236001 2022-02-01 21:59:19 -0800 Workaround ASAN false positive stack-buffer-underflow bmalloc_allocate_impl_casual_case 2025-02-22 18:08:26 -0800 1 1 1 Unclassified WebKit bmalloc Other Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 244560 288303 1 kkinnunen ddkilzer ap darin ddkilzer dino emw ggaren webkit-bug-importer ysuzuki oldest_to_newest 1836328 0 kkinnunen 2022-02-01 21:59:19 -0800 ASAN false positive stack-buffer-underflow bmalloc_allocate_impl_casual_case 1836329 1 webkit-bug-importer 2022-02-01 21:59:52 -0800 <rdar://problem/88364275> 1836330 2 kkinnunen 2022-02-01 22:00:32 -0800 see also <rdar://87613908> 1836334 3 450611 kkinnunen 2022-02-01 22:11:39 -0800 Created attachment 450611 Patch 1836341 4 450613 kkinnunen 2022-02-01 23:08:52 -0800 Created attachment 450613 Patch 1836385 5 450613 ddkilzer 2022-02-02 02:15:48 -0800 Comment on attachment 450613 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=450613&action=review > Source/bmalloc/Configurations/bmalloc.xcconfig:36 > +BMALLOC_ADDRESS_SANITIZER_OTHER_CFLAGS_YES = -fno-sanitize-address-use-after-scope; This will turn it off for all ASan builds on older clang versions, not just the affected versions of clang. We should figure out how to only enable this on given versions of Xcode or the SDK. Just need to find an example of how to do this in other xcconfig files. (I’m not actually awake. :) 1836666 6 450613 ddkilzer 2022-02-02 15:33:21 -0800 Comment on attachment 450613 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=450613&action=review >> Source/bmalloc/Configurations/bmalloc.xcconfig:36 >> +BMALLOC_ADDRESS_SANITIZER_OTHER_CFLAGS_YES = -fno-sanitize-address-use-after-scope; > > This will turn it off for all ASan builds on older clang versions, not just the affected versions of clang. > > We should figure out how to only enable this on given versions of Xcode or the SDK. Just need to find an example of how to do this in other xcconfig files. > > (I’m not actually awake. :) Modeling this after the `WK_XCODE_SUPPORTS_LTO` variables in Source/bmalloc/Configurations/Base.xcconfig should work here. Something like this: OTHER_CFLAGS = $(inherited) $(BMALLOC_ADDRESS_SANITIZER_OTHER_CFLAGS); // Workaround a false positive <https://bugs.webkit.org/show_bug.cgi?id=236001>. BMALLOC_ADDRESS_SANITIZER_OTHER_CFLAGS = $(BMALLOC_ADDRESS_SANITIZER_OTHER_CFLAGS_$(WK_WORKAROUND_ASAN_USE_AFTER_SCOPE)); BMALLOC_ADDRESS_SANITIZER_OTHER_CFLAGS_YES = -fno-sanitize-address-use-after-scope; WK_WORKAROUND_ASAN_USE_AFTER_SCOPE = $(WK_NOT_$(WK_XCODE_VERSION_BEFORE_13_3_$(XCODE_VERSION_MAJOR))); WK_XCODE_VERSION_BEFORE_13_3_0800 = YES; WK_XCODE_VERSION_BEFORE_13_3_0900 = YES; WK_XCODE_VERSION_BEFORE_13_3_1000 = YES; WK_XCODE_VERSION_BEFORE_13_3_1100 = YES; WK_XCODE_VERSION_BEFORE_13_3_1200 = YES; WK_XCODE_VERSION_BEFORE_13_3_1300 = $(WK_XCODE_VERSION_BEFORE_13_3_1300_$(XCODE_VERSION_MINOR)); WK_XCODE_VERSION_BEFORE_13_3_1300_1300 = YES; WK_XCODE_VERSION_BEFORE_13_3_1300_1310 = YES; WK_XCODE_VERSION_BEFORE_13_3_1300_1320 = YES; 1836668 7 ddkilzer 2022-02-02 15:34:58 -0800 When the bug is fixed, we'll have to add another clause for the fixed-in version. 1836702 8 450717 ddkilzer 2022-02-02 16:39:26 -0800 Created attachment 450717 Patch v2 1836956 9 ddkilzer 2022-02-03 08:52:10 -0800 Confirmed that this only 1836957 10 ddkilzer 2022-02-03 08:54:03 -0800 (In reply to David Kilzer (:ddkilzer) from comment #9) > Confirmed that this only ... adds -fno-sanitize-address-use-after-scope when compiling the bmalloc project. Hmm...I probably need to only enable this for Asan builds, though. "Patch v2" is enabling it for all builds. Might also be able to move this to Tools/sanitizer/asan.xcconfig using the project name to enable it. 1837091 11 450812 ddkilzer 2022-02-03 13:42:43 -0800 Created attachment 450812 Patch v3 1837094 12 ddkilzer 2022-02-03 13:46:48 -0800 (In reply to David Kilzer (:ddkilzer) from comment #11) > Created attachment 450812 [details] > Patch v3 Moved the workaround to Tools/sanitizer/asan.xcconfig so that it's only applied when building with ASan, and limited it to the bmalloc project via $(PRODUCT_NAME). 1837100 13 darin 2022-02-03 13:54:25 -0800 (In reply to David Kilzer (:ddkilzer) from comment #12) > limited it to the bmalloc project via $(PRODUCT_NAME). Great! Just makes me wonder if we could easily make it just the one source file (kidding, kind of). 1837181 14 450812 ddkilzer 2022-02-03 17:15:44 -0800 Comment on attachment 450812 Patch v3 Just tested this and the bug still reproduces with this change. I think the change may need to include JavaScriptCore as well. Doing more testing. 