<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>232922</bug_id>
          
          <creation_ts>2021-11-09 21:05:55 -0800</creation_ts>
          <short_desc>bad_optional_access in RenderGrid::updateAutoMarginsInRowAxisIfNeeded</short_desc>
          <delta_ts>2021-11-19 11:05:40 -0800</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>Layout and Rendering</component>
          <version>WebKit Nightly Build</version>
          <rep_platform>Unspecified</rep_platform>
          <op_sys>Unspecified</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>DUPLICATE</resolution>
          <dup_id>228022</dup_id>
          <see_also>https://bugs.webkit.org/show_bug.cgi?id=230768</see_also>
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>InRadar</keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Gabriel Nava Marino">gnavamarino</reporter>
          <assigned_to name="Gabriel Nava Marino">gnavamarino</assigned_to>
          <cc>bfulgham</cc>
    
    <cc>changseok</cc>
    
    <cc>darin</cc>
    
    <cc>esprehn+autocc</cc>
    
    <cc>ews-watchlist</cc>
    
    <cc>glenn</cc>
    
    <cc>jfernandez</cc>
    
    <cc>kondapallykalyan</cc>
    
    <cc>pdr</cc>
    
    <cc>rego</cc>
    
    <cc>simon.fraser</cc>
    
    <cc>svillar</cc>
    
    <cc>webkit-bug-importer</cc>
    
    <cc>zalan</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>1813467</commentid>
    <comment_count>0</comment_count>
    <who name="Gabriel Nava Marino">gnavamarino</who>
    <bug_when>2021-11-09 21:05:55 -0800</bug_when>
    <thetext>overridingContainingBlockContentLogicalHeight() and overridingContainingBlockContentLogicalWidth() return type is std::optional&lt;LayoutUnit&gt;, but we always try to access value().</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1813470</commentid>
    <comment_count>1</comment_count>
      <attachid>443774</attachid>
    <who name="Gabriel Nava Marino">gnavamarino</who>
    <bug_when>2021-11-09 21:24:37 -0800</bug_when>
    <thetext>Created attachment 443774
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1813665</commentid>
    <comment_count>2</comment_count>
    <who name="Gabriel Nava Marino">gnavamarino</who>
    <bug_when>2021-11-10 09:56:53 -0800</bug_when>
    <thetext>&lt;rdar://problem/82857623&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1813805</commentid>
    <comment_count>3</comment_count>
      <attachid>443774</attachid>
    <who name="Sergio Villar Senin">svillar</who>
    <bug_when>2021-11-10 14:44:12 -0800</bug_when>
    <thetext>Comment on attachment 443774
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=443774&amp;action=review

&gt; Source/WebCore/ChangeLog:8
&gt; +        Test: fast/css-grid-layout/grid-crash-update-auto-margins-row-axis.html

Nit: the test line should be placed after the description paragraph.

&gt; Source/WebCore/ChangeLog:16
&gt; +

Nit extra line here.

&gt; Source/WebCore/rendering/RenderGrid.cpp:1226
&gt; +    std::optional&lt;LayoutUnit&gt; availableWidth = child.overridingContainingBlockContentLogicalWidth();

Although this seems correct I don&apos;t get why we have nullopt in the overriding size here. These two methods are called after calling updateGridAreaBreathLogicalSize() which always sets the overrides. That&apos;s why we were calling value() directly here without checking the presence of the value. Do you have more info about the exact conditions that trigger the bad access?

&gt; LayoutTests/fast/css-grid-layout/grid-crash-update-auto-margins-row-axis.html:3
&gt; +&lt;head&gt;

Nit, you don&apos;t need neither &lt;html&gt; nor &lt;head&gt; nor &lt;body&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1813969</commentid>
    <comment_count>4</comment_count>
      <attachid>443774</attachid>
    <who name="Javier Fernandez">jfernandez</who>
    <bug_when>2021-11-11 02:59:41 -0800</bug_when>
    <thetext>Comment on attachment 443774
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=443774&amp;action=review

&gt; Source/WebCore/rendering/RenderGrid.cpp:1260
&gt; +    std::optional&lt;LayoutUnit&gt; availableHeight = child.overridingContainingBlockContentLogicalHeight();

Maybe we could just use value_or(LayoutUnit()) as we already do in other functions of this class to handle the available space. In case of nullopt, we will use the early return already defined for non-positive values.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1814096</commentid>
    <comment_count>5</comment_count>
      <attachid>443774</attachid>
    <who name="Gabriel Nava Marino">gnavamarino</who>
    <bug_when>2021-11-11 10:25:19 -0800</bug_when>
    <thetext>Comment on attachment 443774
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=443774&amp;action=review

Thank you for the feedback on the stylistic issues.

&gt;&gt; Source/WebCore/rendering/RenderGrid.cpp:1226
&gt;&gt; +    std::optional&lt;LayoutUnit&gt; availableWidth = child.overridingContainingBlockContentLogicalWidth();
&gt; 
&gt; Although this seems correct I don&apos;t get why we have nullopt in the overriding size here. These two methods are called after calling updateGridAreaBreathLogicalSize() which always sets the overrides. That&apos;s why we were calling value() directly here without checking the presence of the value. Do you have more info about the exact conditions that trigger the bad access?

I note that these values are set in updateGridAreaBreathLogicalSize(), but later cleared in applyStretchAlignmentToChildIfNeeded:

    // We clear height and width override values because we will decide now whether it&apos;s allowed or
    // not, evaluating the conditions which might have changed since the old values were set.
    child.clearOverridingLogicalHeight();
    child.clearOverridingLogicalWidth();

&gt;&gt; Source/WebCore/rendering/RenderGrid.cpp:1260
&gt;&gt; +    std::optional&lt;LayoutUnit&gt; availableHeight = child.overridingContainingBlockContentLogicalHeight();
&gt; 
&gt; Maybe we could just use value_or(LayoutUnit()) as we already do in other functions of this class to handle the available space. In case of nullopt, we will use the early return already defined for non-positive values.

Thank you, I will use the recommended approach.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1814101</commentid>
    <comment_count>6</comment_count>
      <attachid>443968</attachid>
    <who name="Gabriel Nava Marino">gnavamarino</who>
    <bug_when>2021-11-11 10:26:23 -0800</bug_when>
    <thetext>Created attachment 443968
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1814408</commentid>
    <comment_count>7</comment_count>
      <attachid>443774</attachid>
    <who name="Javier Fernandez">jfernandez</who>
    <bug_when>2021-11-12 06:11:43 -0800</bug_when>
    <thetext>Comment on attachment 443774
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=443774&amp;action=review

&gt;&gt;&gt; Source/WebCore/rendering/RenderGrid.cpp:1226
&gt;&gt;&gt; +    std::optional&lt;LayoutUnit&gt; availableWidth = child.overridingContainingBlockContentLogicalWidth();
&gt;&gt; 
&gt;&gt; Although this seems correct I don&apos;t get why we have nullopt in the overriding size here. These two methods are called after calling updateGridAreaBreathLogicalSize() which always sets the overrides. That&apos;s why we were calling value() directly here without checking the presence of the value. Do you have more info about the exact conditions that trigger the bad access?
&gt; 
&gt; I note that these values are set in updateGridAreaBreathLogicalSize(), but later cleared in applyStretchAlignmentToChildIfNeeded:
&gt; 
&gt;     // We clear height and width override values because we will decide now whether it&apos;s allowed or
&gt;     // not, evaluating the conditions which might have changed since the old values were set.
&gt;     child.clearOverridingLogicalHeight();
&gt;     child.clearOverridingLogicalWidth();

