<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>223911</bug_id>
          
          <creation_ts>2021-03-29 21:18:56 -0700</creation_ts>
          <short_desc>Ensure that GlobalPropertyInfo is allocated on the stack.</short_desc>
          <delta_ts>2021-03-30 14:35:28 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>JavaScriptCore</component>
          <version>WebKit Nightly Build</version>
          <rep_platform>Unspecified</rep_platform>
          <op_sys>Unspecified</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>InRadar</keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Mark Lam">mark.lam</reporter>
          <assigned_to name="Mark Lam">mark.lam</assigned_to>
          <cc>ap</cc>
    
    <cc>benjamin</cc>
    
    <cc>calvaris</cc>
    
    <cc>ddkilzer</cc>
    
    <cc>ews-watchlist</cc>
    
    <cc>fpizlo</cc>
    
    <cc>keith_miller</cc>
    
    <cc>msaboff</cc>
    
    <cc>rmorisset</cc>
    
    <cc>saam</cc>
    
    <cc>tzagallo</cc>
    
    <cc>webkit-bug-importer</cc>
    
    <cc>youennf</cc>
    
    <cc>ysuzuki</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>1745024</commentid>
    <comment_count>0</comment_count>
    <who name="Mark Lam">mark.lam</who>
    <bug_when>2021-03-29 21:18:56 -0700</bug_when>
    <thetext>We rely on GlobalPropertyInfo being allocated on the stack to allow its JSValue value to be scanned by the GC.  Unfortunately, an ASAN compilation would choose to allocate the GlobalPropertyInfo on a side buffer instead of directly on the stack.  This prevents the GC doing the needed scan.

We&apos;ll fix this by suppressing ASAN on the functions that allocated GlobalPropertyInfo arrays.

rdar://75865742</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1745025</commentid>
    <comment_count>1</comment_count>
      <attachid>424615</attachid>
    <who name="Mark Lam">mark.lam</who>
    <bug_when>2021-03-29 21:27:10 -0700</bug_when>
    <thetext>Created attachment 424615
proposed patch.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1745058</commentid>
    <comment_count>2</comment_count>
      <attachid>424615</attachid>
    <who name="Yusuke Suzuki">ysuzuki</who>
    <bug_when>2021-03-30 01:35:29 -0700</bug_when>
    <thetext>Comment on attachment 424615
proposed patch.

View in context: https://bugs.webkit.org/attachment.cgi?id=424615&amp;action=review

&gt; Source/JavaScriptCore/Scripts/wkbuiltins/builtins_generate_internals_wrapper_implementation.py:146
&gt; +        lines = [&quot;SUPPRESS_ASAN void JSBuiltinInternalFunctions::initialize(JSDOMGlobalObject&amp; globalObject)&quot;,

How about putting `inline` here since this function is only called from this file.

&gt; Source/JavaScriptCore/runtime/JSGlobalObject.cpp:583
&gt; +SUPPRESS_ASAN void JSGlobalObject::initStaticGlobals(VM&amp; vm)

How about putting `inline` here since this function is only called from this file.

&gt; Source/JavaScriptCore/runtime/JSGlobalObject.cpp:2116
&gt; +SUPPRESS_ASAN void JSGlobalObject::exposeDollarVM(VM&amp; vm)

How about putting `inline` here since this function is only called from this file.

&gt; Source/WebCore/bindings/js/JSDOMGlobalObject.cpp:176
&gt; +SUPPRESS_ASAN void JSDOMGlobalObject::addBuiltinGlobals(VM&amp; vm)

How about putting `inline` here since this function is only called from this file.

&gt; Source/WebCore/bindings/js/JSDOMWindowBase.cpp:114
&gt; +SUPPRESS_ASAN void JSDOMWindowBase::initStaticGlobals(JSC::VM&amp; vm)

How about putting `inline` here since this function is only called from this file.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1745172</commentid>
    <comment_count>3</comment_count>
      <attachid>424615</attachid>
    <who name="Mark Lam">mark.lam</who>
    <bug_when>2021-03-30 10:17:48 -0700</bug_when>
    <thetext>Comment on attachment 424615
proposed patch.

View in context: https://bugs.webkit.org/attachment.cgi?id=424615&amp;action=review

Thanks for the review.

&gt;&gt; Source/JavaScriptCore/Scripts/wkbuiltins/builtins_generate_internals_wrapper_implementation.py:146
&gt;&gt; +        lines = [&quot;SUPPRESS_ASAN void JSBuiltinInternalFunctions::initialize(JSDOMGlobalObject&amp; globalObject)&quot;,
&gt; 
&gt; How about putting `inline` here since this function is only called from this file.

This one is not an inline function.  It&apos;s generated into WebCoreJSBuiltinsInternals.cpp and called from another module.  Hence, this one should not have an inline attribute.

&gt;&gt; Source/JavaScriptCore/runtime/JSGlobalObject.cpp:583
&gt;&gt; +SUPPRESS_ASAN void JSGlobalObject::initStaticGlobals(VM&amp; vm)
&gt; 
&gt; How about putting `inline` here since this function is only called from this file.

