected.txt?
Also please mention that we&apos;re adding a regression test.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1738792</commentid>
    <comment_count>14</comment_count>
      <attachid>423019</attachid>
    <who name="Frédéric Wang Nélar">fred.wang</who>
    <bug_when>2021-03-11 23:46:05 -0800</bug_when>
    <thetext>Created attachment 423019
Patch for landing</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1739905</commentid>
    <comment_count>15</comment_count>
    <who name="EWS">ews-feeder</who>
    <bug_when>2021-03-16 05:20:36 -0700</bug_when>
    <thetext>Committed r274472: &lt;https://commits.webkit.org/r274472&gt;

All reviewed patches have been landed. Closing bug and clearing flags on attachment 423019.</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="0"
              isprivate="0"
          >
            <attachid>419485</attachid>
            <date>2021-02-05 17:29:29 -0800</date>
            <delta_ts>2021-02-05 17:29:29 -0800</delta_ts>
            <desc>Test</desc>
            <filename>repro_509.html</filename>
            <type>text/html</type>
            <size>459</size>
            <attacher name="Ryosuke Niwa">rniwa</attacher>
            
              <data encoding="base64">PG1ldGE+CjxzdHlsZT4KPC9zdHlsZT4KPHNjcmlwdD4KICBvbmxvYWQgPSAoKSA9PiB7CiAgICBk
b2N1bWVudC5zdHlsZVNoZWV0c1swXS5pbnNlcnRSdWxlKGBoZWFkLCBzY3JpcHQsIG1ldGEsIGlu
cHV0IHsgZGlzcGxheTogYmxvY2s7IH1gKTsKICAgIGRvY3VtZW50LnN0eWxlU2hlZXRzWzBdLmlu
c2VydFJ1bGUoYGlucHV0IHsgdGV4dC1pbmRlbnQ6IDFweDsgfWApOwogICAgZG9jdW1lbnQucXVl
cnlTZWxlY3RvcignbWV0YScpLmFwcGVuZENoaWxkKGRvY3VtZW50LmNyZWF0ZUVsZW1lbnQoJ2lu
cHV0JykpOwogICAgZG9jdW1lbnQuZXhlY0NvbW1hbmQoJ1NlbGVjdEFsbCcpOwogICAgZG9jdW1l
bnQuZGVzaWduTW9kZSA9ICdvbic7CiAgICBkb2N1bWVudC5leGVjQ29tbWFuZCgnQ29weScpOwog
ICAgZG9jdW1lbnQuZXhlY0NvbW1hbmQoJ1Bhc3RlQXNQbGFpblRleHQnKTsKICB9Owo8L3Njcmlw
dD4K
</data>

          </attachment>
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>421512</attachid>
            <date>2021-02-25 02:01:46 -0800</date>
            <delta_ts>2021-02-25 02:01:46 -0800</delta_ts>
            <desc>Patch</desc>
            <filename>bug-221509.patch</filename>
            <type>text/plain</type>
            <size>668</size>
            <attacher name="Frédéric Wang Nélar">fred.wang</attacher>
            
              <data encoding="base64">ZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL2VkaXRpbmcvbWFya3VwLmNwcCBiL1NvdXJjZS9X
ZWJDb3JlL2VkaXRpbmcvbWFya3VwLmNwcAppbmRleCBkYmU0OTk2YWU4Li5iMjE1N2JlNWQ4IDEw
MDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9lZGl0aW5nL21hcmt1cC5jcHAKKysrIGIvU291cmNl
L1dlYkNvcmUvZWRpdGluZy9tYXJrdXAuY3BwCkBAIC0xMTk5LDYgKzExOTksNyBAQCBSZWY8RG9j
dW1lbnRGcmFnbWVudD4gY3JlYXRlRnJhZ21lbnRGcm9tVGV4dChjb25zdCBTaW1wbGVSYW5nZSYg
Y29udGV4dCwgY29uc3QgUwogICAgIGJvb2wgdXNlQ2xvbmVzT2ZFbmNsb3NpbmdCbG9jayA9IGJs
b2NrCiAgICAgICAgICYmICFibG9jay0+aGFzVGFnTmFtZShib2R5VGFnKQogICAgICAgICAmJiAh
YmxvY2stPmhhc1RhZ05hbWUoaHRtbFRhZykKKyAgICAgICAgJiYgIWJsb2NrLT5oYXNUYWdOYW1l
KGlucHV0VGFnKQogICAgICAgICAvLyBBdm9pZCB1c2luZyB0YWJsZSBhcyBwYXJhZ3JhcGhzIGR1
ZSB0byBpdHMgc3BlY2lhbCB0cmVhdG1lbnQgaW4gUG9zaXRpb246OnVwc3RyZWFtL2Rvd25zdHJl
YW0uCiAgICAgICAgICYmICFibG9jay0+aGFzVGFnTmFtZSh0YWJsZVRhZykKICAgICAgICAgJiYg
YmxvY2sgIT0gZWRpdGFibGVSb290Rm9yUG9zaXRpb24oc3RhcnQpOwo=
</data>
<flag name="review"
          id="440372"
          type_id="1"
