<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>225235</bug_id>
          
          <creation_ts>2021-04-30 09:21:34 -0700</creation_ts>
          <short_desc>Crash in ApplyStyleCommand::applyRelativeFontStyleChange</short_desc>
          <delta_ts>2021-05-07 08:24:01 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>HTML Editing</component>
          <version>WebKit Nightly Build</version>
          <rep_platform>Unspecified</rep_platform>
          <op_sys>Unspecified</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          <see_also>https://bugs.webkit.org/show_bug.cgi?id=223974</see_also>
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>InRadar</keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Ali Juma">ajuma</reporter>
          <assigned_to name="Frédéric Wang Nélar">fred.wang</assigned_to>
          <cc>bfulgham</cc>
    
    <cc>ews-feeder</cc>
    
    <cc>ews-watchlist</cc>
    
    <cc>fred.wang</cc>
    
    <cc>mifenton</cc>
    
    <cc>product-security</cc>
    
    <cc>rniwa</cc>
    
    <cc>rohitrao</cc>
    
    <cc>webkit-bug-importer</cc>
    
    <cc>wenson_hsieh</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>1755712</commentid>
    <comment_count>0</comment_count>
      <attachid>427430</attachid>
    <who name="Ali Juma">ajuma</who>
    <bug_when>2021-04-30 09:21:34 -0700</bug_when>
    <thetext>Created attachment 427430
Minimal test case

Filing this as a security bug since it was found using a fuzzer; there&apos;s no disclosure deadline for this bug.

This reproduces in an ASan build of WebKitTestRunner, and also in STP 123.

Stack:
=================================================================
==29379==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000018 (pc 0x0005c83e7854 bp 0x7ffee1561650 sp 0x7ffee1561650 T0)
==29379==The signal is caused by a WRITE memory access.
==29379==Hint: address points to the zero page.
    #0 0x5c83e7853 in WTF::Ref&lt;WebCore::Node, WTF::RawPtrTraits&lt;WebCore::Node&gt; &gt;::Ref(WebCore::Node&amp;) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x484853)
    #1 0x5cb7df0bf in WebCore::ApplyStyleCommand::applyRelativeFontStyleChange(WebCore::EditingStyle*) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x387c0bf)
    #2 0x5cb7dda06 in WebCore::ApplyStyleCommand::doApply() (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x387aa06)
    #3 0x5cb7d80c4 in WebCore::CompositeEditCommand::apply() (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x38750c4)
    #4 0x5cb84ea01 in WebCore::Editor::applyStyle(WTF::RefPtr&lt;WebCore::EditingStyle, WTF::RawPtrTraits&lt;WebCore::EditingStyle&gt;, WTF::DefaultRefDerefTraits&lt;WebCore::EditingStyle&gt; &gt;&amp;&amp;, WebCore::EditAction, WebCore::Editor::ColorFilterMode) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x38eba01)
    #5 0x5cb897175 in WebCore::applyCommandToFrame(WebCore::Frame&amp;, WebCore::EditorCommandSource, WebCore::EditAction, WTF::Ref&lt;WebCore::EditingStyle, WTF::RawPtrTraits&lt;WebCore::EditingStyle&gt; &gt;&amp;&amp;) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x3934175)
    #6 0x5cb897016 in WebCore::executeApplyStyle(WebCore::Frame&amp;, WebCore::EditorCommandSource, WebCore::EditAction, WebCore::CSSPropertyID, WTF::String const&amp;) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x3934016)
    #7 0x5cb4f96a3 in WebCore::Document::execCommand(WTF::String const&amp;, bool, WTF::String const&amp;) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x35966a3)
    #8 0x5c894120a in WebCore::jsDocumentPrototypeFunction_execCommandBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSDocument*) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x9de20a)
    #9 0x5c8940ccb in long long WebCore::IDLOperation&lt;WebCore::JSDocument&gt;::call&lt;&amp;(WebCore::jsDocumentPrototypeFunction_execCommandBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSDocument*)), (WebCore::CastedThisErrorBehavior)0&gt;(JSC::JSGlobalObject&amp;, JSC::CallFrame&amp;, char const*) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x9ddccb)
    #10 0x24a3a7a011d7  (&lt;unknown module&gt;)
    #11 0x5e4a307df in llint_entry (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0xb4e7df)
    #12 0x5e4a307df in llint_entry (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0xb4e7df)
    #13 0x5e4a157f8 in vmEntryToJavaScript (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0xb337f8)
    #14 0x5e61b9c61 in JSC::Interpreter::executeProgram(JSC::SourceCode const&amp;, JSC::JSGlobalObject*, JSC::JSObject*) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x22d7c61)
    #15 0x5e68fa7ed in JSC::evaluate(JSC::JSGlobalObject*, JSC::SourceCode const&amp;, JSC::JSValue, WTF::NakedPtr&lt;JSC::Exception&gt;&amp;) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x2a187ed)
    #16 0x5e68faa97 in JSC::profiledEvaluate(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::SourceCode const&amp;, JSC::JSValue, WTF::NakedPtr&lt;JSC::Exception&gt;&amp;) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/JavaScriptCore.framework/Versions/A/JavaScriptCore:x86_64+0x2a18a97)
    #17 0x5cae12bb9 in WebCore::JSExecState::profiledEvaluate(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::SourceCode const&amp;, JSC::JSValue, WTF::NakedPtr&lt;JSC::Exception&gt;&amp;) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x2eafbb9)
    #18 0x5cae123b9 in WebCore::ScriptController::evaluateInWorld(WebCore::ScriptSourceCode const&amp;, WebCore::DOMWrapperWorld&amp;) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x2eaf3b9)
    #19 0x5cae11fad in WebCore::ScriptController::evaluateInWorldIgnoringException(WebCore::ScriptSourceCode const&amp;, WebCore::DOMWrapperWorld&amp;) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x2eaefad)
    #20 0x5cb6f93f7 in WebCore::ScriptElement::executeClassicScript(WebCore::ScriptSourceCode const&amp;) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x37963f7)
    #21 0x5cb6f65eb in WebCore::ScriptElement::prepareScript(WTF::TextPosition const&amp;, WebCore::ScriptElement::LegacyTypeSupport) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x37935eb)
    #22 0x5cbe3196e in WebCore::HTMLScriptRunner::runScript(WebCore::ScriptElement&amp;, WTF::TextPosition const&amp;) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x3ece96e)
    #23 0x5cbe31644 in WebCore::HTMLScriptRunner::execute(WTF::Ref&lt;WebCore::ScriptElement, WTF::RawPtrTraits&lt;WebCore::ScriptElement&gt; &gt;&amp;&amp;, WTF::TextPosition const&amp;) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x3ece644)
    #24 0x5cbe0a449 in WebCore::HTMLDocumentParser::runScriptsForPausedTreeBuilder() (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x3ea7449)
    #25 0x5cbe0aa8d in WebCore::HTMLDocumentParser::pumpTokenizerLoop(WebCore::HTMLDocumentParser::SynchronousMode, bool, WebCore::PumpSession&amp;) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x3ea7a8d)
    #26 0x5cbe09b2b in WebCore::HTMLDocumentParser::pumpTokenizer(WebCore::HTMLDocumentParser::SynchronousMode) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x3ea6b2b)
    #27 0x5cbe09f9d in WebCore::HTMLDocumentParser::resumeParsingAfterYield() (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x3ea6f9d)
    #28 0x5cc8aa4a4 in WebCore::ThreadTimers::sharedTimerFiredInternal() (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x49474a4)
    #29 0x5cc934109 in WebCore::timerFired(__CFRunLoopTimer*, void*) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebCore.framework/Versions/A/WebCore:x86_64+0x49d1109)
    #30 0x7fff31204467 in __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64+0x9f467)
    #31 0x7fff31203fcd in __CFRunLoopDoTimer (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64+0x9efcd)
    #32 0x7fff31203ab8 in __CFRunLoopDoTimers (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64+0x9eab8)
    #33 0x7fff311e870c in __CFRunLoopRun (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64+0x8370c)
    #34 0x7fff311e7952 in CFRunLoopRunSpecific (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation:x86_64+0x82952)
    #35 0x7fff338a51c7 in -[NSRunLoop(NSRunLoop) runMode:beforeDate:] (/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation:x86_64+0x601c7)
    #36 0x7fff33957c6e in -[NSRunLoop(NSRunLoop) run] (/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation:x86_64+0x112c6e)
    #37 0x7fff6b3c44e9 in _xpc_objc_main.cold.4 (/usr/lib/system/libxpc.dylib:x86_64+0x164e9)
    #38 0x7fff6b3c442f in _xpc_objc_main (/usr/lib/system/libxpc.dylib:x86_64+0x1642f)
    #39 0x7fff6b3c3f62 in xpc_main (/usr/lib/system/libxpc.dylib:x86_64+0x15f62)
    #40 0x5b8f119f3 in WebKit::XPCServiceMain(int, char const**) (/Users/chrome-bot/clusterfuzz/bot/builds/chrome-ios-webkit-to-fuzz_ios-webkit-to-fuzz_cb292771138f3c7c4bb12f2df778e2b1c42b4cd7/revisions/WebKitMacOS/WebKit.framework/Versions/A/WebKit:x86_64+0xf119f3)
    #41 0x7fff6b172cc8 in start (/usr/lib/system/libdyld.dylib:x86_64+0x1acc8)
==29379==Register values:
rax = 0x0000100000000000  rbx = 0x00007ffee1561aa0  rcx = 0x0000100000000003  rdx = 0x0000000000000003
rdi = 0x00007ffee1561860  rsi = 0x0000000000000018  rbp = 0x00007ffee1561650  rsp = 0x00007ffee1561650
 r8 = 0x0000000000000001   r9 = 0x0000000000000000  r10 = 0xffffffffffffffff  r11 = 0x00000fffffffffff
r12 = 0x00007ffee1561840  r13 = 0x00001fffdc2ac310  r14 = 0x00007ffee1561860  r15 = 0x00001fffdc2ac2cc
=========================
Clusterfuzz-id: 5723658426056704</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1755714</commentid>
    <comment_count>1</comment_count>
    <who name="Radar WebKit Bug Importer">webkit-bug-importer</who>
    <bug_when>2021-04-30 09:21:44 -0700</bug_when>
    <thetext>&lt;rdar://problem/77385816&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1755919</commentid>
    <comment_count>2</comment_count>
    <who name="Ryosuke Niwa">rniwa</who>
    <bug_when>2021-04-30 21:14:22 -0700</bug_when>
    <thetext>Frédéric, is this a duplicate of the bug 223974?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1756120</commentid>
    <comment_count>3</comment_count>
    <who name="Frédéric Wang Nélar">fred.wang</who>
    <bug_when>2021-05-03 02:06:32 -0700</bug_when>
    <thetext>(In reply to Ryosuke Niwa from comment #2)
&gt; Frédéric, is this a duplicate of the bug 223974?