1841180 15 450812 kkinnunen 2022-02-14 03:16:57 -0800 Comment on attachment 450812 Patch v3 View in context: https://bugs.webkit.org/attachment.cgi?id=450812&action=review > Tools/sanitizer/asan.xcconfig:9 > +WK_ADDRESS_SANITIZER_OTHER_CPLUSPLUSFLAGS_YES = -U_LIBCPP_HAS_NO_ASAN $(WK_NEEDS_ASAN_USE_AFTER_SCOPE_WORKAROUND_FOR_$(PRODUCT_NAME)_$(WK_NEEDS_ASAN_USE_AFTER_SCOPE_WORKAROUND)); I don't think CPLUSPLUSFLAGS applies for libpas, it's C code? Maybe this is why it's still reproing for you. 1842091 16 450812 ddkilzer 2022-02-15 19:26:07 -0800 Comment on attachment 450812 Patch v3 View in context: https://bugs.webkit.org/attachment.cgi?id=450812&action=review >> Tools/sanitizer/asan.xcconfig:9 >> +WK_ADDRESS_SANITIZER_OTHER_CPLUSPLUSFLAGS_YES = -U_LIBCPP_HAS_NO_ASAN $(WK_NEEDS_ASAN_USE_AFTER_SCOPE_WORKAROUND_FOR_$(PRODUCT_NAME)_$(WK_NEEDS_ASAN_USE_AFTER_SCOPE_WORKAROUND)); > > I don't think CPLUSPLUSFLAGS applies for libpas, it's C code? > Maybe this is why it's still reproing for you. This is probably correct. I have a more targeted workaround for "v4" now. 1842094 17 452125 ddkilzer 2022-02-15 19:29:25 -0800 Created attachment 452125 Patch v4 1842095 18 ddkilzer 2022-02-15 19:30:48 -0800 (In reply to David Kilzer (:ddkilzer) from comment #17) > Created attachment 452125 [details] > Patch v4 This is the super-targeted fix for the specific function having the issue, and only with specific versions of Xcode. 1842282 19 452125 ddkilzer 2022-02-16 07:35:23 -0800 Comment on attachment 452125 Patch v4 Adding cq+ since this doesn't change how the code is compiled unless ASan is enabled. 1842284 20 ddkilzer 2022-02-16 07:37:56 -0800 (In reply to David Kilzer (:ddkilzer) from comment #19) > Comment on attachment 452125 [details] > Patch v4 > > Adding cq+ since this doesn't change how the code is compiled unless ASan is > enabled. This change doesn't even impact the Windows build, so the win test failures are flakey tests. 1842358 21 ews-feeder 2022-02-16 10:12:09 -0800 Committed r289904 (247337@main): <https://commits.webkit.org/247337@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 452125. 1847877 22 kkinnunen 2022-03-03 07:26:26 -0800 Still seeing this ==40555==ERROR: AddressSanitizer: stack-use-after-scope on address 0x700004b81480 at pc 0x0004a7527ae3 bp 0x700004b80c30 sp 0x700004b80c28 READ of size 72 at 0x700004b81480 thread T321 #0 0x4a7527ae2 in try_allocate_without_fixing pas_simple_large_free_heap.c:396 #1 0x4a7523b85 in pas_simple_large_free_heap_try_allocate pas_simple_large_free_heap.c:472 #2 0x4a74e5374 in pas_large_heap_physical_page_sharing_cache_try_allocate_with_alignment pas_large_heap_physical_page_sharing_cache.c:188 #3 0x4a74a2f64 in jit_aligned_allocator jit_heap_config.c:260 #4 0x4a74e5089 in aligned_allocator pas_large_heap.c:69 #5 0x4a74d4117 in pas_fast_large_free_heap_try_allocate pas_fast_large_free_heap.c:422 #6 0x4a74e3717 in allocate_impl pas_large_heap.c:125 #7 0x4a74e3ac6 in pas_large_heap_try_allocate pas_large_heap.c:174 #8 0x4a74a903d in jit_heap_config_specialized_try_allocate_common_impl_slow jit_heap_config.c:375 #9 0x4a749158c in jit_try_allocate_common_primitive_impl_impl_slow jit_heap.c:65 #10 0x4a74912bd in jit_try_allocate_common_primitive_impl_casual_case jit_heap.c:65 #11 0x4a7490239 in jit_heap_try_allocate jit_heap.c:81 #12 0x4a9c224cf in JSC::ExecutableMemoryHandle::createImpl(unsigned long) ExecutableAllocator.cpp:1221 #13 0x4a9c21bd1 in JSC::FixedVMPoolExecutableAllocator::allocate(unsigned long) ExecutableAllocator.cpp:489 #14 0x4a9c21538 in JSC::ExecutableAllocator::allocate(unsigned long, JSC::JITCompilationEffort) ExecutableAllocator.cpp:1047 #15 0x4a83f527c in JSC::LinkBuffer::allocate(JSC::MacroAssembler&, JSC::JITCompilationEffort) LinkBuffer.cpp:444 #16 0x4a83f4da9 in JSC::LinkBuffer::linkCode(JSC::MacroAssembler&, JSC::JITCompilationEffort) LinkBuffer.cpp:399 #17 0x4a84156a9 in JSC::LinkBuffer::LinkBuffer(JSC::MacroAssembler&, void*, JSC::LinkBuffer::Profile, JSC::JITCompilationEffort) LinkBuffer.h:126 #18 0x4a8411e88 in JSC::LinkBuffer::LinkBuffer(JSC::MacroAssembler&, void*, JSC::LinkBuffer::Profile, JSC::JITCompilationEffort) LinkBuffer.h:124 #19 0x4a9c56dda in JSC::JIT::compileAndLinkWithoutFinalizing(JSC::JITCompilationEffort) JIT.cpp:865 #20 0x4a9c03f0e in JSC::BaselineJITPlan::compileInThreadImpl() BaselineJITPlan.cpp:48 #21 0x4a9e79cb1 in JSC::JITPlan::compileInThread(JSC::JITWorklistThread*) JITPlan.cpp:170 #22 0x4aa129dd1 in JSC::JITWorklistThread::work() JITWorklistThread.cpp:123 #23 0x4a72357d0 in WTF::AutomaticThread::start(WTF::AbstractLocker const&)::$_0::operator()() const AutomaticThread.cpp:229 #24 0x4a72350fc in WTF::Detail::CallableWrapper<WTF::AutomaticThread::start(WTF::AbstractLocker const&)::$_0, void>::call() Function.h:53 #25 0x4a725195a in WTF::Function<void ()>::operator()() const Function.h:82 #26 0x4a73670b6 in WTF::Thread::entryPoint(WTF::Thread::NewThreadContext*) Threading.cpp:235 #27 0x4a7372678 in WTF::wtfThreadEntryPoint(void*) ThreadingPOSIX.cpp:242 #28 0x7fff71a094e0 in _pthread_start+0x7c (libsystem_pthread.dylib:x86_64+0x64e0) #29 0x7fff71a04f6a in thread_start+0xe (libsystem_pthread.dylib:x86_64+0x1f6a) Address 0x700004b81480 is located in stack of thread T321 at offset 2112 in frame #0 0x4a7523bbf in try_allocate_without_fixing pas_simple_large_free_heap.c:393 This frame has 26 object(s): [32, 56) 'left_free.i165' (line 292) [96, 168) 'tmp.i114' [208, 256) 'tmp8.i115' [288, 336) 'tmp24.i' [368, 416) 'tmp31.i' [448, 472) 'candidate.i5760113' [512, 584) 'candidate_result.i61' [624, 696) 'tmp.i' [736, 