          status="-"
          setter="fred.wang"
    />
          </attachment>
          <attachment
              isobsolete="1"
              ispatch="1"
              isprivate="0"
          >
            <attachid>421526</attachid>
            <date>2021-02-25 07:56:58 -0800</date>
            <delta_ts>2021-03-11 07:01:04 -0800</delta_ts>
            <desc>Patch</desc>
            <filename>0001-Bug-221509-Crash-in-makeBoundaryPoint-via-ReplaceSel.patch</filename>
            <type>text/plain</type>
            <size>5225</size>
            <attacher name="Frédéric Wang Nélar">fred.wang</attacher>
            
              <data encoding="base64">RnJvbSA3MDM2MDA2ZjZkZWI4Y2Q2MmI4OGQ3MGY2Njc4MmY2YWJkODRlYjM5IE1vbiBTZXAgMTcg
MDA6MDA6MDAgMjAwMQpGcm9tOiA9P1VURi04P3E/RnI9QzM9QTlkPUMzPUE5cmljPTIwV2FuZz89
IDxmd2FuZ0BpZ2FsaWEuY29tPgpEYXRlOiBUaHUsIDI1IEZlYiAyMDIxIDE2OjQ3OjUwICswMTAw
ClN1YmplY3Q6IFtQQVRDSF0gQnVnIDIyMTUwOSAtIENyYXNoIGluIG1ha2VCb3VuZGFyeVBvaW50
IHZpYQogUmVwbGFjZVNlbGVjdGlvbkNvbW1hbmQ6Omluc2VydGVkQ29udGVudFJhbmdlCgotLS0K
IExheW91dFRlc3RzL0NoYW5nZUxvZyAgICAgICAgICAgICAgICAgICAgICAgICB8ICA5ICsrKysr
KysrCiAuLi5sZWN0aW9uLWFuZC1hcHBseS1zdHlsZS1jcmFzaC1leHBlY3RlZC50eHQgfCAgNCAr
KysrCiAuLi5wbGFjZS1zZWxlY3Rpb24tYW5kLWFwcGx5LXN0eWxlLWNyYXNoLmh0bWwgfCAxNyAr
KysrKysrKysrKysrKysKIFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZyAgICAgICAgICAgICAgICAg
ICAgICB8IDIxICsrKysrKysrKysrKysrKysrKysKIC4uLi9lZGl0aW5nL1JlcGxhY2VTZWxlY3Rp
b25Db21tYW5kLmNwcCAgICAgICB8ICA3ICsrKysrKysKIDUgZmlsZXMgY2hhbmdlZCwgNTggaW5z
ZXJ0aW9ucygrKQogY3JlYXRlIG1vZGUgMTAwNjQ0IExheW91dFRlc3RzL2Zhc3QvZWRpdGluZy9y
ZXBsYWNlLXNlbGVjdGlvbi1hbmQtYXBwbHktc3R5bGUtY3Jhc2gtZXhwZWN0ZWQudHh0CiBjcmVh
dGUgbW9kZSAxMDA2NDQgTGF5b3V0VGVzdHMvZmFzdC9lZGl0aW5nL3JlcGxhY2Utc2VsZWN0aW9u
LWFuZC1hcHBseS1zdHlsZS1jcmFzaC5odG1sCgpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvQ2hh
bmdlTG9nIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCmluZGV4IDNiY2YyMmFjYTkuLjFjNDJiMDM4
NDIgMTAwNjQ0Ci0tLSBhL0xheW91dFRlc3RzL0NoYW5nZUxvZworKysgYi9MYXlvdXRUZXN0cy9D
aGFuZ2VMb2cKQEAgLTEsMyArMSwxMiBAQAorMjAyMS0wMi0yNSAgRnJlZGVyaWMgV2FuZyAgPGZ3
YW5nQGlnYWxpYS5jb20+CisKKyAgICAgICAgQ3Jhc2ggaW4gbWFrZUJvdW5kYXJ5UG9pbnQgdmlh
IFJlcGxhY2VTZWxlY3Rpb25Db21tYW5kOjppbnNlcnRlZENvbnRlbnRSYW5nZQorICAgICAgICBo
dHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjIxNTA5CisKKyAgICAgICAg
UmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgKiBmYXN0L2VkaXRpbmcvcmVw
bGFjZS1zZWxlY3Rpb24tYW5kLWFwcGx5LXN0eWxlLWNyYXNoLmh0bWw6IEFkZGVkLgorCiAyMDIx
LTAyLTI0ICBGcmVkZXJpYyBXYW5nICA8ZndhbmdAaWdhbGlhLmNvbT4KIAogICAgICAgICBOdWxs
cHRyIGNyYXNoIGluIENvbXBvc2l0ZUVkaXRDb21tYW5kOjpzcGxpdFRyZWVUb05vZGUgdmlhIElu
c2VydFBhcmFncmFwaFNlcGFyYXRvckNvbW1hbmQ6OmRvQXBwbHkKZGlmZiAtLWdpdCBhL0xheW91
dFRlc3RzL2Zhc3QvZWRpdGluZy9yZXBsYWNlLXNlbGVjdGlvbi1hbmQtYXBwbHktc3R5bGUtY3Jh
c2gtZXhwZWN0ZWQudHh0IGIvTGF5b3V0VGVzdHMvZmFzdC9lZGl0aW5nL3JlcGxhY2Utc2VsZWN0
aW9uLWFuZC1hcHBseS1zdHlsZS1jcmFzaC1leHBlY3RlZC50eHQKbmV3IGZpbGUgbW9kZSAxMDA2
NDQKaW5kZXggMDAwMDAwMDAwMC4uMDQwMGI4YjM3NwotLS0gL2Rldi9udWxsCisrKyBiL0xheW91
dFRlc3RzL2Zhc3QvZWRpdGluZy9yZXBsYWNlLXNlbGVjdGlvbi1hbmQtYXBwbHktc3R5bGUtY3Jh
c2gtZXhwZWN0ZWQudHh0CkBAIC0wLDAgKzEsNCBAQAorQ09OU09MRSBNRVNTQUdFOiBUaGlzIHRl
c3QgcGFzc2VzIGlmIGl0IGRvZXMgbm90IGNyYXNoLgorCisKKwpkaWZmIC0tZ2l0IGEvTGF5b3V0
VGVzdHMvZmFzdC9lZGl0aW5nL3JlcGxhY2Utc2VsZWN0aW9uLWFuZC1hcHBseS1zdHlsZS1jcmFz
