223362 2021-03-17 01:03:37 -0700 Release assert in Vector::at in RenderLayoutState::establishLineGrid 2021-03-29 11:24:13 -0700 1 1 1 Unclassified WebKit Layout and Rendering WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 rniwa fred.wang bfulgham cgarcia ews-feeder fred.wang gpoo koivisto product-security rbuis simon.fraser svillar webkit-bug-importer zalan oldest_to_newest 1740500 0 rniwa 2021-03-17 01:03:37 -0700 e.g. Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.WebCore 0x00000002d02a5829 WTF::CrashOnOverflow::crash() + 9 (CheckedArithmetic.h:134) 1 com.apple.WebCore 0x00000002d02a57ee WTF::CrashOnOverflow::overflowed() + 14 (CheckedArithmetic.h:127) 2 com.apple.WebCore 0x00000002d4d41332 WTF::Vector<std::__1::unique_ptr<WebCore::RenderLayoutState, std::__1::default_delete<WebCore::RenderLayoutState> >, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>::at(unsigned long) const + 50 (Vector.h:707) 3 com.apple.WebCore 0x00000002d5a463c9 WTF::Vector<std::__1::unique_ptr<WebCore::RenderLayoutState, std::__1::default_delete<WebCore::RenderLayoutState> >, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>::operator[](unsigned long) const + 9 (Vector.h:722) 4 com.apple.WebCore 0x00000002d5a45b5b WebCore::RenderLayoutState::establishLineGrid(WTF::Vector<std::__1::unique_ptr<WebCore::RenderLayoutState, std::__1::default_delete<WebCore::RenderLayoutState> >, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const&, WebCore::RenderBlockFlow&) + 603 (RenderLayoutState.cpp:236) 5 com.apple.WebCore 0x00000002d5a44c14 WebCore::RenderLayoutState::computePaginationInformation(WTF::Vector<std::__1::unique_ptr<WebCore::RenderLayoutState, std::__1::default_delete<WebCore::RenderLayoutState> >, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const&, WebCore::RenderBox&, WebCore::LayoutUnit, bool) + 2036 (RenderLayoutState.cpp:166) 6 com.apple.WebCore 0x00000002d5a439cd WebCore::RenderLayoutState::RenderLayoutState(WTF::Vector<std::__1::unique_ptr<WebCore::RenderLayoutState, std::__1::default_delete<WebCore::RenderLayoutState> >, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const&, WebCore::RenderBox&, WebCore::LayoutSize const&, WebCore::LayoutUnit, bool) + 285 (RenderLayoutState.cpp:80) 7 com.apple.WebCore 0x00000002d5a45169 WebCore::RenderLayoutState::RenderLayoutState(WTF::Vector<std::__1::unique_ptr<WebCore::RenderLayoutState, std::__1::default_delete<WebCore::RenderLayoutState> >, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const&, WebCore::RenderBox&, WebCore::LayoutSize const&, WebCore::LayoutUnit, bool) + 9 (RenderLayoutState.cpp:74) 8 com.apple.WebCore 0x00000002d4d20a13 std::__1::__unique_if<WebCore::RenderLayoutState>::__unique_single std::__1::make_unique<WebCore::RenderLayoutState, WTF::Vector<std::__1::unique_ptr<WebCore::RenderLayoutState, std::__1::default_delete<WebCore::RenderLayoutState> >, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>&, WebCore::RenderBox&, WebCore::LayoutSize const&, WebCore::LayoutUnit&, bool&>(WTF::Vector<std::__1::unique_ptr<WebCore::RenderLayoutState, std::__1::default_delete<WebCore::RenderLayoutState> >, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>&, WebCore::RenderBox&, WebCore::LayoutSize const&, WebCore::LayoutUnit&, bool&) + 179 (memory:3033) 9 com.apple.WebCore 0x00000002d4d164ce decltype(auto) WTF::makeUnique<WebCore::RenderLayoutState, WTF::Vector<std::__1::unique_ptr<WebCore::RenderLayoutState, std::__1::default_delete<WebCore::RenderLayoutState> >, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>&, WebCore::RenderBox&, WebCore::LayoutSize