<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>23626</bug_id>
          
          <creation_ts>2009-01-29 14:55:03 -0800</creation_ts>
          <short_desc>Upstream null checks in Navigator.cpp</short_desc>
          <delta_ts>2009-02-10 01:21:06 -0800</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>DOM</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>All</rep_platform>
          <op_sys>All</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords></keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Darin Fisher (:fishd, Google)">fishd</reporter>
          <assigned_to name="Feng Qian">feng</assigned_to>
          <cc>ap</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>107589</commentid>
    <comment_count>0</comment_count>
    <who name="Darin Fisher (:fishd, Google)">fishd</who>
    <bug_when>2009-01-29 14:55:03 -0800</bug_when>
    <thetext>Upstream null checks in Navigator.cpp

From here:
http://build.chromium.org/merge/WebCore-page-Navigator.cpp-before.diff

According to Feng, these are needed to protect against some crashes.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>107698</commentid>
    <comment_count>1</comment_count>
    <who name="Alexey Proskuryakov">ap</who>
    <bug_when>2009-01-30 07:34:13 -0800</bug_when>
    <thetext>I&apos;d be interested to learn what crashes those were (and of course, automated test cases would be good).</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>108673</commentid>
    <comment_count>2</comment_count>
      <attachid>27405</attachid>
    <who name="Feng Qian">feng</who>
    <bug_when>2009-02-06 11:47:19 -0800</bug_when>
    <thetext>Created attachment 27405
a test case (not layout test yet)

I changed Product from WebKit to Security for caution. The test case can crash the browser in various places.

Making a patch.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>108715</commentid>
    <comment_count>3</comment_count>
      <attachid>27418</attachid>
    <who name="Feng Qian">feng</who>
    <bug_when>2009-02-06 14:12:58 -0800</bug_when>
    <thetext>Created attachment 27418
patch v1

Converted the test into a layout test with results attached.

Two checks in plugins() and mimeTypes() are not needed because both PluginArray and MimeTypeArray can handle null frame pointer, (but I think it is better to have null checks so it returns JS null, rather than empty PluginArray and MimeTypeArray).

The patch triggers an assertion in debug mode:

String WebFrameLoaderClient::userAgent(const KURL&amp; url)
{
    WebView *webView = getWebView(m_webFrame.get());
    // ASSERT(webView);  &lt;----------- HERE 

    // We should never get here with nil for the WebView unless there is a bug somewhere else.
    // But if we do, it&apos;s better to return the empty string than just crashing on the spot.
    // Most other call sites are tolerant of nil because of Objective-C behavior, but this one
    // is not because the return value of _userAgentForURL is a const KURL&amp;.
    if (!webView)
        return String(&quot;&quot;);

    return [webView _userAgentForURL:url];
}

From comments, someone already encountered such case. I don&apos;t know enough why this happens. So with this patch, release mode will pass, but debug mode will hit the ASSERT(webView).

Can someone point out what triggers ASSERTION, and whether it is ok to turn off ASSERT in the debug mode, maybe just a logging message.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>108809</commentid>
    <comment_count>4</comment_count>
      <attachid>27418</attachid>
    <who name="Alexey Proskuryakov">ap</who>
    <bug_when>2009-02-07 02:47:28 -0800</bug_when>
    <thetext>Comment on attachment 27418
patch v1

&gt; (but I think it is better to have null checks so it returns JS null,
&gt; rather than empty PluginArray and MimeTypeArray).

Sounds reasonable to me. What does Firefox do?

&gt; The patch triggers an assertion in debug mode:

This assertion was added in &lt;http://trac.webkit.org/changeset/32500&gt;. I think that it is useful, because it helps catch attempts to navigate detached frames. I think that a check for frame-&gt;page() in Navigator::userAgent() should resolve the assertion failure in a way that doesn&apos;t conflict with Darin&apos;s intentions (and the check for document can be removed, because we now always have a document in each frame):

-    return m_frame-&gt;loader()-&gt;userAgent(m_frame-&gt;document() ? m_frame-&gt;document()-&gt;url() : KURL());
+    return m_frame-&gt;loader()-&gt;userAgent(m_frame-&gt;page() ? m_frame-&gt;document()-&gt;url() : KURL());

Of course, this warrants a comment explaining why the check for page() is necessary.

+  old_nav = window.subframe.navigator;

This makes the test fail in Firefox for no good reason, window.frames[0] works in both browsers.

+  if (window.GCController)
+    window.GCController.collect();

I do not see why this is necessary - but if you prefer to invoke GC, it&apos;s better to do it in browser, too (see e.g. fast/workers/worker-gc.html for how we usually do it).

+  // In layout test mode, check one more time later.
+  if (window.layoutTestController)
+    setTimeout(check_navigator_and_done, 200);

That&apos;s a good check - why not make it in browser, too? During the first check, the frame is detached from its page, but not destroyed yet - and during the second one, the frame is already destroyed, and thus detached from its Navigator object.