aC5odG1sIGIvTGF5b3V0VGVzdHMvZmFzdC9lZGl0aW5nL3JlcGxhY2Utc2VsZWN0aW9uLWFuZC1h
cHBseS1zdHlsZS1jcmFzaC5odG1sCm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAw
MDAuLjhiNWRlYWU4OWUKLS0tIC9kZXYvbnVsbAorKysgYi9MYXlvdXRUZXN0cy9mYXN0L2VkaXRp
bmcvcmVwbGFjZS1zZWxlY3Rpb24tYW5kLWFwcGx5LXN0eWxlLWNyYXNoLmh0bWwKQEAgLTAsMCAr
MSwxNyBAQAorPG1ldGE+Cis8c3R5bGU+Cis8L3N0eWxlPgorPHNjcmlwdD4KKyAgaWYgKHdpbmRv
dy50ZXN0UnVubmVyKQorICAgICAgdGVzdFJ1bm5lci5kdW1wQXNUZXh0KCk7CisgIGNvbnNvbGUu
bG9nKCJUaGlzIHRlc3QgcGFzc2VzIGlmIGl0IGRvZXMgbm90IGNyYXNoLiIpCisgIG9ubG9hZCA9
ICgpID0+IHsKKyAgICBkb2N1bWVudC5zdHlsZVNoZWV0c1swXS5pbnNlcnRSdWxlKGBoZWFkLCBz
Y3JpcHQsIG1ldGEsIGlucHV0IHsgZGlzcGxheTogYmxvY2s7IH1gKTsKKyAgICBkb2N1bWVudC5z
dHlsZVNoZWV0c1swXS5pbnNlcnRSdWxlKGBpbnB1dCB7IHRleHQtaW5kZW50OiAxcHg7IH1gKTsK
KyAgICBkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCdtZXRhJykuYXBwZW5kQ2hpbGQoZG9jdW1lbnQu
Y3JlYXRlRWxlbWVudCgnaW5wdXQnKSk7CisgICAgZG9jdW1lbnQuZXhlY0NvbW1hbmQoJ1NlbGVj
dEFsbCcpOworICAgIGRvY3VtZW50LmRlc2lnbk1vZGUgPSAnb24nOworICAgIGRvY3VtZW50LmV4
ZWNDb21tYW5kKCdDb3B5Jyk7CisgICAgZG9jdW1lbnQuZXhlY0NvbW1hbmQoJ1Bhc3RlQXNQbGFp
blRleHQnKTsKKyAgfTsKKzwvc2NyaXB0PgpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvQ2hh
bmdlTG9nIGIvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCmluZGV4IGQyYTkwNmMwYWEuLmExNzc1
YWQ0NDQgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZworKysgYi9Tb3VyY2Uv
V2ViQ29yZS9DaGFuZ2VMb2cKQEAgLTEsMyArMSwyNCBAQAorMjAyMS0wMi0yNSAgRnJlZGVyaWMg
V2FuZyAgPGZ3YW5nQGlnYWxpYS5jb20+CisKKyAgICAgICAgQ3Jhc2ggaW4gbWFrZUJvdW5kYXJ5
UG9pbnQgdmlhIFJlcGxhY2VTZWxlY3Rpb25Db21tYW5kOjppbnNlcnRlZENvbnRlbnRSYW5nZQor
ICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjIxNTA5CisK
KyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgV2ViQ29yZTo6
UmVwbGFjZVNlbGVjdGlvbkNvbW1hbmQ6OmRvQXBwbHkoKSBzYXZlcyBzdGFydC9lbmQgcG9zaXRp
b25zIG9mIGluc2VydGVkIGNvbnRlbnQKKyAgICAgICAgaW50byBtX3N0YXJ0T2ZJbnNlcnRlZENv
bnRlbnQgYW5kIG1fZW5kT2ZJbnNlcnRlZENvbnRlbnQuIEF0IHRoZSBlbmQsIGl0IGNhbGxzCisg
ICAgICAgIFJlcGxhY2VTZWxlY3Rpb25Db21tYW5kOjpjb21wbGV0ZUhUTUxSZXBsYWNlbWVudCgp
IHdoaWNoIGluIHR1cm4gbWF5IGRlZXAgY2xvbmUgcGFydCBvZiB0aGUKKyAgICAgICAgaW5zZXJ0
ZWQgY29udGVudCwgaW4gb3JkZXIgdG8gYXBwbHkgc3R5bGUuIFRoaXMgdGhlbiByZXN1bHQgaW4g
dGhlIHN0YXJ0L2VuZCBhbmNob3Igbm9kZXMKKyAgICAgICAgYmVjb21pbmcgb3JwaGFuLCBjYXVz
aW5nIG51bGxwdHIgZGVyZWZlcmVuY2UgbGF0ZXIgaW4gdGhlIGNvZGUuIElkZWFsbHksIHRoZSBh
bmNob3Igbm9kZXMKKyAgICAgICAgc2hvdWxkIGJlIG1vdmVkIHRvIHRoZSBjbG9uZWQgbm9kZXMg
YnV0IHRoaXMgcGF0Y2ggb25seSB3b3JrcyBhcm91bmQgdGhlIGlzc3VlIGJ5IHJlc2V0dGluZwor
ICAgICAgICB0aGUgc3RhcnQvZW5kIHBvc2l0aW9ucy4KKworICAgICAgICBUZXN0OiBmYXN0L2Vk
aXRpbmcvcmVwbGFjZS1zZWxlY3Rpb24tYW5kLWFwcGx5LXN0eWxlLWNyYXNoLmh0bWwKKworICAg
ICAgICAqIGVkaXRpbmcvUmVwbGFjZVNlbGVjdGlvbkNvbW1hbmQuY3BwOgorICAgICAgICAoV2Vi
Q29yZTo6UmVwbGFjZVNlbGVjdGlvbkNvbW1hbmQ6OmNvbXBsZXRlSFRNTFJlcGxhY2VtZW50KTog
SWYgb25lIG9mIHRoZSBhbmNob3Igbm9kZXMKKyAgICAgICAgYmVjYW1lIG9ycGhhbiwganVzdCBj
bGVhciBtX3N0YXJ0T2ZJbnNlcnRlZENvbnRlbnQgYW5kIG1fZW5kT2ZJbnNlcnRlZENvbnRlbnQu
CisKIDIwMjEtMDItMjQgIEZyZWRlcmljIFdhbmcgIDxmd2FuZ0BpZ2FsaWEuY29tPgogCiAgICAg
ICAgIE51bGxwdHIgY3Jhc2ggaW4gQ29tcG9zaXRlRWRpdENvbW1hbmQ6OnNwbGl0VHJlZVRvTm9k
ZSB2aWEgSW5zZXJ0UGFyYWdyYXBoU2VwYXJhdG9yQ29tbWFuZDo6ZG9BcHBseQpkaWZmIC0tZ2l0
IGEvU291cmNlL1dlYkNvcmUvZWRpdGluZy9SZXBsYWNlU2VsZWN0aW9uQ29tbWFuZC5jcHAgYi9T
b3VyY2UvV2ViQ29yZS9lZGl0aW5nL1JlcGxhY2VTZWxlY3Rpb25Db21tYW5kLmNwcAppbmRleCA3