const&, WebCore::LayoutUnit&, bool&>(WTF::Vector<std::__1::unique_ptr<WebCore::RenderLayoutState, std::__1::default_delete<WebCore::RenderLayoutState> >, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>&, WebCore::RenderBox&, WebCore::LayoutSize const&, WebCore::LayoutUnit&, bool&) + 90 (StdLibExtras.h:507) [inlined] 10 com.apple.WebCore 0x00000002d4d164ce WebCore::FrameViewLayoutContext::pushLayoutState(WebCore::RenderBox&, WebCore::LayoutSize const&, WebCore::LayoutUnit, bool) + 446 (FrameViewLayoutContext.cpp:633) 11 com.apple.WebCore 0x00000002d5a466c4 WebCore::LayoutStateMaintainer::LayoutStateMaintainer(WebCore::RenderBox&, WebCore::LayoutSize, bool, WebCore::LayoutUnit, bool) + 372 (RenderLayoutState.cpp:275) 12 com.apple.WebCore 0x00000002d5a46829 WebCore::LayoutStateMaintainer::LayoutStateMaintainer(WebCore::RenderBox&, WebCore::LayoutSize, bool, WebCore::LayoutUnit, bool) + 9 (RenderLayoutState.cpp:274) 13 com.apple.WebCore 0x00000002d57f1b04 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) + 948 (RenderBlockFlow.cpp:498) 14 com.apple.WebCore 0x00000002d57c1525 WebCore::RenderBlock::layout() + 277 (RenderBlock.cpp:598) 15 com.apple.WebCore 0x00000002d57f7075 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) + 1461 (RenderBlockFlow.cpp:762) 16 com.apple.WebCore 0x00000002d57f3a9e WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) + 718 (RenderBlockFlow.cpp:673) 17 com.apple.WebCore 0x00000002d57f1c28 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) + 1240 (RenderBlockFlow.cpp:525) 18 com.apple.WebCore 0x00000002d57c1525 WebCore::RenderBlock::layout() + 277 (RenderBlock.cpp:598) 19 com.apple.WebCore 0x00000002d56f7dd7 WebCore::RenderElement::layoutIfNeeded() + 71 (RenderElement.h:124) 20 com.apple.WebCore 0x00000002d56f67d6 WebCore::ComplexLineLayout::layoutLineBoxes(bool, WebCore::LayoutUnit&, WebCore::LayoutUnit&) + 1030 (ComplexLineLayout.cpp:1783) 21 com.apple.WebCore 0x00000002d5810f15 WebCore::RenderBlockFlow::ensureLineBoxes() + 565 (RenderBlockFlow.cpp:3763) 22 com.apple.WebCore 0x00000002d5a9ae5d WebCore::RenderObject::setSelectionState(WebCore::RenderObject::HighlightState) + 45 (RenderObject.cpp:1784) 23 com.apple.WebCore 0x00000002d589412f WebCore::RenderBoxModelObject::setSelectionState(WebCore::RenderObject::HighlightState) + 111 24 com.apple.WebCore 0x00000002d58122c2 WebCore::RenderBlockFlow::setSelectionState(WebCore::RenderObject::HighlightState) + 34 (RenderBlockFlow.cpp:3183) 25 com.apple.WebCore 0x00000002d5894183 WebCore::RenderBoxModelObject::setSelectionState(WebCore::RenderObject::HighlightState) + 195 (RenderBoxModelObject.cpp:150) 26 com.apple.WebCore 0x00000002d58122c2 WebCore::RenderBlockFlow::setSelectionState(WebCore::RenderObject::HighlightState) + 34 (RenderBlockFlow.cpp:3183) 27 com.apple.WebCore 0x00000002d5894183 WebCore::RenderBoxModelObject::setSelectionState(WebCore::RenderObject::HighlightState) + 195 (RenderBoxModelObject.cpp:150) 28 com.apple.WebCore 0x00000002d58122c2 WebCore::RenderBlockFlow::setSelectionState(WebCore::RenderObject::HighlightState) + 34 (RenderBlockFlow.cpp:3183) 29 com.apple.WebCore 0x00000002d5b1f346 WebCore::RenderText::setSelectionState(WebCore::RenderObject::HighlightState) + 102 (RenderText.cpp:1282) 30 com.apple.WebCore 0x00000002d5ba272f WebCore::RenderObject::setSelectionStateIfNeeded(WebCore::RenderObject::HighlightState) + 79 (RenderObject.h:1028) 31 com.apple.WebCore 0x00000002d5b9f6cb WebCore::SelectionRangeData::apply(WebCore::RenderRange const&, WebCore::SelectionRangeData::RepaintMode) + 795 (SelectionRangeData.cpp:229) 32 com.apple.WebCore 0x00000002d5b9f22f WebCore::SelectionRangeData::set(WebCore::RenderRange const&, WebCore::SelectionRangeData::RepaintMode) + 415 (SelectionRangeData.cpp:132) 33 com.apple.WebCore 0x00000002d3edcb70 