No, those are different &quot;override&quot; values. Notice the function names are different.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1814486</commentid>
    <comment_count>8</comment_count>
    <who name="Gabriel Nava Marino">gnavamarino</who>
    <bug_when>2021-11-12 09:18:40 -0800</bug_when>
    <thetext>(In reply to Javier Fernandez from comment #7)
&gt; Comment on attachment 443774 [details]
&gt; Patch
&gt; 
&gt; View in context:
&gt; https://bugs.webkit.org/attachment.cgi?id=443774&amp;action=review
&gt; 
&gt; &gt;&gt;&gt; Source/WebCore/rendering/RenderGrid.cpp:1226
&gt; &gt;&gt;&gt; +    std::optional&lt;LayoutUnit&gt; availableWidth = child.overridingContainingBlockContentLogicalWidth();
&gt; &gt;&gt; 
&gt; &gt;&gt; Although this seems correct I don&apos;t get why we have nullopt in the overriding size here. These two methods are called after calling updateGridAreaBreathLogicalSize() which always sets the overrides. That&apos;s why we were calling value() directly here without checking the presence of the value. Do you have more info about the exact conditions that trigger the bad access?
&gt; &gt; 
&gt; &gt; I note that these values are set in updateGridAreaBreathLogicalSize(), but later cleared in applyStretchAlignmentToChildIfNeeded:
&gt; &gt; 
&gt; &gt;     // We clear height and width override values because we will decide now whether it&apos;s allowed or
&gt; &gt;     // not, evaluating the conditions which might have changed since the old values were set.
&gt; &gt;     child.clearOverridingLogicalHeight();
&gt; &gt;     child.clearOverridingLogicalWidth();
&gt; 
&gt; No, those are different &quot;override&quot; values. Notice the function names are
&gt; different.

I am taking a closer look why the values are cleared in applyStretchAlignmentToChildIfNeeded.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1814548</commentid>
    <comment_count>9</comment_count>
      <attachid>443968</attachid>
    <who name="Darin Adler">darin</who>
    <bug_when>2021-11-12 11:49:44 -0800</bug_when>
    <thetext>Comment on attachment 443968
Patch

Looks obviously right as long as none of the heights we are subtracting are negative.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1814618</commentid>
    <comment_count>10</comment_count>
    <who name="Sergio Villar Senin">svillar</who>
    <bug_when>2021-11-12 13:46:00 -0800</bug_when>
    <thetext>(In reply to Darin Adler from comment #9)
&gt; Comment on attachment 443968 [details]
&gt; Patch
&gt; 
&gt; Looks obviously right as long as none of the heights we are subtracting are
&gt; negative.

Wouldn&apos;t like to dismiss your review, but I talked with Gabriel in private that this might fix the crash but does not address the root cause which is having an std::nullopt overriding size at that point.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1814644</commentid>
    <comment_count>11</comment_count>
    <who name="Darin Adler">darin</who>
    <bug_when>2021-11-12 15:09:31 -0800</bug_when>
    <thetext>(In reply to Sergio Villar Senin from comment #10)
&gt; Wouldn&apos;t like to dismiss your review, but I talked with Gabriel in private
&gt; that this might fix the crash but does not address the root cause which is
&gt; having an std::nullopt overriding size at that point.

I don’t feel strongly either way.

What matters is the bad behavior; if the behavior is wrong with this patch, incorrect layout or something, then we should keep working on it. If there is no observable bad behavior I’d be tempted to just land this as is.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1815341</commentid>
    <comment_count>12</comment_count>
    <who name="Gabriel Nava Marino">gnavamarino</who>
    <bug_when>2021-11-15 21:01:19 -0800</bug_when>
    <thetext>(In reply to Javier Fernandez from comment #7)
&gt; Comment on attachment 443774 [details]
&gt; Patch
&gt; 
&gt; View in context:
&gt; https://bugs.webkit.org/attachment.cgi?id=443774&amp;action=review
&gt; 
&gt; &gt;&gt;&gt; Source/WebCore/rendering/RenderGrid.cpp:1226
&gt; &gt;&gt;&gt; +    std::optional&lt;LayoutUnit&gt; availableWidth = child.overridingContainingBlockContentLogicalWidth();
&gt; &gt;&gt; 
&gt; &gt;&gt; Although this seems correct I don&apos;t get why we have nullopt in the overriding size here. These two methods are called after calling updateGridAreaBreathLogicalSize() which always sets the overrides. That&apos;s why we were calling value() directly here without checking the presence of the value. Do you have more info about the exact conditions that trigger the bad access?
&gt; &gt; 
&gt; &gt; I note that these values are set in updateGridAreaBreathLogicalSize(), but later cleared in applyStretchAlignmentToChildIfNeeded:
&gt; &gt; 
&gt; &gt;     // We clear height and width override values because we will decide now whether it&apos;s allowed or
&gt; &gt;     // not, evaluating the conditions which might have changed since the old values were set.
&gt; &gt;     child.clearOverridingLogicalHeight();
&gt; &gt;     child.clearOverridingLogicalWidth();
&gt; 
&gt; No, those are different &quot;override&quot; values. Notice the function names are
&gt; different.

Taking a closer look, the backtrace below best shows the sequence of conditions for which overridingContainingBlockContentLogicalHeight is set to the non-existent values which leads to the crash in updateAutoMarginsInColumnAxisIfNeeded:

1   0x28a96517c WebCore::RenderBox::setOverridingContainingBlockContentLogicalHeight(std::__1::optional&lt;WebCore::LayoutUnit&gt;)
2   0x28ab74508 WebCore::RenderGrid::updateGridAreaLogicalSize(WebCore::RenderBox&amp;, std::__1::optional&lt;WebCore::LayoutUnit&gt;, std::__1::optional&lt;WebCore::LayoutUnit&gt;) const
3   0x28ab6baa0 WebCore::RenderGrid::performGridItemsPreLayout(WebCore::GridTrackSizingAlgorithm const&amp;) const
4   0x28ab6ec58 WebCore::RenderGrid::computeIntrinsicLogicalWidths(WebCore::LayoutUnit&amp;, WebCore::LayoutUnit&amp;) const
5   0x288475ccc WebCore::RenderBox::computeIntrinsicKeywordLogicalWidths(WebCore::LayoutUnit&amp;, WebCore::LayoutUnit&amp;) const
6   0x28a99afd0 WebCore::RenderBox::computeIntrinsicLogicalWidthUsing(WebCore::Length, WebCore::LayoutUnit, WebCore::LayoutUnit) const
7   0x28a957778 WebCore::RenderBox::computeLogicalWidthInFragmentUsing(WebCore::SizeType, WebCore::Length, WebCore::LayoutUnit, WebCore::RenderBlock const&amp;, WebCore::RenderFragmentContainer*) const
8   0x28a956084 WebCore::RenderBox::constrainLogicalWidthInFragmentByMinMax(WebCore::LayoutUnit, WebCore::LayoutUnit, WebCore::RenderBlock&amp;, WebCore::RenderFragmentContainer*, WebCore::RenderBox::AllowIntrinsic) const
9   0x28ab78994 WebCore::RenderGrid::applyStretchAlignmentToChildIfNeeded(WebCore::RenderBox&amp;)

