<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>34182</bug_id>
          
          <creation_ts>2010-01-26 13:41:55 -0800</creation_ts>
          <short_desc>Crash in WebKit!WebCore::RenderMenuList::itemStyle</short_desc>
          <delta_ts>2010-01-26 14:55:41 -0800</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>New Bugs</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>Other</rep_platform>
          <op_sys>OS X 10.5</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords></keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Brian Weinstein">bweinstein</reporter>
          <assigned_to name="Nobody">webkit-unassigned</assigned_to>
          <cc>webkit.review.bot</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>184705</commentid>
    <comment_count>0</comment_count>
    <who name="Brian Weinstein">bweinstein</who>
    <bug_when>2010-01-26 13:41:55 -0800</bug_when>
    <thetext>Crash in WebKit!WebCore::RenderMenuList::itemStyle</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>184708</commentid>
    <comment_count>1</comment_count>
      <attachid>47445</attachid>
    <who name="Brian Weinstein">bweinstein</who>
    <bug_when>2010-01-26 13:55:21 -0800</bug_when>
    <thetext>Created attachment 47445
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>184712</commentid>
    <comment_count>2</comment_count>
    <who name="WebKit Review Bot">webkit.review.bot</who>
    <bug_when>2010-01-26 14:00:47 -0800</bug_when>
    <thetext>Attachment 47445 did not pass style-queue:

Failed to run &quot;WebKitTools/Scripts/check-webkit-style&quot; exit_code: 1
Traceback (most recent call last):
  File &quot;WebKitTools/Scripts/check-webkit-style&quot;, line 94, in &lt;module&gt;
    main()
  File &quot;WebKitTools/Scripts/check-webkit-style&quot;, line 87, in main
    style_checker.check_patch(patch)
  File &quot;/mnt/git/webkit-style-queue/WebKitTools/Scripts/webkitpy/style/checker.py&quot;, line 932, in check_patch
    self.check_file(file_path, handle_patch_style_error)
  File &quot;/mnt/git/webkit-style-queue/WebKitTools/Scripts/webkitpy/style/checker.py&quot;, line 897, in check_file
    process_file(processor, file_path, handle_style_error)
  File &quot;/mnt/git/webkit-style-queue/WebKitTools/Scripts/webkitpy/style/checker.py&quot;, line 858, in _process_file
    &apos;One or more unexpected \\r (^M) found;&apos;
TypeError: handle_patch_style_error() takes exactly 4 arguments (5 given)


If any of these errors are false positives, please file a bug against check-webkit-style.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>184731</commentid>
    <comment_count>3</comment_count>
      <attachid>47445</attachid>
    <who name="Jon Honeycutt">jhoneycutt</who>
    <bug_when>2010-01-26 14:19:57 -0800</bug_when>
    <thetext>Comment on attachment 47445
Patch

&gt; Index: WebCore/manual-tests/select-delete-item.html
&gt; ===================================================================
&gt; --- WebCore/manual-tests/select-delete-item.html	(revision 0)
&gt; +++ WebCore/manual-tests/select-delete-item.html	(revision 0)
&gt; @@ -0,0 +1,21 @@
&gt; +&lt;html&gt;
&gt; +&lt;head&gt;
&gt; +    &lt;title&gt;RenderMenuList::itemStyle Select Element Crash&lt;/title&gt;
&gt; +    &lt;script&gt;
&gt; +        function removeItem() {
&gt; +            var select = document.getElementById(&quot;dropDown&quot;);
&gt; +            select.removeChild(document.getElementsByTagName(&quot;option&quot;)[2]);
&gt; +        }
&gt; +    &lt;/script&gt;
&gt; +&lt;/head&gt;
&gt; +&lt;body&gt;
&gt; +    &lt;select id=&quot;dropDown&quot; onfocus=&quot;setTimeout(&apos;removeItem();&apos;, 2000);&quot;&gt;
&gt; +        &lt;option&gt;Option 1&lt;/option&gt;
&gt; +        &lt;option&gt;Option 2&lt;/option&gt;
&gt; +        &lt;option&gt;Option 3&lt;/option&gt;
&gt; +    &lt;/select&gt;
&gt; +    &lt;p&gt;This is a test for bug &lt;a href=&quot;http://webkit.org/b/34182&quot;&gt;34182&lt;/a&gt; Crash in WebKit!WebCore::RenderMenuList::itemStyle.
&gt; +    Once the select gets focus, in 2 seconds it will delete an item. This test passes
&gt; +    if you have the select open when it deletes an item, and doesn&apos;t crash.&lt;/p&gt;
&gt; +&lt;/body&gt;
&gt; +&lt;/html&gt;