WebCore::FrameSelection::updateAppearance() + 1728 (FrameSelection.cpp:2181) 34 com.apple.WebCore 0x00000002d3edc0c1 WebCore::FrameSelection::updateAndRevealSelection(WebCore::AXTextStateChangeIntent const&) + 257 (FrameSelection.cpp:474) 35 com.apple.WebCore 0x00000002d3ea5743 WebCore::FrameSelection::setSelection(WebCore::VisibleSelection const&, WTF::OptionSet<WebCore::FrameSelection::SetSelectionOption>, WebCore::AXTextStateChangeIntent, WebCore::FrameSelection::CursorAlignOnScroll, WebCore::TextGranularity) + 915 (FrameSelection.cpp:440) 36 com.apple.WebCore 0x00000002d3ea450a WebCore::FrameSelection::selectAll() + 1306 (FrameSelection.cpp:2006) 37 com.apple.WebCore 0x00000002d3ef83c1 WebCore::executeSelectAll(WebCore::Frame&, WebCore::Event*, WebCore::EditorCommandSource, WTF::String const&) + 17 (EditorCommand.cpp:1021) 38 com.apple.WebCore 0x00000002d3eba97c WebCore::Editor::Command::execute(WTF::String const&, WebCore::Event*) const + 220 (EditorCommand.cpp:1860) 39 com.apple.WebCore 0x00000002d3b3ada4 WebCore::Document::execCommand(WTF::String const&, bool, WTF::String const&) + 244 (Document.cpp:5687) 40 com.apple.WebCore 0x00000002d0d20e6a WebCore::jsDocumentPrototypeFunction_execCommandBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSDocument*) + 1130 (JSDocument.cpp:5890) 41 com.apple.WebCore 0x00000002d0d2095c long long WebCore::IDLOperation<WebCore::JSDocument>::call<&(WebCore::jsDocumentPrototypeFunction_execCommandBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSDocument*)), (WebCore::CastedThisErrorBehavior)0>(JSC::JSGlobalObject&, JSC::CallFrame&, char const*) + 252 (JSDOMOperation.h:53) 42 com.apple.WebCore 0x00000002d0d0b239 WebCore::jsDocumentPrototypeFunction_execCommand(JSC::JSGlobalObject*, JSC::CallFrame*) + 9 (JSDocument.cpp:5895) <rdar://75428270> 1740503 1 rniwa 2021-03-17 01:04:47 -0700 I can reproduce this crash with DumpRenderTree and WebKitTestRunner at r274459. 1741855 2 rbuis 2021-03-19 13:08:22 -0700 Seems this lacks a test case. 1742683 3 423989 rniwa 2021-03-22 23:12:46 -0700 Created attachment 423989 Test case Oops, sorry about that. 1743255 4 424119 fred.wang 2021-03-24 03:25:20 -0700 Created attachment 424119 Patch 1743266 5 424119 rniwa 2021-03-24 04:00:10 -0700 Comment on attachment 424119 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=424119&action=review > Source/WebCore/ChangeLog:8 > + Fix out-of-bound access for layoutStateStack and ensure the whole vector is browsed. Nit: two spaces between "whole" and "vector". > Source/WebCore/rendering/RenderLayoutState.cpp:235 > - for (int i = layoutStateStack.size() - 1; i <= 0; --i) { > + for (int i = layoutStateStack.size() - 1; i >= 0; --i) { It seems like we should also be adding some tests demonstrating whatever grid layout bug this will fix? 1743272 6 rniwa 2021-03-24 04:14:49 -0700 Looks like this might be a regression from https://trac.webkit.org/r224612? Hm... looks like this code was introduced in https://trac.webkit.org/r105176 but I guess this loop was never really tested? And line-grid spec has changed so much over the last 9 years that it's gonna be hard to figure out what this loop was supposed to do. Perhaps Alan or Simon can figure out what they ought to be doing. 1743273 7 424119 fred.wang 2021-03-24 04:20:30 -0700 Comment on attachment 424119 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=424119&action=review >> Source/WebCore/rendering/RenderLayoutState.cpp:235 >> + for (int i = layoutStateStack.size() - 1; i >= 0; --i) { > > It seems like we should also be adding some tests demonstrating whatever grid layout bug this will fix? To be honest, I don't know what this code is about. But I see it was added in https://trac.webkit.org/changeset/224612/webkit as part of a refactoring with "No change in functionality". 