At this point:
(lldb) p logicalHeight
(std::optional&lt;WebCore::LayoutUnit&gt;) $0 =  Has Value=false  {}

I do note, the &quot;entry point&quot; in RenderGrid::applyStretchAlignmentToChildIfNeeded is a relatively new area of code (bug 228022).</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1815342</commentid>
    <comment_count>13</comment_count>
      <attachid>443968</attachid>
    <who name="Gabriel Nava Marino">gnavamarino</who>
    <bug_when>2021-11-15 21:07:10 -0800</bug_when>
    <thetext>Comment on attachment 443968
Patch

It looks like the unrelated layout test failure it is hitting was addressed in
Bug 233043 - Regression(r285639) fast/dom/Geolocation/cached-position-iframe.html is frequently crashing on Mac-wk1
Bug 224742 - [css-contain] Support contain:paint (REVERTED)

However, the bot is not yet running with that revision. Moving to &quot;cq?&quot;.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1815392</commentid>
    <comment_count>14</comment_count>
    <who name="Sergio Villar Senin">svillar</who>
    <bug_when>2021-11-16 01:35:31 -0800</bug_when>
    <thetext>(In reply to Gabriel Nava Marino from comment #12)
&gt; (In reply to Javier Fernandez from comment #7)
&gt; &gt; Comment on attachment 443774 [details]
&gt; &gt; Patch
&gt; &gt; 
&gt; &gt; View in context:
&gt; &gt; https://bugs.webkit.org/attachment.cgi?id=443774&amp;action=review
&gt; &gt; 
&gt; &gt; &gt;&gt;&gt; Source/WebCore/rendering/RenderGrid.cpp:1226
&gt; &gt; &gt;&gt;&gt; +    std::optional&lt;LayoutUnit&gt; availableWidth = child.overridingContainingBlockContentLogicalWidth();
&gt; &gt; &gt;&gt; 
&gt; &gt; &gt;&gt; Although this seems correct I don&apos;t get why we have nullopt in the overriding size here. These two methods are called after calling updateGridAreaBreathLogicalSize() which always sets the overrides. That&apos;s why we were calling value() directly here without checking the presence of the value. Do you have more info about the exact conditions that trigger the bad access?
&gt; &gt; &gt; 
&gt; &gt; &gt; I note that these values are set in updateGridAreaBreathLogicalSize(), but later cleared in applyStretchAlignmentToChildIfNeeded:
&gt; &gt; &gt; 
&gt; &gt; &gt;     // We clear height and width override values because we will decide now whether it&apos;s allowed or
&gt; &gt; &gt;     // not, evaluating the conditions which might have changed since the old values were set.
&gt; &gt; &gt;     child.clearOverridingLogicalHeight();
&gt; &gt; &gt;     child.clearOverridingLogicalWidth();
&gt; &gt; 
&gt; &gt; No, those are different &quot;override&quot; values. Notice the function names are
&gt; &gt; different.
&gt; 
&gt; Taking a closer look, the backtrace below best shows the sequence of
&gt; conditions for which overridingContainingBlockContentLogicalHeight is set to
&gt; the non-existent values which leads to the crash in
&gt; updateAutoMarginsInColumnAxisIfNeeded:
&gt; 
&gt; 1   0x28a96517c
&gt; WebCore::RenderBox::setOverridingContainingBlockContentLogicalHeight(std::
&gt; __1::optional&lt;WebCore::LayoutUnit&gt;)
&gt; 2   0x28ab74508
&gt; WebCore::RenderGrid::updateGridAreaLogicalSize(WebCore::RenderBox&amp;,
&gt; std::__1::optional&lt;WebCore::LayoutUnit&gt;,
&gt; std::__1::optional&lt;WebCore::LayoutUnit&gt;) const
&gt; 3   0x28ab6baa0
&gt; WebCore::RenderGrid::performGridItemsPreLayout(WebCore::
&gt; GridTrackSizingAlgorithm const&amp;) const
&gt; 4   0x28ab6ec58
&gt; WebCore::RenderGrid::computeIntrinsicLogicalWidths(WebCore::LayoutUnit&amp;,
&gt; WebCore::LayoutUnit&amp;) const
&gt; 5   0x288475ccc
&gt; WebCore::RenderBox::computeIntrinsicKeywordLogicalWidths(WebCore::
&gt; LayoutUnit&amp;, WebCore::LayoutUnit&amp;) const
&gt; 6   0x28a99afd0
&gt; WebCore::RenderBox::computeIntrinsicLogicalWidthUsing(WebCore::Length,
&gt; WebCore::LayoutUnit, WebCore::LayoutUnit) const
&gt; 7   0x28a957778
&gt; WebCore::RenderBox::computeLogicalWidthInFragmentUsing(WebCore::SizeType,
&gt; WebCore::Length, WebCore::LayoutUnit, WebCore::RenderBlock const&amp;,
&gt; WebCore::RenderFragmentContainer*) const
&gt; 8   0x28a956084
&gt; WebCore::RenderBox::constrainLogicalWidthInFragmentByMinMax(WebCore::
&gt; LayoutUnit, WebCore::LayoutUnit, WebCore::RenderBlock&amp;,
&gt; WebCore::RenderFragmentContainer*, WebCore::RenderBox::AllowIntrinsic) const
&gt; 9   0x28ab78994
&gt; WebCore::RenderGrid::applyStretchAlignmentToChildIfNeeded(WebCore::
&gt; RenderBox&amp;)
&gt; 
&gt; At this point:
&gt; (lldb) p logicalHeight
&gt; (std::optional&lt;WebCore::LayoutUnit&gt;) $0 =  Has Value=false  {}
&gt; 
&gt; I do note, the &quot;entry point&quot; in
&gt; RenderGrid::applyStretchAlignmentToChildIfNeeded is a relatively new area of
&gt; code (bug 228022).