NmRjNWU2NTFiLi4yNTkxZDdlNWUxIDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9lZGl0aW5n
L1JlcGxhY2VTZWxlY3Rpb25Db21tYW5kLmNwcAorKysgYi9Tb3VyY2UvV2ViQ29yZS9lZGl0aW5n
L1JlcGxhY2VTZWxlY3Rpb25Db21tYW5kLmNwcApAQCAtMTU4NCw2ICsxNTg0LDEzIEBAIHZvaWQg
UmVwbGFjZVNlbGVjdGlvbkNvbW1hbmQ6OmNvbXBsZXRlSFRNTFJlcGxhY2VtZW50KGNvbnN0IFBv
c2l0aW9uICZsYXN0UG9zaXRpCiAgICAgICAgIGlmIChtX21hdGNoU3R5bGUpIHsKICAgICAgICAg
ICAgIEFTU0VSVChtX2luc2VydGlvblN0eWxlKTsKICAgICAgICAgICAgIGFwcGx5U3R5bGUobV9p
bnNlcnRpb25TdHlsZS5nZXQoKSwgc3RhcnQsIGVuZCk7CisgICAgICAgICAgICAvLyBhcHBseVN0
eWxlIG1heSBjbG9uZSBjb250ZW50IHRvIG5ldyBibG9jayB3cmFwcGVycyBhbmQgbWFrZSBhbmNo
b3Igbm9kZXMgb3JwaGFuLgorICAgICAgICAgICAgLy8gRklYTUU6IElkZWFsbHksIHN0YXJ0L2Vu
ZCBzaG91bGQgYmUgc2V0IG9uIHRoZSBjbG9uZWQgY29udGVudCBpbnN0ZWFkLgorICAgICAgICAg
ICAgaWYgKHN0YXJ0LmlzT3JwaGFuKCkgfHwgZW5kLmlzT3JwaGFuKCkpIHsKKyAgICAgICAgICAg
ICAgICBzdGFydCA9IGVuZCA9IHsgfTsKKyAgICAgICAgICAgICAgICBtX3N0YXJ0T2ZJbnNlcnRl
ZENvbnRlbnQgPSBzdGFydDsKKyAgICAgICAgICAgICAgICBtX2VuZE9mSW5zZXJ0ZWRDb250ZW50
ID0gZW5kOworICAgICAgICAgICAgfQogICAgICAgICB9CiAKICAgICAgICAgaWYgKGxhc3RQb3Np
dGlvblRvU2VsZWN0LmlzTm90TnVsbCgpKQotLSAKMi4yNS4xCgo=
</data>

          </attachment>
          <attachment
              isobsolete="1"
              ispatch="1"
              isprivate="0"
          >
            <attachid>422928</attachid>
            <date>2021-03-11 07:01:04 -0800</date>
            <delta_ts>2021-03-11 23:46:05 -0800</delta_ts>
            <desc>Patch</desc>
            <filename>0001-Bug-221509-Crash-in-makeBoundaryPoint-via-ReplaceSel.patch</filename>
            <type>text/plain</type>
            <size>5183</size>
            <attacher name="Frédéric Wang Nélar">fred.wang</attacher>
            
              <data encoding="base64">RnJvbSAwMzZiMmZkMGYyYjQ2ZTYzMWQ3NzZhZmQwZDVkNGFlY2VlYjVlNzRhIE1vbiBTZXAgMTcg
MDA6MDA6MDAgMjAwMQpGcm9tOiA9P1VURi04P3E/RnI9QzM9QTlkPUMzPUE5cmljPTIwV2FuZz89
IDxmd2FuZ0BpZ2FsaWEuY29tPgpEYXRlOiBUaHUsIDI1IEZlYiAyMDIxIDE2OjQ3OjUwICswMTAw
ClN1YmplY3Q6IFtQQVRDSF0gQnVnIDIyMTUwOSAtIENyYXNoIGluIG1ha2VCb3VuZGFyeVBvaW50
IHZpYQogUmVwbGFjZVNlbGVjdGlvbkNvbW1hbmQ6Omluc2VydGVkQ29udGVudFJhbmdlCgotLS0K
IExheW91dFRlc3RzL0NoYW5nZUxvZyAgICAgICAgICAgICAgICAgICAgICAgICB8ICA5ICsrKysr
KysrCiAuLi5sZWN0aW9uLWFuZC1hcHBseS1zdHlsZS1jcmFzaC1leHBlY3RlZC50eHQgfCAgNCAr
KysrCiAuLi5wbGFjZS1zZWxlY3Rpb24tYW5kLWFwcGx5LXN0eWxlLWNyYXNoLmh0bWwgfCAxNyAr
KysrKysrKysrKysrKysKIFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZyAgICAgICAgICAgICAgICAg
ICAgICB8IDIxICsrKysrKysrKysrKysrKysrKysKIC4uLi9lZGl0aW5nL1JlcGxhY2VTZWxlY3Rp
b25Db21tYW5kLmNwcCAgICAgICB8ICA4ICsrKysrKysKIDUgZmlsZXMgY2hhbmdlZCwgNTkgaW5z
ZXJ0aW9ucygrKQogY3JlYXRlIG1vZGUgMTAwNjQ0IExheW91dFRlc3RzL2Zhc3QvZWRpdGluZy9y
ZXBsYWNlLXNlbGVjdGlvbi1hbmQtYXBwbHktc3R5bGUtY3Jhc2gtZXhwZWN0ZWQudHh0CiBjcmVh
dGUgbW9kZSAxMDA2NDQgTGF5b3V0VGVzdHMvZmFzdC9lZGl0aW5nL3JlcGxhY2Utc2VsZWN0aW9u
LWFuZC1hcHBseS1zdHlsZS1jcmFzaC5odG1sCgpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvQ2hh
bmdlTG9nIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCmluZGV4IGZlNGQzNmM1OWEuLjU3YWZjZTFk
ZGYgMTAwNjQ0Ci0tLSBhL0xheW91dFRlc3RzL0NoYW5nZUxvZworKysgYi9MYXlvdXRUZXN0cy9D
aGFuZ2VMb2cKQEAgLTEsMyArMSwxMiBAQAorMjAyMS0wMi0yNSAgRnJlZGVyaWMgV2FuZyAgPGZ3
YW5nQGlnYWxpYS5jb20+CisKKyAgICAgICAgQ3Jhc2ggaW4gbWFrZUJvdW5kYXJ5UG9pbnQgdmlh
IFJlcGxhY2VTZWxlY3Rpb25Db21tYW5kOjppbnNlcnRlZENvbnRlbnRSYW5nZQorICAgICAgICBo
dHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjIxNTA5CisKKyAgICAgICAg
UmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgKiBmYXN0L2VkaXRpbmcvcmVw
bGFjZS1zZWxlY3Rpb24tYW5kLWFwcGx5LXN0eWxlLWNyYXNoLmh0bWw6IEFkZGVkLgorCiAyMDIx
LTAzLTAyICBZb3Vlbm4gRmFibGV0ICA8eW91ZW5uQGFwcGxlLmNvbT4KIAogICAgICAgICBFbmFi
bGUgTUVESUFfU09VUkNFIGluIElPUyBTaW11bGF0b3IKZGlmZiAtLWdpdCBhL0xheW91dFRlc3Rz
L2Zhc3QvZWRpdGluZy9yZXBsYWNlLXNlbGVjdGlvbi1hbmQtYXBwbHktc3R5bGUtY3Jhc2gtZXhw
ZWN0ZWQudHh0IGIvTGF5b3V0VGVzdHMvZmFzdC9lZGl0aW5nL3JlcGxhY2Utc2VsZWN0aW9uLWFu
ZC1hcHBseS1zdHlsZS1jcmFzaC1leHBlY3RlZC50eHQKbmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5k
ZXggMDAwMDAwMDAwMC4uMDQwMGI4YjM3NwotLS0gL2Rldi9udWxsCisrKyBiL0xheW91dFRlc3Rz
L2Zhc3QvZWRpdGluZy9yZXBsYWNlLXNlbGVjdGlvbi1hbmQtYXBwbHktc3R5bGUtY3Jhc2gtZXhw
ZWN0ZWQudHh0CkBAIC0wLDAgKzEsNCBAQAorQ09OU09MRSBNRVNTQUdFOiBUaGlzIHRlc3QgcGFz
c2VzIGlmIGl0IGRvZXMgbm90IGNyYXNoLgorCisKKwpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMv
ZmFzdC9lZGl0aW5nL3JlcGxhY2Utc2VsZWN0aW9uLWFuZC1hcHBseS1zdHlsZS1jcmFzaC5odG1s
IGIvTGF5b3V0VGVzdHMvZmFzdC9lZGl0aW5nL3JlcGxhY2Utc2VsZWN0aW9uLWFuZC1hcHBseS1z
dHlsZS1jcmFzaC5odG1sCm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAwMDAuLjhi
NWRlYWU4OWUKLS0tIC9kZXYvbnVsbAorKysgYi9MYXlvdXRUZXN0cy9mYXN0L2VkaXRpbmcvcmVw
bGFjZS1zZWxlY3Rpb24tYW5kLWFwcGx5LXN0eWxlLWNyYXNoLmh0bWwKQEAgLTAsMCArMSwxNyBA
QAorPG1ldGE+Cis8c3R5bGU+Cis8L3N0eWxlPgorPHNjcmlwdD4KKyAgaWYgKHdpbmRvdy50ZXN0
UnVubmVyKQorICAgICAgdGVzdFJ1bm5lci5kdW1wQXNUZXh0KCk7CisgIGNvbnNvbGUubG9nKCJU
aGlzIHRlc3QgcGFzc2VzIGlmIGl0IGRvZXMgbm90IGNyYXNoLiIpCisgIG9ubG9hZCA9ICgpID0+
IHsKKyAgICBkb2N1bWVudC5zdHlsZVNoZWV0c1swXS5pbnNlcnRSdWxlKGBoZWFkLCBzY3JpcHQs
IG1ldGEsIGlucHV0IHsgZGlzcGxheTogYmxvY2s7IH1gKTsKKyAgICBkb2N1bWVudC5zdHlsZVNo
ZWV0c1swXS5pbnNlcnRSdWxlKGBpbnB1dCB7IHRleHQtaW5kZW50OiAxcHg7IH1gKTsKKyAgICBk
b2N1bWVudC5xdWVyeVNlbGVjdG9yKCdtZXRhJykuYXBwZW5kQ2hpbGQoZG9jdW1lbnQuY3JlYXRl
RWxlbWVudCgnaW5wdXQnKSk7CisgICAgZG9jdW1lbnQuZXhlY0NvbW1hbmQoJ1NlbGVjdEFsbCcp
OworICAgIGRvY3VtZW50LmRlc2lnbk1vZGUgPSAnb24nOworICAgIGRvY3VtZW50LmV4ZWNDb21t
YW5kKCdDb3B5Jyk7CisgICAgZG9jdW1lbnQuZXhlY0NvbW1hbmQoJ1Bhc3RlQXNQbGFpblRleHQn
KTsKKyAgfTsKKzwvc2NyaXB0PgpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9n
IGIvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCmluZGV4IGMxMTY0NWQwMTkuLjI4NTdmMzg0M2Qg
MTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZworKysgYi9Tb3VyY2UvV2ViQ29y
ZS9DaGFuZ2VMb2cKQEAgLTEsMyArMSwyNCBAQAorMjAyMS0wMi0yNSAgRnJlZGVyaWMgV2FuZyAg
PGZ3YW5nQGlnYWxpYS5jb20+CisKKyAgICAgICAgQ3Jhc2ggaW4gbWFrZUJvdW5kYXJ5UG9pbnQg
dmlhIFJlcGxhY2VTZWxlY3Rpb25Db21tYW5kOjppbnNlcnRlZENvbnRlbnRSYW5nZQorICAgICAg
ICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjIxNTA5CisKKyAgICAg
ICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgV2ViQ29yZTo6UmVwbGFj
ZVNlbGVjdGlvbkNvbW1hbmQ6OmRvQXBwbHkoKSBzYXZlcyBzdGFydC9lbmQgcG9zaXRpb25zIG9m
IGluc2VydGVkIGNvbnRlbnQKKyAgICAgICAgaW50byBtX3N0YXJ0T2ZJbnNlcnRlZENvbnRlbnQg
YW5kIG1fZW5kT2ZJbnNlcnRlZENvbnRlbnQuIEF0IHRoZSBlbmQsIGl0IGNhbGxzCisgICAgICAg
IFJlcGxhY2VTZWxlY3Rpb25Db21tYW5kOjpjb21wbGV0ZUhUTUxSZXBsYWNlbWVudCgpIHdoaWNo
IGluIHR1cm4gbWF5IGRlZXAgY2xvbmUgcGFydCBvZiB0aGUKKyAgICAgICAgaW5zZXJ0ZWQgY29u
dGVudCwgaW4gb3JkZXIgdG8gYXBwbHkgc3R5bGUuIFRoaXMgdGhlbiByZXN1bHQgaW4gdGhlIHN0
YXJ0L2VuZCBhbmNob3Igbm9kZXMKKyAgICAgICAgYmVjb21pbmcgb3JwaGFuLCBjYXVzaW5nIG51
bGxwdHIgZGVyZWZlcmVuY2UgbGF0ZXIgaW4gdGhlIGNvZGUuIElkZWFsbHksIHRoZSBhbmNob3Ig