The pacth there does not fix it and the assertion failure seems different. Will take a look.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1756136</commentid>
    <comment_count>4</comment_count>
      <attachid>427548</attachid>
    <who name="Frédéric Wang Nélar">fred.wang</who>
    <bug_when>2021-05-03 03:19:10 -0700</bug_when>
    <thetext>Created attachment 427548
testcase reduced a bit further</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1756180</commentid>
    <comment_count>5</comment_count>
    <who name="Frédéric Wang Nélar">fred.wang</who>
    <bug_when>2021-05-03 08:06:42 -0700</bug_when>
    <thetext>(In reply to Frédéric Wang (:fredw) from comment #3)
&gt; The pacth there does not fix it and the assertion failure seems different.
&gt; Will take a look.

Actually it&apos;s the same debug assertion https://webkit-search.igalia.com/webkit/rev/d6c003baa462e89279b24c5ebfe160082a97997e/Source/WebCore/editing/ApplyStyleCommand.cpp#384 but the reason is different.

start/end are both pointing to the body with offsets 2 and 4 respectively, so we have start &lt; end. The inversion of nodes happens at https://webkit-search.igalia.com/webkit/rev/d6c003baa462e89279b24c5ebfe160082a97997e/Source/WebCore/editing/ApplyStyleCommand.cpp#345 where &quot;beyondEnd = NodeTraversal::next(*end.deprecatedNode());&quot; moves to the DIV child while &quot;start = start.upstream();&quot; moves to the #text child. I&apos;m not sure why we use two different functions?

(rr) b Source/WebCore/editing/ApplyStyleCommand.cpp:356
(rr) rc
(rr) 
Thread 1 hit Breakpoint 1, WebCore::ApplyStyleCommand::applyRelativeFontStyleChange (this=0x7fde709b7bc0, style=0x7fde709a3cf0)
    at https://webkit-search.igalia.com/webkit/rev/d6c003baa462e89279b24c5ebfe160082a97997e/Source/WebCore/editing/ApplyStyleCommand.cpp#356
(rr) p showTree(start)
*BODY	0x7fdebab08010 (renderer 0x7fdebab11b40)  STYLE=-webkit-text-security: disc;
	DIV	0x7fdebab08110 (renderer 0x7fdebab08640) 
	#text	0x7fdebab09330 &quot;B\n  &quot;
	SCRIPT	0x7fdebab093a0 (renderer (nil)) 
		#text	0x7fdebab080a0 &quot;\n    document.body.insertBefore(document.createElement(&quot;div&quot;),\n                               document.body.firstChild);\n    document.execCommand(&quot;FontSizeDelta&quot;, false, 3);\n  &quot;
offset, offset:2
$1 = void
(rr) p showTree(end)
*BODY	0x7fdebab08010 (renderer 0x7fdebab11b40)  STYLE=-webkit-text-security: disc;
	DIV	0x7fdebab08110 (renderer 0x7fdebab08640) 
	#text	0x7fdebab09330 &quot;B\n  &quot;
	SCRIPT	0x7fdebab093a0 (renderer (nil)) 
		#text	0x7fdebab080a0 &quot;\n    document.body.insertBefore(document.createElement(&quot;div&quot;),\n                               document.body.firstChild);\n    document.execCommand(&quot;FontSizeDelta&quot;, false, 3);\n  &quot;
offset, offset:4
$2 = void
(rr) p showTree(&amp;*beyondEnd)
BODY	0x7fdebab08010 (renderer 0x7fdebab11b40)  STYLE=-webkit-text-security: disc;
*	DIV	0x7fdebab08110 (renderer 0x7fdebab08640) 
	#text	0x7fdebab09330 &quot;B\n  &quot;
	SCRIPT	0x7fdebab093a0 (renderer (nil)) 
		#text	0x7fdebab080a0 &quot;\n    document.body.insertBefore(document.createElement(&quot;div&quot;),\n                               document.body.firstChild);\n    document.execCommand(&quot;FontSizeDelta&quot;, false, 3);\n  &quot;
$3 = void
(rr) n
(rr) p showTree(start)
BODY	0x7fdebab08010 (renderer 0x7fdebab11b40)  STYLE=-webkit-text-security: disc;
	DIV	0x7fdebab08110 (renderer 0x7fdebab08640) 
*	#text	0x7fdebab09330 &quot;B\n  &quot;
	SCRIPT	0x7fdebab093a0 (renderer (nil)) 
		#text	0x7fdebab080a0 &quot;\n    document.body.insertBefore(document.createElement(&quot;div&quot;),\n                               document.body.firstChild);\n    document.execCommand(&quot;FontSizeDelta&quot;, false, 3);\n  &quot;
legacy, offset, offset:4
$4 = void</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1756252</commentid>
    <comment_count>6</comment_count>
      <attachid>427582</attachid>
    <who name="Frédéric Wang Nélar">fred.wang</who>
    <bug_when>2021-05-03 11:47:56 -0700</bug_when>
    <thetext>Created attachment 427582
experimental patch

This ensures beyondEnd is moved to the next node, if the start &amp; end have the same anchor node. I don&apos;t know if this is what we want or not, I&apos;m uploading it to see whether it causes any test failures on EWS.

(In any case when the anchor node is the same, using NodeTraversal::next() on the end&apos;s anchor node and Position::upstream() on the selection start seems wrong)</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1756399</commentid>
    <comment_count>7</comment_count>
      <attachid>427582</attachid>
    <who name="Ryosuke Niwa">rniwa</who>
    <bug_when>2021-05-03 18:11:43 -0700</bug_when>
    <thetext>Comment on attachment 427582
experimental patch

View in context: https://bugs.webkit.org/attachment.cgi?id=427582&amp;action=review

It doesn&apos;t seem like this is a security issue? Can we add a test?

&gt; Source/WebCore/editing/ApplyStyleCommand.cpp:351
&gt; +    if (start.deprecatedNode() == end.deprecatedNode() || start.deprecatedNode()-&gt;isDescendantOf(*end.deprecatedNode()))

Sounds like we want to do do: end.deprecatedNode()-&gt;contains(*start.deprecatedNode())?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1756455</commentid>
    <comment_count>8</comment_count>
      <attachid>427641</attachid>
    <who name="Frédéric Wang Nélar">fred.wang</who>
    <bug_when>2021-05-04 00:05:00 -0700</bug_when>
    <thetext>Created attachment 427641
Patch

(In reply to Ryosuke Niwa from comment #7)
&gt; It doesn&apos;t seem like this is a security issue? Can we add a test?

Yes, the first loop will crash with a nullptr dereference when reaching the end of the DOM tree, similar to the debug assert.

Here is a new version, including a test. Unfortunately, I was not able to reduce it much.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1756492</commentid>
    <comment_count>9</comment_count>
      <attachid>427649</attachid>
    <who name="Frédéric Wang Nélar">fred.wang</who>
    <bug_when>2021-05-04 03:52:56 -0700</bug_when>
    <thetext>Created attachment 427649
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1757519</commentid>
    <comment_count>10</comment_count>
      <attachid>427649</attachid>
    <who name="Ryosuke Niwa">rniwa</who>
    <bug_when>2021-05-06 11:21:28 -0700</bug_when>
    <thetext>Comment on attachment 427649
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=427649&amp;action=review

&gt; LayoutTests/editing/execCommand/font-size-delta-same-node-for-start-and-end-crash.html:19
&gt; +    document.body.insertBefore(document.createElement(&quot;div&quot;),
&gt; +                               document.body.firstChild);

Nit: wrong indentation. Our indentation is always 4 spaces.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1757520</commentid>
    <comment_count>11</comment_count>
      <attachid>427649</attachid>
    <who name="Ryosuke Niwa">rniwa</who>
    <bug_when>2021-05-06 11:22:05 -0700</bug_when>
    <thetext>Comment on attachment 427649
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=427649&amp;action=review

&gt; LayoutTests/editing/execCommand/font-size-delta-same-node-for-start-and-end-crash.html:1
&gt; +&lt;body style=&quot;-webkit-text-security: disc;&quot;&gt;

Do we really need this?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1757525</commentid>
    <comment_count>12</comment_count>
      <attachid>427649</attachid>
    <who name="Frédéric Wang Nélar">fred.wang</who>
    <bug_when>2021-05-06 11:27:52 -0700</bug_when>
    <thetext>Comment on attachment 427649
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=427649&amp;action=review

&gt;&gt; LayoutTests/editing/execCommand/font-size-delta-same-node-for-start-and-end-crash.html:1
&gt;&gt; +&lt;body style=&quot;-webkit-text-security: disc;&quot;&gt;
&gt; 
&gt; Do we really need this?