Thanks for the info Gabriel. So there are several issues in the current code

1. I don&apos;t think performGridItemsPrelayout() should be called at this point. We must cache and reuse the intrinsic sizes.
2. computeIntrinsicLogicalWidths() should not destroy the previous overriding sizes. We were perhaps assuming that it would only be called as part of the preferred width computation but this example clearly shows that the assumption was incorrect

With all that in mind, if it&apos;s urgent to fix the crash then I&apos;m tempted to accept a simpler patch like yours with a big FIXME, and address the underlying issues in follow ups</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1815393</commentid>
    <comment_count>15</comment_count>
    <who name="Javier Fernandez">jfernandez</who>
    <bug_when>2021-11-16 01:37:24 -0800</bug_when>
    <thetext>(In reply to Gabriel Nava Marino from comment #12)
&gt; (In reply to Javier Fernandez from comment #7)
&gt; &gt; Comment on attachment 443774 [details]
&gt; &gt; Patch
&gt; &gt; 
&gt; &gt; View in context:
&gt; &gt; https://bugs.webkit.org/attachment.cgi?id=443774&amp;action=review
&gt; &gt; 
&gt; &gt; &gt;&gt;&gt; Source/WebCore/rendering/RenderGrid.cpp:1226
&gt; &gt; &gt;&gt;&gt; +    std::optional&lt;LayoutUnit&gt; availableWidth = child.overridingContainingBlockContentLogicalWidth();
&gt; &gt; &gt;&gt; 
&gt; &gt; &gt;&gt; Although this seems correct I don&apos;t get why we have nullopt in the overriding size here. These two methods are called after calling updateGridAreaBreathLogicalSize() which always sets the overrides. That&apos;s why we were calling value() directly here without checking the presence of the value. Do you have more info about the exact conditions that trigger the bad access?
&gt; &gt; &gt; 
&gt; &gt; &gt; I note that these values are set in updateGridAreaBreathLogicalSize(), but later cleared in applyStretchAlignmentToChildIfNeeded:
&gt; &gt; &gt; 
&gt; &gt; &gt;     // We clear height and width override values because we will decide now whether it&apos;s allowed or
&gt; &gt; &gt;     // not, evaluating the conditions which might have changed since the old values were set.
&gt; &gt; &gt;     child.clearOverridingLogicalHeight();
&gt; &gt; &gt;     child.clearOverridingLogicalWidth();
&gt; &gt; 
&gt; &gt; No, those are different &quot;override&quot; values. Notice the function names are
&gt; &gt; different.
&gt; 
&gt; Taking a closer look, the backtrace below best shows the sequence of
&gt; conditions for which overridingContainingBlockContentLogicalHeight is set to
&gt; the non-existent values which leads to the crash in
&gt; updateAutoMarginsInColumnAxisIfNeeded:
&gt; 
&gt; 1   0x28a96517c
&gt; WebCore::RenderBox::setOverridingContainingBlockContentLogicalHeight(std::
&gt; __1::optional&lt;WebCore::LayoutUnit&gt;)
&gt; 2   0x28ab74508
&gt; WebCore::RenderGrid::updateGridAreaLogicalSize(WebCore::RenderBox&amp;,
&gt; std::__1::optional&lt;WebCore::LayoutUnit&gt;,
&gt; std::__1::optional&lt;WebCore::LayoutUnit&gt;) const
&gt; 3   0x28ab6baa0
&gt; WebCore::RenderGrid::performGridItemsPreLayout(WebCore::
&gt; GridTrackSizingAlgorithm const&amp;) const
&gt; 4   0x28ab6ec58
&gt; WebCore::RenderGrid::computeIntrinsicLogicalWidths(WebCore::LayoutUnit&amp;,
&gt; WebCore::LayoutUnit&amp;) const
&gt; 5   0x288475ccc
&gt; WebCore::RenderBox::computeIntrinsicKeywordLogicalWidths(WebCore::
&gt; LayoutUnit&amp;, WebCore::LayoutUnit&amp;) const
&gt; 6   0x28a99afd0
&gt; WebCore::RenderBox::computeIntrinsicLogicalWidthUsing(WebCore::Length,
&gt; WebCore::LayoutUnit, WebCore::LayoutUnit) const
&gt; 7   0x28a957778
&gt; WebCore::RenderBox::computeLogicalWidthInFragmentUsing(WebCore::SizeType,
&gt; WebCore::Length, WebCore::LayoutUnit, WebCore::RenderBlock const&amp;,
&gt; WebCore::RenderFragmentContainer*) const
&gt; 8   0x28a956084
&gt; WebCore::RenderBox::constrainLogicalWidthInFragmentByMinMax(WebCore::
&gt; LayoutUnit, WebCore::LayoutUnit, WebCore::RenderBlock&amp;,
&gt; WebCore::RenderFragmentContainer*, WebCore::RenderBox::AllowIntrinsic) const
&gt; 9   0x28ab78994
&gt; WebCore::RenderGrid::applyStretchAlignmentToChildIfNeeded(WebCore::
&gt; RenderBox&amp;)
&gt; 
&gt; At this point:
&gt; (lldb) p logicalHeight
&gt; (std::optional&lt;WebCore::LayoutUnit&gt;) $0 =  Has Value=false  {}
&gt; 
&gt; I do note, the &quot;entry point&quot; in
&gt; RenderGrid::applyStretchAlignmentToChildIfNeeded is a relatively new area of
&gt; code (bug 228022).

Thank you so much for the analysis. This is clearly the culprit of this issue, which should be classifies as an actual REGRESSION. We usually don&apos;t need to use the overridingLogicalWidth, since the inline-size is &apos;stretched&apos; by default. However, in the mentioned bug #228022 we introduced this new code to deal with some special cases related to replaced elements (eg Images).

However, taking a deeper look at the new code, I couldn&apos;t understand why we are calling  constrainLogicalWidthInFragmentByMinMax on the LayoutGrid instead on the child (despite I&apos;ve been the one reviewing the original patch :( ). 

Calling constrainLogicalWidthInFragmentByMinMax on the LayoutGridItem it&apos;s indeed the root cause of this bug, since it requires to compute again the grid containers preferredLogicalWidth (as part of the call to constrainLogicalHeightByMinMax) and it probably reset to indefinite (nullopt) some of the grid item&apos;s grid areas (aka overridingContaningBlockContentXXX). 

Another issue (which I think we had to face already in other bugs) is why the grid container has its preferred width as dirty as this phase, since we have already computed its logical width (at the beginning of the layoutBlock function) and we are just laying out the grid items now. My theory on this is that in this test case, we are invalidating some of the grid item&apos;s preferred width, which causes the containing block chain to be invalidated as well.

@zsun, could you take a look please ? Also, could you verify why the bug #228022 is still open ? Thanks.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1815404</commentid>
    <comment_count>16</comment_count>
      <attachid>443968</attachid>
    <who name="Sergio Villar Senin">svillar</who>
    <bug_when>2021-11-16 02:02:57 -0800</bug_when>
    <thetext>Comment on attachment 443968
Patch

So Javi and myself have discussed this and we have came up to the conclusion that the issue is indeed located in the patch for bug 228022. In this patch the code is recomputing the intrinsic width of the grid when it should really recompute the intrinsic width of the grid item.

We&apos;ll revert the patch from that bug making this fix not needed.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1816920</commentid>
    <comment_count>17</comment_count>
    <who name="Gabriel Nava Marino">gnavamarino</who>
    <bug_when>2021-11-19 10:50:16 -0800</bug_when>
    <thetext>I&apos;ve verified this has been resolved by bug #228022.