This is obviously an r-, because the test crashes in debug mode due to the assertion in WebFrameClient - looks great otherwise!</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>109029</commentid>
    <comment_count>5</comment_count>
    <who name="Feng Qian">feng</who>
    <bug_when>2009-02-09 14:02:51 -0800</bug_when>
    <thetext>(In reply to comment #4)
&gt; (From update of attachment 27418 [review])
&gt; &gt; (but I think it is better to have null checks so it returns JS null,
&gt; &gt; rather than empty PluginArray and MimeTypeArray).
&gt; 
&gt; Sounds reasonable to me. What does Firefox do?
&gt; 
&gt; &gt; The patch triggers an assertion in debug mode:
&gt; 
&gt; This assertion was added in &lt;http://trac.webkit.org/changeset/32500&gt;. I think
&gt; that it is useful, because it helps catch attempts to navigate detached frames.
&gt; I think that a check for frame-&gt;page() in Navigator::userAgent() should resolve
&gt; the assertion failure in a way that doesn&apos;t conflict with Darin&apos;s intentions
&gt; (and the check for document can be removed, because we now always have a
&gt; document in each frame):
&gt; 
&gt; -    return m_frame-&gt;loader()-&gt;userAgent(m_frame-&gt;document() ?
&gt; m_frame-&gt;document()-&gt;url() : KURL());
&gt; +    return m_frame-&gt;loader()-&gt;userAgent(m_frame-&gt;page() ?
&gt; m_frame-&gt;document()-&gt;url() : KURL());
&gt; 

This does not solve the problem. Do you mean, if m_frame-&gt;page() is null, return an empty string instead of calling into FrameLoader::userAgent? Because FrameLoader::userAgent does not check what URL is passed in.

&gt; Of course, this warrants a comment explaining why the check for page() is
&gt; necessary.
&gt; 
&gt; +  old_nav = window.subframe.navigator;
&gt; 
&gt; This makes the test fail in Firefox for no good reason, window.frames[0] works
&gt; in both browsers.
&gt; 
&gt; +  if (window.GCController)
&gt; +    window.GCController.collect();
&gt; 
&gt; I do not see why this is necessary - but if you prefer to invoke GC, it&apos;s
&gt; better to do it in browser, too (see e.g. fast/workers/worker-gc.html for how
&gt; we usually do it).
&gt; 
&gt; +  // In layout test mode, check one more time later.
&gt; +  if (window.layoutTestController)
&gt; +    setTimeout(check_navigator_and_done, 200);
&gt; 
&gt; That&apos;s a good check - why not make it in browser, too? During the first check,
&gt; the frame is detached from its page, but not destroyed yet - and during the
&gt; second one, the frame is already destroyed, and thus detached from its
&gt; Navigator object.
&gt; 
&gt; This is obviously an r-, because the test crashes in debug mode due to the
&gt; assertion in WebFrameClient - looks great otherwise!
&gt; 

</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>109032</commentid>
    <comment_count>6</comment_count>
      <attachid>27493</attachid>
    <who name="Feng Qian">feng</who>
    <bug_when>2009-02-09 14:25:42 -0800</bug_when>
    <thetext>Created attachment 27493
patch v2

Corrected the patch by incorporating ap&apos;s comments.

1. FF returns a PluginArray/MimeTypeArray object when a frame is detached, so WebKit does not need check here;
2. Test case is fixed by calling the same gc() function, although I don&apos;t like it relies on 90000 object allocations;
3. Navigator::userAgent() returns an empty string if m_frame-&gt;page() is null, avoid calling FrameLoader::userAgent which triggers assertion later in WebFrameLoaderClient::userAgent

Interestingly FF3.1b2 on Mac crashes when loading the layout test. :(</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>109093</commentid>
    <comment_count>7</comment_count>
      <attachid>27493</attachid>
    <who name="Alexey Proskuryakov">ap</who>
    <bug_when>2009-02-10 00:17:23 -0800</bug_when>
    <thetext>Comment on attachment 27493
patch v2

&gt; +    // If the frame does not have a page, returns empty string instead of
&gt; +    // calling FrameLoader::userAgent.
+    if (!m_frame-&gt;page())
+        return String();
+        
     return m_frame-&gt;loader()-&gt;userAgent(m_frame-&gt;document() ? m_frame-&gt;document()-&gt;url() : KURL());

This is not a helpful comment - it says an extremely obvious thing about what happens below, but doesn&apos;t explain the subtle reason. Also, I still think that the check for document() can be removed.

&gt; +  // In layout test mode, check one more time later.
&gt; +  setTimeout(check_navigator_and_done, 200);

This comment is no longer true, and should be removed.

r=me, but comments will need to be tweaked when landing. Did I already say I love this test case?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>109104</commentid>
    <comment_count>8</comment_count>
    <who name="Alexey Proskuryakov">ap</who>
    <bug_when>2009-02-10 01:21:06 -0800</bug_when>
    <thetext>Committed &lt;http://trac.webkit.org/changeset/40814&gt;.</thetext>
  </long_desc>
      
          <attachment
              isobsolete="1"
              ispatch="0"
              isprivate="0"
          >
            <attachid>27405</attachid>
            <date>2009-02-06 11:47:19 -0800</date>
            <delta_ts>2009-02-09 14:25:42 -0800</delta_ts>
            <desc>a test case (not layout test yet)</desc>
            <filename>detached-navigator-no-crash.html</filename>
            <type>text/html</type>
            <size>847</size>
            <attacher name="Feng Qian">feng</attacher>
            