1743274 8 fred.wang 2021-03-24 04:21:22 -0700 cc'ing zalan and antti 1743299 9 424119 zalan 2021-03-24 07:12:37 -0700 Comment on attachment 424119 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=424119&action=review >>> Source/WebCore/rendering/RenderLayoutState.cpp:235 >>> + for (int i = layoutStateStack.size() - 1; i >= 0; --i) { >> >> It seems like we should also be adding some tests demonstrating whatever grid layout bug this will fix? > > To be honest, I don't know what this code is about. But I see it was added in https://trac.webkit.org/changeset/224612/webkit as part of a refactoring with "No change in functionality". This shows how little nested line grids is used (not to confuse it with css grid layout). 1743304 10 424119 fred.wang 2021-03-24 07:26:51 -0700 Comment on attachment 424119 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=424119&action=review >>>> Source/WebCore/rendering/RenderLayoutState.cpp:235 >>>> + for (int i = layoutStateStack.size() - 1; i >= 0; --i) { >>> >>> It seems like we should also be adding some tests demonstrating whatever grid layout bug this will fix? >> >> To be honest, I don't know what this code is about. But I see it was added in https://trac.webkit.org/changeset/224612/webkit as part of a refactoring with "No change in functionality". > > This shows how little nested line grids is used (not to confuse it with css grid layout). So are you able to provide some hints on how we could write a test for this? Or are you saying we should just ignore that? 1743400 11 zalan 2021-03-24 10:38:18 -0700 (In reply to Frédéric Wang (:fredw) from comment #10) > Comment on attachment 424119 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=424119&action=review > > >>>> Source/WebCore/rendering/RenderLayoutState.cpp:235 > >>>> + for (int i = layoutStateStack.size() - 1; i >= 0; --i) { > >>> > >>> It seems like we should also be adding some tests demonstrating whatever grid layout bug this will fix? > >> > >> To be honest, I don't know what this code is about. But I see it was added in https://trac.webkit.org/changeset/224612/webkit as part of a refactoring with "No change in functionality". > > > > This shows how little nested line grids is used (not to confuse it with css grid layout). > > So are you able to provide some hints on how we could write a test for this? No, I have close to zero knowledge about this feature. 1743505 12 rniwa 2021-03-24 13:06:24 -0700 (In reply to Frédéric Wang (:fredw) from comment #10) > Comment on attachment 424119 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=424119&action=review > > >>>> Source/WebCore/rendering/RenderLayoutState.cpp:235 > >>>> + for (int i = layoutStateStack.size() - 1; i >= 0; --i) { > >>> > >>> It seems like we should also be adding some tests demonstrating whatever grid layout bug this will fix? > >> > >> To be honest, I don't know what this code is about. But I see it was added in https://trac.webkit.org/changeset/224612/webkit as part of a refactoring with "No change in functionality". > > > > This shows how little nested line grids is used (not to confuse it with css grid layout). > > So are you able to provide some hints on how we could write a test for this? > Or are you saying we should just ignore that? I initially thought this was related to grid layout but it looks like there is no way of knowing what this CSS property was supposed to do at this point so landing it without a test seems okay to me. 1743698 13 424223 fred.wang 2021-03-25 02:08:24 -0700 Created attachment 424223 Patch for landing 1743699 14 424119 fred.wang 2021-03-25 02:08:54 -0700 Comment on attachment 424119 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=424119&action=review >> Source/WebCore/ChangeLog:8 >> + Fix out-of-bound access for layoutStateStack and ensure the whole vector is browsed. > > Nit: two spaces between "whole" and "vector". Done. >>>>>>> Source/WebCore/rendering/RenderLayoutState.cpp:235 >>>>>>> + for (int i = layoutStateStack.size() - 1; i >= 0; --i) { >>>>>> >>>>>> It seems like we should also be adding some tests demonstrating whatever grid layout bug this will fix? >>>>> >>>>> To be honest, I don't know what this code is about. But I see it was added in https://trac.webkit.org/changeset/224612/webkit as part of a refactoring with "No change in functionality". >>>> >>>> This shows how little nested line grids is used (not to confuse it with css grid layout). >>> >>> So are you able to provide some hints on how we could write a test for this? Or are you saying we should just ignore that? >> >> No, I have close to zero knowledge about this feature. > > I initially thought this was related to grid layout but it looks like there is no way of knowing what this CSS property was supposed to do at this point so landing it without a test seems okay to me. OK, let's try and land this then. 1744690 15 rniwa 2021-03-28 22:55:03 -0700 (In reply to Frédéric Wang (:fredw) from comment #14) > > > I initially thought this was related to grid layout but it looks like there is no way of knowing what this CSS property was supposed to do at this point so landing it without a test seems okay to me. > > OK, let's try and land this then. Sounds good. 1744767 16 ews-feeder 2021-03-29 10:35:00 -0700 Committed r275164: <https://commits.webkit.org/r275164> All reviewed patches have been landed. Closing bug and clearing flags on attachment 424223. 423989 2021-03-22 23:12:46 -0700 2021-03-22 23:12:46 -0700 Test case repro_547.html text/html 335 rniwa PHN0eWxlPgogIDpmaXJzdC1jaGlsZCB7CiAgICBkaXNwbGF5OiBpbmxpbmUtYmxvY2s7CiAgICAt d2Via2l0LWxpbmUtZ3JpZDogYjsKICB9CiAgZGl2IHsKICAgIC13ZWJraXQtbGluZS1ncmlkOiBh OwogIH0KICBkaXYsIGhlYWQgewogICAgbWluLWhlaWdodDogY2FsYygxcHggKyAwJSk7CiAgfQo8 L3N0eWxlPgo8c2NyaXB0PgogIG9ubG9hZCA9ICgpID0+IHsKICAgIGRvY3VtZW50LmhlYWQuYXBw ZW5kQ2hpbGQoZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgnZGl2JykpOwogICAgZG9jdW1lbnQuZXhl Y0NvbW1hbmQoJ1NlbGVjdEFsbCcpOwogIH07Cjwvc2NyaXB0Pgo8ZGl2PjwvZGl2Pgo= 424119 2021-03-24 03:25:20 -0700 2021-03-25 02:08:24 -0700 Patch 0001-Release-assert-in-Vector-at-in-RenderLayoutState-est.patch text/plain 4306 fred.wang RnJvbSAzNjlhM2EwZjhlNWUyNzJkN2U5ZWUzMzU2N2ExOGFhODRlYzhlMWVkIE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiA9P1VURi04P3E/RnI9QzM9QTlkPUMzPUE5cmljPTIwV2FuZz89 IDxmd2FuZ0BpZ2FsaWEuY29tPgpEYXRlOiBXZWQsIDI0IE1hciAyMDIxIDExOjE5OjA3ICswMTAw ClN1YmplY3Q6IFtQQVRDSF0gUmVsZWFzZSBhc3NlcnQgaW4gVmVjdG9yOjphdCBpbgogUmVuZGVy TGF5b3V0U3RhdGU6OmVzdGFibGlzaExpbmVHcmlkCgotLS0KIExheW91dFRlc3RzL0NoYW5nZUxv ZyAgICAgICAgICAgICAgICAgICAgICAgICB8IDEyICsrKysrKysrKysKIC4uLi9lc3RhYmxpc2gt bGluZS1ncmlkLWNyYXNoLWV4cGVjdGVkLnR4dCAgICB8ICAzICsrKwogLi4uL2xpbmUtZ3JpZC9l c3RhYmxpc2gtbGluZS1ncmlkLWNyYXNoLmh0bWwgIHwgMjIgKysrKysrKysrKysrKysrKysrKwog U291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nICAgICAgICAgICAgICAgICAgICAgIHwgMTQgKysrKysr KysrKysrCiAuLi4vV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyTGF5b3V0U3RhdGUuY3BwICAgfCAg MiArLQogNSBmaWxlcyBjaGFuZ2VkLCA1MiBpbnNlcnRpb25zKCspLCAxIGRlbGV0aW9uKC0pCiBj cmVhdGUgbW9kZSAxMDA2NDQgTGF5b3V0VGVzdHMvZmFzdC9saW5lLWdyaWQvZXN0YWJsaXNoLWxp bmUtZ3JpZC1jcmFzaC1leHBlY3RlZC50eHQKIGNyZWF0ZSBtb2RlIDEwMDY0NCBMYXlvdXRUZXN0 cy9mYXN0L2xpbmUtZ3JpZC9lc3RhYmxpc2gtbGluZS1ncmlkLWNyYXNoLmh0bWwKCmRpZmYgLS1n