Crash does not happen without that (I think it&apos;s creating text nodes). In general I was not really able to reduce further.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1757527</commentid>
    <comment_count>13</comment_count>
    <who name="Ryosuke Niwa">rniwa</who>
    <bug_when>2021-05-06 11:29:19 -0700</bug_when>
    <thetext>(In reply to Frédéric Wang (:fredw) from comment #12)
&gt; Comment on attachment 427649 [details]
&gt; Patch
&gt; 
&gt; View in context:
&gt; https://bugs.webkit.org/attachment.cgi?id=427649&amp;action=review
&gt; 
&gt; &gt;&gt; LayoutTests/editing/execCommand/font-size-delta-same-node-for-start-and-end-crash.html:1
&gt; &gt;&gt; +&lt;body style=&quot;-webkit-text-security: disc;&quot;&gt;
&gt; &gt; 
&gt; &gt; Do we really need this?
&gt; 
&gt; Crash does not happen without that (I think it&apos;s creating text nodes). In
&gt; general I was not really able to reduce further.

Okay. Interesting. I wonder how that CSS rule is affecting the editing code...</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1757805</commentid>
    <comment_count>14</comment_count>
      <attachid>427977</attachid>
    <who name="Frédéric Wang Nélar">fred.wang</who>
    <bug_when>2021-05-07 00:51:18 -0700</bug_when>
    <thetext>Created attachment 427977
Patch for landing</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1757870</commentid>
    <comment_count>15</comment_count>
    <who name="EWS">ews-feeder</who>
    <bug_when>2021-05-07 08:23:59 -0700</bug_when>
    <thetext>Committed r277174 (237460@main): &lt;https://commits.webkit.org/237460@main&gt;

All reviewed patches have been landed. Closing bug and clearing flags on attachment 427977.</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="0"
              isprivate="0"
          >
            <attachid>427430</attachid>
            <date>2021-04-30 09:21:34 -0700</date>
            <delta_ts>2021-04-30 09:21:34 -0700</delta_ts>
            <desc>Minimal test case</desc>
            <filename>applyRelativeFontStyleChange.html</filename>
            <type>text/html</type>
            <size>1383</size>
            <attacher name="Ali Juma">ajuma</attacher>
            
              <data encoding="base64">IDwvaGVhZD48Ym9keSAiX19mXzM4NSgpOyIgc3R5bGU9ImRpc3BsYXk6IC13ZWJraXQtaW5saW5l
LWJveDstd2Via2l0LWNvbHVtbi1ydWxlOiAzcHggc29saWQ7b3ZlcmZsb3ctaW5saW5lOiBzY3Jv
bGw7LXdlYmtpdC10ZXh0LXNlY3VyaXR5OiBkaXNjO2RvbWluYW50LWJhc2VsaW5lOiBuby1jaGFu
Z2U7Zm9udC1mYWNlOiBBcmlhbCI+CiAgPHNjcmlwdD48L3NjcmlwdD48ImJvcmRlci1pbmxpbmUt
c3RhcnQtY29sb3I6IG9yYW5nZTtqdXN0aWZ5LWl0ZW1zOiBiYXNlbGluZTttc28tZ2VuZXJpYy1m
b250LWZhbWlseTogYXV0bzt0ZXh0LXJlbmRlcmluZzogb3B0aW1pemVMZWdpYmlsaXR5O3BsYWNl
LXNlbGY6IHN0YXJ0IGJhc2VsaW5lIj48L3A+CiAgICAgICAgX192XzE0My5wb3N0TWVzc2FnZSht
c2cpOwogIDxzY3JpcHQ+CiAgICBmdW5jdGlvbiBfX2ZfMjM4KCB0YWdOYW1lKQogICAgewogICAg
ICAgIF9fdl8yNjQgPSBkb2N1bWVudC5jcmVhdGVFbGVtZW50KHRhZ05hbWUpOwogICAgICAgIHZh
ciBfX3ZfMjQ4ID0gZG9jdW1lbnQuYm9keSB8fCBkb2N1bWVudC5kb2N1bWVudEVsZW1lbnQ7CiAg
ICAgICAgICAgIF9fdl8yNDIgPSBfX3ZfMjQ4LmZpcnN0Q2hpbGQ7CiAgICAgICAgX192XzI0OC5p
bnNlcnRCZWZvcmUoX192XzI2NCwgX192XzI0Mik7CiAgICAgICAgcmV0dXJuIF9fdl8yNjQ7CiAg
ICB9CiAgICBkZWJ1ZyA9IGZ1bmN0aW9uIGRlYnVnKCkKICAgIHsKICAgICAgICBpZiAoc2VsZi5f
bGF6eVRlc3RSZXN1bHRzKSB7CiAgICAgICAgfSBlbHNlIHsKICAgICAgICAgICAgX19mXzIzOCgp
Ll9fdl8yMzk7CiAgICAgICAgfQogICAgfTsKZnVuY3Rpb24gX19mXzI3NSgpCnsKICAgIGRlYnVn
KCk7CiAgICBkb2N1bWVudC5leGVjQ29tbWFuZCgiRm9udFNpemVEZWx0YSIsIGZhbHNlLCAzKTsK
fQo8L3NjcmlwdD4KICA8c2NyaXB0IGlkPSJzY3JpcHQxIj4KZG9jdW1lbnQuYWRkRXZlbnRMaXN0
ZW5lcigiRE9NQ2hhcmFjdGVyRGF0YU1vZGlmaWVkIixmdW5jdGlvbigpewogICAgZG9jdW1lbnQu
Ym9keS5pbm5lckhUTUwgPSAiUEFTUy4gV2ViS2l0IGRpZG4ndCBjcmFzaC4iOyAKfSk7Cjwvc2Ny
aXB0PgogIDxzY3JpcHQgaWQ9ImRvbS1mdXp6LTQzMzUwMDAxIj4KdmFyIHNjcmlwdEVsZW1lbnQg
PSBkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgnc2NyaXB0MScpOwpzY3JpcHRFbGVtZW50LnBhcmVu
dE5vZGUucmVtb3ZlQ2hpbGQoc2NyaXB0RWxlbWVudCk7CmRvY3VtZW50LmRlc2lnbk1vZGUgPSAi
b24iOwpkb2N1bWVudC5leGVjQ29tbWFuZCgiU2VsZWN0QWxsIik7CmRvY3VtZW50LmV4ZWNDb21t
YW5kKCJGb250U2l6ZURlbHRhIiwgZmFsc2UsIDMpOwo8L3NjcmlwdD48c2NyaXB0PgogX19mXzI3
NSgpOyAKPC9zY3JpcHQ+
</data>

          </attachment>
          <attachment
              isobsolete="0"
              ispatch="0"
              isprivate="0"
          >
            <attachid>427548</attachid>
            <date>2021-05-03 03:19:10 -0700</date>
            <delta_ts>2021-05-03 03:19:10 -0700</delta_ts>
            <desc>testcase reduced a bit further</desc>
            <filename>applyRelativeFontStyleChange.html</filename>
            <type>text/html</type>
            <size>696</size>
            <attacher name="Frédéric Wang Nélar">fred.wang</attacher>
            
              <data encoding="base64">PGJvZHkgc3R5bGU9Ii13ZWJraXQtdGV4dC1zZWN1cml0eTogZGlzYzsiPgogIDxkaXY+PC9kaXY+
QQogIDxzY3JpcHQ+PC9zY3JpcHQ+CiAgPHNjcmlwdCBpZD0ic2NyaXB0MSI+CiAgICBkb2N1bWVu
dC5hZGRFdmVudExpc3RlbmVyKCJET01DaGFyYWN0ZXJEYXRhTW9kaWZpZWQiLCAoKSA9PiB7CiAg
ICAgICAgZG9jdW1lbnQuYm9keS5pbm5lckhUTUwgPSAiQiI7CiAgICB9KTsKICA8L3NjcmlwdD4K
ICA8c2NyaXB0PgogICAgdmFyIHNjcmlwdEVsZW1lbnQgPSBkb2N1bWVudC5nZXRFbGVtZW50QnlJ
ZCgnc2NyaXB0MScpOwogICAgc2NyaXB0RWxlbWVudC5wYXJlbnROb2RlLnJlbW92ZUNoaWxkKHNj
cmlwdEVsZW1lbnQpOwogICAgZG9jdW1lbnQuZGVzaWduTW9kZSA9ICJvbiI7CiAgICBkb2N1bWVu
dC5leGVjQ29tbWFuZCgiU2VsZWN0QWxsIik7CiAgICBkb2N1bWVudC5leGVjQ29tbWFuZCgiRm9u
dFNpemVEZWx0YSIsIGZhbHNlLCAzKTsKICA8L3NjcmlwdD4KICA8c2NyaXB0PgogICAgZG9jdW1l
bnQuYm9keS5pbnNlcnRCZWZvcmUoZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiZGl2IiksCiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICBkb2N1bWVudC5ib2R5LmZpcnN0Q2hpbGQpOwogICAg
ZG9jdW1lbnQuZXhlY0NvbW1hbmQoIkZvbnRTaXplRGVsdGEiLCBmYWxzZSwgMyk7CiAgPC9zY3Jp
cHQ+CjwvYm9keT4K
</data>