              <data encoding="base64">PGh0bWw+CjxzY3JpcHQ+CnZhciBvbGRfbmF2OwoKZnVuY3Rpb24gdGVzdCgpIHsKICAvLyByZW1l
bWJlciB0aGUgb2xkIG5hdmlnYXRvcgogIG9sZF9uYXYgPSB3aW5kb3cuc3ViZnJhbWUubmF2aWdh
dG9yOwogIC8vIGRldGFjaCB0aGUgb2xkIG5hdmlnYXRvcgogIHZhciBwID0gZG9jdW1lbnQuZ2V0
RWxlbWVudEJ5SWQoInN1YmZyYW1lIik7CiAgcC5wYXJlbnROb2RlLnJlbW92ZUNoaWxkKHApOwog
IGlmICh3aW5kb3cuR0NDb250cm9sbGVyKQogICAgd2luZG93LkdDQ29udHJvbGxlci5jb2xsZWN0
KCk7CgogIGlmICh3aW5kb3cubGF5b3V0VGVzdENvbnRyb2xsZXIpCiAgICBzZXRUaW1lb3V0KGNo
ZWNrX25hdiwgMjAwKTsKfQoKZnVuY3Rpb24gbG9nKG1zZykgewogIHZhciByID0gZG9jdW1lbnQu
Z2V0RWxlbWVudEJ5SWQoJ3Jlc3VsdCcpOwogIHIuaW5uZXJIVE1MICs9IG1zZyArICc8YnI+JzsK
fQoKZnVuY3Rpb24gY2hlY2tfbmF2KCkgewogIGZvciAocCBpbiBvbGRfbmF2KSB7CiAgICBpZiAo
dHlwZW9mIG9sZF9uYXZbcF0gPT0gJ2Z1bmN0aW9uJykKICAgICAgbG9nKCJuYXZpZ2F0b3IuIitw
KyIoKSA9PSAiICsgb2xkX25hdltwXSgpKTsKICAgIGVsc2UKICAgICAgbG9nKCJuYXZpZ2F0b3Iu
IitwKyIgPT0gIiArIG9sZF9uYXZbcF0pOwogIH0KfQoKPC9zY3JpcHQ+Cjxib2R5IG9ubG9hZD0i
dGVzdCgpIj4KPGlmcmFtZSBpZD0ic3ViZnJhbWUiIHNyYz0iaHR0cDovL2FwcGxlLmNvbSI+PC9p
ZnJhbWU+CjxidXR0b24gb25jbGljaz0iY2hlY2tfbmF2KCkiPkNoZWNrIE5hdmlnYXRvcjwvYnV0
dG9uPjxicj4KPGRpdiBpZD0icmVzdWx0Ij48L2Rpdj4KPC9ib2R5Pgo8L2h0bWw+Cg==
</data>

          </attachment>
          <attachment
              isobsolete="1"
              ispatch="1"
              isprivate="0"
          >
            <attachid>27418</attachid>
            <date>2009-02-06 14:12:58 -0800</date>
            <delta_ts>2009-02-09 14:25:42 -0800</delta_ts>
            <desc>patch v1</desc>
            <filename>23626patch.txt</filename>
            <type>text/plain</type>
            <size>5066</size>
            <attacher name="Feng Qian">feng</attacher>
            