Added inline here.

&gt;&gt; Source/JavaScriptCore/runtime/JSGlobalObject.cpp:2116
&gt;&gt; +SUPPRESS_ASAN void JSGlobalObject::exposeDollarVM(VM&amp; vm)
&gt; 
&gt; How about putting `inline` here since this function is only called from this file.

This one is a sort of &quot;slow path&quot; kind of function (i.e. no motivation to inline), and it also needs to be exported so that it can be called from a test.  So, it doesn&apos;t make sense to inline here.

&gt;&gt; Source/WebCore/bindings/js/JSDOMGlobalObject.cpp:176
&gt;&gt; +SUPPRESS_ASAN void JSDOMGlobalObject::addBuiltinGlobals(VM&amp; vm)
&gt; 
&gt; How about putting `inline` here since this function is only called from this file.

This is not a new function that I introduced.  It is also called from 2 places in this file.  Since this function is large, it may not make sense to inline it.  I&apos;ll leave it as is.

&gt;&gt; Source/WebCore/bindings/js/JSDOMWindowBase.cpp:114
&gt;&gt; +SUPPRESS_ASAN void JSDOMWindowBase::initStaticGlobals(JSC::VM&amp; vm)
&gt; 
&gt; How about putting `inline` here since this function is only called from this file.

Added inline here.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1745173</commentid>
    <comment_count>4</comment_count>
    <who name="Mark Lam">mark.lam</who>
    <bug_when>2021-03-30 10:21:53 -0700</bug_when>
    <thetext>Landed in r275212: &lt;http://trac.webkit.org/r275212&gt;.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1745223</commentid>
    <comment_count>5</comment_count>
      <attachid>424615</attachid>
    <who name="Alexey Proskuryakov">ap</who>
    <bug_when>2021-03-30 12:03:58 -0700</bug_when>
    <thetext>Comment on attachment 424615
proposed patch.

View in context: https://bugs.webkit.org/attachment.cgi?id=424615&amp;action=review

&gt; Source/JavaScriptCore/ChangeLog:12
&gt; +        We rely on GlobalPropertyInfo being allocated on the stack to allow its JSValue
&gt; +        value to be scanned by the GC.  Unfortunately, an ASAN compilation would choose
&gt; +        to allocate the GlobalPropertyInfo on a side buffer instead of directly on the
&gt; +        stack.  This prevents the GC from doing the needed scan.

This sounds like an ASan bug that should be fixed, is there a good reason for this behavior?

Surprised that we aren&apos;t seeing problems caused by this all the time on ASan bots.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1745236</commentid>
    <comment_count>6</comment_count>
      <attachid>424615</attachid>
    <who name="Mark Lam">mark.lam</who>
    <bug_when>2021-03-30 12:22:19 -0700</bug_when>
    <thetext>Comment on attachment 424615
proposed patch.

View in context: https://bugs.webkit.org/attachment.cgi?id=424615&amp;action=review

&gt;&gt; Source/JavaScriptCore/ChangeLog:12
&gt;&gt; +        stack.  This prevents the GC from doing the needed scan.
&gt; 
&gt; This sounds like an ASan bug that should be fixed, is there a good reason for this behavior?
&gt; 
&gt; Surprised that we aren&apos;t seeing problems caused by this all the time on ASan bots.

My guess is that we&apos;re declaring an array of GlobalPropertyInfo, and ASAN wanted to add stuff to do bounds checking on that array.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1745299</commentid>
    <comment_count>7</comment_count>
    <who name="Ryan Haddad">ryanhaddad</who>
    <bug_when>2021-03-30 14:00:07 -0700</bug_when>
    <thetext>Rebaselined builtins generator tests in https://trac.webkit.org/changeset/275233/webkit</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1745304</commentid>
    <comment_count>8</comment_count>
    <who name="Alexey Proskuryakov">ap</who>
    <bug_when>2021-03-30 14:08:12 -0700</bug_when>
    <thetext>ASan works with stack arrays, and even with alloca (stack-buffer-overflow check).

Do you have a theory for what we haven&apos;t been hitting issues caused by this all the time?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1745331</commentid>
    <comment_count>9</comment_count>
    <who name="Mark Lam">mark.lam</who>
    <bug_when>2021-03-30 14:35:28 -0700</bug_when>
    <thetext>(In reply to Alexey Proskuryakov from comment #8)
&gt; ASan works with stack arrays, and even with alloca (stack-buffer-overflow
&gt; check).

OK.

&gt; Do you have a theory for what we haven&apos;t been hitting issues caused by this
&gt; all the time?

The issue was manifesting as a GC bug where an object that should have been alive was collected.  If the relevant object in the global was never referenced / used after it was collected, then we would never have known about this.

Also, it relies on GC running at just the right time (courtesy of --collectContinuously in this case).  If GC missed the window, then this would also not manifest.