          </attachment>
          <attachment
              isobsolete="1"
              ispatch="1"
              isprivate="0"
          >
            <attachid>427582</attachid>
            <date>2021-05-03 11:47:56 -0700</date>
            <delta_ts>2021-05-04 00:05:00 -0700</delta_ts>
            <desc>experimental patch</desc>
            <filename>bug225235.patch</filename>
            <type>text/plain</type>
            <size>788</size>
            <attacher name="Frédéric Wang Nélar">fred.wang</attacher>
            
              <data encoding="base64">ZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL2VkaXRpbmcvQXBwbHlTdHlsZUNvbW1hbmQuY3Bw
IGIvU291cmNlL1dlYkNvcmUvZWRpdGluZy9BcHBseVN0eWxlQ29tbWFuZC5jcHAKaW5kZXggNDEy
OThiYTFiZS4uNGJiNjM1NTdmYSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvZWRpdGluZy9B
cHBseVN0eWxlQ29tbWFuZC5jcHAKKysrIGIvU291cmNlL1dlYkNvcmUvZWRpdGluZy9BcHBseVN0
eWxlQ29tbWFuZC5jcHAKQEAgLTM0OCw3ICszNDgsNyBAQCB2b2lkIEFwcGx5U3R5bGVDb21tYW5k
OjphcHBseVJlbGF0aXZlRm9udFN0eWxlQ2hhbmdlKEVkaXRpbmdTdHlsZSogc3R5bGUpCiAgICAg
UmVmUHRyPE5vZGU+IGJleW9uZEVuZDsKICAgICBBU1NFUlQoc3RhcnQuZGVwcmVjYXRlZE5vZGUo
KSk7CiAgICAgQVNTRVJUKGVuZC5kZXByZWNhdGVkTm9kZSgpKTsKLSAgICBpZiAoc3RhcnQuZGVw
cmVjYXRlZE5vZGUoKS0+aXNEZXNjZW5kYW50T2YoKmVuZC5kZXByZWNhdGVkTm9kZSgpKSkKKyAg
ICBpZiAoc3RhcnQuZGVwcmVjYXRlZE5vZGUoKSA9PSBlbmQuZGVwcmVjYXRlZE5vZGUoKSB8fCBz
dGFydC5kZXByZWNhdGVkTm9kZSgpLT5pc0Rlc2NlbmRhbnRPZigqZW5kLmRlcHJlY2F0ZWROb2Rl
KCkpKQogICAgICAgICBiZXlvbmRFbmQgPSBOb2RlVHJhdmVyc2FsOjpuZXh0U2tpcHBpbmdDaGls
ZHJlbigqZW5kLmRlcHJlY2F0ZWROb2RlKCkpOwogICAgIGVsc2UKICAgICAgICAgYmV5b25kRW5k
ID0gTm9kZVRyYXZlcnNhbDo6bmV4dCgqZW5kLmRlcHJlY2F0ZWROb2RlKCkpOwo=
</data>

          </attachment>
          <attachment
              isobsolete="1"
              ispatch="1"
              isprivate="0"
          >
            <attachid>427641</attachid>
            <date>2021-05-04 00:05:00 -0700</date>
            <delta_ts>2021-05-04 03:52:56 -0700</delta_ts>
            <desc>Patch</desc>
            <filename>bug225235.patch</filename>
            <type>text/plain</type>
            <size>4526</size>
            <attacher name="Frédéric Wang Nélar">fred.wang</attacher>
            