              <data encoding="base64">SW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9n
CShyZXZpc2lvbiA0MDcyOSkKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA
IC0xLDMgKzEsMTUgQEAKKzIwMDktMDItMDYgIGZxaWFuICA8c2V0IGZlbmdAY2hyb21pdW0ub3Jn
PgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIEZpeCBj
cmFzaGVzIHdoZW4gYWNjZXNzaW5nIG5hdmlnYXRvciBvYmplY3Qgb2YgYSBkZWxldGVkIGZyYW1l
LgorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjM2MjYK
KyAgICAgICAgQSBsYXlvdXQgdGVzdCBpcyBhZGRlZDogZmFzdC9kb20vbmF2aWdhdG9yLWRldGFj
aGVkLW5vLWNyYXNoLmh0bWwKKworICAgICAgICAqIHBhZ2UvTmF2aWdhdG9yLmNwcDoKKyAgICAg
ICAgKFdlYkNvcmU6Ok5hdmlnYXRvcjo6Y29va2llRW5hYmxlZCk6CisgICAgICAgIChXZWJDb3Jl
OjpOYXZpZ2F0b3I6OmphdmFFbmFibGVkKToKKwogMjAwOS0wMi0wNiAgRGFuIEJlcm5zdGVpbiAg
PG1pdHpAYXBwbGUuY29tPgogCiAgICAgICAgIFJldmlld2VkIGJ5IERhcmluIEFkbGVyLgpJbmRl
eDogV2ViQ29yZS9wYWdlL05hdmlnYXRvci5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gV2ViQ29yZS9wYWdl
L05hdmlnYXRvci5jcHAJKHJldmlzaW9uIDQwNzI4KQorKysgV2ViQ29yZS9wYWdlL05hdmlnYXRv
ci5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTEyMSw2ICsxMjEsOSBAQCBNaW1lVHlwZUFycmF5KiBO
YXZpZ2F0b3I6Om1pbWVUeXBlcygpIGNvCiAKIGJvb2wgTmF2aWdhdG9yOjpjb29raWVFbmFibGVk
KCkgY29uc3QKIHsKKyAgICBpZiAoIW1fZnJhbWUpCisgICAgICAgIHJldHVybiBmYWxzZTsKKyAg
ICAgICAgCiAgICAgaWYgKG1fZnJhbWUtPnBhZ2UoKSAmJiAhbV9mcmFtZS0+cGFnZSgpLT5jb29r
aWVFbmFibGVkKCkpCiAgICAgICAgIHJldHVybiBmYWxzZTsKIApAQCAtMTI5LDggKzEzMiw5IEBA
IGJvb2wgTmF2aWdhdG9yOjpjb29raWVFbmFibGVkKCkgY29uc3QKIAogYm9vbCBOYXZpZ2F0b3I6
OmphdmFFbmFibGVkKCkgY29uc3QKIHsKLSAgICBpZiAoIW1fZnJhbWUpCisgICAgaWYgKCFtX2Zy
YW1lIHx8ICFtX2ZyYW1lLT5zZXR0aW5ncygpKQogICAgICAgICByZXR1cm4gZmFsc2U7CisKICAg
ICByZXR1cm4gbV9mcmFtZS0+c2V0dGluZ3MoKS0+aXNKYXZhRW5hYmxlZCgpOwogfQogCkluZGV4
OiBMYXlvdXRUZXN0cy9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvQ2hhbmdl
TG9nCShyZXZpc2lvbiA0MDcyOSkKKysrIExheW91dFRlc3RzL0NoYW5nZUxvZwkod29ya2luZyBj
b3B5KQpAQCAtMSwzICsxLDEzIEBACisyMDA5LTAyLTA2ICBmcWlhbiAgPGZlbmdAY2hyb21pdW0u
b3JnPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIEZp
eCBjcmFzaGVzIGluIGRpc2Nvbm5lY3RlZCBuYXZpZ2F0b3Igb2JqZWN0LgorICAgICAgICBodHRw
czovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjM2MjYKKworICAgICAgICAqIGZh
c3QvZG9tL25hdmlnYXRvci1kZXRhY2hlZC1uby1jcmFzaC1leHBlY3RlZC50eHQ6IEFkZGVkLgor
ICAgICAgICAqIGZhc3QvZG9tL25hdmlnYXRvci1kZXRhY2hlZC1uby1jcmFzaC5odG1sOiBBZGRl
ZC4KKwogMjAwOS0wMi0wNSAgQWxleGV5IFByb3NrdXJ5YWtvdiAgPGFwQHdlYmtpdC5vcmc+CiAK
ICAgICAgICAgUmV2aWV3ZWQgYnkgRGFyaW4gQWRsZXIuCkluZGV4OiBMYXlvdXRUZXN0cy9mYXN0
L2RvbS9uYXZpZ2F0b3ItZGV0YWNoZWQtbm8tY3Jhc2gtZXhwZWN0ZWQudHh0Cj09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0K
LS0tIExheW91dFRlc3RzL2Zhc3QvZG9tL25hdmlnYXRvci1kZXRhY2hlZC1uby1jcmFzaC1leHBl
Y3RlZC50eHQJKHJldmlzaW9uIDApCisrKyBMYXlvdXRUZXN0cy9mYXN0L2RvbS9uYXZpZ2F0b3It
ZGV0YWNoZWQtbm8tY3Jhc2gtZXhwZWN0ZWQudHh0CShyZXZpc2lvbiAwKQpAQCAtMCwwICsxLDMz
IEBACitUaGlzIHRlc3RzIHRoYXQgdGhlIG5hdmlnYXRvciBvYmplY3Qgb2YgYSBkZWxldGVkIGZy
YW1lIGlzIGRpc2Nvbm5lY3RlZCBwcm9wZXJseS4gQWNjZXNzaW5nIGZpZWxkcyBvciBtZXRob2Rz
IHNob3VsZG4ndCBjcmFzaCB0aGUgYnJvd3Nlci4gCisgQ2hlY2sgTmF2aWdhdG9yCituYXZpZ2F0
b3IucHJvZHVjdFN1YiBpcyBPSworbmF2aWdhdG9yLnByb2R1Y3QgaXMgT0sKK25hdmlnYXRvci5h
cHBDb2RlTmFtZSBpcyBPSworbmF2aWdhdG9yLnZlbmRvciBpcyBPSworbmF2aWdhdG9yLnBsYXRm
b3JtIGlzIE9LCituYXZpZ2F0b3IubWltZVR5cGVzIGlzIE9LCituYXZpZ2F0b3IubGFuZ3VhZ2Ug
aXMgT0sKK25hdmlnYXRvci5wbHVnaW5zIGlzIE9LCituYXZpZ2F0b3IudXNlckFnZW50IGlzIE9L
CituYXZpZ2F0b3IuY29va2llRW5hYmxlZCBpcyBPSworbmF2aWdhdG9yLmFwcFZlcnNpb24gaXMg
T0sKK25hdmlnYXRvci52ZW5kb3JTdWIgaXMgT0sKK25hdmlnYXRvci5vbkxpbmUgaXMgT0sKK25h
