226870 2021-06-10 03:20:32 -0700 Nullptr crash in positionInParentBeforeNode via InsertTextCommand::doApply 2021-06-16 06:36:31 -0700 1 1 1 Unclassified WebKit HTML Editing WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 rniwa fred.wang bfulgham cgarcia ews-feeder ews-watchlist fred.wang gpoo mifenton product-security rbuis svillar webkit-bug-importer wenson_hsieh oldest_to_newest 1768497 0 431058 rniwa 2021-06-10 03:20:32 -0700 Created attachment 431058 Test e.g. ASSERTION FAILED: ancestor ./dom/Position.cpp(1579) : WebCore::Position WebCore::positionInParentBeforeNode(WebCore::Node *) 1 0x1a999ee59 WTFCrash 2 0x18a8370db WTFCrashWithInfo(int, char const*, char const*, int) 3 0x18db1f9d0 WebCore::positionInParentBeforeNode(WebCore::Node*) 4 0x18dcbd546 WebCore::InsertTextCommand::doApply() 5 0x18dc32d05 WebCore::CompositeEditCommand::applyCommandToComposite(WTF::Ref<WebCore::CompositeEditCommand, WTF::RawPtrTraits<WebCore::CompositeEditCommand> >&&, WebCore::VisibleSelection const&) 6 0x18dcfe7e4 WebCore::TypingCommand::insertTextRunWithoutNewlines(WTF::String const&, bool) 7 0x18dd209da WebCore::TypingCommandLineOperation::operator()(unsigned long, unsigned long, bool) const 8 0x18dcfe6aa void WebCore::forEachLineInString<WebCore::TypingCommandLineOperation>(WTF::String const&, WebCore::TypingCommandLineOperation const&) 9 0x18dcfe5bc WebCore::TypingCommand::insertText(WTF::String const&, bool) 10 0x18dcfd084 WebCore::TypingCommand::insertTextAndNotifyAccessibility(WTF::String const&, bool) 11 0x18dcfdc32 WebCore::TypingCommand::doApply() 12 0x18dc1e12c WebCore::CompositeEditCommand::apply() 13 0x18dceac43 WebCore::TextInsertionBaseCommand::applyTextInsertionCommand(WebCore::Frame*, WebCore::TextInsertionBaseCommand&, WebCore::VisibleSelection const&, WebCore::VisibleSelection const&) 14 0x18dcfcf77 WebCore::TypingCommand::insertText(WebCore::Document&, WTF::String const&, WebCore::VisibleSelection const&, unsigned int, WebCore::TypingCommand::TextCompositionType) 15 0x18dcfccf3 WebCore::TypingCommand::insertText(WebCore::Document&, WTF::String const&, unsigned int, WebCore::TypingCommand::TextCompositionType) 16 0x18dca4e44 WebCore::executeInsertText(WebCore::Frame&, WebCore::Event*, WebCore::EditorCommandSource, WTF::String const&) 17 0x18dc7cfbb WebCore::Editor::Command::execute(WTF::String const&, WebCore::Event*) const 18 0x18d985e45 WebCore::Document::execCommand(WTF::String const&, bool, WTF::String const&) 19 0x18b242004 WebCore::jsDocumentPrototypeFunction_execCommandBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSDocument*) 20 0x18b24196c long long WebCore::IDLOperation<WebCore::JSDocument>::call<&(WebCore::jsDocumentPrototypeFunction_execCommandBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSDocument*)), (WebCore::CastedThisErrorBehavior)0>(JSC::JSGlobalObject&, JSC::CallFrame&, char const*) 21 0x18b22a524 WebCore::jsDocumentPrototypeFunction_execCommand(JSC::JSGlobalObject*, JSC::CallFrame*) 22 0x26d010e011d8 23 0x1a9fa671a llint_entry 24 0x1a9f84440 vmEntryToJavaScript 25 0x1aaea8d4b JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) 26 0x1aaea94ac JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) 27 0x1ab2774ad JSC::call(JSC::JSGlobalObject*, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) 28 0x1ab27758f