              <data encoding="base64">ZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL0NoYW5nZUxvZyBiL0xheW91dFRlc3RzL0NoYW5nZUxv
ZwppbmRleCA3MzY3MzI1MWQxLi4wYWQ2MmM1MzIzIDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9D
aGFuZ2VMb2cKKysrIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTUgQEAKKzIw
MjEtMDUtMDMgIEZyw6lkw6lyaWMgV2FuZyAgPGZ3YW5nQGlnYWxpYS5jb20+CisKKyAgICAgICAg
Q3Jhc2ggaW4gQXBwbHlTdHlsZUNvbW1hbmQ6OmFwcGx5UmVsYXRpdmVGb250U3R5bGVDaGFuZ2UK
KyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIyNTIzNQor
CisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIEFkZCByZWdy
ZXNzaW9uIHRlc3QuCisKKyAgICAgICAgKiBlZGl0aW5nL2V4ZWNDb21tYW5kL2ZvbnQtc2l6ZS1k
ZWx0YS1zYW1lLW5vZGUtZm9yLXN0YXJ0LWFuZC1lbmQtY3Jhc2gtZXhwZWN0ZWQudHh0OiBBZGRl
ZC4KKyAgICAgICAgKiBlZGl0aW5nL2V4ZWNDb21tYW5kL2ZvbnQtc2l6ZS1kZWx0YS1zYW1lLW5v
ZGUtZm9yLXN0YXJ0LWFuZC1lbmQtY3Jhc2guaHRtbDogQWRkZWQuCisKIDIwMjEtMDUtMDMgIERp
ZWdvIFBpbm8gR2FyY2lhICA8ZHBpbm9AaWdhbGlhLmNvbT4KIAogICAgICAgICBbR0xJQl1bR1RL
XSBVbnJldmlld2VkIHRlc3QgZ2FyZGVuaW5nLiBVcGRhdGVkIGV4cGVjdGF0aW9ucyB3aXRoIGxh
dGVzdCBmYWlsdXJlcyBmcm9tIEdUSyByZWxlYXNlIGJvdC4KZGlmZiAtLWdpdCBhL0xheW91dFRl
c3RzL2VkaXRpbmcvZXhlY0NvbW1hbmQvZm9udC1zaXplLWRlbHRhLXNhbWUtbm9kZS1mb3Itc3Rh
cnQtYW5kLWVuZC1jcmFzaC1leHBlY3RlZC50eHQgYi9MYXlvdXRUZXN0cy9lZGl0aW5nL2V4ZWND
b21tYW5kL2ZvbnQtc2l6ZS1kZWx0YS1zYW1lLW5vZGUtZm9yLXN0YXJ0LWFuZC1lbmQtY3Jhc2gt
ZXhwZWN0ZWQudHh0Cm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAwMDAuLmUyMzcx
YWI2MzIKLS0tIC9kZXYvbnVsbAorKysgYi9MYXlvdXRUZXN0cy9lZGl0aW5nL2V4ZWNDb21tYW5k
L2ZvbnQtc2l6ZS1kZWx0YS1zYW1lLW5vZGUtZm9yLXN0YXJ0LWFuZC1lbmQtY3Jhc2gtZXhwZWN0
ZWQudHh0CkBAIC0wLDAgKzEsMiBAQAorQ09OU09MRSBNRVNTQUdFOiBUaGlzIHRlc3QgcGFzc2Vz
IGlmIGl0IGRvZXMgbm90IGNyYXNoLgor4oCi4oCi4oCi4oCi4oCi4oCiCmRpZmYgLS1naXQgYS9M
YXlvdXRUZXN0cy9lZGl0aW5nL2V4ZWNDb21tYW5kL2ZvbnQtc2l6ZS1kZWx0YS1zYW1lLW5vZGUt
Zm9yLXN0YXJ0LWFuZC1lbmQtY3Jhc2guaHRtbCBiL0xheW91dFRlc3RzL2VkaXRpbmcvZXhlY0Nv
bW1hbmQvZm9udC1zaXplLWRlbHRhLXNhbWUtbm9kZS1mb3Itc3RhcnQtYW5kLWVuZC1jcmFzaC5o
dG1sCm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAwMDAuLjY4YTA2NTM2N2IKLS0t
IC9kZXYvbnVsbAorKysgYi9MYXlvdXRUZXN0cy9lZGl0aW5nL2V4ZWNDb21tYW5kL2ZvbnQtc2l6
ZS1kZWx0YS1zYW1lLW5vZGUtZm9yLXN0YXJ0LWFuZC1lbmQtY3Jhc2guaHRtbApAQCAtMCwwICsx
LDIyIEBACis8Ym9keSBzdHlsZT0iLXdlYmtpdC10ZXh0LXNlY3VyaXR5OiBkaXNjOyI+CisgIDxk
aXY+PC9kaXY+QQorICA8c2NyaXB0Pjwvc2NyaXB0PgorICA8ZGl2IGlkPSJlbGVtZW50Ij48L2Rp
dj4KKyAgPHNjcmlwdD4KKyAgICBpZiAod2luZG93LnRlc3RSdW5uZXIpCisgICAgICAgIHRlc3RS
dW5uZXIuZHVtcEFzVGV4dCgpCisgICAgY29uc29sZS5sb2coJ1RoaXMgdGVzdCBwYXNzZXMgaWYg
aXQgZG9lcyBub3QgY3Jhc2guJyk7CisgICAgZG9jdW1lbnQuYWRkRXZlbnRMaXN0ZW5lcigiRE9N
Q2hhcmFjdGVyRGF0YU1vZGlmaWVkIiwgKCkgPT4geworICAgICAgICBkb2N1bWVudC5ib2R5Lmlu
bmVySFRNTCA9ICJCIjsKKyAgICB9KTsKKyAgICBkb2N1bWVudC5ib2R5LnJlbW92ZUNoaWxkKGRv
Y3VtZW50LmdldEVsZW1lbnRCeUlkKCdlbGVtZW50JykpOworICAgIGRvY3VtZW50LmRlc2lnbk1v
ZGUgPSAib24iOworICAgIGRvY3VtZW50LmV4ZWNDb21tYW5kKCJTZWxlY3RBbGwiKTsKKyAgICBk
b2N1bWVudC5leGVjQ29tbWFuZCgiRm9udFNpemVEZWx0YSIsIGZhbHNlLCAzKTsKKyAgPC9zY3Jp
cHQ+CisgIDxzY3JpcHQ+CisgICAgZG9jdW1lbnQuYm9keS5pbnNlcnRCZWZvcmUoZG9jdW1lbnQu
Y3JlYXRlRWxlbWVudCgiZGl2IiksCisgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZG9j
dW1lbnQuYm9keS5maXJzdENoaWxkKTsKKyAgICBkb2N1bWVudC5leGVjQ29tbWFuZCgiRm9udFNp
emVEZWx0YSIsIGZhbHNlLCAzKTsKKyAgPC9zY3JpcHQ+Cis8L2JvZHk+CmRpZmYgLS1naXQgYS9T
b3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXgg
NjU3YTM1ZDk2ZC4uMWNjMzMxOWJhYyAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdl
TG9nCisrKyBiL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDIzIEBACisyMDIx
LTA1LTAzICBGcsOpZMOpcmljIFdhbmcgIDxmd2FuZ0BpZ2FsaWEuY29tPgorCisgICAgICAgIENy
YXNoIGluIEFwcGx5U3R5bGVDb21tYW5kOjphcHBseVJlbGF0aXZlRm9udFN0eWxlQ2hhbmdlCisg
ICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0yMjUyMzUKKwor
ICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBUZXN0OiBlZGl0
aW5nL2V4ZWNDb21tYW5kL2ZvbnQtc2l6ZS1kZWx0YS1zYW1lLW5vZGUtZm9yLXN0YXJ0LWFuZC1l
bmQtY3Jhc2guaHRtbAorCisgICAgICAgIEluIEFwcGx5U3R5bGVDb21tYW5kOjphcHBseVJlbGF0
aXZlRm9udFN0eWxlQ2hhbmdlLCB3aGVuIHRoZSBzZWxlY3Rpb24gc3RhcnQgYW5kIGVuZCBoYXZl
IHRoZQorICAgICAgICBzYW1lIGFuY2hvciBub2RlLCB0aGUgc3RhcnQgbm9kZSBvZiB0aGUgbG9v
cCBpcyBvYnRhaW5lZCBieSBjYWxsaW5nIFBvc2l0aW9uOjp1cHN0cmVhbSBvbiB0aGUKKyAgICAg
ICAgc2VsZWN0aW9uIHN0YXJ0IHdoaWxlIGVuZCBub2RlIG9mIHRoZSBsb29wIGlzIG9idGFpbmVk
IGJ5IGNhbGxpbmcgTm9kZVRyYXZlcnNhbDo6bmV4dCBvbiB0aGUKKyAgICAgICAgYW5jaG9yIG5v
ZGUuIFRoaXMgY2FuIHJlc3VsdCBpbiB0aGUgZm9ybWVyIGJlaW5nIGFmdGVyIHRoZSBsYXR0ZXIu
IFRoaXMgcGF0Y2ggZml4ZXMgdGhpcyBieQorICAgICAgICBtb3ZpbmcgdGhlIGVuZCBvZiB0aGUg
bG9vcCBhZnRlciB0aGUgYW5jaG9yIG5vZGUgKHNpbWlsYXIgdG8gd2hhdCBpcyBhbHJlYWR5IGRv
bmUgd2hlbiB0aGUKKyAgICAgICAgc3RhcnQgYW5jaG9yIG5vZGUgaXMgYSBzdHJpY3QgZGVzY2Vu
ZGFudCBvZiB0aGUgZW5kIGFuY2hvciBub2RlKS4KKworICAgICAgICAqIGVkaXRpbmcvQXBwbHlT
dHlsZUNvbW1hbmQuY3BwOgorICAgICAgICAoV2ViQ29yZTo6QXBwbHlTdHlsZUNvbW1hbmQ6OmFw
cGx5UmVsYXRpdmVGb250U3R5bGVDaGFuZ2UpOiBBbHNvIGluY2x1ZGUgdGhlIGNhc2Ugd2hlcmUK
KyAgICAgICAgZW5kLmRlcHJlY2F0ZWROb2RlKCkgPT0gc3RhcnQuZGVwcmVjYXRlZE5vZGUoKSBp
biB0aGUgY29uZGl0aW9uYWwuCisKIDIwMjEtMDQtMDYgIEZyw6lkw6lyaWMgV2FuZyAgPGZ3YW5n
QGlnYWxpYS5jb20+CiAKICAgICAgICAgbnVsbHB0ciBjcmFzaCBpbiBBcHBseVN0eWxlQ29tbWFu
ZDo6YXBwbHlSZWxhdGl2ZUZvbnRTdHlsZUNoYW5nZQpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNv
cmUvZWRpdGluZy9BcHBseVN0eWxlQ29tbWFuZC5jcHAgYi9Tb3VyY2UvV2ViQ29yZS9lZGl0aW5n
L0FwcGx5U3R5bGVDb21tYW5kLmNwcAppbmRleCA2NTRlNTc5NGE2Li42NmY2YTExZTAwIDEwMDY0
NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9lZGl0aW5nL0FwcGx5U3R5bGVDb21tYW5kLmNwcAorKysg
Yi9Tb3VyY2UvV2ViQ29yZS9lZGl0aW5nL0FwcGx5U3R5bGVDb21tYW5kLmNwcApAQCAtMzQ4LDcg
KzM0OCw3IEBAIHZvaWQgQXBwbHlTdHlsZUNvbW1hbmQ6OmFwcGx5UmVsYXRpdmVGb250U3R5bGVD
aGFuZ2UoRWRpdGluZ1N0eWxlKiBzdHlsZSkKICAgICBSZWZQdHI8Tm9kZT4gYmV5b25kRW5kOwog
ICAgIEFTU0VSVChzdGFydC5kZXByZWNhdGVkTm9kZSgpKTsKICAgICBBU1NFUlQoZW5kLmRlcHJl
Y2F0ZWROb2RlKCkpOwotICAgIGlmIChzdGFydC5kZXByZWNhdGVkTm9kZSgpLT5pc0Rlc2NlbmRh
bnRPZigqZW5kLmRlcHJlY2F0ZWROb2RlKCkpKQorICAgIGlmIChlbmQuZGVwcmVjYXRlZE5vZGUo
KS0+Y29udGFpbnMoKnN0YXJ0LmRlcHJlY2F0ZWROb2RlKCkpKQogICAgICAgICBiZXlvbmRFbmQg
PSBOb2RlVHJhdmVyc2FsOjpuZXh0U2tpcHBpbmdDaGlsZHJlbigqZW5kLmRlcHJlY2F0ZWROb2Rl
KCkpOwogICAgIGVsc2UKICAgICAgICAgYmV5b25kRW5kID0gTm9kZVRyYXZlcnNhbDo6bmV4dCgq
ZW5kLmRlcHJlY2F0ZWROb2RlKCkpOwo=
</data>
<flag name="commit-queue"
          id="448325"
          type_id="3"
          status="-"
          setter="ews-feeder"
    />
          </attachment>
          <attachment
              isobsolete="1"
              ispatch="1"
              isprivate="0"
          >
            <attachid>427649</attachid>
            <date>2021-05-04 03:52:56 -0700</date>
            <delta_ts>2021-05-07 00:51:18 -0700</delta_ts>
            <desc>Patch</desc>
            <filename>bug225235.patch</filename>
            <type>text/plain</type>
            <size>5120</size>
            <attacher name="Frédéric Wang Nélar">fred.wang</attacher>
            