dmlnYXRvci5hcHBOYW1lIGlzIE9LCituYXZpZ2F0b3IuamF2YUVuYWJsZWQoKSBpcyBPSworbmF2
aWdhdG9yLnByb2R1Y3RTdWIgaXMgT0sKK25hdmlnYXRvci5wcm9kdWN0IGlzIE9LCituYXZpZ2F0
b3IuYXBwQ29kZU5hbWUgaXMgT0sKK25hdmlnYXRvci52ZW5kb3IgaXMgT0sKK25hdmlnYXRvci5w
bGF0Zm9ybSBpcyBPSworbmF2aWdhdG9yLm1pbWVUeXBlcyBpcyBPSworbmF2aWdhdG9yLmxhbmd1
YWdlIGlzIE9LCituYXZpZ2F0b3IucGx1Z2lucyBpcyBPSworbmF2aWdhdG9yLnVzZXJBZ2VudCBp
cyBPSworbmF2aWdhdG9yLmNvb2tpZUVuYWJsZWQgaXMgT0sKK25hdmlnYXRvci5hcHBWZXJzaW9u
IGlzIE9LCituYXZpZ2F0b3IudmVuZG9yU3ViIGlzIE9LCituYXZpZ2F0b3Iub25MaW5lIGlzIE9L
CituYXZpZ2F0b3IuYXBwTmFtZSBpcyBPSworbmF2aWdhdG9yLmphdmFFbmFibGVkKCkgaXMgT0sK
KwpJbmRleDogTGF5b3V0VGVzdHMvZmFzdC9kb20vbmF2aWdhdG9yLWRldGFjaGVkLW5vLWNyYXNo
Lmh0bWwKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvZmFzdC9kb20vbmF2aWdhdG9yLWRldGFj
aGVkLW5vLWNyYXNoLmh0bWwJKHJldmlzaW9uIDApCisrKyBMYXlvdXRUZXN0cy9mYXN0L2RvbS9u
YXZpZ2F0b3ItZGV0YWNoZWQtbm8tY3Jhc2guaHRtbAkocmV2aXNpb24gMCkKQEAgLTAsMCArMSw2
MSBAQAorPGh0bWw+Cis8c2NyaXB0PgoraWYgKHdpbmRvdy5sYXlvdXRUZXN0Q29udHJvbGxlcikg
eworICBsYXlvdXRUZXN0Q29udHJvbGxlci5kdW1wQXNUZXh0KCk7CisgIGxheW91dFRlc3RDb250
cm9sbGVyLndhaXRVbnRpbERvbmUoKTsKK30KKwordmFyIG9sZF9uYXY7CisKK2Z1bmN0aW9uIHRl
c3QoKSB7CisgIC8vIHJlbWVtYmVyIHRoZSBvbGQgbmF2aWdhdG9yCisgIG9sZF9uYXYgPSB3aW5k
b3cuc3ViZnJhbWUubmF2aWdhdG9yOworICAvLyBkZXRhY2ggdGhlIG9sZCBuYXZpZ2F0b3IKKyAg
dmFyIHAgPSBkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgic3ViZnJhbWUiKTsKKyAgcC5wYXJlbnRO
b2RlLnJlbW92ZUNoaWxkKHApOworICBpZiAod2luZG93LkdDQ29udHJvbGxlcikKKyAgICB3aW5k
b3cuR0NDb250cm9sbGVyLmNvbGxlY3QoKTsKKworICAvLyBDaGVjayBvbmNlIGltbWVkaWF0ZWx5
CisgIGNoZWNrX25hdmlnYXRvcigpOworCisgIC8vIEluIGxheW91dCB0ZXN0IG1vZGUsIGNoZWNr
IG9uZSBtb3JlIHRpbWUgbGF0ZXIuCisgIGlmICh3aW5kb3cubGF5b3V0VGVzdENvbnRyb2xsZXIp
CisgICAgc2V0VGltZW91dChjaGVja19uYXZpZ2F0b3JfYW5kX2RvbmUsIDIwMCk7Cit9CisKK2Z1
bmN0aW9uIGNoZWNrX25hdmlnYXRvcl9hbmRfZG9uZSgpIHsKKyAgY2hlY2tfbmF2aWdhdG9yKCk7
CisgIGlmICh3aW5kb3cubGF5b3V0VGVzdENvbnRyb2xsZXIpCisgICAgbGF5b3V0VGVzdENvbnRy
b2xsZXIubm90aWZ5RG9uZSgpOworfQorCitmdW5jdGlvbiBjaGVja19uYXZpZ2F0b3IoKSB7Cisg
IGZvciAocCBpbiBvbGRfbmF2KSB7CisgICAgaWYgKHR5cGVvZiBvbGRfbmF2W3BdID09ICdmdW5j
dGlvbicpIHsKKyAgICAgIHZhciB2ID0gb2xkX25hdltwXSgpOworICAgICAgLy8gbm8gY3Jhc2gs
IGl0IGlzIG9rCisgICAgICBsb2coIm5hdmlnYXRvci4iK3ArIigpIGlzIE9LIik7CisgICAgfSBl
bHNlIHsKKyAgICAgIHZhciB2ID0gb2xkX25hdltwXTsKKyAgICAgIC8vIG5vIGNyYXNoLCBpdCBp
cyBvay4KKyAgICAgIGxvZygibmF2aWdhdG9yLiIrcCsiIGlzIE9LIik7CisgICAgfQorICB9Cit9
CisKK2Z1bmN0aW9uIGxvZyhtc2cpIHsKKyAgdmFyIHIgPSBkb2N1bWVudC5nZXRFbGVtZW50QnlJ
ZCgncmVzdWx0Jyk7CisgIHIuaW5uZXJIVE1MICs9IG1zZyArICc8YnI+JzsKK30KKworPC9zY3Jp
cHQ+Cis8Ym9keSBvbmxvYWQ9InRlc3QoKSI+CitUaGlzIHRlc3RzIHRoYXQgdGhlIG5hdmlnYXRv
ciBvYmplY3Qgb2YgYSBkZWxldGVkIGZyYW1lIGlzIGRpc2Nvbm5lY3RlZAorcHJvcGVybHkuIEFj
Y2Vzc2luZyBmaWVsZHMgb3IgbWV0aG9kcyBzaG91bGRuJ3QgY3Jhc2ggdGhlIGJyb3dzZXIuCis8
YnI+Cis8aWZyYW1lIGlkPSJzdWJmcmFtZSIgc3JjPSJhYm91dDpibGFuayI+PC9pZnJhbWU+Cis8
YnV0dG9uIG9uY2xpY2s9ImNoZWNrX25hdmlnYXRvcigpIj5DaGVjayBOYXZpZ2F0b3I8L2J1dHRv
bj48YnI+Cis8ZGl2IGlkPSJyZXN1bHQiPjwvZGl2PgorPC9ib2R5PgorPC9odG1sPgo=
</data>
<flag name="review"
          id="13255"
          type_id="1"
          status="-"
          setter="ap"
    />
          </attachment>
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>27493</attachid>
            <date>2009-02-09 14:25:42 -0800</date>
            <delta_ts>2009-02-10 00:17:23 -0800</delta_ts>
            <desc>patch v2</desc>
            <filename>23626patch.txt</filename>
            <type>text/plain</type>
            <size>5630</size>
            <attacher name="Feng Qian">feng</attacher>
            