760) 'candidate.i5760' [800, 824) 'new_free.i600.i' [864, 888) 'new_free.i571.i' [928, 952) 'new_free.i.i' [992, 1064) 'tmp.i.i' [1104, 1152) 'tmp8.i.i' [1184, 1232) 'tmp24.i.i' [1264, 1312) 'tmp31.i.i' [1344, 1416) 'best.i' [1456, 1576) 'test_allocation_candidate_data.i' [1616, 1672) 'page_allocation.i' [1712, 1736) 'candidate.i' [1776, 1848) 'candidate_result.i' [1888, 1912) 'merged.i' [1952, 2008) 'tmp13.i' [2048, 2072) 'new_free.i' [2112, 2184) 'tmp66.i' <== Memory access at offset 2112 is inside this variable [2224, 2272) 'additions.i' HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork (longjmp and C++ exceptions *are* supported) Thread T321 created by T0 here: #0 0x47850cd9c in wrap_pthread_create+0x5c (libclang_rt.asan_iossim_dynamic.dylib:x86_64+0x3bd9c) #1 0x4a7372540 in WTF::Thread::establishHandle(WTF::Thread::NewThreadContext*, std::__1::optional<unsigned long>, WTF::Thread::QOS) ThreadingPOSIX.cpp:292 #2 0x4a7367395 in WTF::Thread::create(char const*, WTF::Function<void ()>&&, WTF::ThreadType, WTF::Thread::QOS) Threading.cpp:251 #3 0x4a7230788 in WTF::AutomaticThread::start(WTF::AbstractLocker const&) AutomaticThread.cpp:171 #4 0x4a72303ba in WTF::AutomaticThreadCondition::notifyOne(WTF::AbstractLocker const&) AutomaticThread.cpp:60 #5 0x4aa110377 in JSC::JITWorklist::enqueue(WTF::Ref<JSC::JITPlan, WTF::RawPtrTraits<JSC::JITPlan> >) JITWorklist.cpp:96 #6 0x4a9412d08 in JSC::DFG::compileImpl(JSC::VM&, JSC::CodeBlock*, JSC::CodeBlock*, JSC::JITCompilationMode, JSC::BytecodeIndex, JSC::Operands<std::__1::optional<JSC::JSValue>, WTF::Vector<std::__1::optional<JSC::JSValue>, 0ul, WTF::UnsafeVectorOverflow, 16ul, WTF::FastMalloc> > const&, WTF::Ref<JSC::DeferredCompilationCallback, WTF::RawPtrTraits<JSC::DeferredCompilationCallback> >&&) DFGDriver.cpp:90 #7 0x4a94128a3 in JSC::DFG::compile(JSC::VM&, JSC::CodeBlock*, JSC::CodeBlock*, JSC::JITCompilationMode, JSC::BytecodeIndex, JSC::Operands<std::__1::optional<JSC::JSValue>, WTF::Vector<std::__1::optional<JSC::JSValue>, 0ul, WTF::UnsafeVectorOverflow, 16ul, WTF::FastMalloc> > const&, WTF::Ref<JSC::DeferredCompilationCallback, WTF::RawPtrTraits<JSC::DeferredCompilationCallback> >&&) DFGDriver.cpp:106 #8 0x4a9db7be1 in operationOptimize JITOperations.cpp:2001 #9 0x21a0e5a1c0f3 (<unknown module>) #10 0x21a0e5adbcd3 (<unknown module>) #11 0x21a0e5adbcd3 (<unknown module>) #12 0x21a0e5adbcd3 (<unknown module>) #13 0x21a0e5adbcd3 (<unknown module>) #14 0x21a0e5c080a1 (<unknown module>) #15 0x21a0e5bf7977 (<unknown module>) #16 0x4a81ef43b in llint_entry LowLevelInterpreter.asm:1171 #17 0x4a81d21d8 in vmEntryToJavaScript LowLevelInterpreter64.asm:351 #18 0x4a9bd9581 in JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::JSGlobalObject*, JSC::JSObject*) Interpreter.cpp:977 #19 0x4aa620572 in JSC::evaluate(JSC::JSGlobalObject*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) Completion.cpp:137 #20 0x4aa62082b in JSC::profiledEvaluate(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) Completion.cpp:152 #21 0x4ce9bc9df in WebCore::JSExecState::profiledEvaluate(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) JSExecState.h:104 #22 0x4ce9bc17c in WebCore::ScriptController::evaluateInWorld(WebCore::ScriptSourceCode const&, WebCore::DOMWrapperWorld&) ScriptController.cpp:152 #23 0x4ce9bbcf1 in WebCore::ScriptController::evaluateInWorldIgnoringException(WebCore::ScriptSourceCode const&, WebCore::DOMWrapperWorld&) ScriptController.cpp:119 #24 0x4ce9bcbbf in WebCore::ScriptController::evaluateIgnoringException(WebCore::ScriptSourceCode const&) ScriptController.cpp:171 #25 0x4cf4ceba7 in WebCore::ScriptElement::executeClassicScript(WebCore::ScriptSourceCode const&) ScriptElement.cpp:400 #26 0x4cf4cb3a2 in WebCore::ScriptElement::prepareScript(WTF::TextPosition const&, WebCore::ScriptElement::LegacyTypeSupport) ScriptElement.cpp:283 #27 0x4cfbaee68 in WebCore::HTMLScriptRunner::runScript(WebCore::ScriptElement&, WTF::TextPosition const&) HTMLScriptRunner.cpp:250 #28 0x4cfbaeb56 in WebCore::HTMLScriptRunner::execute(WTF::Ref<WebCore::ScriptElement, WTF::RawPtrTraits<WebCore::ScriptElement> >&&, WTF::TextPosition const&) HTMLScriptRunner.cpp:140 #29 0x4cfb8937f in WebCore::HTMLDocumentParser::runScriptsForPausedTreeBuilder() HTMLDocumentParser.cpp:241 #30 0x4cfb898ba in WebCore::HTMLDocumentParser::pumpTokenizerLoop(WebCore::HTMLDocumentParser::SynchronousMode, bool, WebCore::PumpSession&) HTMLDocumentParser.cpp:261 #31 0x4cfb889df in WebCore::HTMLDocumentParser::pumpTokenizer(WebCore::HTMLDocumentParser::SynchronousMode) HTMLDocumentParser.cpp:306 #32 0x4cfb88578 in WebCore::HTMLDocumentParser::pumpTokenizerIfPossible(WebCore::HTMLDocumentParser::SynchronousMode) HTMLDocumentParser.cpp:193 #33 0x4cfb8a7d0 in WebCore::HTMLDocumentParser::append(WTF::RefPtr<WTF::StringImpl, WTF::RawPtrTraits<WTF::StringImpl>, WTF::DefaultRefDerefTraits<WTF::StringImpl> >&&, WebCore::HTMLDocumentParser::SynchronousMode) HTMLDocumentParser.cpp:431 #34 0x4cfb8a4d5 in WebCore::HTMLDocumentParser::append(WTF::RefPtr<WTF::StringImpl, WTF::RawPtrTraits<WTF::StringImpl>, WTF::DefaultRefDerefTraits<WTF::StringImpl> >&&) HTMLDocumentParser.cpp:391 #35 0x4cf24874b in WebCore::DecodedDataDocumentParser::appendBytes(WebCore::DocumentWriter&, unsigned char const*, unsigned long) DecodedDataDocumentParser.cpp:50 #36 0x4d01033af in WebCore::DocumentWriter::addData(WebCore::SharedBuffer const&) DocumentWriter.cpp:276 #37 0x4d00f89aa in WebCore::DocumentLoader::commitData(WebCore::SharedBuffer const&) DocumentLoader.cpp:1314 #38 0x48d5037a2 in WebKit::WebFrameLoaderClient::committedLoad(WebCore::DocumentLoader*, WebCore::SharedBuffer const&) WebFrameLoaderClient.cpp:1163 #39 0x4d01016d7 in WebCore::DocumentLoader::commitLoad(WebCore::SharedBuffer const&) DocumentLoader.cpp:1178 #40 0x4d0103511 in WebCore::DocumentLoader::dataReceived(WebCore::SharedBuffer const&) DocumentLoader.cpp:1346 #41 0x4d010342b in WebCore::DocumentLoader::dataReceived(WebCore::CachedResource&, WebCore::SharedBuffer const&) DocumentLoader.cpp:1320 #42 0x4d02e0772 in WebCore::CachedRawResource::notifyClientsDataWasReceived(WebCore::SharedBuffer const&) CachedRawResource.cpp:145 #43 0x4d02e03c2 in WebCore::CachedRawResource::updateBuffer(WebCore::FragmentedSharedBuffer const&) CachedRawResource.cpp:81 #44 0x4d0253b39 in WebCore::SubresourceLoader::didReceiveBuffer(WebCore::FragmentedSharedBuffer const&, long long, WebCore::DataPayloadType) SubresourceLoader.cpp:545 #45 0x4d022b085 in WebCore::ResourceLoader::didReceiveData(WebCore::SharedBuffer const&, long long, WebCore::DataPayloadType) ResourceLoader.cpp:559 #46 0x48d37693e in WebKit::WebResourceLoader::didReceiveData(IPC::SharedBufferCopy const&, long long) WebResourceLoader.cpp:238 #47 0x48dd86acc in void IPC::callMemberFunctionImpl<WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(IPC::SharedBufferCopy const&, long long), std::__1::tuple<IPC::SharedBufferCopy, long long>, 0ul, 1ul>(WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(IPC::SharedBufferCopy const&, long long), std::__1::tuple<IPC::SharedBufferCopy, long long>&&, std::__1::integer_sequence<unsigned long, 0ul, 1ul>) HandleMessage.h:125 #48 0x48dd86a38 in void IPC::callMemberFunction<WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(IPC::SharedBufferCopy const&, long long), std::__1::tuple<IPC::SharedBufferCopy, long long>, std::__1::integer_sequence<unsigned long, 0ul, 1ul> >(std::__1::tuple<IPC::SharedBufferCopy, long long>&&, WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(IPC::SharedBufferCopy const&, long long)) HandleMessage.h:131 #49 0x48dd81394 in void IPC::handleMessage<Messages::WebResourceLoader::DidReceiveData, WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(IPC::SharedBufferCopy const&, long long)>(IPC::Connection&, IPC::Decoder&, WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(IPC::SharedBufferCopy const&, long long)) HandleMessage.h:196 #50 0x48dd80aec in WebKit::WebResourceLoader::didReceiveWebResourceLoaderMessage(IPC::Connection&, IPC::Decoder&) WebResourceLoaderMessageReceiver.cpp:74 #51 0x48d35fbe6 in WebKit::NetworkProcessConnection::didReceiveMessage(IPC::Connection&, IPC::Decoder&) NetworkProcessConnection.cpp:102 #52 0x48c20fcf7 in IPC::Connection::dispatchMessage(IPC::Decoder&) Connection.cpp:1092 #53 0x48c210757 in IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >) Connection.cpp:1137 #54 0x48c2112c5 in IPC::Connection::dispatchOneIncomingMessage() Connection.cpp:1206 #55 0x48c22e275 in IPC::Connection::enqueueIncomingMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >)::$_15::operator()() Connection.cpp:1056 #56 0x48c22e1dc in WTF::Detail::CallableWrapper<IPC::Connection::enqueueIncomingMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >)::$_15, void>::call() Function.h:53 #57 0x4a725195a in WTF::Function<void ()>::operator()() const Function.h:82 #58 0x4a7311fd7 in WTF::RunLoop::performWork() RunLoop.cpp:133 #59 0x4a7315589 in WTF::RunLoop::performWork(void*) RunLoopCF.cpp:46 #60 0x7fff2037490e in __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__+0x10 (CoreFoundation:x86_64+0x8290e) #61 0x7fff20374806 in __CFRunLoopDoSource0+0xb3 (CoreFoundation:x86_64+0x82806) #62 0x7fff20373cd3 in __CFRunLoopDoSources0+0xf1 (CoreFoundation:x86_64+0x81cd3) #63 0x7fff2036e3cf in __CFRunLoopRun+0x366 (CoreFoundation:x86_64+0x7c3cf) #64 0x7fff2036db6b in CFRunLoopRunSpecific+0x231 (CoreFoundation:x86_64+0x7bb6b) #65 0x7fff20828860 in -[NSRunLoop(NSRunLoop) runMode:beforeDate:]+0xd4 (Foundation:x86_64+0x123860) #66 0x7fff20828a7e in -[NSRunLoop(NSRunLoop) run]+0x4b (Foundation:x86_64+0x123a7e) #67 0x7fff2006afea in _xpc_objc_main+0x1b7 (libxpc.dylib:x86_64+0x12fea) #68 0x7fff2006cfd3 in xpc_main+0x79 (libxpc.dylib:x86_64+0x14fd3) #69 0x48b93f60f in WebKit::XPCServiceMain(int, char const**) XPCServiceMain.mm:223 #70 0x48df69da8 in WKXPCServiceMain WKMain.mm:35 #71 0x104465cc8 in main AuxiliaryProcessMain.cpp:30 #72 0x47820bf20 (<unknown module>) #73 0x1141ec51d in start+0x1cd (dyld:x86_64+0x551d) SUMMARY: AddressSanitizer: stack-use-after-scope pas_simple_large_free_heap.c:396 in try_allocate_without_fixing Shadow bytes around the buggy address: 0x0e04e6630240: 00 00 