*** This bug has been marked as a duplicate of bug 228022 ***</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1816929</commentid>
    <comment_count>18</comment_count>
    <who name="Darin Adler">darin</who>
    <bug_when>2021-11-19 11:02:36 -0800</bug_when>
    <thetext>Wait, no this was a regression caused by bug 228022, so not a duplicate of it.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1816930</commentid>
    <comment_count>19</comment_count>
    <who name="Darin Adler">darin</who>
    <bug_when>2021-11-19 11:05:40 -0800</bug_when>
    <thetext>I guess this is resolved by the new corrected fix for bug 228022 and caused by the original incorrect fix for bug 228022, so I’ll leave it marked as a duplicate.</thetext>
  </long_desc>
      
          <attachment
              isobsolete="1"
              ispatch="1"
              isprivate="0"
          >
            <attachid>443774</attachid>
            <date>2021-11-09 21:24:37 -0800</date>
            <delta_ts>2021-11-11 10:26:17 -0800</delta_ts>
            <desc>Patch</desc>
            <filename>bug-232922-20211109212436.patch</filename>
            <type>text/plain</type>
            <size>4838</size>
            <attacher name="Gabriel Nava Marino">gnavamarino</attacher>
            
              <data encoding="base64">U3VidmVyc2lvbiBSZXZpc2lvbjogMjg1MTk4CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D
aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggYjU1NWQxODI5MjJmMTc2
NWE0MDk2YjJiMTUzMzVkMGZiODJhMGY1ZC4uY2I0YWQ2NDAyMWNmMjBkNmI3YzljMzIyODQ3NWQw
MzkyZWI1NDg5YiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv
dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDIzIEBACisyMDIxLTExLTA5ICBHYWJy
aWVsIE5hdmEgTWFyaW5vICA8Z25hdmFtYXJpbm9AYXBwbGUuY29tPgorCisgICAgICAgIGJhZF9v
cHRpb25hbF9hY2Nlc3MgaW4gUmVuZGVyR3JpZDo6dXBkYXRlQXV0b01hcmdpbnNJblJvd0F4aXNJ
Zk5lZWRlZAorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9
MjMyOTIyCisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAg
VGVzdDogZmFzdC9jc3MtZ3JpZC1sYXlvdXQvZ3JpZC1jcmFzaC11cGRhdGUtYXV0by1tYXJnaW5z
LXJvdy1heGlzLmh0bWwKKworICAgICAgICBUaGUgb3ZlcnJpZGluZ0NvbnRhaW5pbmdCbG9ja0Nv
bnRlbnRMb2dpY2FsSGVpZ2h0KCkgYW5kCisgICAgICAgIG92ZXJyaWRpbmdDb250YWluaW5nQmxv
Y2tDb250ZW50TG9naWNhbFdpZHRoKCkgbWV0aG9kcyBoYXZlIGEgcmV0dXJuCisgICAgICAgIHR5
cGUgb2Ygc3RkOjpvcHRpb25hbDxMYXlvdXRVbml0PiwgYnV0IHdlIGFsd2F5cyB0cnkgdG8gYWNj
ZXNzIHZhbHVlLgorICAgICAgICBDaGVjayB2YWx1ZSBleGlzdHMgYmVmb3JlIGRpcmVjdGx5IGFj
Y2Vzc2luZyBhcyBpcyBkb25lIGluIG90aGVyIHBsYWNlcworICAgICAgICBzdWNoIGFzIFJlbmRl
ckJveC5jcHAuCisKKworICAgICAgICAqIHJlbmRlcmluZy9SZW5kZXJHcmlkLmNwcDoKKyAgICAg
ICAgKFdlYkNvcmU6OlJlbmRlckdyaWQ6OnVwZGF0ZUF1dG9NYXJnaW5zSW5Sb3dBeGlzSWZOZWVk
ZWQpOgorICAgICAgICAoV2ViQ29yZTo6UmVuZGVyR3JpZDo6dXBkYXRlQXV0b01hcmdpbnNJbkNv
bHVtbkF4aXNJZk5lZWRlZCk6CisKIDIwMjEtMTEtMDIgIENhaXRsbiBQb3R0ZXIgIDxjYWl0cEBp
Z2FsaWEuY29tPgogCiAgICAgICAgIFtXZWJJRExdIFN1cHBvcnQgW0V4cG9zZWQ9Kl0gZXh0ZW5k
ZWQgYXR0cmlidXRlCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVy
R3JpZC5jcHAgYi9Tb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyR3JpZC5jcHAKaW5kZXgg
MWRkODU3ZjdiZDI3Y2ZjNjk2NWYwNWQ1YTVlNGQwZGI4OGZlNWJhOS4uMzczOWEzZGM0Y2QxNWEy
MTg2MjAwODllYTllYmVjMjljM2FiMDkyOSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvcmVu
ZGVyaW5nL1JlbmRlckdyaWQuY3BwCisrKyBiL1NvdXJjZS9XZWJDb3JlL3JlbmRlcmluZy9SZW5k
ZXJHcmlkLmNwcApAQCAtMTIyMyw3ICsxMjIzLDEwIEBAIHZvaWQgUmVuZGVyR3JpZDo6dXBkYXRl
QXV0b01hcmdpbnNJblJvd0F4aXNJZk5lZWRlZChSZW5kZXJCb3gmIGNoaWxkKQogICAgIGlmICgh
bWFyZ2luRW5kLmlzQXV0bygpKQogICAgICAgICBtYXJnaW5Mb2dpY2FsV2lkdGggKz0gY2hpbGQu
bWFyZ2luRW5kKCk7CiAKLSAgICBMYXlvdXRVbml0IGF2YWlsYWJsZUFsaWdubWVudFNwYWNlID0g
Y2hpbGQub3ZlcnJpZGluZ0NvbnRhaW5pbmdCbG9ja0NvbnRlbnRMb2dpY2FsV2lkdGgoKS52YWx1
ZSgpIC0gY2hpbGQubG9naWNhbFdpZHRoKCkgLSBtYXJnaW5Mb2dpY2FsV2lkdGg7CisgICAgc3Rk
OjpvcHRpb25hbDxMYXlvdXRVbml0PiBhdmFpbGFibGVXaWR0aCA9IGNoaWxkLm92ZXJyaWRpbmdD
b250YWluaW5nQmxvY2tDb250ZW50TG9naWNhbFdpZHRoKCk7CisgICAgaWYgKCFhdmFpbGFibGVX
aWR0aCkKKyAgICAgICAgcmV0dXJuOworICAgIExheW91dFVuaXQgYXZhaWxhYmxlQWxpZ25tZW50