bm9kZXMKKyAgICAgICAgc2hvdWxkIGJlIG1vdmVkIHRvIHRoZSBjbG9uZWQgbm9kZXMgYnV0IHRo
aXMgcGF0Y2ggb25seSB3b3JrcyBhcm91bmQgdGhlIGlzc3VlIGJ5IHJlc2V0dGluZworICAgICAg
ICB0aGUgc3RhcnQvZW5kIHBvc2l0aW9ucy4KKworICAgICAgICBUZXN0OiBmYXN0L2VkaXRpbmcv
cmVwbGFjZS1zZWxlY3Rpb24tYW5kLWFwcGx5LXN0eWxlLWNyYXNoLmh0bWwKKworICAgICAgICAq
IGVkaXRpbmcvUmVwbGFjZVNlbGVjdGlvbkNvbW1hbmQuY3BwOgorICAgICAgICAoV2ViQ29yZTo6
UmVwbGFjZVNlbGVjdGlvbkNvbW1hbmQ6OmNvbXBsZXRlSFRNTFJlcGxhY2VtZW50KTogSWYgb25l
IG9mIHRoZSBhbmNob3Igbm9kZXMKKyAgICAgICAgYmVjYW1lIG9ycGhhbiwganVzdCBjbGVhciBt
X3N0YXJ0T2ZJbnNlcnRlZENvbnRlbnQgYW5kIG1fZW5kT2ZJbnNlcnRlZENvbnRlbnQuCisKIDIw
MjEtMDMtMDIgIE1hcnRpbiBSb2JpbnNvbiAgPG1yb2JpbnNvbkBpZ2FsaWEuY29tPgogCiAgICAg
ICAgIEVsaW1pbmF0ZSBTY3JvbGxBbmltYXRvckdlbmVyaWM6Om1fc21vb3RoQW5pbWF0aW9uCmRp
ZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9lZGl0aW5nL1JlcGxhY2VTZWxlY3Rpb25Db21tYW5k
LmNwcCBiL1NvdXJjZS9XZWJDb3JlL2VkaXRpbmcvUmVwbGFjZVNlbGVjdGlvbkNvbW1hbmQuY3Bw
CmluZGV4IDc2ZGM1ZTY1MWIuLjgzMzJmY2EwODAgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3Jl
L2VkaXRpbmcvUmVwbGFjZVNlbGVjdGlvbkNvbW1hbmQuY3BwCisrKyBiL1NvdXJjZS9XZWJDb3Jl
L2VkaXRpbmcvUmVwbGFjZVNlbGVjdGlvbkNvbW1hbmQuY3BwCkBAIC0xNTg0LDYgKzE1ODQsMTQg
QEAgdm9pZCBSZXBsYWNlU2VsZWN0aW9uQ29tbWFuZDo6Y29tcGxldGVIVE1MUmVwbGFjZW1lbnQo
Y29uc3QgUG9zaXRpb24gJmxhc3RQb3NpdGkKICAgICAgICAgaWYgKG1fbWF0Y2hTdHlsZSkgewog
ICAgICAgICAgICAgQVNTRVJUKG1faW5zZXJ0aW9uU3R5bGUpOwogICAgICAgICAgICAgYXBwbHlT
dHlsZShtX2luc2VydGlvblN0eWxlLmdldCgpLCBzdGFydCwgZW5kKTsKKyAgICAgICAgICAgIC8v
IGFwcGx5U3R5bGUgbWF5IGNsb25lIGNvbnRlbnQgdG8gbmV3IGJsb2NrIHdyYXBwZXJzIGFuZCBt
YWtlIGFuY2hvciBub2RlcyBvcnBoYW4uCisgICAgICAgICAgICAvLyBGSVhNRTogSWRlYWxseSwg
c3RhcnQvZW5kIHNob3VsZCBiZSBzZXQgb24gdGhlIGNsb25lZCBjb250ZW50IGluc3RlYWQuCisg
ICAgICAgICAgICBpZiAoc3RhcnQuaXNPcnBoYW4oKSB8fCBlbmQuaXNPcnBoYW4oKSkgeworICAg
ICAgICAgICAgICAgIHN0YXJ0ID0gZW5kaW5nU2VsZWN0aW9uKCkuc3RhcnQoKTsKKyAgICAgICAg
ICAgICAgICBlbmQgPSBlbmRpbmdTZWxlY3Rpb24oKS5lbmQoKTsKKyAgICAgICAgICAgICAgICBt
X3N0YXJ0T2ZJbnNlcnRlZENvbnRlbnQgPSBzdGFydDsKKyAgICAgICAgICAgICAgICBtX2VuZE9m
SW5zZXJ0ZWRDb250ZW50ID0gZW5kOworICAgICAgICAgICAgfQogICAgICAgICB9CiAKICAgICAg
ICAgaWYgKGxhc3RQb3NpdGlvblRvU2VsZWN0LmlzTm90TnVsbCgpKQotLSAKMi4yNS4xCgo=
</data>
<flag name="review"
          id="442151"
          type_id="1"
          status="+"
          setter="rniwa"
    />
          </attachment>
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>423019</attachid>
            <date>2021-03-11 23:46:05 -0800</date>
            <delta_ts>2021-03-16 05:20:37 -0700</delta_ts>
            <desc>Patch for landing</desc>
            <filename>0001-Bug-221509-Crash-in-makeBoundaryPoint-via-ReplaceSel.patch</filename>
            <type>text/plain</type>
            <size>5214</size>
            <attacher name="Frédéric Wang Nélar">fred.wang</attacher>
            
              <data encoding="base64">RnJvbSA1MmVhNzdkNmI5Y2NlOTlhYTEzNzU3ZTg4NjUyZTUzMmIzZTg3ZTQyIE1vbiBTZXAgMTcg
MDA6MDA6MDAgMjAwMQpGcm9tOiA9P1VURi04P3E/RnI9QzM9QTlkPUMzPUE5cmljPTIwV2FuZz89
IDxmd2FuZ0BpZ2FsaWEuY29tPgpEYXRlOiBUaHUsIDI1IEZlYiAyMDIxIDE2OjQ3OjUwICswMTAw
ClN1YmplY3Q6IFtQQVRDSF0gQnVnIDIyMTUwOSAtIENyYXNoIGluIG1ha2VCb3VuZGFyeVBvaW50
IHZpYQogUmVwbGFjZVNlbGVjdGlvbkNvbW1hbmQ6Omluc2VydGVkQ29udGVudFJhbmdlCgotLS0K
IExheW91dFRlc3RzL0NoYW5nZUxvZyAgICAgICAgICAgICAgICAgICAgICAgICB8IDEyICsrKysr
KysrKysrCiAuLi5sZWN0aW9uLWFuZC1hcHBseS1zdHlsZS1jcmFzaC1leHBlY3RlZC50eHQgfCAg