JSC::call(JSC::JSGlobalObject*, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) 29 0x1ab277872 JSC::profiledCall(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) 30 0x18d306fee WebCore::JSExecState::profiledCall(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) 31 0x18d326fdb WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext&, WebCore::Event&) <>ASSERTION FAILED: ancestor ./dom/Position.cpp(1579) : WebCore::Position WebCore::positionInParentBeforeNode(WebCore::Node *) 1 0x1a999ee59 WTFCrash 2 0x18a8370db WTFCrashWithInfo(int, char const*, char const*, int) 3 0x18db1f9d0 WebCore::positionInParentBeforeNode(WebCore::Node*) 4 0x18dcbd546 WebCore::InsertTextCommand::doApply() 5 0x18dc32d05 WebCore::CompositeEditCommand::applyCommandToComposite(WTF::Ref<WebCore::CompositeEditCommand, WTF::RawPtrTraits<WebCore::CompositeEditCommand> >&&, WebCore::VisibleSelection const&) 6 0x18dcfe7e4 WebCore::TypingCommand::insertTextRunWithoutNewlines(WTF::String const&, bool) 7 0x18dd209da WebCore::TypingCommandLineOperation::operator()(unsigned long, unsigned long, bool) const 8 0x18dcfe6aa void WebCore::forEachLineInString<WebCore::TypingCommandLineOperation>(WTF::String const&, WebCore::TypingCommandLineOperation const&) 9 0x18dcfe5bc WebCore::TypingCommand::insertText(WTF::String const&, bool) 10 0x18dcfd084 WebCore::TypingCommand::insertTextAndNotifyAccessibility(WTF::String const&, bool) 11 0x18dcfdc32 WebCore::TypingCommand::doApply() 12 0x18dc1e12c WebCore::CompositeEditCommand::apply() 13 0x18dceac43 WebCore::TextInsertionBaseCommand::applyTextInsertionCommand(WebCore::Frame*, WebCore::TextInsertionBaseCommand&, WebCore::VisibleSelection const&, WebCore::VisibleSelection const&) 14 0x18dcfcf77 WebCore::TypingCommand::insertText(WebCore::Document&, WTF::String const&, WebCore::VisibleSelection const&, unsigned int, WebCore::TypingCommand::TextCompositionType) 15 0x18dcfccf3 WebCore::TypingCommand::insertText(WebCore::Document&, WTF::String const&, unsigned int, WebCore::TypingCommand::TextCompositionType) 16 0x18dca4e44 WebCore::executeInsertText(WebCore::Frame&, WebCore::Event*, WebCore::EditorCommandSource, WTF::String const&) 17 0x18dc7cfbb WebCore::Editor::Command::execute(WTF::String const&, WebCore::Event*) const 18 0x18d985e45 WebCore::Document::execCommand(WTF::String const&, bool, WTF::String const&) 19 0x18b242004 WebCore::jsDocumentPrototypeFunction_execCommandBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSDocument*) 20 0x18b24196c long long WebCore::IDLOperation<WebCore::JSDocument>::call<&(WebCore::jsDocumentPrototypeFunction_execCommandBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSDocument*)), (WebCore::CastedThisErrorBehavior)0>(JSC::JSGlobalObject&, JSC::CallFrame&, char const*) 21 0x18b22a524 WebCore::jsDocumentPrototypeFunction_execCommand(JSC::JSGlobalObject*, JSC::CallFrame*) 22 0x26d010e011d8 23 0x1a9fa671a llint_entry 24 0x1a9f84440 vmEntryToJavaScript 25 0x1aaea8d4b JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) 26 0x1aaea94ac JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) 27 0x1ab2774ad JSC::call(JSC::JSGlobalObject*, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) 28 0x1ab27758f JSC::call(JSC::JSGlobalObject*, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) 29 0x1ab277872 JSC::profiledCall(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) 30 0x18d306fee WebCore::JSExecState::profiledCall(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) 31 0x18d326fdb WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext&, WebCore::Event&) <rdar://78607686> 1768498 1 rniwa 2021-06-10 03:21:10 -0700 Reproduced with debug build of WebKitTestRunner at r278627. 