You should be able to add an automated test using the AccessibilityController to show the menu:

document.getElementById(&quot;dropDown&quot;).focus();
accessibilityController.focusedUIElement.showMenu();


&gt; Index: WebCore/rendering/RenderMenuList.cpp
&gt; ===================================================================
&gt; --- WebCore/rendering/RenderMenuList.cpp	(revision 53736)
&gt; +++ WebCore/rendering/RenderMenuList.cpp	(working copy)
&gt; @@ -359,7 +368,18 @@ bool RenderMenuList::itemIsEnabled(unsig
&gt;  PopupMenuStyle RenderMenuList::itemStyle(unsigned listIndex) const
&gt;  {
&gt;      SelectElement* select = toSelectElement(static_cast&lt;Element*&gt;(node()));
&gt; -    Element* element = select-&gt;listItems()[listIndex];
&gt; +    const Vector&lt;Element*&gt;&amp; listItems = select-&gt;listItems();
&gt; +    if (listIndex &gt;= listItems.size()) {
&gt; +        // If we are making an out of bounds access, then we want to use the style
&gt; +        // of the option element before us. However, if there isn&apos;t an option element
&gt; +        // before us, we fall back to the default menu style.
&gt; +        if (!listIndex)
&gt; +            return menuStyle();
&gt; +
&gt; +        // Try to retrieve the style of the previous option element.
&gt; +        listIndex--;
&gt; +    }

You should set listIndex to 0 as we discussed.

r=me</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>184751</commentid>
    <comment_count>4</comment_count>
    <who name="Brian Weinstein">bweinstein</who>
    <bug_when>2010-01-26 14:39:45 -0800</bug_when>
    <thetext>(In reply to comment #3)
&gt; You should be able to add an automated test using the AccessibilityController
&gt; to show the menu:
&gt; 
&gt; document.getElementById(&quot;dropDown&quot;).focus();
&gt; accessibilityController.focusedUIElement.showMenu();

I wasn&apos;t able to get the automated test to hit my breakpoints, which means it wasn&apos;t doing anything, so I&apos;ll do a manual test for now.

&gt; You should set listIndex to 0 as we discussed.

Done.

&gt; r=me

Thanks!</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>184760</commentid>
    <comment_count>5</comment_count>
    <who name="Brian Weinstein">bweinstein</who>
    <bug_when>2010-01-26 14:46:16 -0800</bug_when>
    <thetext>Landed in r53687.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>184771</commentid>
    <comment_count>6</comment_count>
      <attachid>47445</attachid>
    <who name="Eric Seidel (no email)">eric</who>
    <bug_when>2010-01-26 14:55:41 -0800</bug_when>
    <thetext>Comment on attachment 47445
Patch

I think I would have used some listItem(index) function which did the bounds check and return 0 instead of usign a local Vector&amp; in every function.</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>47445</attachid>
            <date>2010-01-26 13:55:21 -0800</date>
            <delta_ts>2010-01-26 14:55:41 -0800</delta_ts>
            <desc>Patch</desc>
            <filename>bug-34182-20100126135514.patch</filename>
            <type>text/plain</type>
            <size>7507</size>
            <attacher name="Brian Weinstein">bweinstein</attacher>
            