              <data encoding="base64">SW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9n
CShyZXZpc2lvbiA0MDcyOSkKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA
IC0xLDMgKzEsMTUgQEAKKzIwMDktMDItMDYgIEZlbmcgUWlhbiA8ZmVuZ0BjaHJvbWl1bS5vcmc+
CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgRml4IGNy
YXNoZXMgd2hlbiBhY2Nlc3NpbmcgbmF2aWdhdG9yIG9iamVjdCBvZiBhIGRlbGV0ZWQgZnJhbWUu
CisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0yMzYyNgor
ICAgICAgICBBIGxheW91dCB0ZXN0IGlzIGFkZGVkOiBmYXN0L2RvbS9uYXZpZ2F0b3ItZGV0YWNo
ZWQtbm8tY3Jhc2guaHRtbAorCisgICAgICAgICogcGFnZS9OYXZpZ2F0b3IuY3BwOgorICAgICAg
ICAoV2ViQ29yZTo6TmF2aWdhdG9yOjpjb29raWVFbmFibGVkKToKKyAgICAgICAgKFdlYkNvcmU6
Ok5hdmlnYXRvcjo6amF2YUVuYWJsZWQpOgorCiAyMDA5LTAyLTA2ICBEYW4gQmVybnN0ZWluICA8
bWl0ekBhcHBsZS5jb20+CiAKICAgICAgICAgUmV2aWV3ZWQgYnkgRGFyaW4gQWRsZXIuCkluZGV4
OiBXZWJDb3JlL3BhZ2UvTmF2aWdhdG9yLmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBXZWJDb3JlL3BhZ2Uv
TmF2aWdhdG9yLmNwcAkocmV2aXNpb24gNDA3MjgpCisrKyBXZWJDb3JlL3BhZ2UvTmF2aWdhdG9y
LmNwcAkod29ya2luZyBjb3B5KQpAQCAtMTAyLDYgKzEwMiwxMiBAQCBTdHJpbmcgTmF2aWdhdG9y
Ojp1c2VyQWdlbnQoKSBjb25zdAogewogICAgIGlmICghbV9mcmFtZSkKICAgICAgICAgcmV0dXJu
IFN0cmluZygpOworICAgICAgICAKKyAgICAvLyBJZiB0aGUgZnJhbWUgZG9lcyBub3QgaGF2ZSBh
IHBhZ2UsIHJldHVybnMgZW1wdHkgc3RyaW5nIGluc3RlYWQgb2YKKyAgICAvLyBjYWxsaW5nIEZy
YW1lTG9hZGVyOjp1c2VyQWdlbnQuCisgICAgaWYgKCFtX2ZyYW1lLT5wYWdlKCkpCisgICAgICAg
IHJldHVybiBTdHJpbmcoKTsKKyAgICAgICAgCiAgICAgcmV0dXJuIG1fZnJhbWUtPmxvYWRlcigp
LT51c2VyQWdlbnQobV9mcmFtZS0+ZG9jdW1lbnQoKSA/IG1fZnJhbWUtPmRvY3VtZW50KCktPnVy
bCgpIDogS1VSTCgpKTsKIH0KIApAQCAtMTIxLDYgKzEyNyw5IEBAIE1pbWVUeXBlQXJyYXkqIE5h
dmlnYXRvcjo6bWltZVR5cGVzKCkgY28KIAogYm9vbCBOYXZpZ2F0b3I6OmNvb2tpZUVuYWJsZWQo
KSBjb25zdAogeworICAgIGlmICghbV9mcmFtZSkKKyAgICAgICAgcmV0dXJuIGZhbHNlOworICAg
ICAgICAKICAgICBpZiAobV9mcmFtZS0+cGFnZSgpICYmICFtX2ZyYW1lLT5wYWdlKCktPmNvb2tp
ZUVuYWJsZWQoKSkKICAgICAgICAgcmV0dXJuIGZhbHNlOwogCkBAIC0xMjksOCArMTM4LDkgQEAg
Ym9vbCBOYXZpZ2F0b3I6OmNvb2tpZUVuYWJsZWQoKSBjb25zdAogCiBib29sIE5hdmlnYXRvcjo6
amF2YUVuYWJsZWQoKSBjb25zdAogewotICAgIGlmICghbV9mcmFtZSkKKyAgICBpZiAoIW1fZnJh
bWUgfHwgIW1fZnJhbWUtPnNldHRpbmdzKCkpCiAgICAgICAgIHJldHVybiBmYWxzZTsKKwogICAg
IHJldHVybiBtX2ZyYW1lLT5zZXR0aW5ncygpLT5pc0phdmFFbmFibGVkKCk7CiB9CiAKSW5kZXg6
IExheW91dFRlc3RzL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9DaGFuZ2VM
b2cJKHJldmlzaW9uIDQwNzI5KQorKysgTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCSh3b3JraW5nIGNv
cHkpCkBAIC0xLDMgKzEsMTMgQEAKKzIwMDktMDItMDYgIEZlbmcgUWlhbiA8ZmVuZ0BjaHJvbWl1