00 00 00 00 00 00 00 00 00 00 00 f2 f2 f2 0x0e04e6630250: f2 f2 00 00 00 00 00 00 00 f2 f2 f2 f2 f2 00 00 0x0e04e6630260: 00 f2 f2 f2 f2 f2 00 00 00 00 00 00 00 00 00 f2 0x0e04e6630270: f2 f2 f2 f2 00 00 00 f2 f2 f2 f2 f2 f8 f8 f8 f8 0x0e04e6630280: f8 f8 f8 f2 f2 f2 f2 f2 f8 f8 f8 f2 f2 f2 f2 f2 =>0x0e04e6630290:[f8]f8 f8 f8 f8 f8 f8 f8 f8 f2 f2 f2 f2 f2 f8 f8 0x0e04e66302a0: f8 f8 f8 f8 f3 f3 f3 f3 00 00 00 00 00 00 00 00 0x0e04e66302b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0e04e66302c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0e04e66302d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0e04e66302e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==40555==ABORTING com.apple.WebKit.WebContent.Development terminated (pid 40555) because the process crashed 1894993 23 ddkilzer 2022-08-30 17:11:34 -0700 This should cover remaining issues: Bug 244560: Workaround ASAN false positive stack-buffer-underflow in pas_fast_large_free_heap_try_allocate 450611 2022-02-01 22:11:39 -0800 2022-02-01 23:08:47 -0800 Patch bug-236001-20220202081137.patch text/plain 1614 kkinnunen U3VidmVyc2lvbiBSZXZpc2lvbjogMjg4NjEwCmRpZmYgLS1naXQgYS9Tb3VyY2UvYm1hbGxvYy9D aGFuZ2VMb2cgYi9Tb3VyY2UvYm1hbGxvYy9DaGFuZ2VMb2cKaW5kZXggNThiNzNlNmZjMzU1MWYw NTlmNTY1NTdmODk4MWQ1MTBiYjk5MWVhYS4uZDliZmRmNWI2NGUzYjQ3ZmE0Njk3YTQ0NDYxNzky ZTM0OTc3ODkzOSAxMDA2NDQKLS0tIGEvU291cmNlL2JtYWxsb2MvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9ibWFsbG9jL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE2IEBACisyMDIyLTAyLTAxICBLaW1t byBLaW5udW5lbiAgPGtraW5udW5lbkBhcHBsZS5jb20+CisKKyAgICAgICAgQVNBTiBmYWxzZSBw b3NpdGl2ZSBzdGFjay1idWZmZXItdW5kZXJmbG93IGJtYWxsb2NfYWxsb2NhdGVfaW1wbF9jYXN1 YWxfY2FzZQorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9 MjM2MDAxCisgICAgICAgIDxyZGFyOi8vcHJvYmxlbS84ODM2NDI3NT4KKworICAgICAgICBSZXZp ZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBEaXNhYmxlIHNhbml0aXplLWFkZHJl c3MtdXNlLWFmdGVyLXNjb3BlIHRlbXBvcmFyaWx5IHVudGlsIHRoZSBmYWxzZSBwb3NpdGl2ZSBj YW4gYmUKKyAgICAgICAgZml4ZWQuCisKKyAgICAgICAgKiBDb25maWd1cmF0aW9ucy9ibWFsbG9j LnhjY29uZmlnOgorCiAyMDIyLTAxLTIxICBDb21taXQgUXVldWUgIDxjb21taXQtcXVldWVAd2Vi a2l0Lm9yZz4KIAogICAgICAgICBVbnJldmlld2VkLCByZXZlcnRpbmcgcjI4ODQwMC4KZGlmZiAt LWdpdCBhL1NvdXJjZS9ibWFsbG9jL0NvbmZpZ3VyYXRpb25zL2JtYWxsb2MueGNjb25maWcgYi9T b3VyY2UvYm1hbGxvYy9Db25maWd1cmF0aW9ucy9ibWFsbG9jLnhjY29uZmlnCmluZGV4IGM2Mzcy NzNhZmExMTA0YTk3YzdmNGVkNDMyNzcxNjM4N2VjMWFlMDUuLmFjMjMwOGQ4MTM1NTczMDgyNDU4 MDRhYzhlMWUxYzg5NzJiZGVhYjEgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9ibWFsbG9jL0NvbmZpZ3Vy YXRpb25zL2JtYWxsb2MueGNjb25maWcKKysrIGIvU291cmNlL2JtYWxsb2MvQ29uZmlndXJhdGlv bnMvYm1hbGxvYy54Y2NvbmZpZwpAQCAtMjgsMyArMjgsMTAgQEAgUFJPRFVDVF9OQU1FID0gYm1h bGxvYzsKIAogR0NDX1NZTUJPTFNfUFJJVkFURV9FWFRFUk4gPSBZRVM7CiBTVFJJUF9JTlNUQUxM RURfUFJPRFVDVCA9IE5POworCitPVEhFUl9DRkxBR1MgPSAkKGluaGVyaXRlZCkgJChCTUFMTE9D X0FERFJFU1NfU0FOSVRJWkVSX09USEVSX0NGTEFHUyk7CisKKy8vIFdvcmthcm91bmQgYSBmYWxz ZSBwb3NpdGl2ZSBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjM2MDAx CitCTUFMTE9DX0FERFJFU1NfU0FOSVRJWkVSX09USEVSX0NGTEFHUyA9ICQoQk1BTExPQ19BRERS RVNTX1NBTklUSVpFUl9PVEhFUl9DRkxBR1NfJChFTkFCTEVfQUREUkVTU19TQU5JVElaRVIpKTsK K0JNQUxMT0NfQUREUkVTU19TQU5JVElaRVJfT1RIRVJfQ0ZMQUdTX05PID0gOworQk1BTExPQ19B RERSRVNTX1NBTklUSVpFUl9PVEhFUl9DRkxBR1NfWUVTID0gLWZuby1zYW5pdGl6ZS1hZGRyZXNz LXVzZS1hZnRlci1zY29wZTsK 450613 2022-02-01 23:08:52 -0800 2022-02-02 16:39:24 -0800 Patch bug-236001-20220202090850.patch text/plain 1566 kkinnunen U3VidmVyc2lvbiBSZXZpc2lvbjogMjg4NjEwCmRpZmYgLS1naXQgYS9Tb3VyY2UvYm1hbGxvYy9D aGFuZ2VMb2cgYi9Tb3VyY2UvYm1hbGxvYy9DaGFuZ2VMb2cKaW5kZXggNThiNzNlNmZjMzU1MWYw NTlmNTY1NTdmODk4MWQ1MTBiYjk5MWVhYS4uZDliZmRmNWI2NGUzYjQ3ZmE0Njk3YTQ0NDYxNzky ZTM0OTc3ODkzOSAxMDA2NDQKLS0tIGEvU291cmNlL2JtYWxsb2MvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9ibWFsbG9jL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE2IEBACisyMDIyLTAyLTAxICBLaW1t byBLaW5udW5lbiAgPGtraW5udW5lbkBhcHBsZS5jb20+CisKKyAgICAgICAgQVNBTiBmYWxzZSBw b3NpdGl2ZSBzdGFjay1idWZmZXItdW5kZXJmbG93IGJtYWxsb2NfYWxsb2NhdGVfaW1wbF9jYXN1 YWxfY2FzZQorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9 MjM2MDAxCisgICAgICAgIDxyZGFyOi8vcHJvYmxlbS84ODM2NDI3NT4KKworICAgICAgICBSZXZp ZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBEaXNhYmxlIHNhbml0aXplLWFkZHJl c3MtdXNlLWFmdGVyLXNjb3BlIHRlbXBvcmFyaWx5IHVudGlsIHRoZSBmYWxzZSBwb3NpdGl2ZSBj YW4gYmUKKyAgICAgICAgZml4ZWQuCisKKyAgICAgICAgKiBDb25maWd1cmF0aW9ucy9ibWFsbG9j LnhjY29uZmlnOgorCiAyMDIyLTAxLTIxICBDb21taXQgUXVldWUgIDxjb21taXQtcXVldWVAd2Vi a2l0Lm9yZz4KIAogICAgICAgICBVbnJldmlld2VkLCByZXZlcnRpbmcgcjI4ODQwMC4KZGlmZiAt LWdpdCBhL1NvdXJjZS9ibWFsbG9jL0NvbmZpZ3VyYXRpb25zL2JtYWxsb2MueGNjb25maWcgYi9T b3VyY2UvYm1hbGxvYy9Db25maWd1cmF0aW9ucy9ibWFsbG9jLnhjY29uZmlnCmluZGV4IGM2Mzcy NzNhZmExMTA0YTk3YzdmNGVkNDMyNzcxNjM4N2VjMWFlMDUuLmMyZWMxMjhkMWQ0NTFjYmU5Y2Ex NmYwNjQ3OGNkOGQxZThiMWM4NjggMTAwNjQ0Ci0tLSBhL1NvdXJjZS9ibWFsbG9jL0NvbmZpZ3Vy YXRpb25zL2JtYWxsb2MueGNjb25maWcKKysrIGIvU291cmNlL2JtYWxsb2MvQ29uZmlndXJhdGlv bnMvYm1hbGxvYy54Y2NvbmZpZwpAQCAtMjgsMyArMjgsOSBAQCBQUk9EVUNUX05BTUUgPSBibWFs bG9jOwogCiBHQ0NfU1lNQk9MU19QUklWQVRFX0VYVEVSTiA9IFlFUzsKIFNUUklQX0lOU1RBTExF