That&apos;s the best I can think of.</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>424615</attachid>
            <date>2021-03-29 21:27:10 -0700</date>
            <delta_ts>2021-03-30 01:35:29 -0700</delta_ts>
            <desc>proposed patch.</desc>
            <filename>bug-223911.patch</filename>
            <type>text/plain</type>
            <size>10352</size>
            <attacher name="Mark Lam">mark.lam</attacher>
            
              <data encoding="base64">SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291
cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMjc1MTk2KQorKysgU291cmNl
L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDI5IEBA
CisyMDIxLTAzLTI5ICBNYXJrIExhbSAgPG1hcmsubGFtQGFwcGxlLmNvbT4KKworICAgICAgICBF
bnN1cmUgdGhhdCBHbG9iYWxQcm9wZXJ0eUluZm8gaXMgYWxsb2NhdGVkIG9uIHRoZSBzdGFjay4K
KyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIyMzkxMQor
ICAgICAgICByZGFyOi8vNzU4NjU3NDIKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9P
UFMhKS4KKworICAgICAgICBXZSByZWx5IG9uIEdsb2JhbFByb3BlcnR5SW5mbyBiZWluZyBhbGxv
Y2F0ZWQgb24gdGhlIHN0YWNrIHRvIGFsbG93IGl0cyBKU1ZhbHVlCisgICAgICAgIHZhbHVlIHRv
IGJlIHNjYW5uZWQgYnkgdGhlIEdDLiAgVW5mb3J0dW5hdGVseSwgYW4gQVNBTiBjb21waWxhdGlv
biB3b3VsZCBjaG9vc2UKKyAgICAgICAgdG8gYWxsb2NhdGUgdGhlIEdsb2JhbFByb3BlcnR5SW5m
byBvbiBhIHNpZGUgYnVmZmVyIGluc3RlYWQgb2YgZGlyZWN0bHkgb24gdGhlCisgICAgICAgIHN0
YWNrLiAgVGhpcyBwcmV2ZW50cyB0aGUgR0MgZnJvbSBkb2luZyB0aGUgbmVlZGVkIHNjYW4uCisK
KyAgICAgICAgV2UnbGwgZml4IHRoaXMgYnkgc3VwcHJlc3NpbmcgQVNBTiBvbiB0aGUgZnVuY3Rp
b25zIHRoYXQgYWxsb2NhdGVkIEdsb2JhbFByb3BlcnR5SW5mbworICAgICAgICBhcnJheXMuICBB
bHNvIGFkZGVkIGFuIEFTU0VSVCBpbiB0aGUgR2xvYmFsUHJvcGVydHlJbmZvIGNvbnN0cnVjdG9y
IHRvIGFzc2VydCB0aGF0CisgICAgICAgIGl0IGlzIGFsbG9jYXRlZCBvbiB0aGUgc3RhY2suCisK
KyAgICAgICAgKiBTY3JpcHRzL3drYnVpbHRpbnMvYnVpbHRpbnNfZ2VuZXJhdGVfaW50ZXJuYWxz
X3dyYXBwZXJfaW1wbGVtZW50YXRpb24ucHk6CisgICAgICAgIChCdWlsdGluc0ludGVybmFsc1dy
YXBwZXJJbXBsZW1lbnRhdGlvbkdlbmVyYXRvci5nZW5lcmF0ZV9pbml0aWFsaXplX21ldGhvZCk6
CisgICAgICAgICogcnVudGltZS9KU0dsb2JhbE9iamVjdC5jcHA6CisgICAgICAgIChKU0M6OkpT
R2xvYmFsT2JqZWN0Ojppbml0U3RhdGljR2xvYmFscyk6CisgICAgICAgIChKU0M6OkpTR2xvYmFs
T2JqZWN0Ojppbml0KToKKyAgICAgICAgKEpTQzo6SlNHbG9iYWxPYmplY3Q6OmV4cG9zZURvbGxh
clZNKToKKyAgICAgICAgKiBydW50aW1lL0pTR2xvYmFsT2JqZWN0Lmg6CisgICAgICAgIChKU0M6
OkpTR2xvYmFsT2JqZWN0OjpHbG9iYWxQcm9wZXJ0eUluZm86Okdsb2JhbFByb3BlcnR5SW5mbyk6