NCArKysrCiAuLi5wbGFjZS1zZWxlY3Rpb24tYW5kLWFwcGx5LXN0eWxlLWNyYXNoLmh0bWwgfCAx
NyArKysrKysrKysrKysrKysKIFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZyAgICAgICAgICAgICAg
ICAgICAgICB8IDIxICsrKysrKysrKysrKysrKysrKysKIC4uLi9lZGl0aW5nL1JlcGxhY2VTZWxl
Y3Rpb25Db21tYW5kLmNwcCAgICAgICB8ICA3ICsrKysrKysKIDUgZmlsZXMgY2hhbmdlZCwgNjEg
aW5zZXJ0aW9ucygrKQogY3JlYXRlIG1vZGUgMTAwNjQ0IExheW91dFRlc3RzL2Zhc3QvZWRpdGlu
Zy9yZXBsYWNlLXNlbGVjdGlvbi1hbmQtYXBwbHktc3R5bGUtY3Jhc2gtZXhwZWN0ZWQudHh0CiBj
cmVhdGUgbW9kZSAxMDA2NDQgTGF5b3V0VGVzdHMvZmFzdC9lZGl0aW5nL3JlcGxhY2Utc2VsZWN0
aW9uLWFuZC1hcHBseS1zdHlsZS1jcmFzaC5odG1sCgpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMv
Q2hhbmdlTG9nIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCmluZGV4IGZlNGQzNmM1OWEuLjllM2Rj
ZTcyMzIgMTAwNjQ0Ci0tLSBhL0xheW91dFRlc3RzL0NoYW5nZUxvZworKysgYi9MYXlvdXRUZXN0
cy9DaGFuZ2VMb2cKQEAgLTEsMyArMSwxNSBAQAorMjAyMS0wMi0yNSAgRnJlZGVyaWMgV2FuZyAg
PGZ3YW5nQGlnYWxpYS5jb20+CisKKyAgICAgICAgQ3Jhc2ggaW4gbWFrZUJvdW5kYXJ5UG9pbnQg
dmlhIFJlcGxhY2VTZWxlY3Rpb25Db21tYW5kOjppbnNlcnRlZENvbnRlbnRSYW5nZQorICAgICAg
ICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjIxNTA5CisKKyAgICAg
ICAgUmV2aWV3ZWQgYnkgUnlvc3VrZSBOaXdhLgorCisgICAgICAgIEFkZCBhIHJlZ3Jlc3Npb24g
dGVzdC4KKworICAgICAgICAqIGZhc3QvZWRpdGluZy9yZXBsYWNlLXNlbGVjdGlvbi1hbmQtYXBw
bHktc3R5bGUtY3Jhc2gtZXhwZWN0ZWQudHh0OiBBZGRlZC4KKyAgICAgICAgKiBmYXN0L2VkaXRp
bmcvcmVwbGFjZS1zZWxlY3Rpb24tYW5kLWFwcGx5LXN0eWxlLWNyYXNoLmh0bWw6IEFkZGVkLgor
CiAyMDIxLTAzLTAyICBZb3Vlbm4gRmFibGV0ICA8eW91ZW5uQGFwcGxlLmNvbT4KIAogICAgICAg
ICBFbmFibGUgTUVESUFfU09VUkNFIGluIElPUyBTaW11bGF0b3IKZGlmZiAtLWdpdCBhL0xheW91
dFRlc3RzL2Zhc3QvZWRpdGluZy9yZXBsYWNlLXNlbGVjdGlvbi1hbmQtYXBwbHktc3R5bGUtY3Jh
c2gtZXhwZWN0ZWQudHh0IGIvTGF5b3V0VGVzdHMvZmFzdC9lZGl0aW5nL3JlcGxhY2Utc2VsZWN0
aW9uLWFuZC1hcHBseS1zdHlsZS1jcmFzaC1leHBlY3RlZC50eHQKbmV3IGZpbGUgbW9kZSAxMDA2
NDQKaW5kZXggMDAwMDAwMDAwMC4uMDQwMGI4YjM3NwotLS0gL2Rldi9udWxsCisrKyBiL0xheW91
dFRlc3RzL2Zhc3QvZWRpdGluZy9yZXBsYWNlLXNlbGVjdGlvbi1hbmQtYXBwbHktc3R5bGUtY3Jh
c2gtZXhwZWN0ZWQudHh0CkBAIC0wLDAgKzEsNCBAQAorQ09OU09MRSBNRVNTQUdFOiBUaGlzIHRl
c3QgcGFzc2VzIGlmIGl0IGRvZXMgbm90IGNyYXNoLgorCisKKwpkaWZmIC0tZ2l0IGEvTGF5b3V0
VGVzdHMvZmFzdC9lZGl0aW5nL3JlcGxhY2Utc2VsZWN0aW9uLWFuZC1hcHBseS1zdHlsZS1jcmFz
aC5odG1sIGIvTGF5b3V0VGVzdHMvZmFzdC9lZGl0aW5nL3JlcGxhY2Utc2VsZWN0aW9uLWFuZC1h
cHBseS1zdHlsZS1jcmFzaC5odG1sCm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAw
MDAuLjhiNWRlYWU4OWUKLS0tIC9kZXYvbnVsbAorKysgYi9MYXlvdXRUZXN0cy9mYXN0L2VkaXRp
bmcvcmVwbGFjZS1zZWxlY3Rpb24tYW5kLWFwcGx5LXN0eWxlLWNyYXNoLmh0bWwKQEAgLTAsMCAr
MSwxNyBAQAorPG1ldGE+Cis8c3R5bGU+Cis8L3N0eWxlPgorPHNjcmlwdD4KKyAgaWYgKHdpbmRv
dy50ZXN0UnVubmVyKQorICAgICAgdGVzdFJ1bm5lci5kdW1wQXNUZXh0KCk7CisgIGNvbnNvbGUu
bG9nKCJUaGlzIHRlc3QgcGFzc2VzIGlmIGl0IGRvZXMgbm90IGNyYXNoLiIpCisgIG9ubG9hZCA9
ICgpID0+IHsKKyAgICBkb2N1bWVudC5zdHlsZVNoZWV0c1swXS5pbnNlcnRSdWxlKGBoZWFkLCBz
Y3JpcHQsIG1ldGEsIGlucHV0IHsgZGlzcGxheTogYmxvY2s7IH1gKTsKKyAgICBkb2N1bWVudC5z
dHlsZVNoZWV0c1swXS5pbnNlcnRSdWxlKGBpbnB1dCB7IHRleHQtaW5kZW50OiAxcHg7IH1gKTsK
KyAgICBkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCdtZXRhJykuYXBwZW5kQ2hpbGQoZG9jdW1lbnQu
Y3JlYXRlRWxlbWVudCgnaW5wdXQnKSk7CisgICAgZG9jdW1lbnQuZXhlY0NvbW1hbmQoJ1NlbGVj
dEFsbCcpOworICAgIGRvY3VtZW50LmRlc2lnbk1vZGUgPSAnb24nOworICAgIGRvY3VtZW50LmV4
ZWNDb21tYW5kKCdDb3B5Jyk7CisgICAgZG9jdW1lbnQuZXhlY0NvbW1hbmQoJ1Bhc3RlQXNQbGFp