RF9QUk9EVUNUID0gTk87CisKK09USEVSX0NGTEFHUyA9ICQoaW5oZXJpdGVkKSAkKEJNQUxMT0Nf QUREUkVTU19TQU5JVElaRVJfT1RIRVJfQ0ZMQUdTKTsKKworLy8gV29ya2Fyb3VuZCBhIGZhbHNl IHBvc2l0aXZlIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0yMzYwMDEK K0JNQUxMT0NfQUREUkVTU19TQU5JVElaRVJfT1RIRVJfQ0ZMQUdTID0gJChCTUFMTE9DX0FERFJF U1NfU0FOSVRJWkVSX09USEVSX0NGTEFHU18kKEVOQUJMRV9BRERSRVNTX1NBTklUSVpFUikpOwor Qk1BTExPQ19BRERSRVNTX1NBTklUSVpFUl9PVEhFUl9DRkxBR1NfWUVTID0gLWZuby1zYW5pdGl6 ZS1hZGRyZXNzLXVzZS1hZnRlci1zY29wZTsK 450717 2022-02-02 16:39:26 -0800 2022-02-03 13:42:40 -0800 Patch v2 bug-236001-20220202163926.patch text/plain 2260 ddkilzer U3VidmVyc2lvbiBSZXZpc2lvbjogMjg5MDEyCmRpZmYgLS1naXQgYS9Tb3VyY2UvYm1hbGxvYy9D aGFuZ2VMb2cgYi9Tb3VyY2UvYm1hbGxvYy9DaGFuZ2VMb2cKaW5kZXggOTY2NDY2N2VkZGNmYTZl NjI2OGQzODZhM2VlMWMwMjIzMDkzNTNhNC4uNzRkY2U5Y2U5N2VmMWFjZjljMDcxNjJmNjZmZWQ1 ZTRkZjgzYjBkMSAxMDA2NDQKLS0tIGEvU291cmNlL2JtYWxsb2MvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9ibWFsbG9jL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE4IEBACisyMDIyLTAyLTAyICBEYXZp ZCBLaWx6ZXIgIDxkZGtpbHplckBhcHBsZS5jb20+CisKKyAgICAgICAgQVNBTiBmYWxzZSBwb3Np dGl2ZSBzdGFjay1idWZmZXItdW5kZXJmbG93IGJtYWxsb2NfYWxsb2NhdGVfaW1wbF9jYXN1YWxf Y2FzZQorICAgICAgICA8aHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIz NjAwMT4KKyAgICAgICAgPHJkYXI6Ly9wcm9ibGVtLzg4MzY0Mjc1PgorCisgICAgICAgIEJhc2Vk IG9uIGEgcGF0Y2ggYnkgS2ltbW8gS2lubnVuZW4uCisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9C T0RZIChPT1BTISkuCisKKyAgICAgICAgRGlzYWJsZSBzYW5pdGl6ZS1hZGRyZXNzLXVzZS1hZnRl ci1zY29wZSB0ZW1wb3JhcmlseSB1bnRpbCB0aGUgZmFsc2UgcG9zaXRpdmUgY2FuIGJlCisgICAg ICAgIGZpeGVkLgorCisgICAgICAgICogQ29uZmlndXJhdGlvbnMvYm1hbGxvYy54Y2NvbmZpZzoK KwogMjAyMi0wMS0zMSAgRGF2aWQgS2lsemVyICA8ZGRraWx6ZXJAYXBwbGUuY29tPgogCiAgICAg ICAgIFtsaWJwYXNdIGdldF9udW1fZnJlZV9ieXRlc19mb3JfZWFjaF9oZWFwX2NhbGxiYWNrKCkg aXMgY2FsbGVkIHdpdGggYGFyZ2AgcG9pbnRpbmcgdG8gdW5pbml0aWFsaXplZCBzdGFjayBtZW1v cnkKZGlmZiAtLWdpdCBhL1NvdXJjZS9ibWFsbG9jL0NvbmZpZ3VyYXRpb25zL2JtYWxsb2MueGNj b25maWcgYi9Tb3VyY2UvYm1hbGxvYy9Db25maWd1cmF0aW9ucy9ibWFsbG9jLnhjY29uZmlnCmlu ZGV4IGM2MzcyNzNhZmExMTA0YTk3YzdmNGVkNDMyNzcxNjM4N2VjMWFlMDUuLmE1ODM4ZGNhZjg3 ODBjMmRiMzk5ZmJhNWI0ZWIxYzhlZjhiZDdjYjUgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9ibWFsbG9j L0NvbmZpZ3VyYXRpb25zL2JtYWxsb2MueGNjb25maWcKKysrIGIvU291cmNlL2JtYWxsb2MvQ29u ZmlndXJhdGlvbnMvYm1hbGxvYy54Y2NvbmZpZwpAQCAtMjgsMyArMjgsMjEgQEAgUFJPRFVDVF9O QU1FID0gYm1hbGxvYzsKIAogR0NDX1NZTUJPTFNfUFJJVkFURV9FWFRFUk4gPSBZRVM7CiBTVFJJ UF9JTlNUQUxMRURfUFJPRFVDVCA9IE5POworCitPVEhFUl9DRkxBR1MgPSAkKGluaGVyaXRlZCkg JChCTUFMTE9DX0FERFJFU1NfU0FOSVRJWkVSX09USEVSX0NGTEFHUyk7CisKKy8vIFdvcmthcm91 bmQgYSBmYWxzZSBwb3NpdGl2ZSA8aHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dp P2lkPTIzNjAwMT4uCitCTUFMTE9DX0FERFJFU1NfU0FOSVRJWkVSX09USEVSX0NGTEFHUyA9ICQo Qk1BTExPQ19BRERSRVNTX1NBTklUSVpFUl9PVEhFUl9DRkxBR1NfJChXS19XT1JLQVJPVU5EX0FT QU5fVVNFX0FGVEVSX1NDT1BFKSk7CitCTUFMTE9DX0FERFJFU1NfU0FOSVRJWkVSX09USEVSX0NG TEFHU19ZRVMgPSAtZm5vLXNhbml0aXplLWFkZHJlc3MtdXNlLWFmdGVyLXNjb3BlOworCitXS19X T1JLQVJPVU5EX0FTQU5fVVNFX0FGVEVSX1NDT1BFID0gJChXS19OT1RfJChXS19YQ09ERV9WRVJT SU9OX0JFRk9SRV8xM18zXyQoWENPREVfVkVSU0lPTl9NQUpPUikpKTsKKworV0tfWENPREVfVkVS U0lPTl9CRUZPUkVfMTNfM18wODAwID0gWUVTOworV0tfWENPREVfVkVSU0lPTl9CRUZPUkVfMTNf M18wOTAwID0gWUVTOworV0tfWENPREVfVkVSU0lPTl9CRUZPUkVfMTNfM18xMDAwID0gWUVTOwor V0tfWENPREVfVkVSU0lPTl9CRUZPUkVfMTNfM18xMTAwID0gWUVTOworV0tfWENPREVfVkVSU0lP Tl9CRUZPUkVfMTNfM18xMjAwID0gWUVTOworV0tfWENPREVfVkVSU0lPTl9CRUZPUkVfMTNfM18x MzAwID0gJChXS19YQ09ERV9WRVJTSU9OX0JFRk9SRV8xM18zXzEzMDBfJChYQ09ERV9WRVJTSU9O X01JTk9SKSk7CitXS19YQ09ERV9WRVJTSU9OX0JFRk9SRV8xM18zXzEzMDBfMTMwMCA9IFlFUzsK K1dLX1hDT0RFX1ZFUlNJT05fQkVGT1JFXzEzXzNfMTMwMF8xMzEwID0gWUVTOworV0tfWENPREVf VkVSU0lPTl9CRUZPUkVfMTNfM18xMzAwXzEzMjAgPSBZRVM7Cg== 450812 2022-02-03 13:42:43 -0800 2022-02-15 19:29:22 -0800 Patch v3 bug-236001-20220203134242.patch text/plain 2281 ddkilzer U3VidmVyc2lvbiBSZXZpc2lvbjogMjg5MDEyCmRpZmYgLS1naXQgYS9Ub29scy9DaGFuZ2VMb2cg Yi9Ub29scy9DaGFuZ2VMb2cKaW5kZXggZjRlZWM4ZmMyMGZkMzNhNzAxZTk1MDJjNjAxNGQ4YmIw YzgxMTViNy4uZWMyYWVlMzU2ZGU4YmQwODAyODg1MTFiODJiYmIxNWZmZWE4MzcxOSAxMDA2NDQK LS0tIGEvVG9vbHMvQ2hhbmdlTG9nCisrKyBiL1Rvb2xzL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE4 IEBACisyMDIyLTAyLTAyICBEYXZpZCBLaWx6ZXIgIDxkZGtpbHplckBhcHBsZS5jb20+CisKKyAg ICAgICAgQVNBTiBmYWxzZSBwb3NpdGl2ZSBzdGFjay1idWZmZXItdW5kZXJmbG93IGJtYWxsb2Nf YWxsb2NhdGVfaW1wbF9jYXN1YWxfY2FzZQorICAgICAgICA8aHR0cHM6Ly9idWdzLndlYmtpdC5v cmcvc2hvd19idWcuY2dpP2lkPTIzNjAwMT4KKyAgICAgICAgPHJkYXI6Ly9wcm9ibGVtLzg4MzY0 Mjc1PgorCisgICAgICAgIEJhc2VkIG9uIGEgcGF0Y2ggYnkgS2ltbW8gS2lubnVuZW4uCisKKyAg ICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgRGlzYWJsZSBzYW5p dGl6ZS1hZGRyZXNzLXVzZS1hZnRlci1zY29wZSB0ZW1wb3JhcmlseSBpbiBibWFsbG9jCisgICAg ICAgIHVudGlsIHRoZSBmYWxzZSBwb3NpdGl2ZSBjYW4gYmUgZml4ZWQuCisKKyAgICAgICAgKiBz YW5pdGl6ZXIvYXNhbi54Y2NvbmZpZzoKKwogMjAyMi0wMi0wMiAgVGltb3RoeSBIYXRjaGVyICA8 dGltb3RoeUBhcHBsZS5jb20+CiAKICAgICAgICAgV2ViIEluc3BlY3RvcjogZGlkU2hvd0V4dGVu c2lvblRhYiBuZWVkcyB0byBwYXNzIHRoZSBmcmFtZUlEIG9mIHRoZSB0YWIKZGlmZiAtLWdpdCBh