CisKIDIwMjEtMDMtMjkgIFhhbiBMw7NwZXogIDx4YW5AaWdhbGlhLmNvbT4KIAogICAgICAgICBb
SlNDXSBVc2UgaGVscGVyIG1ldGhvZCB3aGVuIHBvc3NpYmxlIHRvIHN0b3JlIGRhdGEgaW4gdGhl
IGNhbGxmcmFtZSBoZWFkZXIKSW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9TY3JpcHRzL3dr
YnVpbHRpbnMvYnVpbHRpbnNfZ2VuZXJhdGVfaW50ZXJuYWxzX3dyYXBwZXJfaW1wbGVtZW50YXRp
b24ucHkKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PQotLS0gU291cmNlL0phdmFTY3JpcHRDb3JlL1NjcmlwdHMvd2tidWls
dGlucy9idWlsdGluc19nZW5lcmF0ZV9pbnRlcm5hbHNfd3JhcHBlcl9pbXBsZW1lbnRhdGlvbi5w
eQkocmV2aXNpb24gMjc1MDY2KQorKysgU291cmNlL0phdmFTY3JpcHRDb3JlL1NjcmlwdHMvd2ti
dWlsdGlucy9idWlsdGluc19nZW5lcmF0ZV9pbnRlcm5hbHNfd3JhcHBlcl9pbXBsZW1lbnRhdGlv
bi5weQkod29ya2luZyBjb3B5KQpAQCAtMTQzLDcgKzE0Myw3IEBAIGNsYXNzIEJ1aWx0aW5zSW50
ZXJuYWxzV3JhcHBlckltcGxlbWVudGEKICAgICAgICAgcmV0dXJuICdcbicuam9pbihsaW5lcykK
IAogICAgIGRlZiBnZW5lcmF0ZV9pbml0aWFsaXplX21ldGhvZChzZWxmKToKLSAgICAgICAgbGlu
ZXMgPSBbInZvaWQgSlNCdWlsdGluSW50ZXJuYWxGdW5jdGlvbnM6OmluaXRpYWxpemUoSlNET01H
bG9iYWxPYmplY3QmIGdsb2JhbE9iamVjdCkiLAorICAgICAgICBsaW5lcyA9IFsiU1VQUFJFU1Nf
QVNBTiB2b2lkIEpTQnVpbHRpbkludGVybmFsRnVuY3Rpb25zOjppbml0aWFsaXplKEpTRE9NR2xv
YmFsT2JqZWN0JiBnbG9iYWxPYmplY3QpIiwKICAgICAgICAgICAgICAgICAieyIsCiAgICAgICAg
ICAgICAgICAgIiAgICBVTlVTRURfUEFSQU0oZ2xvYmFsT2JqZWN0KTsiXQogCkluZGV4OiBTb3Vy
Y2UvSmF2YVNjcmlwdENvcmUvcnVudGltZS9KU0dsb2JhbE9iamVjdC5jcHAKPT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQot
LS0gU291cmNlL0phdmFTY3JpcHRDb3JlL3J1bnRpbWUvSlNHbG9iYWxPYmplY3QuY3BwCShyZXZp
c2lvbiAyNzUwNjYpCisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvcnVudGltZS9KU0dsb2JhbE9i
amVjdC5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTU4MCw2ICs1ODAsMTkgQEAgdm9pZCBKU0dsb2Jh
bE9iamVjdDo6aW5pdGlhbGl6ZUFnZ3JlZ2F0ZQogICAgIGluaXQuc2V0Q29uc3RydWN0b3IoQWdn
cmVnYXRlRXJyb3JDb25zdHJ1Y3Rvcjo6Y3JlYXRlKGluaXQudm0sIEFnZ3JlZ2F0ZUVycm9yQ29u
c3RydWN0b3I6OmNyZWF0ZVN0cnVjdHVyZShpbml0LnZtLCB0aGlzLCBtX2Vycm9yU3RydWN0dXJl
LmNvbnN0cnVjdG9yKHRoaXMpKSwganNDYXN0PEFnZ3JlZ2F0ZUVycm9yUHJvdG90eXBlKj4oaW5p
dC5wcm90b3R5cGUpKSk7CiB9CiAKK1NVUFBSRVNTX0FTQU4gdm9pZCBKU0dsb2JhbE9iamVjdDo6
aW5pdFN0YXRpY0dsb2JhbHMoVk0mIHZtKQoreworICAgIEdsb2JhbFByb3BlcnR5SW5mbyBzdGF0
aWNHbG9iYWxzW10gPSB7CisgICAgICAgIEdsb2JhbFByb3BlcnR5SW5mbyh2bS5wcm9wZXJ0eU5h
bWVzLT5OYU4sIGpzTmFOKCksIFByb3BlcnR5QXR0cmlidXRlOjpEb250RW51bSB8IFByb3BlcnR5
QXR0cmlidXRlOjpEb250RGVsZXRlIHwgUHJvcGVydHlBdHRyaWJ1dGU6OlJlYWRPbmx5KSwKKyAg