U3BhY2UgPSBhdmFpbGFibGVXaWR0aC52YWx1ZSgpIC0gY2hpbGQubG9naWNhbFdpZHRoKCkgLSBt
YXJnaW5Mb2dpY2FsV2lkdGg7CiAgICAgaWYgKGF2YWlsYWJsZUFsaWdubWVudFNwYWNlIDw9IDAp
CiAgICAgICAgIHJldHVybjsKIApAQCAtMTI1NCw3ICsxMjU3LDEwIEBAIHZvaWQgUmVuZGVyR3Jp
ZDo6dXBkYXRlQXV0b01hcmdpbnNJbkNvbHVtbkF4aXNJZk5lZWRlZChSZW5kZXJCb3gmIGNoaWxk
KQogICAgIGlmICghbWFyZ2luQWZ0ZXIuaXNBdXRvKCkpCiAgICAgICAgIG1hcmdpbkxvZ2ljYWxI
ZWlnaHQgKz0gY2hpbGQubWFyZ2luQWZ0ZXIoKTsKIAotICAgIExheW91dFVuaXQgYXZhaWxhYmxl
QWxpZ25tZW50U3BhY2UgPSBjaGlsZC5vdmVycmlkaW5nQ29udGFpbmluZ0Jsb2NrQ29udGVudExv
Z2ljYWxIZWlnaHQoKS52YWx1ZSgpIC0gY2hpbGQubG9naWNhbEhlaWdodCgpIC0gbWFyZ2luTG9n
aWNhbEhlaWdodDsKKyAgICBzdGQ6Om9wdGlvbmFsPExheW91dFVuaXQ+IGF2YWlsYWJsZUhlaWdo
dCA9IGNoaWxkLm92ZXJyaWRpbmdDb250YWluaW5nQmxvY2tDb250ZW50TG9naWNhbEhlaWdodCgp
OworICAgIGlmICghYXZhaWxhYmxlSGVpZ2h0KQorICAgICAgICByZXR1cm47CisgICAgTGF5b3V0
VW5pdCBhdmFpbGFibGVBbGlnbm1lbnRTcGFjZSA9IGF2YWlsYWJsZUhlaWdodC52YWx1ZSgpIC0g
Y2hpbGQubG9naWNhbEhlaWdodCgpIC0gbWFyZ2luTG9naWNhbEhlaWdodDsKICAgICBpZiAoYXZh
aWxhYmxlQWxpZ25tZW50U3BhY2UgPD0gMCkKICAgICAgICAgcmV0dXJuOwogCmRpZmYgLS1naXQg
YS9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cgYi9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKaW5kZXggNGI4
MzVmZmY3YmViMmRmMGYxYTY4YWI1NWFjZTI1NWI1OTgzOWZiMC4uZjIyYjMwYTc1ZmI0MjMzY2Jk
NTIyZDgwOWFiNzY4ZTg5NTZhNGIxMSAxMDA2NDQKLS0tIGEvTGF5b3V0VGVzdHMvQ2hhbmdlTG9n
CisrKyBiL0xheW91dFRlc3RzL0NoYW5nZUxvZwpAQCAtMSwzICsxLDEzIEBACisyMDIxLTExLTA5
ICBHYWJyaWVsIE5hdmEgTWFyaW5vICA8Z25hdmFtYXJpbm9AYXBwbGUuY29tPgorCisgICAgICAg
IGJhZF9vcHRpb25hbF9hY2Nlc3MgaW4gUmVuZGVyR3JpZDo6dXBkYXRlQXV0b01hcmdpbnNJblJv
d0F4aXNJZk5lZWRlZAorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5j
Z2k/aWQ9MjMyOTIyCisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAg
ICAgICAgKiBmYXN0L2Nzcy1ncmlkLWxheW91dC9ncmlkLWNyYXNoLXVwZGF0ZS1hdXRvLW1hcmdp
bnMtcm93LWF4aXMtZXhwZWN0ZWQudHh0OiBBZGRlZC4KKyAgICAgICAgKiBmYXN0L2Nzcy1ncmlk
LWxheW91dC9ncmlkLWNyYXNoLXVwZGF0ZS1hdXRvLW1hcmdpbnMtcm93LWF4aXMuaHRtbDogQWRk
ZWQuCisKIDIwMjEtMTEtMDIgIEdhYnJpZWwgTmF2YSBNYXJpbm8gIDxnbmF2YW1hcmlub0BhcHBs
ZS5jb20+CiAKICAgICAgICAgQ3Jhc2ggaW4gUmVuZGVyTGF5ZXI6OnJlYnVpbGRaT3JkZXJMaXN0
cwpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvZmFzdC9jc3MtZ3JpZC1sYXlvdXQvZ3JpZC1jcmFz
aC11cGRhdGUtYXV0by1tYXJnaW5zLXJvdy1heGlzLWV4cGVjdGVkLnR4dCBiL0xheW91dFRlc3Rz
L2Zhc3QvY3NzLWdyaWQtbGF5b3V0L2dyaWQtY3Jhc2gtdXBkYXRlLWF1dG8tbWFyZ2lucy1yb3ct
YXhpcy1leHBlY3RlZC50eHQKbmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMDAwMDAw
MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMC4uZmU3MmQzMmQ0YmQ2NzBlMGQ0YWVjYjkzODJm
NzhjMzEyZDViOGE2YgotLS0gL2Rldi9udWxsCisrKyBiL0xheW91dFRlc3RzL2Zhc3QvY3NzLWdy
aWQtbGF5b3V0L2dyaWQtY3Jhc2gtdXBkYXRlLWF1dG8tbWFyZ2lucy1yb3ctYXhpcy1leHBlY3Rl
ZC50eHQKQEAgLTAsMCArMSwzIEBACitvbmxvYWQgPSAoKSA9PiB7IGlmICh3aW5kb3cudGVzdFJ1
bm5lcikgdGVzdFJ1bm5lci5kdW1wQXNUZXh0KCk7IH0KK2xpIHsgbWF4LXdpZHRoOiBtaW4tY29u
dGVudDsgYWxpZ24taXRlbXM6IGJhc2VsaW5lOyB9ICogeyBkaXNwbGF5OiBpbmxpbmUtZ3JpZDsg
fQorUEFTUyBpZiB0aGlzIGRvZXNuJ3QgY3Jhc2guCmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9m
YXN0L2Nzcy1ncmlkLWxheW91dC9ncmlkLWNyYXNoLXVwZGF0ZS1hdXRvLW1hcmdpbnMtcm93LWF4
aXMuaHRtbCBiL0xheW91dFRlc3RzL2Zhc3QvY3NzLWdyaWQtbGF5b3V0L2dyaWQtY3Jhc2gtdXBk
YXRlLWF1dG8tbWFyZ2lucy1yb3ctYXhpcy5odG1sCm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4
IDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAuLmY4YTUyNGNmZDJjMjU3
Zjg3Y2Q5YzM0NWY0YjcyZmE2YzAyNjllNzEKLS0tIC9kZXYvbnVsbAorKysgYi9MYXlvdXRUZXN0
cy9mYXN0L2Nzcy1ncmlkLWxheW91dC9ncmlkLWNyYXNoLXVwZGF0ZS1hdXRvLW1hcmdpbnMtcm93
LWF4aXMuaHRtbApAQCAtMCwwICsxLDE4IEBACis8IURPQ1RZUEUgaHRtbD4KKzxodG1sPgorPGhl
YWQ+Cis8c2NyaXB0Pgorb25sb2FkID0gKCkgPT4geworICBpZiAod2luZG93LnRlc3RSdW5uZXIp
CisgICAgdGVzdFJ1bm5lci5kdW1wQXNUZXh0KCk7Cit9Cis8L3NjcmlwdD4KKzxzdHlsZT4KK2xp
IHsgbWF4LXdpZHRoOiBtaW4tY29udGVudDsgYWxpZ24taXRlbXM6IGJhc2VsaW5lOyB9CisqIHsg
ZGlzcGxheTogaW5saW5lLWdyaWQ7IH0KKzwvc3R5bGU+Cis8L2hlYWQ+Cis8Ym9keT4KKzxsaT5Q
QVNTIGlmIHRoaXMgZG9lc24ndCBjcmFzaC48L2xpPgorPC9ib2R5PgorPC9odG1sPgo=
</data>