1769789 2 431435 fred.wang 2021-06-15 07:23:25 -0700 Created attachment 431435 Patch From a quick debugging, the <summary> element is detached from the tree in the testcase. Here is a tentative patch that fixes the assert. 1769961 3 431435 rniwa 2021-06-15 14:23:10 -0700 Comment on attachment 431435 Patch Please add the test for this. Also, the actual selection isn't orphaned here, is it? 1770073 4 fred.wang 2021-06-15 21:27:33 -0700 (In reply to Ryosuke Niwa from comment #3) > Please add the test for this. Will do. > Also, the actual selection isn't orphaned here, is it? I guess you mean endingSelection().isOrphan()? Yes, it became orphan here too (see reverse debugging below). Do you mean we should rely on that method instead? (rr) bt #0 0x00007feb1ace29f7 in CRASH_WITH_INFO(...) () at WTF/Headers/wtf/Assertions.h:744 #1 0x00007feb2162f5b7 in WebCore::positionInParentBeforeNode(WebCore::Node*) (node=0x60c0002a7fc0) at ../../Source/WebCore/dom/Position.cpp:1579 #2 0x00007feb218d622b in WebCore::InsertTextCommand::doApply() (this= 0x61200006f340) at ../../Source/WebCore/editing/InsertTextCommand.cpp:177 ... (rr) reverse-f (rr) p showTree(node) *SUMMARY 0x60c0002a7fc0 (renderer (nil)) #document-fragment 0x61200007e940 (renderer (nil)) (needs style recalc) (child needs style recalc) DIV 0x60c0002a8080 (renderer (nil)) SLOT 0x60d000065fc0 (renderer (nil)) BODY 0x60c0002a82c0 (renderer (nil)) Q 0x60c0002a8380 (renderer (nil)) $1 = void (rr) watch -l node->m_parentNode (rr) rc (rr) delete (rr) reverse-f (rr) bt #0 0x00007feb2128da05 in WebCore::ContainerNode::removeBetween(WebCore::Node*, WebCore::Node*, WebCore::Node&) (this=0x60c0002a6a00, previousChild=0x0, nextChild=0x0, oldChild=...) at ../../Source/WebCore/dom/ContainerNode.cpp:655 #1 0x00007feb2129b9a2 in WebCore::ContainerNode::removeNodeWithScriptAssertion(WebCore::Node&, WebCore::ContainerNode::ChildChange::Source) (this=0x60c0002a6a00, childToRemove=..., source=WebCore::ContainerNode::ChildChange::Source::API) at ../../Source/WebCore/dom/ContainerNode.cpp:181 #2 0x00007feb2128d355 in WebCore::ContainerNode::removeChild(WebCore::Node&) (this=0x60c0002a6a00, oldChild=...) at ../../Source/WebCore/dom/ContainerNode.cpp:614 ... #15 0x00007feb218d5f30 in WebCore::InsertTextCommand::doApply() (this=0x61200006f340) at ../../Source/WebCore/editing/InsertTextCommand.cpp:143 ... (rr) b Source/WebCore/editing/InsertTextCommand.cpp:143 Breakpoint 2 at 0x7feb218d5f06: file ../../Source/WebCore/editing/InsertTextCommand.cpp, line 143. (rr) rc Continuing. 143 deleteSelection(false, true, true, false, false); (rr) p endingSelection().isNoneOrOrphaned() $2 = false (rr) p endingSelection().isOrphan() $3 = false (rr) p endingSelection().start().isOrphan() $4 = false (rr) p endingSelection().end().isOrphan() $5 = false (rr) n 147 if (endingSelection().isNone()) (rr) p endingSelection().isNoneOrOrphaned() $6 = true (rr) p endingSelection().isOrphan() $7 = true (rr) p endingSelection().start().isOrphan() $8 = true (rr) p endingSelection().end().isOrphan() $9 = true 1770074 5 rniwa 2021-06-15 21:31:26 -0700 no, I mean FrameSelection 1770077 6 fred.wang 2021-06-15 22:04:47 -0700 (In reply to Ryosuke Niwa from comment #5) > no, I mean FrameSelection OK, yes after deleteSelection, endingSelection().isOrphan() is true but document().selection().selection().isOrphan() is false. 