              <data encoding="base64">ZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL0NoYW5nZUxvZyBiL0xheW91dFRlc3RzL0NoYW5nZUxv
ZwppbmRleCA5ZWMzNjc0MDdiLi5hMjVhYjJjODBiIDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9D
aGFuZ2VMb2cKKysrIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTYgQEAKKzIw
MjEtMDUtMDMgIEZyw6lkw6lyaWMgV2FuZyAgPGZ3YW5nQGlnYWxpYS5jb20+CisKKyAgICAgICAg
Q3Jhc2ggaW4gQXBwbHlTdHlsZUNvbW1hbmQ6OmFwcGx5UmVsYXRpdmVGb250U3R5bGVDaGFuZ2UK
KyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIyNTIzNQor
CisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIEFkZCByZWdy
ZXNzaW9uIHRlc3QuCisKKyAgICAgICAgKiBlZGl0aW5nL2V4ZWNDb21tYW5kL2ZvbnQtc2l6ZS1k
ZWx0YS1zYW1lLW5vZGUtZm9yLXN0YXJ0LWFuZC1lbmQtY3Jhc2gtZXhwZWN0ZWQudHh0OiBBZGRl
ZC4KKyAgICAgICAgKiBlZGl0aW5nL2V4ZWNDb21tYW5kL2ZvbnQtc2l6ZS1kZWx0YS1zYW1lLW5v
ZGUtZm9yLXN0YXJ0LWFuZC1lbmQtY3Jhc2guaHRtbDogQWRkZWQuCisgICAgICAgICogcGxhdGZv
cm0vaW9zL2VkaXRpbmcvZXhlY0NvbW1hbmQvZm9udC1zaXplLWRlbHRhLXNhbWUtbm9kZS1mb3It
c3RhcnQtYW5kLWVuZC1jcmFzaC1leHBlY3RlZC50eHQ6IEFkZGVkLgorCiAyMDIxLTA1LTAzICBT
aW1vbiBGcmFzZXIgIDxzaW1vbi5mcmFzZXJAYXBwbGUuY29tPgogCiAgICAgICAgIFJFR1JFU1NJ
T04gKHIyNzQ0NjEpOiBbbWFjT1Mgd2sxXSBmYXN0L3JlcGFpbnQvY2FudmFzLW9iamVjdC1maXQu
aHRtbCBpcyBmbGFrZXkgdGV4dCBmYWlsaW5nCmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9lZGl0
aW5nL2V4ZWNDb21tYW5kL2ZvbnQtc2l6ZS1kZWx0YS1zYW1lLW5vZGUtZm9yLXN0YXJ0LWFuZC1l
bmQtY3Jhc2gtZXhwZWN0ZWQudHh0IGIvTGF5b3V0VGVzdHMvZWRpdGluZy9leGVjQ29tbWFuZC9m
b250LXNpemUtZGVsdGEtc2FtZS1ub2RlLWZvci1zdGFydC1hbmQtZW5kLWNyYXNoLWV4cGVjdGVk
LnR4dApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwMDAwLi5lMjM3MWFiNjMyCi0t
LSAvZGV2L251bGwKKysrIGIvTGF5b3V0VGVzdHMvZWRpdGluZy9leGVjQ29tbWFuZC9mb250LXNp
emUtZGVsdGEtc2FtZS1ub2RlLWZvci1zdGFydC1hbmQtZW5kLWNyYXNoLWV4cGVjdGVkLnR4dApA
QCAtMCwwICsxLDIgQEAKK0NPTlNPTEUgTUVTU0FHRTogVGhpcyB0ZXN0IHBhc3NlcyBpZiBpdCBk
b2VzIG5vdCBjcmFzaC4KK+KAouKAouKAouKAouKAouKAogpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVz
dHMvZWRpdGluZy9leGVjQ29tbWFuZC9mb250LXNpemUtZGVsdGEtc2FtZS1ub2RlLWZvci1zdGFy
dC1hbmQtZW5kLWNyYXNoLmh0bWwgYi9MYXlvdXRUZXN0cy9lZGl0aW5nL2V4ZWNDb21tYW5kL2Zv
bnQtc2l6ZS1kZWx0YS1zYW1lLW5vZGUtZm9yLXN0YXJ0LWFuZC1lbmQtY3Jhc2guaHRtbApuZXcg
ZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwMDAwLi42OGEwNjUzNjdiCi0tLSAvZGV2L251
bGwKKysrIGIvTGF5b3V0VGVzdHMvZWRpdGluZy9leGVjQ29tbWFuZC9mb250LXNpemUtZGVsdGEt
c2FtZS1ub2RlLWZvci1zdGFydC1hbmQtZW5kLWNyYXNoLmh0bWwKQEAgLTAsMCArMSwyMiBAQAor
PGJvZHkgc3R5bGU9Ii13ZWJraXQtdGV4dC1zZWN1cml0eTogZGlzYzsiPgorICA8ZGl2PjwvZGl2
PkEKKyAgPHNjcmlwdD48L3NjcmlwdD4KKyAgPGRpdiBpZD0iZWxlbWVudCI+PC9kaXY+CisgIDxz
Y3JpcHQ+CisgICAgaWYgKHdpbmRvdy50ZXN0UnVubmVyKQorICAgICAgICB0ZXN0UnVubmVyLmR1
bXBBc1RleHQoKQorICAgIGNvbnNvbGUubG9nKCdUaGlzIHRlc3QgcGFzc2VzIGlmIGl0IGRvZXMg
bm90IGNyYXNoLicpOworICAgIGRvY3VtZW50LmFkZEV2ZW50TGlzdGVuZXIoIkRPTUNoYXJhY3Rl
ckRhdGFNb2RpZmllZCIsICgpID0+IHsKKyAgICAgICAgZG9jdW1lbnQuYm9keS5pbm5lckhUTUwg
PSAiQiI7CisgICAgfSk7CisgICAgZG9jdW1lbnQuYm9keS5yZW1vdmVDaGlsZChkb2N1bWVudC5n
ZXRFbGVtZW50QnlJZCgnZWxlbWVudCcpKTsKKyAgICBkb2N1bWVudC5kZXNpZ25Nb2RlID0gIm9u
IjsKKyAgICBkb2N1bWVudC5leGVjQ29tbWFuZCgiU2VsZWN0QWxsIik7CisgICAgZG9jdW1lbnQu
ZXhlY0NvbW1hbmQoIkZvbnRTaXplRGVsdGEiLCBmYWxzZSwgMyk7CisgIDwvc2NyaXB0PgorICA8
c2NyaXB0PgorICAgIGRvY3VtZW50LmJvZHkuaW5zZXJ0QmVmb3JlKGRvY3VtZW50LmNyZWF0ZUVs
ZW1lbnQoImRpdiIpLAorICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGRvY3VtZW50LmJv
ZHkuZmlyc3RDaGlsZCk7CisgICAgZG9jdW1lbnQuZXhlY0NvbW1hbmQoIkZvbnRTaXplRGVsdGEi
LCBmYWxzZSwgMyk7CisgIDwvc2NyaXB0PgorPC9ib2R5PgpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVz
dHMvcGxhdGZvcm0vaW9zL2VkaXRpbmcvZXhlY0NvbW1hbmQvZm9udC1zaXplLWRlbHRhLXNhbWUt
bm9kZS1mb3Itc3RhcnQtYW5kLWVuZC1jcmFzaC1leHBlY3RlZC50eHQgYi9MYXlvdXRUZXN0cy9w
bGF0Zm9ybS9pb3MvZWRpdGluZy9leGVjQ29tbWFuZC9mb250LXNpemUtZGVsdGEtc2FtZS1ub2Rl
LWZvci1zdGFydC1hbmQtZW5kLWNyYXNoLWV4cGVjdGVkLnR4dApuZXcgZmlsZSBtb2RlIDEwMDY0