ICAgICAgR2xvYmFsUHJvcGVydHlJbmZvKHZtLnByb3BlcnR5TmFtZXMtPkluZmluaXR5LCBqc051
bWJlcihzdGQ6Om51bWVyaWNfbGltaXRzPGRvdWJsZT46OmluZmluaXR5KCkpLCBQcm9wZXJ0eUF0
dHJpYnV0ZTo6RG9udEVudW0gfCBQcm9wZXJ0eUF0dHJpYnV0ZTo6RG9udERlbGV0ZSB8IFByb3Bl
cnR5QXR0cmlidXRlOjpSZWFkT25seSksCisgICAgICAgIEdsb2JhbFByb3BlcnR5SW5mbyh2bS5w
cm9wZXJ0eU5hbWVzLT51bmRlZmluZWRLZXl3b3JkLCBqc1VuZGVmaW5lZCgpLCBQcm9wZXJ0eUF0
dHJpYnV0ZTo6RG9udEVudW0gfCBQcm9wZXJ0eUF0dHJpYnV0ZTo6RG9udERlbGV0ZSB8IFByb3Bl
cnR5QXR0cmlidXRlOjpSZWFkT25seSksCisjaWYgQVNTRVJUX0VOQUJMRUQKKyAgICAgICAgR2xv
YmFsUHJvcGVydHlJbmZvKHZtLnByb3BlcnR5TmFtZXMtPmJ1aWx0aW5OYW1lcygpLmFzc2VydFBy
aXZhdGVOYW1lKCksIEpTRnVuY3Rpb246OmNyZWF0ZSh2bSwgdGhpcywgMSwgU3RyaW5nKCksIGFz
c2VydENhbGwpLCBQcm9wZXJ0eUF0dHJpYnV0ZTo6RG9udEVudW0gfCBQcm9wZXJ0eUF0dHJpYnV0
ZTo6RG9udERlbGV0ZSB8IFByb3BlcnR5QXR0cmlidXRlOjpSZWFkT25seSksCisjZW5kaWYKKyAg
ICB9OworICAgIGFkZFN0YXRpY0dsb2JhbHMoc3RhdGljR2xvYmFscywgV1RGX0FSUkFZX0xFTkdU
SChzdGF0aWNHbG9iYWxzKSk7Cit9CisKIHZvaWQgSlNHbG9iYWxPYmplY3Q6OmluaXQoVk0mIHZt
KQogewogICAgIEFTU0VSVCh2bS5jdXJyZW50VGhyZWFkSXNIb2xkaW5nQVBJTG9jaygpKTsKQEAg
LTEzNTcsMTUgKzEzNzAsNyBAQCBjYXBpdGFsTmFtZSAjIyBDb25zdHJ1Y3RvciogbG93ZXJOYW1l
ICMjCiAgICAgICAgIHB1dERpcmVjdFdpdGhvdXRUcmFuc2l0aW9uKHZtLCBJZGVudGlmaWVyOjpm
cm9tU3RyaW5nKHZtLCAiX19kaXNhYmxlU3VwZXJTYW1wbGVyIiksIEpTRnVuY3Rpb246OmNyZWF0
ZSh2bSwgdGhpcywgMSwgU3RyaW5nKCksIGRpc2FibGVTdXBlclNhbXBsZXIpLCBQcm9wZXJ0eUF0
dHJpYnV0ZTo6RG9udEVudW0gfCBQcm9wZXJ0eUF0dHJpYnV0ZTo6RG9udERlbGV0ZSB8IFByb3Bl
cnR5QXR0cmlidXRlOjpSZWFkT25seSk7CiAgICAgfQogCi0gICAgR2xvYmFsUHJvcGVydHlJbmZv
IHN0YXRpY0dsb2JhbHNbXSA9IHsKLSAgICAgICAgR2xvYmFsUHJvcGVydHlJbmZvKHZtLnByb3Bl
cnR5TmFtZXMtPk5hTiwganNOYU4oKSwgUHJvcGVydHlBdHRyaWJ1dGU6OkRvbnRFbnVtIHwgUHJv
cGVydHlBdHRyaWJ1dGU6OkRvbnREZWxldGUgfCBQcm9wZXJ0eUF0dHJpYnV0ZTo6UmVhZE9ubHkp
LAotICAgICAgICBHbG9iYWxQcm9wZXJ0eUluZm8odm0ucHJvcGVydHlOYW1lcy0+SW5maW5pdHks
IGpzTnVtYmVyKHN0ZDo6bnVtZXJpY19saW1pdHM8ZG91YmxlPjo6aW5maW5pdHkoKSksIFByb3Bl
cnR5QXR0cmlidXRlOjpEb250RW51bSB8IFByb3BlcnR5QXR0cmlidXRlOjpEb250RGVsZXRlIHwg
UHJvcGVydHlBdHRyaWJ1dGU6OlJlYWRPbmx5KSwKLSAgICAgICAgR2xvYmFsUHJvcGVydHlJbmZv
KHZtLnByb3BlcnR5TmFtZXMtPnVuZGVmaW5lZEtleXdvcmQsIGpzVW5kZWZpbmVkKCksIFByb3Bl
cnR5QXR0cmlidXRlOjpEb250RW51bSB8IFByb3BlcnR5QXR0cmlidXRlOjpEb250RGVsZXRlIHwg
UHJvcGVydHlBdHRyaWJ1dGU6OlJlYWRPbmx5KSwKLSNpZiBBU1NFUlRfRU5BQkxFRAotICAgICAg
ICBHbG9iYWxQcm9wZXJ0eUluZm8odm0ucHJvcGVydHlOYW1lcy0+YnVpbHRpbk5hbWVzKCkuYXNz