1770079 7 431515 fred.wang 2021-06-15 22:16:23 -0700 Created attachment 431515 Patch 1770086 8 rniwa 2021-06-15 22:43:11 -0700 (In reply to Frédéric Wang (:fredw) from comment #6) > (In reply to Ryosuke Niwa from comment #5) > > no, I mean FrameSelection > > OK, yes after deleteSelection, endingSelection().isOrphan() is true but > document().selection().selection().isOrphan() is false. Cool. 1770087 9 431515 rniwa 2021-06-15 22:44:18 -0700 Comment on attachment 431515 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=431515&action=review > LayoutTests/ChangeLog:6 > + Add regression test. This should appear after "reviewed by" line. > Source/WebCore/ChangeLog:7 > + deleteSelection call In InsertTextCommand::doApply() can make the endingSelection() orphan. > + If that happens, exit early to avoid dereferencing a nullptr pointer later. This long description should appear below "reviewed by" line while the bug title & URL should continue to appear above it. 1770090 10 431515 fred.wang 2021-06-15 22:58:45 -0700 Comment on attachment 431515 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=431515&action=review >> LayoutTests/ChangeLog:6 >> + Add regression test. > > This should appear after "reviewed by" line. Oops, I thought about it but got confused with the 'Test:' thing that is put after... Will fix. 1770091 11 431521 fred.wang 2021-06-15 23:05:44 -0700 Created attachment 431521 Patch 1770167 12 ews-feeder 2021-06-16 06:36:28 -0700 Committed r278930 (238861@main): <https://commits.webkit.org/238861@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 431521. 431058 2021-06-10 03:20:32 -0700 2021-06-10 03:20:32 -0700 Test repro_657.html text/html 378 rniwa PCFET0NUWVBFIGh0bWw+CjxzY3JpcHQ+CiAgb25sb2FkID0gKCkgPT4gewogICAgbGV0IHN1bW1h cnkwID0gZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgnc3VtbWFyeScpOwogICAgZG9jdW1lbnQuYm9k eS5hcHBlbmRDaGlsZChzdW1tYXJ5MCk7CiAgICBzdW1tYXJ5MC5hcHBlbmRDaGlsZChkb2N1bWVu dC5jcmVhdGVFbGVtZW50KCdib2R5JykpOwogICAgc3VtbWFyeTAuYXBwZW5kQ2hpbGQoZG9jdW1l bnQuY3JlYXRlRWxlbWVudCgncScpKTsKICAgIGRvY3VtZW50LmRlc2lnbk1vZGUgPSAnb24nOwog ICAgZG9jdW1lbnQuZXhlY0NvbW1hbmQoJ1NlbGVjdEFsbCcpOwogICAgZG9jdW1lbnQuZXhlY0Nv bW1hbmQoJ0luc2VydFRleHQnKTsKICB9Owo8L3NjcmlwdD4K 431435 2021-06-15 07:23:25 -0700 2021-06-15 22:16:23 -0700 Patch 226870.patch text/plain 881 fred.wang ZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL2VkaXRpbmcvSW5zZXJ0VGV4dENvbW1hbmQuY3Bw IGIvU291cmNlL1dlYkNvcmUvZWRpdGluZy9JbnNlcnRUZXh0Q29tbWFuZC5jcHAKaW5kZXggNmRi NWJiMDFiYi4uNjFhNzdmNTEwZiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvZWRpdGluZy9J bnNlcnRUZXh0Q29tbWFuZC5jcHAKKysrIGIvU291cmNlL1dlYkNvcmUvZWRpdGluZy9JbnNlcnRU ZXh0Q29tbWFuZC5jcHAKQEAgLTE0NCw3ICsxNDQsNyBAQCB2b2lkIEluc2VydFRleHRDb21tYW5k Ojpkb0FwcGx5KCkKICAgICAgICAgLy8gZGVsZXRlU2VsZWN0aW9uIGV2ZW50dWFsbHkgbWFrZXMg YSBuZXcgZW5kaW5nU2VsZWN0aW9uIG91dCBvZiBhIFBvc2l0aW9uLiBJZiB0aGF0IFBvc2l0aW9u IGRvZXNuJ3QgaGF2ZQogICAgICAgICAvLyBhIHJlbmRlcmVyIChlLmcuIGl0IGlzIG9uIGEgPGZy