NAppbmRleCAwMDAwMDAwMDAwLi5lZWM1MWRmZTkwCi0tLSAvZGV2L251bGwKKysrIGIvTGF5b3V0
VGVzdHMvcGxhdGZvcm0vaW9zL2VkaXRpbmcvZXhlY0NvbW1hbmQvZm9udC1zaXplLWRlbHRhLXNh
bWUtbm9kZS1mb3Itc3RhcnQtYW5kLWVuZC1jcmFzaC1leHBlY3RlZC50eHQKQEAgLTAsMCArMSwy
IEBACitDT05TT0xFIE1FU1NBR0U6IFRoaXMgdGVzdCBwYXNzZXMgaWYgaXQgZG9lcyBub3QgY3Jh
c2guCivil4/il4/il4/il4/il4/il48KZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL0NoYW5n
ZUxvZyBiL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwppbmRleCBjMzU0OTQwYjFhLi5iNjZjZjc2
YTQ3IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKKysrIGIvU291cmNlL1dl
YkNvcmUvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMjMgQEAKKzIwMjEtMDUtMDMgIEZyw6lkw6lyaWMg
V2FuZyAgPGZ3YW5nQGlnYWxpYS5jb20+CisKKyAgICAgICAgQ3Jhc2ggaW4gQXBwbHlTdHlsZUNv
bW1hbmQ6OmFwcGx5UmVsYXRpdmVGb250U3R5bGVDaGFuZ2UKKyAgICAgICAgaHR0cHM6Ly9idWdz
LndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIyNTIzNQorCisgICAgICAgIFJldmlld2VkIGJ5
IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIFRlc3Q6IGVkaXRpbmcvZXhlY0NvbW1hbmQvZm9u
dC1zaXplLWRlbHRhLXNhbWUtbm9kZS1mb3Itc3RhcnQtYW5kLWVuZC1jcmFzaC5odG1sCisKKyAg
ICAgICAgSW4gQXBwbHlTdHlsZUNvbW1hbmQ6OmFwcGx5UmVsYXRpdmVGb250U3R5bGVDaGFuZ2Us
IHdoZW4gdGhlIHNlbGVjdGlvbiBzdGFydCBhbmQgZW5kIGhhdmUgdGhlCisgICAgICAgIHNhbWUg
YW5jaG9yIG5vZGUsIHRoZSBzdGFydCBub2RlIG9mIHRoZSBsb29wIGlzIG9idGFpbmVkIGJ5IGNh
bGxpbmcgUG9zaXRpb246OnVwc3RyZWFtIG9uIHRoZQorICAgICAgICBzZWxlY3Rpb24gc3RhcnQg
d2hpbGUgZW5kIG5vZGUgb2YgdGhlIGxvb3AgaXMgb2J0YWluZWQgYnkgY2FsbGluZyBOb2RlVHJh
dmVyc2FsOjpuZXh0IG9uIHRoZQorICAgICAgICBhbmNob3Igbm9kZS4gVGhpcyBjYW4gcmVzdWx0
IGluIHRoZSBmb3JtZXIgYmVpbmcgYWZ0ZXIgdGhlIGxhdHRlci4gVGhpcyBwYXRjaCBmaXhlcyB0
aGlzIGJ5CisgICAgICAgIG1vdmluZyB0aGUgZW5kIG9mIHRoZSBsb29wIGFmdGVyIHRoZSBhbmNo
b3Igbm9kZSAoc2ltaWxhciB0byB3aGF0IGlzIGFscmVhZHkgZG9uZSB3aGVuIHRoZQorICAgICAg
ICBzdGFydCBhbmNob3Igbm9kZSBpcyBhIHN0cmljdCBkZXNjZW5kYW50IG9mIHRoZSBlbmQgYW5j
aG9yIG5vZGUpLgorCisgICAgICAgICogZWRpdGluZy9BcHBseVN0eWxlQ29tbWFuZC5jcHA6Cisg
ICAgICAgIChXZWJDb3JlOjpBcHBseVN0eWxlQ29tbWFuZDo6YXBwbHlSZWxhdGl2ZUZvbnRTdHls
ZUNoYW5nZSk6IEFsc28gaW5jbHVkZSB0aGUgY2FzZSB3aGVyZQorICAgICAgICBlbmQuZGVwcmVj
YXRlZE5vZGUoKSA9PSBzdGFydC5kZXByZWNhdGVkTm9kZSgpIGluIHRoZSBjb25kaXRpb25hbC4K
KwogMjAyMS0wNS0wNCAgRGllZ28gUGlubyBHYXJjaWEgIDxkcGlub0BpZ2FsaWEuY29tPgogCiAg
ICAgICAgIFVucmV2aWV3ZWQsIGZpeCBHVEsgYW5kIFdQRSBidWlsZHMgYWZ0ZXIgcjI3Njk0Nwpk
aWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvZWRpdGluZy9BcHBseVN0eWxlQ29tbWFuZC5jcHAg
Yi9Tb3VyY2UvV2ViQ29yZS9lZGl0aW5nL0FwcGx5U3R5bGVDb21tYW5kLmNwcAppbmRleCA0MTI5
OGJhMWJlLi45Mzg0MTU4NzE2IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9lZGl0aW5nL0Fw
cGx5U3R5bGVDb21tYW5kLmNwcAorKysgYi9Tb3VyY2UvV2ViQ29yZS9lZGl0aW5nL0FwcGx5U3R5
bGVDb21tYW5kLmNwcApAQCAtMzQ4LDcgKzM0OCw3IEBAIHZvaWQgQXBwbHlTdHlsZUNvbW1hbmQ6
OmFwcGx5UmVsYXRpdmVGb250U3R5bGVDaGFuZ2UoRWRpdGluZ1N0eWxlKiBzdHlsZSkKICAgICBS
ZWZQdHI8Tm9kZT4gYmV5b25kRW5kOwogICAgIEFTU0VSVChzdGFydC5kZXByZWNhdGVkTm9kZSgp
KTsKICAgICBBU1NFUlQoZW5kLmRlcHJlY2F0ZWROb2RlKCkpOwotICAgIGlmIChzdGFydC5kZXBy
ZWNhdGVkTm9kZSgpLT5pc0Rlc2NlbmRhbnRPZigqZW5kLmRlcHJlY2F0ZWROb2RlKCkpKQorICAg
IGlmIChlbmQuZGVwcmVjYXRlZE5vZGUoKS0+Y29udGFpbnMoKnN0YXJ0LmRlcHJlY2F0ZWROb2Rl
KCkpKQogICAgICAgICBiZXlvbmRFbmQgPSBOb2RlVHJhdmVyc2FsOjpuZXh0U2tpcHBpbmdDaGls
ZHJlbigqZW5kLmRlcHJlY2F0ZWROb2RlKCkpOwogICAgIGVsc2UKICAgICAgICAgYmV5b25kRW5k
ID0gTm9kZVRyYXZlcnNhbDo6bmV4dCgqZW5kLmRlcHJlY2F0ZWROb2RlKCkpOwo=
</data>
<flag name="review"
          id="448328"
          type_id="1"
          status="+"
          setter="rniwa"
    />
          </attachment>
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>427977</attachid>
            <date>2021-05-07 00:51:18 -0700</date>
            <delta_ts>2021-05-07 08:24:00 -0700</delta_ts>
            <desc>Patch for landing</desc>
            <filename>bug225235.patch</filename>
            <type>text/plain</type>
            <size>5052</size>
            <attacher name="Frédéric Wang Nélar">fred.wang</attacher>
            