L1Rvb2xzL3Nhbml0aXplci9hc2FuLnhjY29uZmlnIGIvVG9vbHMvc2FuaXRpemVyL2FzYW4ueGNj b25maWcKaW5kZXggYWVmMDkwNDYwY2FkNTI5NTI4OGI4MmU1ZjdmZGI3OGZlMmY4MTc2OS4uMTli NjVjNTkzNjczMDRmNDJjZjc3YjkzNTAwYjIwMmJjOTAyN2I3NCAxMDA2NDQKLS0tIGEvVG9vbHMv c2FuaXRpemVyL2FzYW4ueGNjb25maWcKKysrIGIvVG9vbHMvc2FuaXRpemVyL2FzYW4ueGNjb25m aWcKQEAgLTYsNCArNiwyMyBAQCBFTkFCTEVfQUREUkVTU19TQU5JVElaRVJfTk8gPSBZRVM7CiAK IFdLX0VOQUJMRV9BRERSRVNTX1NBTklUSVpFUiA9ICQoRU5BQkxFX0FERFJFU1NfU0FOSVRJWkVS KTsKIAotV0tfQUREUkVTU19TQU5JVElaRVJfT1RIRVJfQ1BMVVNQTFVTRkxBR1NfWUVTID0gLVVf TElCQ1BQX0hBU19OT19BU0FOOworV0tfQUREUkVTU19TQU5JVElaRVJfT1RIRVJfQ1BMVVNQTFVT RkxBR1NfWUVTID0gLVVfTElCQ1BQX0hBU19OT19BU0FOICQoV0tfTkVFRFNfQVNBTl9VU0VfQUZU RVJfU0NPUEVfV09SS0FST1VORF9GT1JfJChQUk9EVUNUX05BTUUpXyQoV0tfTkVFRFNfQVNBTl9V U0VfQUZURVJfU0NPUEVfV09SS0FST1VORCkpOworCisvLyBXb3JrYXJvdW5kIGEgZmFsc2UgcG9z aXRpdmUgPGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0yMzYwMDE+Lgor Ly8gVXBkYXRlIGFmdGVyIDxyZGFyOi8vODc2MTM5MDg+IGlzIGZpeGVkLgorV0tfTkVFRFNfQVNB Tl9VU0VfQUZURVJfU0NPUEVfV09SS0FST1VORF9GT1JfYm1hbGxvY19ZRVMgPSAtZm5vLXNhbml0 aXplLWFkZHJlc3MtdXNlLWFmdGVyLXNjb3BlOworCitXS19OT1RfID0gWUVTOworV0tfTk9UX1lF UyA9IE5POworCitXS19ORUVEU19BU0FOX1VTRV9BRlRFUl9TQ09QRV9XT1JLQVJPVU5EID0gJChX S19OT1RfJChXS19YQ09ERV9WRVJTSU9OX0JFRk9SRV8xM18zXyQoWENPREVfVkVSU0lPTl9NQUpP UikpKTsKKworV0tfWENPREVfVkVSU0lPTl9CRUZPUkVfMTNfM18wODAwID0gWUVTOworV0tfWENP REVfVkVSU0lPTl9CRUZPUkVfMTNfM18wOTAwID0gWUVTOworV0tfWENPREVfVkVSU0lPTl9CRUZP UkVfMTNfM18xMDAwID0gWUVTOworV0tfWENPREVfVkVSU0lPTl9CRUZPUkVfMTNfM18xMTAwID0g WUVTOworV0tfWENPREVfVkVSU0lPTl9CRUZPUkVfMTNfM18xMjAwID0gWUVTOworV0tfWENPREVf VkVSU0lPTl9CRUZPUkVfMTNfM18xMzAwID0gJChXS19YQ09ERV9WRVJTSU9OX0JFRk9SRV8xM18z XzEzMDBfJChYQ09ERV9WRVJTSU9OX01JTk9SKSk7CitXS19YQ09ERV9WRVJTSU9OX0JFRk9SRV8x M18zXzEzMDBfMTMwMCA9IFlFUzsKK1dLX1hDT0RFX1ZFUlNJT05fQkVGT1JFXzEzXzNfMTMwMF8x MzEwID0gWUVTOworV0tfWENPREVfVkVSU0lPTl9CRUZPUkVfMTNfM18xMzAwXzEzMjAgPSBZRVM7 Cg== 452125 2022-02-15 19:29:25 -0800 2022-02-16 10:12:11 -0800 Patch v4 bug-236001-20220215192931.patch text/plain 5987 ddkilzer U3VidmVyc2lvbiBSZXZpc2lvbjogMjg5ODcxCmRpZmYgLS1naXQgYS9Tb3VyY2UvYm1hbGxvYy9D aGFuZ2VMb2cgYi9Tb3VyY2UvYm1hbGxvYy9DaGFuZ2VMb2cKaW5kZXggZDI0MjQ3NzYyOWVkMTUy ZWNjMjljMWYzNjQ3YTI4YWU3NGY3OWRhZi4uMDE1OTMwNjZlNjU1MzQzZTE2OWVhNTgwNGM2YTVl YzcyMDI0ZmU2MCAxMDA2NDQKLS0tIGEvU291cmNlL2JtYWxsb2MvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9ibWFsbG9jL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE3IEBACisyMDIyLTAyLTE1ICBEYXZp ZCBLaWx6ZXIgIDxkZGtpbHplckBhcHBsZS5jb20+CisKKyAgICAgICAgV29ya2Fyb3VuZCBBU0FO IGZhbHNlIHBvc2l0aXZlIHN0YWNrLWJ1ZmZlci11bmRlcmZsb3cgYm1hbGxvY19hbGxvY2F0ZV9p bXBsX2Nhc3VhbF9jYXNlCisgICAgICAgIDxodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1 Zy5jZ2k/aWQ9MjM2MDAxPgorICAgICAgICA8cmRhcjovL3Byb2JsZW0vODgzNjQyNzU+CisKKyAg ICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgKiBsaWJwYXMvc3Jj L2xpYnBhcy9wYXNfbGFyZ2VfZnJlZV9pbmxpbmVzLmg6CisgICAgICAgIChwYXNfbGFyZ2VfZnJl ZV9jcmVhdGVfbWVyZ2VkKToKKyAgICAgICAgLSBUdXJuIG9mZiBQQVNfQUxXQVlTX0lOTElORSB3 aGVuIHRoZQorICAgICAgICAgIFdLX1dPUktBUk9VTkRfUkRBUl84NzYxMzkwOF9BU0FOX1NUQUNL X1VTRV9BRlRFUl9TQ09QRSBtYWNybworICAgICAgICAgIGlzIGRlZmluZWQgdG8gYXZvaWQgdGhl IGJ1Zy4KKwogMjAyMi0wMi0xNCAgWXVzdWtlIFN1enVraSAgPHlzdXp1a2lAYXBwbGUuY29tPgog CiAgICAgICAgIFtsaWJwYXNdIGNvbXBhY3QgcG9pbnRlcnMgc2hvdWxkIGxvYWQgcGF5bG9hZCB2 aWEgbWVtY3B5CmRpZmYgLS1naXQgYS9Tb3VyY2UvYm1hbGxvYy9saWJwYXMvc3JjL2xpYnBhcy9w YXNfbGFyZ2VfZnJlZV9pbmxpbmVzLmggYi9Tb3VyY2UvYm1hbGxvYy9saWJwYXMvc3JjL2xpYnBh cy9wYXNfbGFyZ2VfZnJlZV9pbmxpbmVzLmgKaW5kZXggMTA1YmUyMmY3ODUzZTJmMGVkOTQ3NzQ1 MDY3NjFkNjgwNTEyYWZhMi4uOTliMTEwM2VlNzhhMzBlOTk3YjBmNjA3MDcxY2QzMjZiOWQ3OTIx ZCAxMDA2NDQKLS0tIGEvU291cmNlL2JtYWxsb2MvbGlicGFzL3NyYy9saWJwYXMvcGFzX2xhcmdl X2ZyZWVfaW5saW5lcy5oCisrKyBiL1NvdXJjZS9ibWFsbG9jL2xpYnBhcy9zcmMvbGlicGFzL3Bh c19sYXJnZV9mcmVlX2lubGluZXMuaApAQCAtMzMsNyArMzMsMTEgQEAKIAogUEFTX0JFR0lOX0VY VEVSTl9DOwogCi1zdGF0aWMgUEFTX0FMV0FZU19JTkxJTkUgcGFzX2xhcmdlX2ZyZWUKK3N0YXRp YworI2lmbmRlZiBXS19XT1JLQVJPVU5EX1JEQVJfODc2MTM5MDhfQVNBTl9TVEFDS19VU0VfQUZU RVJfU0NPUEUKK1BBU19BTFdBWVNfSU5MSU5FCisjZW5kaWYKK3Bhc19sYXJnZV9mcmVlCiBwYXNf bGFyZ2VfZnJlZV9jcmVhdGVfbWVyZ2VkKHBhc19sYXJnZV9mcmVlIGxlZnQsCiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIHBhc19sYXJnZV9mcmVlIHJpZ2h0LAogICAgICAgICAgICAgICAg ICAgICAgICAgICAgICBwYXNfbGFyZ2VfZnJlZV9oZWFwX2NvbmZpZyogY29uZmlnKQpkaWZmIC0t Z2l0IGEvVG9vbHMvQ2hhbmdlTG9nIGIvVG9vbHMvQ2hhbmdlTG9nCmluZGV4IDRhNTkwOTc3YjIz YTkwMzE3YjgwMWFiZjZiZDI4MjU1MjIwYzBmZTAuLjc4M2FjYWQ1YWM2YzhmMzE3MmUyZjMyZmM4 ZTQ2Nzg5YzY4NGFkM2YgMTAwNjQ0Ci0tLSBhL1Rvb2xzL0NoYW5nZUxvZworKysgYi9Ub29scy9D aGFuZ2VMb2cKQEAgLTEsMyArMSw0MCBAQAorMjAyMi0wMi0xNSAgRGF2aWQgS2lsemVyICA8ZGRr aWx6ZXJAYXBwbGUuY29tPgorCisgICAgICAgIFdvcmthcm91bmQgQVNBTiBmYWxzZSBwb3NpdGl2 ZSBzdGFjay1idWZmZXItdW5kZXJmbG93IGJtYWxsb2NfYWxsb2NhdGVfaW1wbF9jYXN1YWxfY2Fz ZQorICAgICAgICA8aHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIzNjAw MT4KKyAgICAgICAgPHJkYXI6Ly9wcm9ibGVtLzg4MzY0Mjc1PgorCisgICAgICAgIFJldmlld2Vk IGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIEJhc2VkIG9uIGEgcGF0Y2ggYnkgS2ltbW8g S2lubnVuZW4uCisKKyAgICAgICAgRGVmaW5lIGEgV0tfV09SS0FST1VORF9SREFSXzg3NjEzOTA4 