YW1lc2V0PiBpbiB0aGUgRE9NKSwgdGhlIFZpc2libGVTZWxlY3Rpb24gY2Fubm90IGJlIGNhbm9u aWNhbGl6ZWQgdG8gCiAgICAgICAgIC8vIGFueXRoaW5nIG90aGVyIHRoYW4gTm9TZWxlY3Rpb24u IFRoZSByZXN0IG9mIHRoaXMgZnVuY3Rpb24gcmVxdWlyZXMgYSByZWFsIGVuZGluZ1NlbGVjdGlv biwgc28gYmFpbCBvdXQuCi0gICAgICAgIGlmIChlbmRpbmdTZWxlY3Rpb24oKS5pc05vbmUoKSkK KyAgICAgICAgaWYgKGVuZGluZ1NlbGVjdGlvbigpLmlzTm9uZU9yT3JwaGFuZWQoKSkKICAgICAg ICAgICAgIHJldHVybjsKICAgICB9IGVsc2UgaWYgKGRvY3VtZW50KCkuZWRpdG9yKCkuaXNPdmVy d3JpdGVNb2RlRW5hYmxlZCgpKSB7CiAgICAgICAgIGlmIChwZXJmb3JtT3ZlcndyaXRlKG1fdGV4 dCwgbV9zZWxlY3RJbnNlcnRlZFRleHQpKQo= 431515 2021-06-15 22:16:23 -0700 2021-06-15 23:05:44 -0700 Patch 0001-Bug-226870-Nullptr-crash-in-positionInParentBeforeNo.patch text/plain 4482 fred.wang RnJvbSA1NDA3MmJjMWQ1ZmEyNzVhNzhkMGU3YjQ1N2MwZjFkODhmMjdmMWZmIE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiA9P1VURi04P3E/RnI9QzM9QTlkPUMzPUE5cmljPTIwV2FuZz89 IDxmd2FuZ0BpZ2FsaWEuY29tPgpEYXRlOiBXZWQsIDE2IEp1biAyMDIxIDA3OjE1OjI2ICswMjAw ClN1YmplY3Q6IFtQQVRDSF0gQnVnIDIyNjg3MCAtIE51bGxwdHIgY3Jhc2ggaW4gcG9zaXRpb25J blBhcmVudEJlZm9yZU5vZGUgdmlhCiBJbnNlcnRUZXh0Q29tbWFuZDo6ZG9BcHBseQoKLS0tCiBM YXlvdXRUZXN0cy9DaGFuZ2VMb2cgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHwgMTIgKysr KysrKysrKysrCiAuLi5uc2VydC10ZXh0LW9ycGhhbmVkLXN1bW1hcnktY3Jhc2gtZXhwZWN0ZWQu dHh0IHwgIDIgKysKIC4uLi9pbnNlcnQtdGV4dC1vcnBoYW5lZC1zdW1tYXJ5LWNyYXNoLmh0bWwg ICAgICAgfCAxNSArKysrKysrKysrKysrKysKIFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZyAgICAg ICAgICAgICAgICAgICAgICAgICAgfCAxNSArKysrKysrKysrKysrKysKIFNvdXJjZS9XZWJDb3Jl L2VkaXRpbmcvSW5zZXJ0VGV4dENvbW1hbmQuY3BwICAgICAgfCAgMiArLQogNSBmaWxlcyBjaGFu Z2VkLCA0NSBpbnNlcnRpb25zKCspLCAxIGRlbGV0aW9uKC0pCiBjcmVhdGUgbW9kZSAxMDA2NDQg TGF5b3V0VGVzdHMvZmFzdC9lZGl0aW5nL2luc2VydC10ZXh0LW9ycGhhbmVkLXN1bW1hcnktY3Jh c2gtZXhwZWN0ZWQudHh0CiBjcmVhdGUgbW9kZSAxMDA2NDQgTGF5b3V0VGVzdHMvZmFzdC9lZGl0 aW5nL2luc2VydC10ZXh0LW9ycGhhbmVkLXN1bW1hcnktY3Jhc2guaHRtbAoKZGlmZiAtLWdpdCBh L0xheW91dFRlc3RzL0NoYW5nZUxvZyBiL0xheW91dFRlc3RzL0NoYW5nZUxvZwppbmRleCAyNTY3 MmNhMTUzLi40MjAxMjBiZjg5IDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKKysr IGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTUgQEAKKzIwMjEtMDYtMTUgIEZy ZWRlcmljIFdhbmcgIDxmd2FuZ0BpZ2FsaWEuY29tPgorCisgICAgICAgIE51bGxwdHIgY3Jhc2gg aW4gcG9zaXRpb25JblBhcmVudEJlZm9yZU5vZGUgdmlhIEluc2VydFRleHRDb21tYW5kOjpkb0Fw cGx5CisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0yMjY4 NzAKKworICAgICAgICBBZGQgcmVncmVzc2lvbiB0ZXN0LgorCisgICAgICAgIFJldmlld2VkIGJ5 IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgICogZmFzdC9lZGl0aW5nL2luc2VydC10ZXh0LW9y cGhhbmVkLXN1bW1hcnktY3Jhc2gtZXhwZWN0ZWQudHh0OiBBZGRlZC4KKyAgICAgICAgKiBmYXN0 L2VkaXRpbmcvaW5zZXJ0LXRleHQtb3JwaGFuZWQtc3VtbWFyeS1jcmFzaC5odG1sOiBBZGRlZC4K KwogMjAyMS0wNi0xMyAgRnVqaWkgSGlyb25vcmkgIDxIaXJvbm9yaS5GdWppaUBzb255LmNvbT4K IAogICAgICAgICBbV2luQ2Fpcm9dIFVucmV2aWV3ZWQgdGVzdCBnYXJkZW5pbmcKZGlmZiAtLWdp dCBhL0xheW91dFRlc3RzL2Zhc3QvZWRpdGluZy9pbnNlcnQtdGV4dC1vcnBoYW5lZC1zdW1tYXJ5 LWNyYXNoLWV4cGVjdGVkLnR4dCBiL0xheW91dFRlc3RzL2Zhc3QvZWRpdGluZy9pbnNlcnQtdGV4 dC1vcnBoYW5lZC1zdW1tYXJ5LWNyYXNoLWV4cGVjdGVkLnR4dApuZXcgZmlsZSBtb2RlIDEwMDY0 NAppbmRleCAwMDAwMDAwMDAwLi5hYTI1ZDgyNGY3Ci0tLSAvZGV2L251bGwKKysrIGIvTGF5b3V0 VGVzdHMvZmFzdC9lZGl0aW5nL2luc2VydC10ZXh0LW9ycGhhbmVkLXN1bW1hcnktY3Jhc2gtZXhw ZWN0ZWQudHh0CkBAIC0wLDAgKzEsMiBAQAorQ09OU09MRSBNRVNTQUdFOiBUaGUgdGVzdCBQQVNT