          </attachment>
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>443968</attachid>
            <date>2021-11-11 10:26:23 -0800</date>
            <delta_ts>2021-11-16 02:02:57 -0800</delta_ts>
            <desc>Patch</desc>
            <filename>bug-232922-20211111102622.patch</filename>
            <type>text/plain</type>
            <size>4782</size>
            <attacher name="Gabriel Nava Marino">gnavamarino</attacher>
            
              <data encoding="base64">U3VidmVyc2lvbiBSZXZpc2lvbjogMjg1NTk5CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D
aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggMGExNjNlZDdmODI4M2Mz
YTcxMDRkMzk2ZGY0NTFjYzlkZThiOTFmNC4uYzY2NjY0ZDI5ODQxNjIzYTRkYjVmMDYzYTU1NjI0
NTg4ZjMyODUyMyAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv
dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDIzIEBACisyMDIxLTExLTExICBHYWJy
aWVsIE5hdmEgTWFyaW5vICA8Z25hdmFtYXJpbm9AYXBwbGUuY29tPgorCisgICAgICAgIGJhZF9v
cHRpb25hbF9hY2Nlc3MgaW4gUmVuZGVyR3JpZDo6dXBkYXRlQXV0b01hcmdpbnNJblJvd0F4aXNJ
Zk5lZWRlZAorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9
MjMyOTIyCisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAg
VGhlIG92ZXJyaWRpbmdDb250YWluaW5nQmxvY2tDb250ZW50TG9naWNhbEhlaWdodCgpIGFuZAor
ICAgICAgICBvdmVycmlkaW5nQ29udGFpbmluZ0Jsb2NrQ29udGVudExvZ2ljYWxXaWR0aCgpIG1l
dGhvZHMgaGF2ZSBhIHJldHVybgorICAgICAgICB0eXBlIG9mIHN0ZDo6b3B0aW9uYWw8TGF5b3V0
VW5pdD4sIGJ1dCB3ZSBhbHdheXMgdHJ5IHRvIGFjY2VzcyB2YWx1ZS4KKyAgICAgICAgSW5zdGVh
ZCB1c2UgdmFsdWVfb3IoTGF5b3V0VW5pdCgpKSBhcyB3ZSBhbHJlYWR5IGRvIGluIG90aGVyIGZ1
bmN0aW9ucyBvZgorICAgICAgICB0aGlzIGNsYXNzLiBJbiBjYXNlIG9mIG51bGxvcHQsIHdlIHdp
bGwgdXNlIHRoZSBlYXJseSByZXR1cm4gYWxyZWFkeSBkZWZpbmVkCisgICAgICAgIGZvciBub24t
cG9zaXRpdmUgdmFsdWVzLgorCisgICAgICAgIFRlc3Q6IGZhc3QvY3NzLWdyaWQtbGF5b3V0L2dy
aWQtY3Jhc2gtdXBkYXRlLWF1dG8tbWFyZ2lucy1yb3ctYXhpcy5odG1sCisKKyAgICAgICAgKiBy
ZW5kZXJpbmcvUmVuZGVyR3JpZC5jcHA6CisgICAgICAgIChXZWJDb3JlOjpSZW5kZXJHcmlkOjp1
cGRhdGVBdXRvTWFyZ2luc0luUm93QXhpc0lmTmVlZGVkKToKKyAgICAgICAgKFdlYkNvcmU6OlJl
bmRlckdyaWQ6OnVwZGF0ZUF1dG9NYXJnaW5zSW5Db2x1bW5BeGlzSWZOZWVkZWQpOgorCiAyMDIx
LTExLTEwICBBbGV4IENocmlzdGVuc2VuICA8YWNocmlzdGVuc2VuQHdlYmtpdC5vcmc+CiAKICAg
ICAgICAgSW1wbGVtZW50IHNlcmlhbGl6YXRpb24gYW5kIGRlc2VyaWFsaXphdGlvbiBvZiByZWRp
cmVjdCBhbmQgbW9kaWZ5IGhlYWRlcnMgYWN0aW9ucyBmb3IgV0tDb250ZW50UnVsZUxpc3QKZGlm
ZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL3JlbmRlcmluZy9SZW5kZXJHcmlkLmNwcCBiL1NvdXJj
ZS9XZWJDb3JlL3JlbmRlcmluZy9SZW5kZXJHcmlkLmNwcAppbmRleCBkOTBjMTEzOTE5MjJhNzJl
ODkwMTY4ODFkN2IyM2VkOWIzMGU3NjkzLi4yYmQyYzZkMzFkYTZiMTk1ZTAxYmNlN2FjYTY4YTYx
MWMzNjk2YTMxIDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyR3Jp
ZC5jcHAKKysrIGIvU291cmNlL1dlYkNvcmUvcmVuZGVyaW5nL1JlbmRlckdyaWQuY3BwCkBAIC0x
MjQ1LDcgKzEyNDUsNyBAQCB2b2lkIFJlbmRlckdyaWQ6OnVwZGF0ZUF1dG9NYXJnaW5zSW5Sb3dB
eGlzSWZOZWVkZWQoUmVuZGVyQm94JiBjaGlsZCkKICAgICBpZiAoIW1hcmdpbkVuZC5pc0F1dG8o
KSkKICAgICAgICAgbWFyZ2luTG9naWNhbFdpZHRoICs9IGNoaWxkLm1hcmdpbkVuZCgpOwogCi0g
ICAgTGF5b3V0VW5pdCBhdmFpbGFibGVBbGlnbm1lbnRTcGFjZSA9IGNoaWxkLm92ZXJyaWRpbmdD
b250YWluaW5nQmxvY2tDb250ZW50TG9naWNhbFdpZHRoKCkudmFsdWUoKSAtIGNoaWxkLmxvZ2lj
YWxXaWR0aCgpIC0gbWFyZ2luTG9naWNhbFdpZHRoOworICAgIExheW91dFVuaXQgYXZhaWxhYmxl
QWxpZ25tZW50U3BhY2UgPSBjaGlsZC5vdmVycmlkaW5nQ29udGFpbmluZ0Jsb2NrQ29udGVudExv
Z2ljYWxXaWR0aCgpLnZhbHVlX29yKExheW91dFVuaXQoKSkgLSBjaGlsZC5sb2dpY2FsV2lkdGgo
KSAtIG1hcmdpbkxvZ2ljYWxXaWR0aDsKICAgICBpZiAoYXZhaWxhYmxlQWxpZ25tZW50U3BhY2Ug
PD0gMCkKICAgICAgICAgcmV0dXJuOwogCkBAIC0xMjc2LDcgKzEyNzYsNyBAQCB2b2lkIFJlbmRl
ckdyaWQ6OnVwZGF0ZUF1dG9NYXJnaW5zSW5Db2x1bW5BeGlzSWZOZWVkZWQoUmVuZGVyQm94JiBj
aGlsZCkKICAgICBpZiAoIW1hcmdpbkFmdGVyLmlzQXV0bygpKQogICAgICAgICBtYXJnaW5Mb2dp
Y2FsSGVpZ2h0ICs9IGNoaWxkLm1hcmdpbkFmdGVyKCk7CiAKLSAgICBMYXlvdXRVbml0IGF2YWls