aXQgYS9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cgYi9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKaW5kZXgg MGYwYmQ2YWFmZC4uYWRiZTA3Njk2OSAxMDA2NDQKLS0tIGEvTGF5b3V0VGVzdHMvQ2hhbmdlTG9n CisrKyBiL0xheW91dFRlc3RzL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE1IEBACisyMDIxLTAzLTI0 ICBGcsOpZMOpcmljIFdhbmcgIDxmd2FuZ0BpZ2FsaWEuY29tPgorCisgICAgICAgIFJlbGVhc2Ug YXNzZXJ0IGluIFZlY3Rvcjo6YXQgaW4gUmVuZGVyTGF5b3V0U3RhdGU6OmVzdGFibGlzaExpbmVH cmlkCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0yMjMz NjIKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBBZGQg cmVncmVzc2lvbiB0ZXN0LgorCisgICAgICAgICogZmFzdC9saW5lLWdyaWQvZXN0YWJsaXNoLWxp bmUtZ3JpZC1jcmFzaC1leHBlY3RlZC50eHQ6IEFkZGVkLgorICAgICAgICAqIGZhc3QvbGluZS1n cmlkL2VzdGFibGlzaC1saW5lLWdyaWQtY3Jhc2guaHRtbDogQWRkZWQuCisKIDIwMjEtMDMtMjMg IFBlciBBcm5lICA8cHZvbGxhbkBhcHBsZS5jb20+CiAKICAgICAgICAgW1dpbl0gRmxha3kgZWRp dGluZyBhbmQgZXZlbnRzIHRlc3RzCmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9mYXN0L2xpbmUt Z3JpZC9lc3RhYmxpc2gtbGluZS1ncmlkLWNyYXNoLWV4cGVjdGVkLnR4dCBiL0xheW91dFRlc3Rz L2Zhc3QvbGluZS1ncmlkL2VzdGFibGlzaC1saW5lLWdyaWQtY3Jhc2gtZXhwZWN0ZWQudHh0Cm5l dyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAwMDAuLjRmMjk0ZjlhZTgKLS0tIC9kZXYv bnVsbAorKysgYi9MYXlvdXRUZXN0cy9mYXN0L2xpbmUtZ3JpZC9lc3RhYmxpc2gtbGluZS1ncmlk LWNyYXNoLWV4cGVjdGVkLnR4dApAQCAtMCwwICsxLDMgQEAKK0NPTlNPTEUgTUVTU0FHRTogVGhp cyB0ZXN0IHBhc3NlcyBpZiBpdCBkb2VzIG5vdCBjcmFzaC4KKzpmaXJzdC1jaGlsZCB7IGRpc3Bs YXk6IGlubGluZS1ibG9jazsgLXdlYmtpdC1saW5lLWdyaWQ6IGI7IH0gZGl2IHsgLXdlYmtpdC1s aW5lLWdyaWQ6IGE7IH0gZGl2LCBoZWFkIHsgbWluLWhlaWdodDogY2FsYygxcHggKyAwJSk7IH0K KwpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvZmFzdC9saW5lLWdyaWQvZXN0YWJsaXNoLWxpbmUt Z3JpZC1jcmFzaC5odG1sIGIvTGF5b3V0VGVzdHMvZmFzdC9saW5lLWdyaWQvZXN0YWJsaXNoLWxp bmUtZ3JpZC1jcmFzaC5odG1sCm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAwMDAu LjNkZDc4ZmZiZGIKLS0tIC9kZXYvbnVsbAorKysgYi9MYXlvdXRUZXN0cy9mYXN0L2xpbmUtZ3Jp ZC9lc3RhYmxpc2gtbGluZS1ncmlkLWNyYXNoLmh0bWwKQEAgLTAsMCArMSwyMiBAQAorPHN0eWxl PgorICA6Zmlyc3QtY2hpbGQgeworICAgIGRpc3BsYXk6IGlubGluZS1ibG9jazsKKyAgICAtd2Vi a2l0LWxpbmUtZ3JpZDogYjsKKyAgfQorICBkaXYgeworICAgIC13ZWJraXQtbGluZS1ncmlkOiBh OworICB9CisgIGRpdiwgaGVhZCB7CisgICAgbWluLWhlaWdodDogY2FsYygxcHggKyAwJSk7Cisg IH0KKzwvc3R5bGU+Cis8c2NyaXB0PgorICBvbmxvYWQgPSAoKSA9PiB7CisgICAgaWYgKHdpbmRv dy50ZXN0UnVubmVyKQorICAgICAgICB0ZXN0UnVubmVyLmR1bXBBc1RleHQoKTsKKyAgICBjb25z b2xlLmxvZygnVGhpcyB0ZXN0IHBhc3NlcyBpZiBpdCBkb2VzIG5vdCBjcmFzaC4nKTsKKyAgICBk b2N1bWVudC5oZWFkLmFwcGVuZENoaWxkKGRvY3VtZW50LmNyZWF0ZUVsZW1lbnQoJ2RpdicpKTsK KyAgICBkb2N1bWVudC5leGVjQ29tbWFuZCgnU2VsZWN0QWxsJyk7CisgIH07Cis8L3NjcmlwdD4K KzxkaXY+PC9kaXY+CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cgYi9Tb3Vy Y2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggNGZmMzM2MjJhNy4uMzQwYzMzOGMwZiAxMDA2NDQK LS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwpAQCAtMSwzICsxLDE3IEBACisyMDIxLTAzLTI0ICBGcsOpZMOpcmljIFdhbmcgIDxmd2Fu Z0BpZ2FsaWEuY29tPgorCisgICAgICAgIFJlbGVhc2UgYXNzZXJ0IGluIFZlY3Rvcjo6YXQgaW4g UmVuZGVyTGF5b3V0U3RhdGU6OmVzdGFibGlzaExpbmVHcmlkCisgICAgICAgIGh0dHBzOi8vYnVn cy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0yMjMzNjgKKworICAgICAgICBSZXZpZXdlZCBi eSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBGaXggb3V0LW9mLWJvdW5kIGFjY2VzcyBmb3Ig bGF5b3V0U3RhdGVTdGFjayBhbmQgZW5zdXJlIHRoZSB3aG9sZSAgdmVjdG9yIGlzIGJyb3dzZWQu CisKKyAgICAgICAgVGVzdDogZmFzdC9saW5lLWdyaWQvZXN0YWJsaXNoLWxpbmUtZ3JpZC1jcmFz aC5odG1sCisKKyAgICAgICAgKiByZW5kZXJpbmcvUmVuZGVyTGF5b3V0U3RhdGUuY3BwOgorICAg ICAgICAoV2ViQ29yZTo6UmVuZGVyTGF5b3V0U3RhdGU6OmVzdGFibGlzaExpbmVHcmlkKTogRml4 IHRoZSBleGl0IGNvbmRpdGlvbi4KKwogMjAyMS0wMy0yMyAgRnLDqWTDqXJpYyBXYW5nICA8Zndh bmdAaWdhbGlhLmNvbT4KIAogICAgICAgICBOdWxscHRyIGRlcmVmIGluIFdlYkNvcmU6OkFwcGx5 