bS5vcmc+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAg
Rml4IGNyYXNoZXMgaW4gZGlzY29ubmVjdGVkIG5hdmlnYXRvciBvYmplY3QuCisgICAgICAgIGh0
dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0yMzYyNgorCisgICAgICAgICog
ZmFzdC9kb20vbmF2aWdhdG9yLWRldGFjaGVkLW5vLWNyYXNoLWV4cGVjdGVkLnR4dDogQWRkZWQu
CisgICAgICAgICogZmFzdC9kb20vbmF2aWdhdG9yLWRldGFjaGVkLW5vLWNyYXNoLmh0bWw6IEFk
ZGVkLgorCiAyMDA5LTAyLTA1ICBBbGV4ZXkgUHJvc2t1cnlha292ICA8YXBAd2Via2l0Lm9yZz4K
IAogICAgICAgICBSZXZpZXdlZCBieSBEYXJpbiBBZGxlci4KSW5kZXg6IExheW91dFRlc3RzL2Zh
c3QvZG9tL25hdmlnYXRvci1kZXRhY2hlZC1uby1jcmFzaC1leHBlY3RlZC50eHQKPT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PQotLS0gTGF5b3V0VGVzdHMvZmFzdC9kb20vbmF2aWdhdG9yLWRldGFjaGVkLW5vLWNyYXNoLWV4
cGVjdGVkLnR4dAkocmV2aXNpb24gMCkKKysrIExheW91dFRlc3RzL2Zhc3QvZG9tL25hdmlnYXRv
ci1kZXRhY2hlZC1uby1jcmFzaC1leHBlY3RlZC50eHQJKHJldmlzaW9uIDApCkBAIC0wLDAgKzEs
MzMgQEAKK1RoaXMgdGVzdHMgdGhhdCB0aGUgbmF2aWdhdG9yIG9iamVjdCBvZiBhIGRlbGV0ZWQg
ZnJhbWUgaXMgZGlzY29ubmVjdGVkIHByb3Blcmx5LiBBY2Nlc3NpbmcgZmllbGRzIG9yIG1ldGhv
ZHMgc2hvdWxkbid0IGNyYXNoIHRoZSBicm93c2VyLiAKKyBDaGVjayBOYXZpZ2F0b3IKK25hdmln
YXRvci5wcm9kdWN0U3ViIGlzIE9LCituYXZpZ2F0b3IucHJvZHVjdCBpcyBPSworbmF2aWdhdG9y
LmFwcENvZGVOYW1lIGlzIE9LCituYXZpZ2F0b3IudmVuZG9yIGlzIE9LCituYXZpZ2F0b3IucGxh
dGZvcm0gaXMgT0sKK25hdmlnYXRvci5taW1lVHlwZXMgaXMgT0sKK25hdmlnYXRvci5sYW5ndWFn
ZSBpcyBPSworbmF2aWdhdG9yLnBsdWdpbnMgaXMgT0sKK25hdmlnYXRvci51c2VyQWdlbnQgaXMg
T0sKK25hdmlnYXRvci5jb29raWVFbmFibGVkIGlzIE9LCituYXZpZ2F0b3IuYXBwVmVyc2lvbiBp
cyBPSworbmF2aWdhdG9yLnZlbmRvclN1YiBpcyBPSworbmF2aWdhdG9yLm9uTGluZSBpcyBPSwor
bmF2aWdhdG9yLmFwcE5hbWUgaXMgT0sKK25hdmlnYXRvci5qYXZhRW5hYmxlZCgpIGlzIE9LCitu
YXZpZ2F0b3IucHJvZHVjdFN1YiBpcyBPSworbmF2aWdhdG9yLnByb2R1Y3QgaXMgT0sKK25hdmln
YXRvci5hcHBDb2RlTmFtZSBpcyBPSworbmF2aWdhdG9yLnZlbmRvciBpcyBPSworbmF2aWdhdG9y
LnBsYXRmb3JtIGlzIE9LCituYXZpZ2F0b3IubWltZVR5cGVzIGlzIE9LCituYXZpZ2F0b3IubGFu
Z3VhZ2UgaXMgT0sKK25hdmlnYXRvci5wbHVnaW5zIGlzIE9LCituYXZpZ2F0b3IudXNlckFnZW50
IGlzIE9LCituYXZpZ2F0b3IuY29va2llRW5hYmxlZCBpcyBPSworbmF2aWdhdG9yLmFwcFZlcnNp
b24gaXMgT0sKK25hdmlnYXRvci52ZW5kb3JTdWIgaXMgT0sKK25hdmlnYXRvci5vbkxpbmUgaXMg
T0sKK25hdmlnYXRvci5hcHBOYW1lIGlzIE9LCituYXZpZ2F0b3IuamF2YUVuYWJsZWQoKSBpcyBP
SworCkluZGV4OiBMYXlvdXRUZXN0cy9mYXN0L2RvbS9uYXZpZ2F0b3ItZGV0YWNoZWQtbm8tY3Jh
c2guaHRtbAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9mYXN0L2RvbS9uYXZpZ2F0b3ItZGV0
YWNoZWQtbm8tY3Jhc2guaHRtbAkocmV2aXNpb24gMCkKKysrIExheW91dFRlc3RzL2Zhc3QvZG9t
L25hdmlnYXRvci1kZXRhY2hlZC1uby1jcmFzaC5odG1sCShyZXZpc2lvbiAwKQpAQCAtMCwwICsx