IGlmIGl0IGRvZXMgbm90IGNyYXNoLgorCmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9mYXN0L2Vk aXRpbmcvaW5zZXJ0LXRleHQtb3JwaGFuZWQtc3VtbWFyeS1jcmFzaC5odG1sIGIvTGF5b3V0VGVz dHMvZmFzdC9lZGl0aW5nL2luc2VydC10ZXh0LW9ycGhhbmVkLXN1bW1hcnktY3Jhc2guaHRtbApu ZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwMDAwLi5hYWYwMDg5ODhiCi0tLSAvZGV2 L251bGwKKysrIGIvTGF5b3V0VGVzdHMvZmFzdC9lZGl0aW5nL2luc2VydC10ZXh0LW9ycGhhbmVk LXN1bW1hcnktY3Jhc2guaHRtbApAQCAtMCwwICsxLDE1IEBACis8IURPQ1RZUEUgaHRtbD4KKzxz Y3JpcHQ+CisgIGlmICh3aW5kb3cudGVzdFJ1bm5lcikKKyAgICB0ZXN0UnVubmVyLmR1bXBBc1Rl eHQoKTsKKyAgY29uc29sZS5sb2coJ1RoZSB0ZXN0IFBBU1MgaWYgaXQgZG9lcyBub3QgY3Jhc2gu JykKKyAgb25sb2FkID0gKCkgPT4geworICAgIGxldCBzdW1tYXJ5MCA9IGRvY3VtZW50LmNyZWF0 ZUVsZW1lbnQoJ3N1bW1hcnknKTsKKyAgICBkb2N1bWVudC5ib2R5LmFwcGVuZENoaWxkKHN1bW1h cnkwKTsKKyAgICBzdW1tYXJ5MC5hcHBlbmRDaGlsZChkb2N1bWVudC5jcmVhdGVFbGVtZW50KCdi b2R5JykpOworICAgIHN1bW1hcnkwLmFwcGVuZENoaWxkKGRvY3VtZW50LmNyZWF0ZUVsZW1lbnQo J3EnKSk7CisgICAgZG9jdW1lbnQuZGVzaWduTW9kZSA9ICdvbic7CisgICAgZG9jdW1lbnQuZXhl Y0NvbW1hbmQoJ1NlbGVjdEFsbCcpOworICAgIGRvY3VtZW50LmV4ZWNDb21tYW5kKCdJbnNlcnRU ZXh0Jyk7CisgIH07Cis8L3NjcmlwdD4KZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZyBiL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwppbmRleCAzNThjYTIzMGYyLi5lNDhkOTYx MmYyIDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKKysrIGIvU291cmNlL1dl YkNvcmUvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTggQEAKKzIwMjEtMDYtMTUgIEZyZWRlcmljIFdh bmcgIDxmd2FuZ0BpZ2FsaWEuY29tPgorCisgICAgICAgIE51bGxwdHIgY3Jhc2ggaW4gcG9zaXRp b25JblBhcmVudEJlZm9yZU5vZGUgdmlhIEluc2VydFRleHRDb21tYW5kOjpkb0FwcGx5CisgICAg ICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0yMjY4NzAKKworICAg ICAgICBkZWxldGVTZWxlY3Rpb24gY2FsbCBJbiBJbnNlcnRUZXh0Q29tbWFuZDo6ZG9BcHBseSgp IGNhbiBtYWtlIHRoZSBlbmRpbmdTZWxlY3Rpb24oKSBvcnBoYW4uCisgICAgICAgIElmIHRoYXQg aGFwcGVucywgZXhpdCBlYXJseSB0byBhdm9pZCBkZXJlZmVyZW5jaW5nIGEgbnVsbHB0ciBwb2lu dGVyIGxhdGVyLgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAg ICAgIFRlc3Q6IGZhc3QvZWRpdGluZy9pbnNlcnQtdGV4dC1vcnBoYW5lZC1zdW1tYXJ5LWNyYXNo Lmh0bWwKKworICAgICAgICAqIGVkaXRpbmcvSW5zZXJ0VGV4dENvbW1hbmQuY3BwOgorICAgICAg ICAoV2ViQ29yZTo6SW5zZXJ0VGV4dENvbW1hbmQ6OmRvQXBwbHkpOgorCiAyMDIxLTA2LTEzICBD aHJpcyBEdW1leiAgPGNkdW1lekBhcHBsZS5jb20+CiAKICAgICAgICAgUmVsYXggInBhcmVudCBt dXN0IGJlIGFuIEhUTUxFbGVtZW50IiByZXN0cmljdGlvbiBpbiBvdXRlckhUTUwgc2V0dGVyCmRp ZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9lZGl0aW5nL0luc2VydFRleHRDb21tYW5kLmNwcCBi L1NvdXJjZS9XZWJDb3JlL2VkaXRpbmcvSW5zZXJ0VGV4dENvbW1hbmQuY3BwCmluZGV4IDZkYjVi YjAxYmIuLjYxYTc3ZjUxMGYgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL2VkaXRpbmcvSW5z ZXJ0VGV4dENvbW1hbmQuY3BwCisrKyBiL1NvdXJjZS9XZWJDb3JlL2VkaXRpbmcvSW5zZXJ0VGV4 dENvbW1hbmQuY3BwCkBAIC0xNDQsNyArMTQ0LDcgQEAgdm9pZCBJbnNlcnRUZXh0Q29tbWFuZDo6 ZG9BcHBseSgpCiAgICAgICAgIC8vIGRlbGV0ZVNlbGVjdGlvbiBldmVudHVhbGx5IG1ha2VzIGEg bmV3IGVuZGluZ1NlbGVjdGlvbiBvdXQgb2YgYSBQb3NpdGlvbi4gSWYgdGhhdCBQb3NpdGlvbiBk b2Vzbid0IGhhdmUKICAgICAgICAgLy8gYSByZW5kZXJlciAoZS5nLiBpdCBpcyBvbiBhIDxmcmFt ZXNldD4gaW4gdGhlIERPTSksIHRoZSBWaXNpYmxlU2VsZWN0aW9uIGNhbm5vdCBiZSBjYW5vbmlj YWxpemVkIHRvIAogICAgICAgICAvLyBhbnl0aGluZyBvdGhlciB0aGFuIE5vU2VsZWN0aW9uLiBU aGUgcmVzdCBvZiB0aGlzIGZ1bmN0aW9uIHJlcXVpcmVzIGEgcmVhbCBlbmRpbmdTZWxlY3Rpb24s IHNvIGJhaWwgb3V0LgotICAgICAgICBpZiAoZW5kaW5nU2VsZWN0aW9uKCkuaXNOb25lKCkpCisg