U3R5bGVDb21tYW5kOjphcHBseVJlbGF0aXZlRm9udFN0eWxlQ2hhbmdlCmRpZmYgLS1naXQgYS9T b3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyTGF5b3V0U3RhdGUuY3BwIGIvU291cmNlL1dl YkNvcmUvcmVuZGVyaW5nL1JlbmRlckxheW91dFN0YXRlLmNwcAppbmRleCAzMjIwOTU5ZTQ3Li5l ZGVlMWI2YWU5IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyTGF5 b3V0U3RhdGUuY3BwCisrKyBiL1NvdXJjZS9XZWJDb3JlL3JlbmRlcmluZy9SZW5kZXJMYXlvdXRT dGF0ZS5jcHAKQEAgLTIzMiw3ICsyMzIsNyBAQCB2b2lkIFJlbmRlckxheW91dFN0YXRlOjplc3Rh Ymxpc2hMaW5lR3JpZChjb25zdCBGcmFtZVZpZXdMYXlvdXRDb250ZXh0OjpMYXlvdXRTdAogICAg ICAgICBpZiAobV9saW5lR3JpZC0+c3R5bGUoKS5saW5lR3JpZCgpID09IHJlbmRlcmVyLnN0eWxl KCkubGluZUdyaWQoKSkKICAgICAgICAgICAgIHJldHVybjsKICAgICAgICAgYXV0byogY3VycmVu dEdyaWQgPSBtX2xpbmVHcmlkLmdldCgpOwotICAgICAgICBmb3IgKGludCBpID0gbGF5b3V0U3Rh dGVTdGFjay5zaXplKCkgLSAxOyBpIDw9IDA7IC0taSkgeworICAgICAgICBmb3IgKGludCBpID0g bGF5b3V0U3RhdGVTdGFjay5zaXplKCkgLSAxOyBpID49IDA7IC0taSkgewogICAgICAgICAgICAg YXV0byYgY3VycmVudFN0YXRlID0gKmxheW91dFN0YXRlU3RhY2tbaV0uZ2V0KCk7CiAgICAgICAg ICAgICBpZiAoY3VycmVudFN0YXRlLm1fbGluZUdyaWQgPT0gY3VycmVudEdyaWQpCiAgICAgICAg ICAgICAgICAgY29udGludWU7Ci0tIAoyLjI1LjEKCg== 424223 2021-03-25 02:08:24 -0700 2021-03-29 10:35:01 -0700 Patch for landing 0001-Release-assert-in-Vector-at-in-RenderLayoutState-est.patch text/plain 4301 fred.wang RnJvbSA5ZjM5OTk4NmQ4YzNiNWUwMjcwZGQ4ZDI2Y2NjYzg3ZTk4ZmYxYTE4IE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiA9P1VURi04P3E/RnI9QzM9QTlkPUMzPUE5cmljPTIwV2FuZz89 IDxmd2FuZ0BpZ2FsaWEuY29tPgpEYXRlOiBXZWQsIDI0IE1hciAyMDIxIDExOjE5OjA3ICswMTAw ClN1YmplY3Q6IFtQQVRDSF0gUmVsZWFzZSBhc3NlcnQgaW4gVmVjdG9yOjphdCBpbgogUmVuZGVy TGF5b3V0U3RhdGU6OmVzdGFibGlzaExpbmVHcmlkCgotLS0KIExheW91dFRlc3RzL0NoYW5nZUxv ZyAgICAgICAgICAgICAgICAgICAgICAgICB8IDEyICsrKysrKysrKysKIC4uLi9lc3RhYmxpc2gt bGluZS1ncmlkLWNyYXNoLWV4cGVjdGVkLnR4dCAgICB8ICAzICsrKwogLi4uL2xpbmUtZ3JpZC9l c3RhYmxpc2gtbGluZS1ncmlkLWNyYXNoLmh0bWwgIHwgMjIgKysrKysrKysrKysrKysrKysrKwog U291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nICAgICAgICAgICAgICAgICAgICAgIHwgMTQgKysrKysr KysrKysrCiAuLi4vV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyTGF5b3V0U3RhdGUuY3BwICAgfCAg MiArLQogNSBmaWxlcyBjaGFuZ2VkLCA1MiBpbnNlcnRpb25zKCspLCAxIGRlbGV0aW9uKC0pCiBj cmVhdGUgbW9kZSAxMDA2NDQgTGF5b3V0VGVzdHMvZmFzdC9saW5lLWdyaWQvZXN0YWJsaXNoLWxp bmUtZ3JpZC1jcmFzaC1leHBlY3RlZC50eHQKIGNyZWF0ZSBtb2RlIDEwMDY0NCBMYXlvdXRUZXN0 cy9mYXN0L2xpbmUtZ3JpZC9lc3RhYmxpc2gtbGluZS1ncmlkLWNyYXNoLmh0bWwKCmRpZmYgLS1n aXQgYS9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cgYi9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKaW5kZXgg MGYwYmQ2YWFmZC4uNDc3ODk2NzQ2NiAxMDA2NDQKLS0tIGEvTGF5b3V0VGVzdHMvQ2hhbmdlTG9n CisrKyBiL0xheW91dFRlc3RzL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE1IEBACisyMDIxLTAzLTI0 ICBGcsOpZMOpcmljIFdhbmcgIDxmd2FuZ0BpZ2FsaWEuY29tPgorCisgICAgICAgIFJlbGVhc2Ug YXNzZXJ0IGluIFZlY3Rvcjo6YXQgaW4gUmVuZGVyTGF5b3V0U3RhdGU6OmVzdGFibGlzaExpbmVH cmlkCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0yMjMz NjIKKworICAgICAgICBSZXZpZXdlZCBieSBaYWxhbiBCdWp0YXMuCisKKyAgICAgICAgQWRkIHJl Z3Jlc3Npb24gdGVzdC4KKworICAgICAgICAqIGZhc3QvbGluZS1ncmlkL2VzdGFibGlzaC1saW5l LWdyaWQtY3Jhc2gtZXhwZWN0ZWQudHh0OiBBZGRlZC4KKyAgICAgICAgKiBmYXN0L2xpbmUtZ3Jp ZC9lc3RhYmxpc2gtbGluZS1ncmlkLWNyYXNoLmh0bWw6IEFkZGVkLgorCiAyMDIxLTAzLTIzICBQ ZXIgQXJuZSAgPHB2b2xsYW5AYXBwbGUuY29tPgogCiAgICAgICAgIFtXaW5dIEZsYWt5IGVkaXRp bmcgYW5kIGV2ZW50cyB0ZXN0cwpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvZmFzdC9saW5lLWdy aWQvZXN0YWJsaXNoLWxpbmUtZ3JpZC1jcmFzaC1leHBlY3RlZC50eHQgYi9MYXlvdXRUZXN0cy9m YXN0L2xpbmUtZ3JpZC9lc3RhYmxpc2gtbGluZS1ncmlkLWNyYXNoLWV4cGVjdGVkLnR4dApuZXcg ZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwMDAwLi40ZjI5NGY5YWU4Ci0tLSAvZGV2L251 