ZXJ0UHJpdmF0ZU5hbWUoKSwgSlNGdW5jdGlvbjo6Y3JlYXRlKHZtLCB0aGlzLCAxLCBTdHJpbmco
KSwgYXNzZXJ0Q2FsbCksIFByb3BlcnR5QXR0cmlidXRlOjpEb250RW51bSB8IFByb3BlcnR5QXR0
cmlidXRlOjpEb250RGVsZXRlIHwgUHJvcGVydHlBdHRyaWJ1dGU6OlJlYWRPbmx5KSwKLSNlbmRp
ZgotICAgIH07Ci0gICAgYWRkU3RhdGljR2xvYmFscyhzdGF0aWNHbG9iYWxzLCBXVEZfQVJSQVlf
TEVOR1RIKHN0YXRpY0dsb2JhbHMpKTsKKyAgICBpbml0U3RhdGljR2xvYmFscyh2bSk7CiAgICAg
CiAgICAgaWYgKFVOTElLRUxZKE9wdGlvbnM6OnVzZURvbGxhclZNKCkpKQogICAgICAgICBleHBv
c2VEb2xsYXJWTSh2bSk7CkBAIC0yMTA4LDcgKzIxMTMsNyBAQCBDYWxsRnJhbWUqIEpTR2xvYmFs
T2JqZWN0OjpkZXByZWNhdGVkQ2FsCiAgICAgcmV0dXJuIENhbGxGcmFtZTo6Y3JlYXRlKG1fZGVw
cmVjYXRlZENhbGxGcmFtZUZvckRlYnVnZ2VyKTsKIH0KIAotdm9pZCBKU0dsb2JhbE9iamVjdDo6
ZXhwb3NlRG9sbGFyVk0oVk0mIHZtKQorU1VQUFJFU1NfQVNBTiB2b2lkIEpTR2xvYmFsT2JqZWN0
OjpleHBvc2VEb2xsYXJWTShWTSYgdm0pCiB7CiAgICAgUkVMRUFTRV9BU1NFUlQoZ19qc2NDb25m
aWcucmVzdHJpY3RlZE9wdGlvbnNFbmFibGVkICYmIE9wdGlvbnM6OnVzZURvbGxhclZNKCkpOwog
ICAgIGlmIChoYXNPd25Qcm9wZXJ0eSh0aGlzLCB2bS5wcm9wZXJ0eU5hbWVzLT5idWlsdGluTmFt
ZXMoKS5kb2xsYXJWTVByaXZhdGVOYW1lKCkpKQpJbmRleDogU291cmNlL0phdmFTY3JpcHRDb3Jl
L3J1bnRpbWUvSlNHbG9iYWxPYmplY3QuaAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvSmF2YVNjcmlw
dENvcmUvcnVudGltZS9KU0dsb2JhbE9iamVjdC5oCShyZXZpc2lvbiAyNzUwNjYpCisrKyBTb3Vy
Y2UvSmF2YVNjcmlwdENvcmUvcnVudGltZS9KU0dsb2JhbE9iamVjdC5oCSh3b3JraW5nIGNvcHkp
CkBAIC0xMTE2LDYgKzExMTYsNyBAQCBwcm90ZWN0ZWQ6CiAgICAgICAgICAgICAsIHZhbHVlKHYp
CiAgICAgICAgICAgICAsIGF0dHJpYnV0ZXMoYSkKICAgICAgICAgeworICAgICAgICAgICAgQVNT
RVJUKFRocmVhZDo6Y3VycmVudCgpLnN0YWNrKCkuY29udGFpbnModGhpcykpOwogICAgICAgICB9
CiAKICAgICAgICAgY29uc3QgSWRlbnRpZmllciBpZGVudGlmaWVyOwpAQCAtMTEzOCw2ICsxMTM5
LDcgQEAgcHJpdmF0ZToKICAgICB2b2lkIGluaXRpYWxpemVBZ2dyZWdhdGVFcnJvckNvbnN0cnVj
dG9yKExhenlDbGFzc1N0cnVjdHVyZTo6SW5pdGlhbGl6ZXImKTsKIAogICAgIEpTX0VYUE9SVF9Q
UklWQVRFIHZvaWQgaW5pdChWTSYpOworICAgIHZvaWQgaW5pdFN0YXRpY0dsb2JhbHMoVk0mKTsK
ICAgICB2b2lkIGZpeHVwUHJvdG90eXBlQ2hhaW5XaXRoT2JqZWN0UHJvdG90eXBlKFZNJik7CiAK
ICAgICBKU19FWFBPUlRfUFJJVkFURSBzdGF0aWMgdm9pZCBjbGVhclJhcmVEYXRhKEpTQ2VsbCop
OwpJbmRleDogU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9X
ZWJDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMjc1MDY2KQorKysgU291cmNlL1dlYkNvcmUvQ2hh
bmdlTG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTggQEAKKzIwMjEtMDMtMjkgIE1hcmsg
TGFtICA8bWFyay5sYW1AYXBwbGUuY29tPgorCisgICAgICAgIEVuc3VyZSB0aGF0IEdsb2JhbFBy