ICAgICAgIGlmIChlbmRpbmdTZWxlY3Rpb24oKS5pc05vbmVPck9ycGhhbmVkKCkpCiAgICAgICAg ICAgICByZXR1cm47CiAgICAgfSBlbHNlIGlmIChkb2N1bWVudCgpLmVkaXRvcigpLmlzT3Zlcndy aXRlTW9kZUVuYWJsZWQoKSkgewogICAgICAgICBpZiAocGVyZm9ybU92ZXJ3cml0ZShtX3RleHQs IG1fc2VsZWN0SW5zZXJ0ZWRUZXh0KSkKLS0gCjIuMjUuMQoK 431521 2021-06-15 23:05:44 -0700 2021-06-16 06:36:30 -0700 Patch 0001-Bug-226870-Nullptr-crash-in-positionInParentBeforeNo.patch text/plain 4475 fred.wang RnJvbSAzMzI5YWYyZjE3MTdiNzE4NGNlMTBhZTk4NzAzODc5OGE2MzNiMTY1IE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiA9P1VURi04P3E/RnI9QzM9QTlkPUMzPUE5cmljPTIwV2FuZz89 IDxmd2FuZ0BpZ2FsaWEuY29tPgpEYXRlOiBXZWQsIDE2IEp1biAyMDIxIDA3OjE1OjI2ICswMjAw ClN1YmplY3Q6IFtQQVRDSF0gQnVnIDIyNjg3MCAtIE51bGxwdHIgY3Jhc2ggaW4gcG9zaXRpb25J blBhcmVudEJlZm9yZU5vZGUgdmlhCiBJbnNlcnRUZXh0Q29tbWFuZDo6ZG9BcHBseQoKLS0tCiBM YXlvdXRUZXN0cy9DaGFuZ2VMb2cgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHwgMTIgKysr KysrKysrKysrCiAuLi5uc2VydC10ZXh0LW9ycGhhbmVkLXN1bW1hcnktY3Jhc2gtZXhwZWN0ZWQu dHh0IHwgIDIgKysKIC4uLi9pbnNlcnQtdGV4dC1vcnBoYW5lZC1zdW1tYXJ5LWNyYXNoLmh0bWwg ICAgICAgfCAxNSArKysrKysrKysrKysrKysKIFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZyAgICAg ICAgICAgICAgICAgICAgICAgICAgfCAxNCArKysrKysrKysrKysrKwogU291cmNlL1dlYkNvcmUv ZWRpdGluZy9JbnNlcnRUZXh0Q29tbWFuZC5jcHAgICAgICB8ICAyICstCiA1IGZpbGVzIGNoYW5n ZWQsIDQ0IGluc2VydGlvbnMoKyksIDEgZGVsZXRpb24oLSkKIGNyZWF0ZSBtb2RlIDEwMDY0NCBM YXlvdXRUZXN0cy9mYXN0L2VkaXRpbmcvaW5zZXJ0LXRleHQtb3JwaGFuZWQtc3VtbWFyeS1jcmFz aC1leHBlY3RlZC50eHQKIGNyZWF0ZSBtb2RlIDEwMDY0NCBMYXlvdXRUZXN0cy9mYXN0L2VkaXRp bmcvaW5zZXJ0LXRleHQtb3JwaGFuZWQtc3VtbWFyeS1jcmFzaC5odG1sCgpkaWZmIC0tZ2l0IGEv TGF5b3V0VGVzdHMvQ2hhbmdlTG9nIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCmluZGV4IDI1Njcy Y2ExNTMuLjgwNjA3ODRjYjYgMTAwNjQ0Ci0tLSBhL0xheW91dFRlc3RzL0NoYW5nZUxvZworKysg Yi9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKQEAgLTEsMyArMSwxNSBAQAorMjAyMS0wNi0xNSAgRnJl ZGVyaWMgV2FuZyAgPGZ3YW5nQGlnYWxpYS5jb20+CisKKyAgICAgICAgTnVsbHB0ciBjcmFzaCBp biBwb3NpdGlvbkluUGFyZW50QmVmb3JlTm9kZSB2aWEgSW5zZXJ0VGV4dENvbW1hbmQ6OmRvQXBw bHkKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIyNjg3 MAorCisgICAgICAgIFJldmlld2VkIGJ5IFJ5b3N1a2UgTml3YS4KKworICAgICAgICBBZGQgcmVn cmVzc2lvbiB0ZXN0LgorCisgICAgICAgICogZmFzdC9lZGl0aW5nL2luc2VydC10ZXh0LW9ycGhh bmVkLXN1bW1hcnktY3Jhc2gtZXhwZWN0ZWQudHh0OiBBZGRlZC4KKyAgICAgICAgKiBmYXN0L2Vk aXRpbmcvaW5zZXJ0LXRleHQtb3JwaGFuZWQtc3VtbWFyeS1jcmFzaC5odG1sOiBBZGRlZC4KKwog MjAyMS0wNi0xMyAgRnVqaWkgSGlyb25vcmkgIDxIaXJvbm9yaS5GdWppaUBzb255LmNvbT4KIAog ICAgICAgICBbV2luQ2Fpcm9dIFVucmV2aWV3ZWQgdGVzdCBnYXJkZW5pbmcKZGlmZiAtLWdpdCBh L0xheW91dFRlc3RzL2Zhc3QvZWRpdGluZy9pbnNlcnQtdGV4dC1vcnBoYW5lZC1zdW1tYXJ5LWNy YXNoLWV4cGVjdGVkLnR4dCBiL0xheW91dFRlc3RzL2Zhc3QvZWRpdGluZy9pbnNlcnQtdGV4dC1v cnBoYW5lZC1zdW1tYXJ5LWNyYXNoLWV4cGVjdGVkLnR4dApuZXcgZmlsZSBtb2RlIDEwMDY0NApp bmRleCAwMDAwMDAwMDAwLi5hYTI1ZDgyNGY3Ci0tLSAvZGV2L251bGwKKysrIGIvTGF5b3V0VGVz dHMvZmFzdC9lZGl0aW5nL2luc2VydC10ZXh0LW9ycGhhbmVkLXN1bW1hcnktY3Jhc2gtZXhwZWN0 ZWQudHh0CkBAIC0wLDAgKzEsMiBAQAorQ09OU09MRSBNRVNTQUdFOiBUaGUgdGVzdCBQQVNTIGlm IGl0IGRvZXMgbm90IGNyYXNoLgorCmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9mYXN0L2VkaXRp bmcvaW5zZXJ0LXRleHQtb3JwaGFuZWQtc3VtbWFyeS1jcmFzaC5odG1sIGIvTGF5b3V0VGVzdHMv ZmFzdC9lZGl0aW5nL2luc2VydC10ZXh0LW9ycGhhbmVkLXN1bW1hcnktY3Jhc2guaHRtbApuZXcg ZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwMDAwLi5hYWYwMDg5ODhiCi0tLSAvZGV2L251 bGwKKysrIGIvTGF5b3V0VGVzdHMvZmFzdC9lZGl0aW5nL2luc2VydC10ZXh0LW9ycGhhbmVkLXN1 bW1hcnktY3Jhc2guaHRtbApAQCAtMCwwICsxLDE1IEBACis8IURPQ1RZUEUgaHRtbD4KKzxzY3Jp cHQ+CisgIGlmICh3aW5kb3cudGVzdFJ1bm5lcikKKyAgICB0ZXN0UnVubmVyLmR1bXBBc1RleHQo KTsKKyAgY29uc29sZS5sb2coJ1RoZSB0ZXN0IFBBU1MgaWYgaXQgZG9lcyBub3QgY3Jhc2guJykK KyAgb25sb2FkID0gKCkgPT4geworICAgIGxldCBzdW1tYXJ5MCA9IGRvY3VtZW50LmNyZWF0ZUVs ZW1lbnQoJ3N1bW1hcnknKTsKKyAgICBkb2N1bWVudC5ib2R5LmFwcGVuZENoaWxkKHN1bW1hcnkw KTsKKyAgICBzdW1tYXJ5MC5hcHBlbmRDaGlsZChkb2N1bWVudC5jcmVhdGVFbGVtZW50KCdib2R5 JykpOworICAgIHN1bW1hcnkwLmFwcGVuZENoaWxkKGRvY3VtZW50LmNyZWF0ZUVsZW1lbnQoJ3En KSk7CisgICAgZG9jdW1lbnQuZGVzaWduTW9kZSA9ICdvbic7CisgICAgZG9jdW1lbnQuZXhlY0Nv bW1hbmQoJ1NlbGVjdEFsbCcpOworICAgIGRvY3VtZW50LmV4ZWNDb21tYW5kKCdJbnNlcnRUZXh0 Jyk7CisgIH07Cis8L3NjcmlwdD4KZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxv ZyBiL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwppbmRleCAzNThjYTIzMGYyLi44ZDIyN2QzNGIw IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKKysrIGIvU291cmNlL1dlYkNv cmUvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTcgQEAKKzIwMjEtMDYtMTUgIEZyZWRlcmljIFdhbmcg IDxmd2FuZ0BpZ2FsaWEuY29tPgorCisgICAgICAgIE51bGxwdHIgY3Jhc2ggaW4gcG9zaXRpb25J blBhcmVudEJlZm9yZU5vZGUgdmlhIEluc2VydFRleHRDb21tYW5kOjpkb0FwcGx5CisgICAgICAg IGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0yMjY4NzAKKworICAgICAg ICBSZXZpZXdlZCBieSBSeW9zdWtlIE5pd2EuCisKKyAgICAgICAgZGVsZXRlU2VsZWN0aW9uIGNh bGwgSW4gSW5zZXJ0VGV4dENvbW1hbmQ6OmRvQXBwbHkoKSBjYW4gbWFrZSB0aGUgZW5kaW5nU2Vs ZWN0aW9uKCkgb3JwaGFuLgorICAgICAgICBJZiB0aGF0IGhhcHBlbnMsIGV4aXQgZWFybHkgdG8g YXZvaWQgZGVyZWZlcmVuY2luZyBhIG51bGxwdHIgcG9pbnRlciBsYXRlci4KKyAgICAgICAgVGVz dDogZmFzdC9lZGl0aW5nL2luc2VydC10ZXh0LW9ycGhhbmVkLXN1bW1hcnktY3Jhc2guaHRtbAor CisgICAgICAgICogZWRpdGluZy9JbnNlcnRUZXh0Q29tbWFuZC5jcHA6CisgICAgICAgIChXZWJD b3JlOjpJbnNlcnRUZXh0Q29tbWFuZDo6ZG9BcHBseSk6CisKIDIwMjEtMDYtMTMgIENocmlzIER1 bWV6ICA8Y2R1bWV6QGFwcGxlLmNvbT4KIAogICAgICAgICBSZWxheCAicGFyZW50IG11c3QgYmUg YW4gSFRNTEVsZW1lbnQiIHJlc3RyaWN0aW9uIGluIG91dGVySFRNTCBzZXR0ZXIKZGlmZiAtLWdp dCBhL1NvdXJjZS9XZWJDb3JlL2VkaXRpbmcvSW5zZXJ0VGV4dENvbW1hbmQuY3BwIGIvU291cmNl L1dlYkNvcmUvZWRpdGluZy9JbnNlcnRUZXh0Q29tbWFuZC5jcHAKaW5kZXggNmRiNWJiMDFiYi4u NjFhNzdmNTEwZiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvZWRpdGluZy9JbnNlcnRUZXh0 Q29tbWFuZC5jcHAKKysrIGIvU291cmNlL1dlYkNvcmUvZWRpdGluZy9JbnNlcnRUZXh0Q29tbWFu ZC5jcHAKQEAgLTE0NCw3ICsxNDQsNyBAQCB2b2lkIEluc2VydFRleHRDb21tYW5kOjpkb0FwcGx5 KCkKICAgICAgICAgLy8gZGVsZXRlU2VsZWN0aW9uIGV2ZW50dWFsbHkgbWFrZXMgYSBuZXcgZW5k aW5nU2VsZWN0aW9uIG91dCBvZiBhIFBvc2l0aW9uLiBJZiB0aGF0IFBvc2l0aW9uIGRvZXNuJ3Qg aGF2ZQogICAgICAgICAvLyBhIHJlbmRlcmVyIChlLmcuIGl0IGlzIG9uIGEgPGZyYW1lc2V0PiBp biB0aGUgRE9NKSwgdGhlIFZpc2libGVTZWxlY3Rpb24gY2Fubm90IGJlIGNhbm9uaWNhbGl6ZWQg dG8gCiAgICAgICAgIC8vIGFueXRoaW5nIG90aGVyIHRoYW4gTm9TZWxlY3Rpb24uIFRoZSByZXN0 IG9mIHRoaXMgZnVuY3Rpb24gcmVxdWlyZXMgYSByZWFsIGVuZGluZ1NlbGVjdGlvbiwgc28gYmFp bCBvdXQuCi0gICAgICAgIGlmIChlbmRpbmdTZWxlY3Rpb24oKS5pc05vbmUoKSkKKyAgICAgICAg aWYgKGVuZGluZ1NlbGVjdGlvbigpLmlzTm9uZU9yT3JwaGFuZWQoKSkKICAgICAgICAgICAgIHJl dHVybjsKICAgICB9IGVsc2UgaWYgKGRvY3VtZW50KCkuZWRpdG9yKCkuaXNPdmVyd3JpdGVNb2Rl RW5hYmxlZCgpKSB7CiAgICAgICAgIGlmIChwZXJmb3JtT3ZlcndyaXRlKG1fdGV4dCwgbV9zZWxl Y3RJbnNlcnRlZFRleHQpKQotLSAKMi4yNS4xCgo=