blRleHQnKTsKKyAgfTsKKzwvc2NyaXB0PgpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvQ2hh
bmdlTG9nIGIvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCmluZGV4IGMxMTY0NWQwMTkuLjZlY2Yx
NTM3NjcgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZworKysgYi9Tb3VyY2Uv
V2ViQ29yZS9DaGFuZ2VMb2cKQEAgLTEsMyArMSwyNCBAQAorMjAyMS0wMi0yNSAgRnJlZGVyaWMg
V2FuZyAgPGZ3YW5nQGlnYWxpYS5jb20+CisKKyAgICAgICAgQ3Jhc2ggaW4gbWFrZUJvdW5kYXJ5
UG9pbnQgdmlhIFJlcGxhY2VTZWxlY3Rpb25Db21tYW5kOjppbnNlcnRlZENvbnRlbnRSYW5nZQor
ICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjIxNTA5CisK
KyAgICAgICAgUmV2aWV3ZWQgYnkgUnlvc3VrZSBOaXdhLgorCisgICAgICAgIFdlYkNvcmU6OlJl
cGxhY2VTZWxlY3Rpb25Db21tYW5kOjpkb0FwcGx5KCkgc2F2ZXMgc3RhcnQvZW5kIHBvc2l0aW9u
cyBvZiBpbnNlcnRlZCBjb250ZW50CisgICAgICAgIGludG8gbV9zdGFydE9mSW5zZXJ0ZWRDb250
ZW50IGFuZCBtX2VuZE9mSW5zZXJ0ZWRDb250ZW50LiBBdCB0aGUgZW5kLCBpdCBjYWxscworICAg
ICAgICBSZXBsYWNlU2VsZWN0aW9uQ29tbWFuZDo6Y29tcGxldGVIVE1MUmVwbGFjZW1lbnQoKSB3
aGljaCBpbiB0dXJuIG1heSBkZWVwIGNsb25lIHBhcnQgb2YgdGhlCisgICAgICAgIGluc2VydGVk
IGNvbnRlbnQsIGluIG9yZGVyIHRvIGFwcGx5IHN0eWxlLiBUaGlzIHRoZW4gcmVzdWx0IGluIHRo
ZSBzdGFydC9lbmQgYW5jaG9yIG5vZGVzCisgICAgICAgIGJlY29taW5nIG9ycGhhbiwgY2F1c2lu
ZyBudWxscHRyIGRlcmVmZXJlbmNlIGxhdGVyIGluIHRoZSBjb2RlLiBJZGVhbGx5LCB0aGUgYW5j
aG9yIG5vZGVzCisgICAgICAgIHNob3VsZCBiZSBtb3ZlZCB0byB0aGUgY2xvbmVkIG5vZGVzIGJ1
dCB0aGlzIHBhdGNoIG9ubHkgd29ya3MgYXJvdW5kIHRoZSBpc3N1ZSBieSByZXNldHRpbmcKKyAg
ICAgICAgdGhlIHN0YXJ0L2VuZCBwb3NpdGlvbnMuCisKKyAgICAgICAgVGVzdDogZmFzdC9lZGl0
aW5nL3JlcGxhY2Utc2VsZWN0aW9uLWFuZC1hcHBseS1zdHlsZS1jcmFzaC5odG1sCisKKyAgICAg
ICAgKiBlZGl0aW5nL1JlcGxhY2VTZWxlY3Rpb25Db21tYW5kLmNwcDoKKyAgICAgICAgKFdlYkNv
cmU6OlJlcGxhY2VTZWxlY3Rpb25Db21tYW5kOjpjb21wbGV0ZUhUTUxSZXBsYWNlbWVudCk6IElm
IG9uZSBvZiB0aGUgYW5jaG9yIG5vZGVzCisgICAgICAgIGJlY2FtZSBvcnBoYW4sIGp1c3QgY2xl
YXIgbV9zdGFydE9mSW5zZXJ0ZWRDb250ZW50IGFuZCBtX2VuZE9mSW5zZXJ0ZWRDb250ZW50Lgor
CiAyMDIxLTAzLTAyICBNYXJ0aW4gUm9iaW5zb24gIDxtcm9iaW5zb25AaWdhbGlhLmNvbT4KIAog
ICAgICAgICBFbGltaW5hdGUgU2Nyb2xsQW5pbWF0b3JHZW5lcmljOjptX3Ntb290aEFuaW1hdGlv
bgpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvZWRpdGluZy9SZXBsYWNlU2VsZWN0aW9uQ29t
bWFuZC5jcHAgYi9Tb3VyY2UvV2ViQ29yZS9lZGl0aW5nL1JlcGxhY2VTZWxlY3Rpb25Db21tYW5k
LmNwcAppbmRleCA3NmRjNWU2NTFiLi5lMTBjYzIwY2ZkIDEwMDY0NAotLS0gYS9Tb3VyY2UvV2Vi
Q29yZS9lZGl0aW5nL1JlcGxhY2VTZWxlY3Rpb25Db21tYW5kLmNwcAorKysgYi9Tb3VyY2UvV2Vi
Q29yZS9lZGl0aW5nL1JlcGxhY2VTZWxlY3Rpb25Db21tYW5kLmNwcApAQCAtMTU4NCw2ICsxNTg0
LDEzIEBAIHZvaWQgUmVwbGFjZVNlbGVjdGlvbkNvbW1hbmQ6OmNvbXBsZXRlSFRNTFJlcGxhY2Vt
ZW50KGNvbnN0IFBvc2l0aW9uICZsYXN0UG9zaXRpCiAgICAgICAgIGlmIChtX21hdGNoU3R5bGUp
IHsKICAgICAgICAgICAgIEFTU0VSVChtX2luc2VydGlvblN0eWxlKTsKICAgICAgICAgICAgIGFw
cGx5U3R5bGUobV9pbnNlcnRpb25TdHlsZS5nZXQoKSwgc3RhcnQsIGVuZCk7CisgICAgICAgICAg
ICAvLyBhcHBseVN0eWxlIG1heSBjbG9uZSBjb250ZW50IHRvIG5ldyBibG9jayB3cmFwcGVycyBh
bmQgbWFrZSBhbmNob3Igbm9kZXMgb3JwaGFuLgorICAgICAgICAgICAgaWYgKHN0YXJ0LmlzT3Jw
aGFuKCkgfHwgZW5kLmlzT3JwaGFuKCkpIHsKKyAgICAgICAgICAgICAgICBzdGFydCA9IGVuZGlu
Z1NlbGVjdGlvbigpLnN0YXJ0KCk7CisgICAgICAgICAgICAgICAgZW5kID0gZW5kaW5nU2VsZWN0
aW9uKCkuZW5kKCk7CisgICAgICAgICAgICAgICAgbV9zdGFydE9mSW5zZXJ0ZWRDb250ZW50ID0g
c3RhcnQ7CisgICAgICAgICAgICAgICAgbV9lbmRPZkluc2VydGVkQ29udGVudCA9IGVuZDsKKyAg
ICAgICAgICAgIH0KICAgICAgICAgfQogCiAgICAgICAgIGlmIChsYXN0UG9zaXRpb25Ub1NlbGVj
dC5pc05vdE51bGwoKSkKLS0gCjIuMjUuMQoK
</data>

          </attachment>
      

    </bug>

</bugzilla>