b3BlcnR5SW5mbyBpcyBhbGxvY2F0ZWQgb24gdGhlIHN0YWNrLgorICAgICAgICBodHRwczovL2J1
Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjIzOTExCisgICAgICAgIHJkYXI6Ly83NTg2
NTc0MgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgICog
YmluZGluZ3MvanMvSlNET01HbG9iYWxPYmplY3QuY3BwOgorICAgICAgICAoV2ViQ29yZTo6SlNE
T01HbG9iYWxPYmplY3Q6OmFkZEJ1aWx0aW5HbG9iYWxzKToKKyAgICAgICAgKiBiaW5kaW5ncy9q
cy9KU0RPTVdpbmRvd0Jhc2UuY3BwOgorICAgICAgICAoV2ViQ29yZTo6SlNET01XaW5kb3dCYXNl
OjpmaW5pc2hDcmVhdGlvbik6CisgICAgICAgIChXZWJDb3JlOjpKU0RPTVdpbmRvd0Jhc2U6Omlu
aXRTdGF0aWNHbG9iYWxzKToKKyAgICAgICAgKiBiaW5kaW5ncy9qcy9KU0RPTVdpbmRvd0Jhc2Uu
aDoKKwogMjAyMS0wMy0yNSAgQW5kcmVzIEdvbnphbGV6ICA8YW5kcmVzZ18yMkBhcHBsZS5jb20+
CiAKICAgICAgICAgQVg6IENvbnNpZGVyIGltcGxlbWVudGluZyBAYXJpYS1kZXRhaWxzLgpJbmRl
eDogU291cmNlL1dlYkNvcmUvYmluZGluZ3MvanMvSlNET01HbG9iYWxPYmplY3QuY3BwCj09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT0KLS0tIFNvdXJjZS9XZWJDb3JlL2JpbmRpbmdzL2pzL0pTRE9NR2xvYmFsT2JqZWN0LmNw
cAkocmV2aXNpb24gMjc1MDY2KQorKysgU291cmNlL1dlYkNvcmUvYmluZGluZ3MvanMvSlNET01H
bG9iYWxPYmplY3QuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC0xNzMsNyArMTczLDcgQEAgSlNDX0RF
RklORV9IT1NUX0ZVTkNUSU9OKHdoZW5TaWduYWxBYm9ydAogICAgIHJldHVybiBKU1ZhbHVlOjpl
bmNvZGUocmVzdWx0ID8gSlNWYWx1ZShKU0M6OkpTVmFsdWU6OkpTVHJ1ZSkgOiBKU1ZhbHVlKEpT
Qzo6SlNWYWx1ZTo6SlNGYWxzZSkpOwogfQogCi12b2lkIEpTRE9NR2xvYmFsT2JqZWN0OjphZGRC
dWlsdGluR2xvYmFscyhWTSYgdm0pCitTVVBQUkVTU19BU0FOIHZvaWQgSlNET01HbG9iYWxPYmpl
Y3Q6OmFkZEJ1aWx0aW5HbG9iYWxzKFZNJiB2bSkKIHsKICAgICBtX2J1aWx0aW5JbnRlcm5hbEZ1
bmN0aW9ucy5pbml0aWFsaXplKCp0aGlzKTsKIApJbmRleDogU291cmNlL1dlYkNvcmUvYmluZGlu
Z3MvanMvSlNET01XaW5kb3dCYXNlLmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2ViQ29yZS9i
aW5kaW5ncy9qcy9KU0RPTVdpbmRvd0Jhc2UuY3BwCShyZXZpc2lvbiAyNzUwNjYpCisrKyBTb3Vy
Y2UvV2ViQ29yZS9iaW5kaW5ncy9qcy9KU0RPTVdpbmRvd0Jhc2UuY3BwCSh3b3JraW5nIGNvcHkp
CkBAIC0xLDcgKzEsNyBAQAogLyoKICAqICBDb3B5cmlnaHQgKEMpIDIwMDAgSGFycmkgUG9ydGVu
IChwb3J0ZW5Aa2RlLm9yZykKICAqICBDb3B5cmlnaHQgKEMpIDIwMDYgSm9uIFNoaWVyIChqc2hp
ZXJAaWFzdGF0ZS5lZHUpCi0gKiAgQ29weXJpZ2h0IChDKSAyMDAzLTIwMjAgQXBwbGUgSW5jLiBB
bGwgcmlnaHRzIHJlc2V2ZWQuCisgKiAgQ29weXJpZ2h0IChDKSAyMDAzLTIwMjEgQXBwbGUgSW5j
LiBBbGwgcmlnaHRzIHJlc2V2ZWQuCiAgKiAgQ29weXJpZ2h0IChDKSAyMDA2IEFsZXhleSBQcm9z
a3VyeWFrb3YgKGFwQHdlYmtpdC5vcmcpCiAgKiAgQ29weXJpZ2h0IChjKSAyMDE1IENhbm9uIElu
Yy4gQWxsIHJpZ2h0cyByZXNlcnZlZC4KICAqCkBAIC0xMDUsNiArMTA1LDE0IEBAIHZvaWQgSlNE