              <data encoding="base64">SW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9n
CShyZXZpc2lvbiA1Mzg2NCkKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA
IC0xLDMgKzEsMjkgQEAKKzIwMTAtMDEtMjYgIEJyaWFuIFdlaW5zdGVpbiAgPGJ3ZWluc3RlaW5A
YXBwbGUuY29tPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAg
ICAgIENyYXNoIGluIFdlYktpdCFXZWJDb3JlOjpSZW5kZXJNZW51TGlzdDo6aXRlbVN0eWxlCisg
ICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0zNDE4MgorICAg
ICAgICA8cmRhcjovLzcwODc3NTc+CisgICAgICAgIAorICAgICAgICBBZGRlZCBib3VuZHMgY2hl
Y2tzIGluIFJlbmRlck1lbnVMaXN0IHRvIG1ha2Ugc3VyZSB3ZSBhcmUKKyAgICAgICAgbm90IG1h
a2luZyBhbiBvdXQgb2YgYm91bmRzIGNoZWNrIGluIGEgdmVjdG9yIG9uY2UgYW4gb3B0aW9uCisg
ICAgICAgIGVsZW1lbnQgaGFzIGJlZW4gZGVsZXRlZC4gSWYgd2UgYXJlIG91dCBvZiBib3VuZHMs
IHdlIGZhbGwgYmFjayB0bworICAgICAgICBhIGRlZmF1bHQgdmFsdWUgYW5kIHJldHVybiBlYXJs
eSwgYW5kIGluIHRoZSBjYXNlIG9mIGl0ZW1TdHlsZSwgd2UgdXNlIGEgCisgICAgICAgIHByZXZp
b3VzIG9wdGlvbidzIHN0eWxlLCBpZiBpdCBpcyBhdmFpbGFibGUuCisKKyAgICAgICAgKiBtYW51
YWwtdGVzdHMvc2VsZWN0LWRlbGV0ZS1pdGVtLmh0bWw6IEFkZGVkLgorICAgICAgICAqIHJlbmRl
cmluZy9SZW5kZXJNZW51TGlzdC5jcHA6CisgICAgICAgIChXZWJDb3JlOjpSZW5kZXJNZW51TGlz
dDo6aXRlbVRleHQpOiBJZiBvdXQgb2YgYm91bmRzIGNoZWNrLCByZXR1cm4gZWFybHkuCisgICAg
ICAgIChXZWJDb3JlOjpSZW5kZXJNZW51TGlzdDo6aXRlbVRvb2xUaXApOiBEaXR0by4KKyAgICAg
ICAgKFdlYkNvcmU6OlJlbmRlck1lbnVMaXN0OjppdGVtSXNFbmFibGVkKTogRGl0dG8uCisgICAg
ICAgIChXZWJDb3JlOjpSZW5kZXJNZW51TGlzdDo6aXRlbVN0eWxlKTogSWYgb3V0IG9mIGJvdW5k
cyBjaGVjaywgdHJ5IHVzaW5nIHRoZSBwcmV2aW91cworICAgICAgICAgICAgb3B0aW9uJ3Mgc3R5
bGUsIHRoZW4gZmFsbCBiYWNrIHRvIHRoZSBzZWxlY3QncyBzdHlsZSBpZiB0aGVyZSBpcyBubyBw
cmV2aW91cyBvcHRpb24uCisgICAgICAgIChXZWJDb3JlOjpSZW5kZXJNZW51TGlzdDo6aXRlbUJh
Y2tncm91bmRDb2xvcik6IElmIG91dCBvZiBib3VuZHMgY2hlY2ssIHJldHVybiBlYXJseS4KKyAg
ICAgICAgKFdlYkNvcmU6OlJlbmRlck1lbnVMaXN0OjppdGVtSXNTZXBhcmF0b3IpOiBEaXR0by4K
KyAgICAgICAgKFdlYkNvcmU6OlJlbmRlck1lbnVMaXN0OjppdGVtSXNMYWJlbCk6IERpdHRvLgor
ICAgICAgICAoV2ViQ29yZTo6UmVuZGVyTWVudUxpc3Q6Oml0ZW1Jc1NlbGVjdGVkKTogRGl0dG8u
CisKIDIwMTAtMDEtMjYgIFN0ZXZlIEZhbGtlbmJ1cmcgIDxzZmFsa2VuQGFwcGxlLmNvbT4KIAog