              <data encoding="base64">ZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL0NoYW5nZUxvZyBiL0xheW91dFRlc3RzL0NoYW5nZUxv
ZwppbmRleCAyMTE2Y2EwNjRiLi4xNjdkNDczYzk0IDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9D
aGFuZ2VMb2cKKysrIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTYgQEAKKzIw
MjEtMDUtMDcgIEZyw6lkw6lyaWMgV2FuZyAgPGZ3YW5nQGlnYWxpYS5jb20+CisKKyAgICAgICAg
Q3Jhc2ggaW4gQXBwbHlTdHlsZUNvbW1hbmQ6OmFwcGx5UmVsYXRpdmVGb250U3R5bGVDaGFuZ2UK
KyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIyNTIzNQor
CisgICAgICAgIFJldmlld2VkIGJ5IFJ5b3N1a2UgTml3YS4KKworICAgICAgICBBZGQgcmVncmVz
c2lvbiB0ZXN0LgorCisgICAgICAgICogZWRpdGluZy9leGVjQ29tbWFuZC9mb250LXNpemUtZGVs
dGEtc2FtZS1ub2RlLWZvci1zdGFydC1hbmQtZW5kLWNyYXNoLWV4cGVjdGVkLnR4dDogQWRkZWQu
CisgICAgICAgICogZWRpdGluZy9leGVjQ29tbWFuZC9mb250LXNpemUtZGVsdGEtc2FtZS1ub2Rl
LWZvci1zdGFydC1hbmQtZW5kLWNyYXNoLmh0bWw6IEFkZGVkLgorICAgICAgICAqIHBsYXRmb3Jt
L2lvcy9lZGl0aW5nL2V4ZWNDb21tYW5kL2ZvbnQtc2l6ZS1kZWx0YS1zYW1lLW5vZGUtZm9yLXN0
YXJ0LWFuZC1lbmQtY3Jhc2gtZXhwZWN0ZWQudHh0OiBBZGRlZC4KKwogMjAyMS0wNS0wNiAgQWxp
Y2lhIEJveWEgR2FyY8OtYSAgPGFib3lhQGlnYWxpYS5jb20+CiAKICAgICAgICAgW0VNRV1bR1N0
cmVhbWVyXSBVbnJldmlld2VkIG1pY3JvLWdhcmRlbmluZwpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVz
dHMvZWRpdGluZy9leGVjQ29tbWFuZC9mb250LXNpemUtZGVsdGEtc2FtZS1ub2RlLWZvci1zdGFy
dC1hbmQtZW5kLWNyYXNoLWV4cGVjdGVkLnR4dCBiL0xheW91dFRlc3RzL2VkaXRpbmcvZXhlY0Nv
bW1hbmQvZm9udC1zaXplLWRlbHRhLXNhbWUtbm9kZS1mb3Itc3RhcnQtYW5kLWVuZC1jcmFzaC1l
eHBlY3RlZC50eHQKbmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMDAwMC4uZTIzNzFh
YjYzMgotLS0gL2Rldi9udWxsCisrKyBiL0xheW91dFRlc3RzL2VkaXRpbmcvZXhlY0NvbW1hbmQv
Zm9udC1zaXplLWRlbHRhLXNhbWUtbm9kZS1mb3Itc3RhcnQtYW5kLWVuZC1jcmFzaC1leHBlY3Rl
ZC50eHQKQEAgLTAsMCArMSwyIEBACitDT05TT0xFIE1FU1NBR0U6IFRoaXMgdGVzdCBwYXNzZXMg
aWYgaXQgZG9lcyBub3QgY3Jhc2guCivigKLigKLigKLigKLigKLigKIKZGlmZiAtLWdpdCBhL0xh
eW91dFRlc3RzL2VkaXRpbmcvZXhlY0NvbW1hbmQvZm9udC1zaXplLWRlbHRhLXNhbWUtbm9kZS1m
b3Itc3RhcnQtYW5kLWVuZC1jcmFzaC5odG1sIGIvTGF5b3V0VGVzdHMvZWRpdGluZy9leGVjQ29t
bWFuZC9mb250LXNpemUtZGVsdGEtc2FtZS1ub2RlLWZvci1zdGFydC1hbmQtZW5kLWNyYXNoLmh0
bWwKbmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMDAwMC4uZGNhMWE1ZDJiNQotLS0g
L2Rldi9udWxsCisrKyBiL0xheW91dFRlc3RzL2VkaXRpbmcvZXhlY0NvbW1hbmQvZm9udC1zaXpl
LWRlbHRhLXNhbWUtbm9kZS1mb3Itc3RhcnQtYW5kLWVuZC1jcmFzaC5odG1sCkBAIC0wLDAgKzEs
MjEgQEAKKzxib2R5IHN0eWxlPSItd2Via2l0LXRleHQtc2VjdXJpdHk6IGRpc2M7Ij4KKyAgPGRp
dj48L2Rpdj5BCisgIDxzY3JpcHQ+PC9zY3JpcHQ+CisgIDxkaXYgaWQ9ImVsZW1lbnQiPjwvZGl2
PgorICA8c2NyaXB0PgorICAgIGlmICh3aW5kb3cudGVzdFJ1bm5lcikKKyAgICAgICAgdGVzdFJ1
bm5lci5kdW1wQXNUZXh0KCkKKyAgICBjb25zb2xlLmxvZygnVGhpcyB0ZXN0IHBhc3NlcyBpZiBp
dCBkb2VzIG5vdCBjcmFzaC4nKTsKKyAgICBkb2N1bWVudC5hZGRFdmVudExpc3RlbmVyKCJET01D
aGFyYWN0ZXJEYXRhTW9kaWZpZWQiLCAoKSA9PiB7CisgICAgICAgIGRvY3VtZW50LmJvZHkuaW5u
ZXJIVE1MID0gIkIiOworICAgIH0pOworICAgIGRvY3VtZW50LmJvZHkucmVtb3ZlQ2hpbGQoZG9j
dW1lbnQuZ2V0RWxlbWVudEJ5SWQoJ2VsZW1lbnQnKSk7CisgICAgZG9jdW1lbnQuZGVzaWduTW9k
ZSA9ICJvbiI7CisgICAgZG9jdW1lbnQuZXhlY0NvbW1hbmQoIlNlbGVjdEFsbCIpOworICAgIGRv
Y3VtZW50LmV4ZWNDb21tYW5kKCJGb250U2l6ZURlbHRhIiwgZmFsc2UsIDMpOworICA8L3Njcmlw
dD4KKyAgPHNjcmlwdD4KKyAgICBkb2N1bWVudC5ib2R5Lmluc2VydEJlZm9yZShkb2N1bWVudC5j
cmVhdGVFbGVtZW50KCJkaXYiKSwgZG9jdW1lbnQuYm9keS5maXJzdENoaWxkKTsKKyAgICBkb2N1
bWVudC5leGVjQ29tbWFuZCgiRm9udFNpemVEZWx0YSIsIGZhbHNlLCAzKTsKKyAgPC9zY3JpcHQ+
Cis8L2JvZHk+CmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9wbGF0Zm9ybS9pb3MvZWRpdGluZy9l
eGVjQ29tbWFuZC9mb250LXNpemUtZGVsdGEtc2FtZS1ub2RlLWZvci1zdGFydC1hbmQtZW5kLWNy
YXNoLWV4cGVjdGVkLnR4dCBiL0xheW91dFRlc3RzL3BsYXRmb3JtL2lvcy9lZGl0aW5nL2V4ZWND
b21tYW5kL2ZvbnQtc2l6ZS1kZWx0YS1zYW1lLW5vZGUtZm9yLXN0YXJ0LWFuZC1lbmQtY3Jhc2gt
ZXhwZWN0ZWQudHh0Cm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAwMDAuLmVlYzUx
ZGZlOTAKLS0tIC9kZXYvbnVsbAorKysgYi9MYXlvdXRUZXN0cy9wbGF0Zm9ybS9pb3MvZWRpdGlu
Zy9leGVjQ29tbWFuZC9mb250LXNpemUtZGVsdGEtc2FtZS1ub2RlLWZvci1zdGFydC1hbmQtZW5k
LWNyYXNoLWV4cGVjdGVkLnR4dApAQCAtMCwwICsxLDIgQEAKK0NPTlNPTEUgTUVTU0FHRTogVGhp
cyB0ZXN0IHBhc3NlcyBpZiBpdCBkb2VzIG5vdCBjcmFzaC4KK+KXj+KXj+KXj+KXj+KXj+KXjwpk
aWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nIGIvU291cmNlL1dlYkNvcmUvQ2hh
bmdlTG9nCmluZGV4IDg4NGUyZTFlZmMuLjUwY2FlOWJlMDYgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9X
ZWJDb3JlL0NoYW5nZUxvZworKysgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKQEAgLTEsMyAr
MSwyMyBAQAorMjAyMS0wNS0wNyAgRnLDqWTDqXJpYyBXYW5nICA8ZndhbmdAaWdhbGlhLmNvbT4K
KworICAgICAgICBDcmFzaCBpbiBBcHBseVN0eWxlQ29tbWFuZDo6YXBwbHlSZWxhdGl2ZUZvbnRT
dHlsZUNoYW5nZQorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/
aWQ9MjI1MjM1CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgUnlvc3VrZSBOaXdhLgorCisgICAgICAg
IFRlc3Q6IGVkaXRpbmcvZXhlY0NvbW1hbmQvZm9udC1zaXplLWRlbHRhLXNhbWUtbm9kZS1mb3It
c3RhcnQtYW5kLWVuZC1jcmFzaC5odG1sCisKKyAgICAgICAgSW4gQXBwbHlTdHlsZUNvbW1hbmQ6
OmFwcGx5UmVsYXRpdmVGb250U3R5bGVDaGFuZ2UsIHdoZW4gdGhlIHNlbGVjdGlvbiBzdGFydCBh
bmQgZW5kIGhhdmUgdGhlCisgICAgICAgIHNhbWUgYW5jaG9yIG5vZGUsIHRoZSBzdGFydCBub2Rl
IG9mIHRoZSBsb29wIGlzIG9idGFpbmVkIGJ5IGNhbGxpbmcgUG9zaXRpb246OnVwc3RyZWFtIG9u
IHRoZQorICAgICAgICBzZWxlY3Rpb24gc3RhcnQgd2hpbGUgZW5kIG5vZGUgb2YgdGhlIGxvb3Ag
aXMgb2J0YWluZWQgYnkgY2FsbGluZyBOb2RlVHJhdmVyc2FsOjpuZXh0IG9uIHRoZQorICAgICAg
ICBhbmNob3Igbm9kZS4gVGhpcyBjYW4gcmVzdWx0IGluIHRoZSBmb3JtZXIgYmVpbmcgYWZ0ZXIg
dGhlIGxhdHRlci4gVGhpcyBwYXRjaCBmaXhlcyB0aGlzIGJ5CisgICAgICAgIG1vdmluZyB0aGUg
ZW5kIG9mIHRoZSBsb29wIGFmdGVyIHRoZSBhbmNob3Igbm9kZSAoc2ltaWxhciB0byB3aGF0IGlz
IGFscmVhZHkgZG9uZSB3aGVuIHRoZQorICAgICAgICBzdGFydCBhbmNob3Igbm9kZSBpcyBhIHN0
cmljdCBkZXNjZW5kYW50IG9mIHRoZSBlbmQgYW5jaG9yIG5vZGUpLgorCisgICAgICAgICogZWRp
dGluZy9BcHBseVN0eWxlQ29tbWFuZC5jcHA6CisgICAgICAgIChXZWJDb3JlOjpBcHBseVN0eWxl
Q29tbWFuZDo6YXBwbHlSZWxhdGl2ZUZvbnRTdHlsZUNoYW5nZSk6IEFsc28gaW5jbHVkZSB0aGUg
Y2FzZSB3aGVyZQorICAgICAgICBlbmQuZGVwcmVjYXRlZE5vZGUoKSA9PSBzdGFydC5kZXByZWNh
dGVkTm9kZSgpIGluIHRoZSBjb25kaXRpb25hbC4KKwogMjAyMS0wNS0wNiAgTWFydGluIFJvYmlu
c29uICA8bXJvYmluc29uQHdlYmtpdC5vcmc+CiAKICAgICAgICAgW2Nzcy1zY3JvbGwtc25hcF0g
Q29tcHV0ZSBwcm94aW1pdHkgaW5mb3JtYXRpb24gd2hpbGUgc25hcHBpbmcKZGlmZiAtLWdpdCBh
L1NvdXJjZS9XZWJDb3JlL2VkaXRpbmcvQXBwbHlTdHlsZUNvbW1hbmQuY3BwIGIvU291cmNlL1dl
YkNvcmUvZWRpdGluZy9BcHBseVN0eWxlQ29tbWFuZC5jcHAKaW5kZXggNDEyOThiYTFiZS4uOTM4
NDE1ODcxNiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvZWRpdGluZy9BcHBseVN0eWxlQ29t
bWFuZC5jcHAKKysrIGIvU291cmNlL1dlYkNvcmUvZWRpdGluZy9BcHBseVN0eWxlQ29tbWFuZC5j
cHAKQEAgLTM0OCw3ICszNDgsNyBAQCB2b2lkIEFwcGx5U3R5bGVDb21tYW5kOjphcHBseVJlbGF0
aXZlRm9udFN0eWxlQ2hhbmdlKEVkaXRpbmdTdHlsZSogc3R5bGUpCiAgICAgUmVmUHRyPE5vZGU+
IGJleW9uZEVuZDsKICAgICBBU1NFUlQoc3RhcnQuZGVwcmVjYXRlZE5vZGUoKSk7CiAgICAgQVNT
RVJUKGVuZC5kZXByZWNhdGVkTm9kZSgpKTsKLSAgICBpZiAoc3RhcnQuZGVwcmVjYXRlZE5vZGUo
KS0+aXNEZXNjZW5kYW50T2YoKmVuZC5kZXByZWNhdGVkTm9kZSgpKSkKKyAgICBpZiAoZW5kLmRl
cHJlY2F0ZWROb2RlKCktPmNvbnRhaW5zKCpzdGFydC5kZXByZWNhdGVkTm9kZSgpKSkKICAgICAg
ICAgYmV5b25kRW5kID0gTm9kZVRyYXZlcnNhbDo6bmV4dFNraXBwaW5nQ2hpbGRyZW4oKmVuZC5k
ZXByZWNhdGVkTm9kZSgpKTsKICAgICBlbHNlCiAgICAgICAgIGJleW9uZEVuZCA9IE5vZGVUcmF2
ZXJzYWw6Om5leHQoKmVuZC5kZXByZWNhdGVkTm9kZSgpKTsK
</data>

          </attachment>
      

    </bug>

</bugzilla>