X0FTQU5fU1RBQ0tfVVNFX0FGVEVSX1NDT1BFCisgICAgICAgIG1hY3JvIHNvIHRoYXQgdGhlIGZp eCBjYW4gYmUgdGFyZ2V0ZWQgdG8gYSBzcGVjaWZpYyBmdW5jdGlvbiBpbgorICAgICAgICBsaWJw YXMuICBUaGlzIGF2b2lkcyBkaXNhYmxpbmcgYWxsIHN0YWNrLXVzZS1hZnRlci1zY29wZSBjaGVj a3MKKyAgICAgICAgaW4gYm1hbGxvYyB3aGVuIGNvbXBpbGluZyB3aXRoIEFkZHJlc3MgU2FuaXRp emVyIGVuYWJsZWQuCisKKyAgICAgICAgKiBzYW5pdGl6ZXIvYXNhbi54Y2NvbmZpZzoKKyAgICAg ICAgKFdLX0FERFJFU1NfU0FOSVRJWkVSX09USEVSX0NGTEFHU19ZRVMpOiBBZGQuCisgICAgICAg IC0gVGhpcyB2YXJpYWJsZSBjb250YWlucyB0aGUgbWFjcm8gZGVmaW5pdGlvbiB3aGVuIHRoZQor ICAgICAgICAgIHdvcmthcm91bmQgaXMgbmVlZGVkLiAgSXQncyB1c2VkIGluIHNhbml0aXplci54 Y2NvbmZpZyB0byBhZGQKKyAgICAgICAgICB0aGUgbWFjcm8gZGVmaW5pdGlvbiB0byAkKE9USEVS X0NGTEFHUykuCisgICAgICAgIChXS19ORUVEU19BU0FOX1VTRV9BRlRFUl9TQ09QRV9XT1JLQVJP VU5EX0ZPUl9ibWFsbG9jX1lFUyk6IEFkZC4KKyAgICAgICAgLSBUaGUgd29ya2Fyb3VuZCBpcyBj dXJyZW50bHkgb25seSBuZWVkZWQgaW4gYm1hbGxvYy4KKyAgICAgICAgKFdLX05PVF8pOiBBZGQu CisgICAgICAgIChXS19OT1RfWUVTKTogQWRkLgorICAgICAgICAtIEFkZCBzdXBwb3J0IGZvciAk KFdLX05PVF8kKFgpKSB2YXJpYWJsZXMuCisgICAgICAgIChXS19ORUVEU19BU0FOX1VTRV9BRlRF Ul9TQ09QRV9XT1JLQVJPVU5EKTogQWRkLgorICAgICAgICAtIFNldHMgd2hlbiB0aGUgd29ya2Fy b3VuZCBpcyBuZWVkZWQgYmFzZWQgb24gdGhlIFhjb2RlIHZlcnNpb24uCisgICAgICAgICAgVXNl cyBhICQoV0tfTk9UXyQoWCkpIHZhcmlhYmxlIHRvIG5lZ2F0ZSB0aGUgcmVzdWx0IHdoZW4gdGhl CisgICAgICAgICAgd29ya2Fyb3VuZCBpcyBub3QgbmVlZGVkLgorICAgICAgICAoV0tfWENPREVf VkVSU0lPTl9CRUZPUkVfMTNfM18qKTogQWRkLgorICAgICAgICAtIExpc3QgWGNvZGUgdmVyc2lv bnMgd2hlcmUgdGhlIHdvcmthcm91bmQgaXMgbm90IG5lZWRlZC4KKworICAgICAgICAqIHNhbml0 aXplci9zYW5pdGl6ZXIueGNjb25maWc6CisgICAgICAgIChPVEhFUl9DRkxBR1MpOgorICAgICAg ICAtIEFkZCB0aGUgdmFsdWUgb2YgJChXS19BRERSRVNTX1NBTklUSVpFUl9PVEhFUl9DRkxBR1Nf WUVTKSBmcm9tCisgICAgICAgICAgYXNhbi54Y2NvbmZpZyB3aGVuIGJ1aWxkaW5nIHdpdGggQWRk cmVzcyBTYW5pdGl6ZXIgZW5hYmxlZC4KKwogMjAyMi0wMi0xNSAgTWFyayBMYW0gIDxtYXJrLmxh bUBhcHBsZS5jb20+CiAKICAgICAgICAgTWFrZSBIZWFwVHlwZSBhbiBlbnVtIGNsYXNzLgpkaWZm IC0tZ2l0IGEvVG9vbHMvc2FuaXRpemVyL2FzYW4ueGNjb25maWcgYi9Ub29scy9zYW5pdGl6ZXIv YXNhbi54Y2NvbmZpZwppbmRleCBhZWYwOTA0NjBjYWQ1Mjk1Mjg4YjgyZTVmN2ZkYjc4ZmUyZjgx NzY5Li45OWJlOGYxYmU4YzJkY2M0ZTU1MjkzNzAwNzNmYTA3YTExMTk3MGUxIDEwMDY0NAotLS0g YS9Ub29scy9zYW5pdGl6ZXIvYXNhbi54Y2NvbmZpZworKysgYi9Ub29scy9zYW5pdGl6ZXIvYXNh bi54Y2NvbmZpZwpAQCAtNiw0ICs2LDI0IEBAIEVOQUJMRV9BRERSRVNTX1NBTklUSVpFUl9OTyA9 IFlFUzsKIAogV0tfRU5BQkxFX0FERFJFU1NfU0FOSVRJWkVSID0gJChFTkFCTEVfQUREUkVTU19T QU5JVElaRVIpOwogCitXS19BRERSRVNTX1NBTklUSVpFUl9PVEhFUl9DRkxBR1NfWUVTID0gJChX S19ORUVEU19BU0FOX1VTRV9BRlRFUl9TQ09QRV9XT1JLQVJPVU5EX0ZPUl8kKFBST0RVQ1RfTkFN RSlfJChXS19ORUVEU19BU0FOX1VTRV9BRlRFUl9TQ09QRV9XT1JLQVJPVU5EKSk7CiBXS19BRERS RVNTX1NBTklUSVpFUl9PVEhFUl9DUExVU1BMVVNGTEFHU19ZRVMgPSAtVV9MSUJDUFBfSEFTX05P X0FTQU47CisKKy8vIFdvcmthcm91bmQgYSBmYWxzZSBwb3NpdGl2ZSA8aHR0cHM6Ly9idWdzLndl YmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIzNjAwMT4uCisvLyBVcGRhdGUgYWZ0ZXIgPHJkYXI6 Ly84NzYxMzkwOD4gaXMgZml4ZWQuCitXS19ORUVEU19BU0FOX1VTRV9BRlRFUl9TQ09QRV9XT1JL QVJPVU5EX0ZPUl9ibWFsbG9jX1lFUyA9IC1EV0tfV09SS0FST1VORF9SREFSXzg3NjEzOTA4X0FT QU5fU1RBQ0tfVVNFX0FGVEVSX1NDT1BFOworCitXS19OT1RfID0gWUVTOworV0tfTk9UX1lFUyA9 IE5POworCitXS19ORUVEU19BU0FOX1VTRV9BRlRFUl9TQ09QRV9XT1JLQVJPVU5EID0gJChXS19O T1RfJChXS19YQ09ERV9WRVJTSU9OX0JFRk9SRV8xM18zXyQoWENPREVfVkVSU0lPTl9NQUpPUikp KTsKKworV0tfWENPREVfVkVSU0lPTl9CRUZPUkVfMTNfM18wODAwID0gWUVTOworV0tfWENPREVf VkVSU0lPTl9CRUZPUkVfMTNfM18wOTAwID0gWUVTOworV0tfWENPREVfVkVSU0lPTl9CRUZPUkVf MTNfM18xMDAwID0gWUVTOworV0tfWENPREVfVkVSU0lPTl9CRUZPUkVfMTNfM18xMTAwID0gWUVT OworV0tfWENPREVfVkVSU0lPTl9CRUZPUkVfMTNfM18xMjAwID0gWUVTOworV0tfWENPREVfVkVS U0lPTl9CRUZPUkVfMTNfM18xMzAwID0gJChXS19YQ09ERV9WRVJTSU9OX0JFRk9SRV8xM18zXzEz MDBfJChYQ09ERV9WRVJTSU9OX01JTk9SKSk7CitXS19YQ09ERV9WRVJTSU9OX0JFRk9SRV8xM18z XzEzMDBfMTMwMCA9IFlFUzsKK1dLX1hDT0RFX1ZFUlNJT05fQkVGT1JFXzEzXzNfMTMwMF8xMzEw ID0gWUVTOworV0tfWENPREVfVkVSU0lPTl9CRUZPUkVfMTNfM18xMzAwXzEzMjAgPSBZRVM7CmRp ZmYgLS1naXQgYS9Ub29scy9zYW5pdGl6ZXIvc2FuaXRpemVyLnhjY29uZmlnIGIvVG9vbHMvc2Fu aXRpemVyL3Nhbml0aXplci54Y2NvbmZpZwppbmRleCA4YjdmYTczM2JjMzgzYTBiYmEzYjc5Y2Ez OGE0YjBlYTdiMjdkODE0Li4yMTE3MjJkYzJhNGVkNzdhNmI0NmU2OWM0NWRmMGM3NjA4OWIyODc1 IDEwMDY0NAotLS0gYS9Ub29scy9zYW5pdGl6ZXIvc2FuaXRpemVyLnhjY29uZmlnCisrKyBiL1Rv b2xzL3Nhbml0aXplci9zYW5pdGl6ZXIueGNjb25maWcKQEAgLTMsNyArMyw3IEBAIEdDQ19PUFRJ TUlaQVRJT05fTEVWRUxfRGVidWcgPSAwOwogR0NDX09QVElNSVpBVElPTl9MRVZFTF9Qcm9kdWN0 aW9uID0gMTsKIEdDQ19PUFRJTUlaQVRJT05fTEVWRUxfUmVsZWFzZSA9IDE7CiAKLU9USEVSX0NG TEFHUyA9ICQoaW5oZXJpdGVkKSAtZm5vLW9taXQtZnJhbWUtcG9pbnRlciAtZyAkKFdLX1VOREVG SU5FRF9CRUhBVklPUl9TQU5JVElaRVJfT1RIRVJfQ0ZMQUdTXyQoV0tfRU5BQkxFX1VOREVGSU5F RF9CRUhBVklPUl9TQU5JVElaRVIpKTsKK09USEVSX0NGTEFHUyA9ICQoaW5oZXJpdGVkKSAtZm5v LW9taXQtZnJhbWUtcG9pbnRlciAtZyAkKFdLX0FERFJFU1NfU0FOSVRJWkVSX09USEVSX0NGTEFH U18kKFdLX0VOQUJMRV9BRERSRVNTX1NBTklUSVpFUikpICQoV0tfVU5ERUZJTkVEX0JFSEFWSU9S X1NBTklUSVpFUl9PVEhFUl9DRkxBR1NfJChXS19FTkFCTEVfVU5ERUZJTkVEX0JFSEFWSU9SX1NB TklUSVpFUikpOwogT1RIRVJfQ1BMVVNQTFVTRkxBR1MgPSAkKGluaGVyaXRlZCkgJChXS19BRERS RVNTX1NBTklUSVpFUl9PVEhFUl9DUExVU1BMVVNGTEFHU18kKFdLX0VOQUJMRV9BRERSRVNTX1NB TklUSVpFUikpOwogCiAvLyBXb3JrYXJvdW5kIGZvciA8cmRhcjovL3Byb2JsZW0vNDk0OTgwOTI+ Lgo=