YWJsZUFsaWdubWVudFNwYWNlID0gY2hpbGQub3ZlcnJpZGluZ0NvbnRhaW5pbmdCbG9ja0NvbnRl
bnRMb2dpY2FsSGVpZ2h0KCkudmFsdWUoKSAtIGNoaWxkLmxvZ2ljYWxIZWlnaHQoKSAtIG1hcmdp
bkxvZ2ljYWxIZWlnaHQ7CisgICAgTGF5b3V0VW5pdCBhdmFpbGFibGVBbGlnbm1lbnRTcGFjZSA9
IGNoaWxkLm92ZXJyaWRpbmdDb250YWluaW5nQmxvY2tDb250ZW50TG9naWNhbEhlaWdodCgpLnZh
bHVlX29yKExheW91dFVuaXQoKSkgLSBjaGlsZC5sb2dpY2FsSGVpZ2h0KCkgLSBtYXJnaW5Mb2dp
Y2FsSGVpZ2h0OwogICAgIGlmIChhdmFpbGFibGVBbGlnbm1lbnRTcGFjZSA8PSAwKQogICAgICAg
ICByZXR1cm47CiAKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL0NoYW5nZUxvZyBiL0xheW91dFRl
c3RzL0NoYW5nZUxvZwppbmRleCA1ZTU1NmU0MmM0YWQ2YmI1MzVkYzA5NjgxMDAyZWQwOGViMTc2
OGFkLi44ODJiOWRlNDZhZTQ1ZWVhOGRjZmFlYzQ0MmZmMDQzOTI4OTE5ZTk3IDEwMDY0NAotLS0g
YS9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKKysrIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCkBAIC0x
LDMgKzEsMTMgQEAKKzIwMjEtMTEtMTEgIEdhYnJpZWwgTmF2YSBNYXJpbm8gIDxnbmF2YW1hcmlu
b0BhcHBsZS5jb20+CisKKyAgICAgICAgYmFkX29wdGlvbmFsX2FjY2VzcyBpbiBSZW5kZXJHcmlk
Ojp1cGRhdGVBdXRvTWFyZ2luc0luUm93QXhpc0lmTmVlZGVkCisgICAgICAgIGh0dHBzOi8vYnVn
cy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0yMzI5MjIKKworICAgICAgICBSZXZpZXdlZCBi
eSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICAqIGZhc3QvY3NzLWdyaWQtbGF5b3V0L2dyaWQt
Y3Jhc2gtdXBkYXRlLWF1dG8tbWFyZ2lucy1yb3ctYXhpcy1leHBlY3RlZC50eHQ6IEFkZGVkLgor
ICAgICAgICAqIGZhc3QvY3NzLWdyaWQtbGF5b3V0L2dyaWQtY3Jhc2gtdXBkYXRlLWF1dG8tbWFy
Z2lucy1yb3ctYXhpcy5odG1sOiBBZGRlZC4KKwogMjAyMS0xMS0xMCAgU2FpZCBBYm91LUhhbGxh
d2EgIDxzYWlkQGFwcGxlLmNvbT4KIAogICAgICAgICBbR1BVIFByb2Nlc3NdIE1ha2UgU1ZHRmls
dGVyIGFuZCBDU1NGaWx0ZXIgd29yayBpbiB0aGUgc2FtZSBjb29yZGluYXRlcyBzeXN0ZW0KZGlm
ZiAtLWdpdCBhL0xheW91dFRlc3RzL2Zhc3QvY3NzLWdyaWQtbGF5b3V0L2dyaWQtY3Jhc2gtdXBk
YXRlLWF1dG8tbWFyZ2lucy1yb3ctYXhpcy1leHBlY3RlZC50eHQgYi9MYXlvdXRUZXN0cy9mYXN0
L2Nzcy1ncmlkLWxheW91dC9ncmlkLWNyYXNoLXVwZGF0ZS1hdXRvLW1hcmdpbnMtcm93LWF4aXMt
ZXhwZWN0ZWQudHh0Cm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAwMDAwMDAwMDAw
MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAuLmZlNzJkMzJkNGJkNjcwZTBkNGFlY2I5MzgyZjc4YzMx
MmQ1YjhhNmIKLS0tIC9kZXYvbnVsbAorKysgYi9MYXlvdXRUZXN0cy9mYXN0L2Nzcy1ncmlkLWxh
eW91dC9ncmlkLWNyYXNoLXVwZGF0ZS1hdXRvLW1hcmdpbnMtcm93LWF4aXMtZXhwZWN0ZWQudHh0
CkBAIC0wLDAgKzEsMyBAQAorb25sb2FkID0gKCkgPT4geyBpZiAod2luZG93LnRlc3RSdW5uZXIp
IHRlc3RSdW5uZXIuZHVtcEFzVGV4dCgpOyB9CitsaSB7IG1heC13aWR0aDogbWluLWNvbnRlbnQ7
IGFsaWduLWl0ZW1zOiBiYXNlbGluZTsgfSAqIHsgZGlzcGxheTogaW5saW5lLWdyaWQ7IH0KK1BB
U1MgaWYgdGhpcyBkb2Vzbid0IGNyYXNoLgpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvZmFzdC9j
c3MtZ3JpZC1sYXlvdXQvZ3JpZC1jcmFzaC11cGRhdGUtYXV0by1tYXJnaW5zLXJvdy1heGlzLmh0
bWwgYi9MYXlvdXRUZXN0cy9mYXN0L2Nzcy1ncmlkLWxheW91dC9ncmlkLWNyYXNoLXVwZGF0ZS1h
dXRvLW1hcmdpbnMtcm93LWF4aXMuaHRtbApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAw
MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwLi43MDdkMGY3MzQ0MTE2YjZiYjM5
ZjM2NDE3ZmExNTcwNzNlYjEwYWM0Ci0tLSAvZGV2L251bGwKKysrIGIvTGF5b3V0VGVzdHMvZmFz
dC9jc3MtZ3JpZC1sYXlvdXQvZ3JpZC1jcmFzaC11cGRhdGUtYXV0by1tYXJnaW5zLXJvdy1heGlz
Lmh0bWwKQEAgLTAsMCArMSwxMiBAQAorPCFET0NUWVBFIGh0bWw+Cis8c2NyaXB0Pgorb25sb2Fk
ID0gKCkgPT4geworICBpZiAod2luZG93LnRlc3RSdW5uZXIpCisgICAgdGVzdFJ1bm5lci5kdW1w
QXNUZXh0KCk7Cit9Cis8L3NjcmlwdD4KKzxzdHlsZT4KK2xpIHsgbWF4LXdpZHRoOiBtaW4tY29u
dGVudDsgYWxpZ24taXRlbXM6IGJhc2VsaW5lOyB9CisqIHsgZGlzcGxheTogaW5saW5lLWdyaWQ7
IH0KKzwvc3R5bGU+Cis8bGk+UEFTUyBpZiB0aGlzIGRvZXNuJ3QgY3Jhc2guPC9saT4K
</data>
<flag name="review"
          id="468832"
          type_id="1"
          status="+"
          setter="darin"
    />
    <flag name="commit-queue"
          id="468864"
          type_id="3"
          status="-"
          setter="svillar"
    />
          </attachment>
      

    </bug>

</bugzilla>