LDcyIEBACis8aHRtbD4KKzxzY3JpcHQ+CitpZiAod2luZG93LmxheW91dFRlc3RDb250cm9sbGVy
KSB7CisgIGxheW91dFRlc3RDb250cm9sbGVyLmR1bXBBc1RleHQoKTsKKyAgbGF5b3V0VGVzdENv
bnRyb2xsZXIud2FpdFVudGlsRG9uZSgpOworfQorCitmdW5jdGlvbiBsb2cobXNnKSB7CisgIGRv
Y3VtZW50LmdldEVsZW1lbnRCeUlkKCdyZXN1bHQnKS5pbm5lckhUTUwgKz0gbXNnICsgJzxicj4n
OworfQorCitmdW5jdGlvbiBnYygpCit7CisgICAgaWYgKHdpbmRvdy5HQ0NvbnRyb2xsZXIpIHsK
KyAgICAgICAgR0NDb250cm9sbGVyLmNvbGxlY3QoKTsKKyAgICB9IGVsc2UgeworICAgICAgICBm
b3IgKHZhciBpID0gMDsgaSA8IDEwMDAwOyBpKyspIHsKKyAgICAgICAgICAgIHZhciBzID0gbmV3
IFN0cmluZygiYWJjIik7CisgICAgICAgIH0KKyAgICB9Cit9CisKK3ZhciBvbGRfbmF2OworCitm
dW5jdGlvbiB0ZXN0KCkgeworICAvLyByZW1lbWJlciB0aGUgb2xkIG5hdmlnYXRvcgorICBvbGRf
bmF2ID0gd2luZG93LmZyYW1lc1swXS5uYXZpZ2F0b3I7CisgIC8vIGRldGFjaCB0aGUgb2xkIG5h
dmlnYXRvcgorICB2YXIgcCA9IGRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCJzdWJmcmFtZSIpOwor
ICBwLnBhcmVudE5vZGUucmVtb3ZlQ2hpbGQocCk7CisgIGlmICh3aW5kb3cuR0NDb250cm9sbGVy
KQorICAgIHdpbmRvdy5HQ0NvbnRyb2xsZXIuY29sbGVjdCgpOworCisgIC8vIENoZWNrIG9uY2Ug
aW1tZWRpYXRlbHkKKyAgY2hlY2tfbmF2aWdhdG9yKCk7CisKKyAgZ2MoKTsKKworICAvLyBJbiBs
YXlvdXQgdGVzdCBtb2RlLCBjaGVjayBvbmUgbW9yZSB0aW1lIGxhdGVyLgorICBzZXRUaW1lb3V0
KGNoZWNrX25hdmlnYXRvcl9hbmRfZG9uZSwgMjAwKTsKK30KKworZnVuY3Rpb24gY2hlY2tfbmF2
aWdhdG9yX2FuZF9kb25lKCkgeworICBjaGVja19uYXZpZ2F0b3IoKTsKKyAgaWYgKHdpbmRvdy5s
YXlvdXRUZXN0Q29udHJvbGxlcikKKyAgICBsYXlvdXRUZXN0Q29udHJvbGxlci5ub3RpZnlEb25l
KCk7Cit9CisKK2Z1bmN0aW9uIGNoZWNrX25hdmlnYXRvcigpIHsKKyAgZm9yIChwIGluIG9sZF9u
YXYpIHsKKyAgICBpZiAodHlwZW9mIG9sZF9uYXZbcF0gPT0gJ2Z1bmN0aW9uJykgeworICAgICAg
dmFyIHYgPSBvbGRfbmF2W3BdKCk7CisgICAgICAvLyBubyBjcmFzaCwgaXQgaXMgb2sKKyAgICAg
IGxvZygibmF2aWdhdG9yLiIrcCsiKCkgaXMgT0siKTsKKyAgICB9IGVsc2UgeworICAgICAgdmFy
IHYgPSBvbGRfbmF2W3BdOworICAgICAgLy8gbm8gY3Jhc2gsIGl0IGlzIG9rLgorICAgICAgbG9n
KCJuYXZpZ2F0b3IuIitwKyIgaXMgT0siKTsKKyAgICB9CisgIH0KK30KKworPC9zY3JpcHQ+Cis8
Ym9keSBvbmxvYWQ9InRlc3QoKSI+CitUaGlzIHRlc3RzIHRoYXQgdGhlIG5hdmlnYXRvciBvYmpl
Y3Qgb2YgYSBkZWxldGVkIGZyYW1lIGlzIGRpc2Nvbm5lY3RlZAorcHJvcGVybHkuIEFjY2Vzc2lu
ZyBmaWVsZHMgb3IgbWV0aG9kcyBzaG91bGRuJ3QgY3Jhc2ggdGhlIGJyb3dzZXIuCis8YnI+Cis8
aWZyYW1lIGlkPSJzdWJmcmFtZSIgc3JjPSJhYm91dDpibGFuayI+PC9pZnJhbWU+Cis8YnV0dG9u
IG9uY2xpY2s9ImNoZWNrX25hdmlnYXRvcigpIj5DaGVjayBOYXZpZ2F0b3I8L2J1dHRvbj48YnI+
Cis8ZGl2IGlkPSJyZXN1bHQiPjwvZGl2PgorPC9ib2R5PgorPC9odG1sPgo=
</data>
<flag name="review"
          id="13301"
          type_id="1"
          status="+"
          setter="ap"
    />
          </attachment>
      

    </bug>

</bugzilla>