T01XaW5kb3dCYXNlOjpmaW5pc2hDcmVhdGlvbihWTSYKICAgICBCYXNlOjpmaW5pc2hDcmVhdGlv
bih2bSwgcHJveHkpOwogICAgIEFTU0VSVChpbmhlcml0cyh2bSwgaW5mbygpKSk7CiAKKyAgICBp
bml0U3RhdGljR2xvYmFscyh2bSk7CisKKyAgICBpZiAobV93cmFwcGVkICYmIG1fd3JhcHBlZC0+
ZnJhbWUoKSAmJiBtX3dyYXBwZWQtPmZyYW1lKCktPnNldHRpbmdzKCkubmVlZHNTaXRlU3BlY2lm
aWNRdWlya3MoKSkKKyAgICAgICAgc2V0TmVlZHNTaXRlU3BlY2lmaWNRdWlya3ModHJ1ZSk7Cit9
CisKK1NVUFBSRVNTX0FTQU4gdm9pZCBKU0RPTVdpbmRvd0Jhc2U6OmluaXRTdGF0aWNHbG9iYWxz
KEpTQzo6Vk0mIHZtKQorewogICAgIGF1dG8mIGJ1aWx0aW5OYW1lcyA9IHN0YXRpY19jYXN0PEpT
Vk1DbGllbnREYXRhKj4odm0uY2xpZW50RGF0YSktPmJ1aWx0aW5OYW1lcygpOwogCiAgICAgR2xv
YmFsUHJvcGVydHlJbmZvIHN0YXRpY0dsb2JhbHNbXSA9IHsKQEAgLTExMyw5ICsxMjEsNiBAQCB2
b2lkIEpTRE9NV2luZG93QmFzZTo6ZmluaXNoQ3JlYXRpb24oVk0mCiAgICAgfTsKIAogICAgIGFk
ZFN0YXRpY0dsb2JhbHMoc3RhdGljR2xvYmFscywgV1RGX0FSUkFZX0xFTkdUSChzdGF0aWNHbG9i
YWxzKSk7Ci0KLSAgICBpZiAobV93cmFwcGVkICYmIG1fd3JhcHBlZC0+ZnJhbWUoKSAmJiBtX3dy
YXBwZWQtPmZyYW1lKCktPnNldHRpbmdzKCkubmVlZHNTaXRlU3BlY2lmaWNRdWlya3MoKSkKLSAg
ICAgICAgc2V0TmVlZHNTaXRlU3BlY2lmaWNRdWlya3ModHJ1ZSk7CiB9CiAKIHZvaWQgSlNET01X
aW5kb3dCYXNlOjpkZXN0cm95KEpTQ2VsbCogY2VsbCkKSW5kZXg6IFNvdXJjZS9XZWJDb3JlL2Jp
bmRpbmdzL2pzL0pTRE9NV2luZG93QmFzZS5oCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9XZWJDb3Jl
L2JpbmRpbmdzL2pzL0pTRE9NV2luZG93QmFzZS5oCShyZXZpc2lvbiAyNzUwNjYpCisrKyBTb3Vy
Y2UvV2ViQ29yZS9iaW5kaW5ncy9qcy9KU0RPTVdpbmRvd0Jhc2UuaAkod29ya2luZyBjb3B5KQpA
QCAtMSw2ICsxLDYgQEAKIC8qCiAgKiAgQ29weXJpZ2h0IChDKSAyMDAwIEhhcnJpIFBvcnRlbiAo
cG9ydGVuQGtkZS5vcmcpCi0gKiAgQ29weXJpZ2h0IChDKSAyMDAzLTIwMTcgQXBwbGUgSW5jLiBB
bGwgcmlnaHRzIHJlc2V2ZWQuCisgKiAgQ29weXJpZ2h0IChDKSAyMDAzLTIwMjEgQXBwbGUgSW5j
LiBBbGwgcmlnaHRzIHJlc2V2ZWQuCiAgKgogICogIFRoaXMgbGlicmFyeSBpcyBmcmVlIHNvZnR3
YXJlOyB5b3UgY2FuIHJlZGlzdHJpYnV0ZSBpdCBhbmQvb3IKICAqICBtb2RpZnkgaXQgdW5kZXIg
dGhlIHRlcm1zIG9mIHRoZSBHTlUgTGVzc2VyIEdlbmVyYWwgUHVibGljCkBAIC05Myw2ICs5Myw3
IEBAIHB1YmxpYzoKIHByb3RlY3RlZDoKICAgICBKU0RPTVdpbmRvd0Jhc2UoSlNDOjpWTSYsIEpT
Qzo6U3RydWN0dXJlKiwgUmVmUHRyPERPTVdpbmRvdz4mJiwgSlNXaW5kb3dQcm94eSopOwogICAg
IHZvaWQgZmluaXNoQ3JlYXRpb24oSlNDOjpWTSYsIEpTV2luZG93UHJveHkqKTsKKyAgICB2b2lk
IGluaXRTdGF0aWNHbG9iYWxzKEpTQzo6Vk0mKTsKIAogICAgIFJlZlB0cjxKU0M6OldhdGNocG9p
bnRTZXQ+IG1fd2luZG93Q2xvc2VXYXRjaHBvaW50czsKIAo=
</data>
<flag name="review"
          id="444343"
          type_id="1"
          status="+"
          setter="ysuzuki"
    />
          </attachment>
      

    </bug>

</bugzilla>