bGwKKysrIGIvTGF5b3V0VGVzdHMvZmFzdC9saW5lLWdyaWQvZXN0YWJsaXNoLWxpbmUtZ3JpZC1j cmFzaC1leHBlY3RlZC50eHQKQEAgLTAsMCArMSwzIEBACitDT05TT0xFIE1FU1NBR0U6IFRoaXMg dGVzdCBwYXNzZXMgaWYgaXQgZG9lcyBub3QgY3Jhc2guCis6Zmlyc3QtY2hpbGQgeyBkaXNwbGF5 OiBpbmxpbmUtYmxvY2s7IC13ZWJraXQtbGluZS1ncmlkOiBiOyB9IGRpdiB7IC13ZWJraXQtbGlu ZS1ncmlkOiBhOyB9IGRpdiwgaGVhZCB7IG1pbi1oZWlnaHQ6IGNhbGMoMXB4ICsgMCUpOyB9CisK ZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL2Zhc3QvbGluZS1ncmlkL2VzdGFibGlzaC1saW5lLWdy aWQtY3Jhc2guaHRtbCBiL0xheW91dFRlc3RzL2Zhc3QvbGluZS1ncmlkL2VzdGFibGlzaC1saW5l LWdyaWQtY3Jhc2guaHRtbApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwMDAwLi4z ZGQ3OGZmYmRiCi0tLSAvZGV2L251bGwKKysrIGIvTGF5b3V0VGVzdHMvZmFzdC9saW5lLWdyaWQv ZXN0YWJsaXNoLWxpbmUtZ3JpZC1jcmFzaC5odG1sCkBAIC0wLDAgKzEsMjIgQEAKKzxzdHlsZT4K KyAgOmZpcnN0LWNoaWxkIHsKKyAgICBkaXNwbGF5OiBpbmxpbmUtYmxvY2s7CisgICAgLXdlYmtp dC1saW5lLWdyaWQ6IGI7CisgIH0KKyAgZGl2IHsKKyAgICAtd2Via2l0LWxpbmUtZ3JpZDogYTsK KyAgfQorICBkaXYsIGhlYWQgeworICAgIG1pbi1oZWlnaHQ6IGNhbGMoMXB4ICsgMCUpOworICB9 Cis8L3N0eWxlPgorPHNjcmlwdD4KKyAgb25sb2FkID0gKCkgPT4geworICAgIGlmICh3aW5kb3cu dGVzdFJ1bm5lcikKKyAgICAgICAgdGVzdFJ1bm5lci5kdW1wQXNUZXh0KCk7CisgICAgY29uc29s ZS5sb2coJ1RoaXMgdGVzdCBwYXNzZXMgaWYgaXQgZG9lcyBub3QgY3Jhc2guJyk7CisgICAgZG9j dW1lbnQuaGVhZC5hcHBlbmRDaGlsZChkb2N1bWVudC5jcmVhdGVFbGVtZW50KCdkaXYnKSk7Cisg ICAgZG9jdW1lbnQuZXhlY0NvbW1hbmQoJ1NlbGVjdEFsbCcpOworICB9OworPC9zY3JpcHQ+Cis8 ZGl2PjwvZGl2PgpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nIGIvU291cmNl L1dlYkNvcmUvQ2hhbmdlTG9nCmluZGV4IDRmZjMzNjIyYTcuLjQxYjUzMjFmOTAgMTAwNjQ0Ci0t LSBhL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZworKysgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VM b2cKQEAgLTEsMyArMSwxNyBAQAorMjAyMS0wMy0yNCAgRnLDqWTDqXJpYyBXYW5nICA8ZndhbmdA aWdhbGlhLmNvbT4KKworICAgICAgICBSZWxlYXNlIGFzc2VydCBpbiBWZWN0b3I6OmF0IGluIFJl bmRlckxheW91dFN0YXRlOjplc3RhYmxpc2hMaW5lR3JpZAorICAgICAgICBodHRwczovL2J1Z3Mu d2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjIzMzY4CisKKyAgICAgICAgUmV2aWV3ZWQgYnkg WmFsYW4gQnVqdGFzLgorCisgICAgICAgIEZpeCBvdXQtb2YtYm91bmQgYWNjZXNzIGZvciBsYXlv dXRTdGF0ZVN0YWNrIGFuZCBlbnN1cmUgdGhlIHdob2xlIHZlY3RvciBpcyBicm93c2VkLgorCisg ICAgICAgIFRlc3Q6IGZhc3QvbGluZS1ncmlkL2VzdGFibGlzaC1saW5lLWdyaWQtY3Jhc2guaHRt bAorCisgICAgICAgICogcmVuZGVyaW5nL1JlbmRlckxheW91dFN0YXRlLmNwcDoKKyAgICAgICAg KFdlYkNvcmU6OlJlbmRlckxheW91dFN0YXRlOjplc3RhYmxpc2hMaW5lR3JpZCk6IEZpeCB0aGUg ZXhpdCBjb25kaXRpb24uCisKIDIwMjEtMDMtMjMgIEZyw6lkw6lyaWMgV2FuZyAgPGZ3YW5nQGln YWxpYS5jb20+CiAKICAgICAgICAgTnVsbHB0ciBkZXJlZiBpbiBXZWJDb3JlOjpBcHBseVN0eWxl Q29tbWFuZDo6YXBwbHlSZWxhdGl2ZUZvbnRTdHlsZUNoYW5nZQpkaWZmIC0tZ2l0IGEvU291cmNl L1dlYkNvcmUvcmVuZGVyaW5nL1JlbmRlckxheW91dFN0YXRlLmNwcCBiL1NvdXJjZS9XZWJDb3Jl L3JlbmRlcmluZy9SZW5kZXJMYXlvdXRTdGF0ZS5jcHAKaW5kZXggMzIyMDk1OWU0Ny4uZWRlZTFi NmFlOSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvcmVuZGVyaW5nL1JlbmRlckxheW91dFN0 YXRlLmNwcAorKysgYi9Tb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyTGF5b3V0U3RhdGUu Y3BwCkBAIC0yMzIsNyArMjMyLDcgQEAgdm9pZCBSZW5kZXJMYXlvdXRTdGF0ZTo6ZXN0YWJsaXNo TGluZUdyaWQoY29uc3QgRnJhbWVWaWV3TGF5b3V0Q29udGV4dDo6TGF5b3V0U3QKICAgICAgICAg aWYgKG1fbGluZUdyaWQtPnN0eWxlKCkubGluZUdyaWQoKSA9PSByZW5kZXJlci5zdHlsZSgpLmxp bmVHcmlkKCkpCiAgICAgICAgICAgICByZXR1cm47CiAgICAgICAgIGF1dG8qIGN1cnJlbnRHcmlk ID0gbV9saW5lR3JpZC5nZXQoKTsKLSAgICAgICAgZm9yIChpbnQgaSA9IGxheW91dFN0YXRlU3Rh Y2suc2l6ZSgpIC0gMTsgaSA8PSAwOyAtLWkpIHsKKyAgICAgICAgZm9yIChpbnQgaSA9IGxheW91 dFN0YXRlU3RhY2suc2l6ZSgpIC0gMTsgaSA+PSAwOyAtLWkpIHsKICAgICAgICAgICAgIGF1dG8m IGN1cnJlbnRTdGF0ZSA9ICpsYXlvdXRTdGF0ZVN0YWNrW2ldLmdldCgpOwogICAgICAgICAgICAg aWYgKGN1cnJlbnRTdGF0ZS5tX2xpbmVHcmlkID09IGN1cnJlbnRHcmlkKQogICAgICAgICAgICAg ICAgIGNvbnRpbnVlOwotLSAKMi4yNS4xCgo=