ICAgICAgICBSZXZpZXdlZCBieSBPbGl2ZXIgSHVudC4KSW5kZXg6IFdlYkNvcmUvbWFudWFsLXRl
c3RzL3NlbGVjdC1kZWxldGUtaXRlbS5odG1sCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvbWFudWFs
LXRlc3RzL3NlbGVjdC1kZWxldGUtaXRlbS5odG1sCShyZXZpc2lvbiAwKQorKysgV2ViQ29yZS9t
YW51YWwtdGVzdHMvc2VsZWN0LWRlbGV0ZS1pdGVtLmh0bWwJKHJldmlzaW9uIDApCkBAIC0wLDAg
KzEsMjEgQEAKKzxodG1sPg0KKzxoZWFkPg0KKyAgICA8dGl0bGU+UmVuZGVyTWVudUxpc3Q6Oml0
ZW1TdHlsZSBTZWxlY3QgRWxlbWVudCBDcmFzaDwvdGl0bGU+DQorICAgIDxzY3JpcHQ+DQorICAg
ICAgICBmdW5jdGlvbiByZW1vdmVJdGVtKCkgew0KKyAgICAgICAgICAgIHZhciBzZWxlY3QgPSBk
b2N1bWVudC5nZXRFbGVtZW50QnlJZCgiZHJvcERvd24iKTsNCisgICAgICAgICAgICBzZWxlY3Qu
cmVtb3ZlQ2hpbGQoZG9jdW1lbnQuZ2V0RWxlbWVudHNCeVRhZ05hbWUoIm9wdGlvbiIpWzJdKTsN
CisgICAgICAgIH0NCisgICAgPC9zY3JpcHQ+DQorPC9oZWFkPg0KKzxib2R5Pg0KKyAgICA8c2Vs
ZWN0IGlkPSJkcm9wRG93biIgb25mb2N1cz0ic2V0VGltZW91dCgncmVtb3ZlSXRlbSgpOycsIDIw
MDApOyI+DQorICAgICAgICA8b3B0aW9uPk9wdGlvbiAxPC9vcHRpb24+DQorICAgICAgICA8b3B0
aW9uPk9wdGlvbiAyPC9vcHRpb24+DQorICAgICAgICA8b3B0aW9uPk9wdGlvbiAzPC9vcHRpb24+
DQorICAgIDwvc2VsZWN0Pg0KKyAgICA8cD5UaGlzIGlzIGEgdGVzdCBmb3IgYnVnIDxhIGhyZWY9
Imh0dHA6Ly93ZWJraXQub3JnL2IvMzQxODIiPjM0MTgyPC9hPiBDcmFzaCBpbiBXZWJLaXQhV2Vi
Q29yZTo6UmVuZGVyTWVudUxpc3Q6Oml0ZW1TdHlsZS4NCisgICAgT25jZSB0aGUgc2VsZWN0IGdl
dHMgZm9jdXMsIGluIDIgc2Vjb25kcyBpdCB3aWxsIGRlbGV0ZSBhbiBpdGVtLiBUaGlzIHRlc3Qg
cGFzc2VzDQorICAgIGlmIHlvdSBoYXZlIHRoZSBzZWxlY3Qgb3BlbiB3aGVuIGl0IGRlbGV0ZXMg
YW4gaXRlbSwgYW5kIGRvZXNuJ3QgY3Jhc2guPC9wPg0KKzwvYm9keT4NCis8L2h0bWw+DQpJbmRl
eDogV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyTWVudUxpc3QuY3BwCj09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdl
YkNvcmUvcmVuZGVyaW5nL1JlbmRlck1lbnVMaXN0LmNwcAkocmV2aXNpb24gNTM3MzYpCisrKyBX
ZWJDb3JlL3JlbmRlcmluZy9SZW5kZXJNZW51TGlzdC5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTMy
Myw3ICszMjMsMTAgQEAgdm9pZCBSZW5kZXJNZW51TGlzdDo6ZGlkU2V0U2VsZWN0ZWRJbmRleAog
U3RyaW5nIFJlbmRlck1lbnVMaXN0OjppdGVtVGV4dCh1bnNpZ25lZCBsaXN0SW5kZXgpIGNvbnN0
CiB7CiAgICAgU2VsZWN0RWxlbWVudCogc2VsZWN0ID0gdG9TZWxlY3RFbGVtZW50KHN0YXRpY19j
YXN0PEVsZW1lbnQqPihub2RlKCkpKTsKLSAgICBFbGVtZW50KiBlbGVtZW50ID0gc2VsZWN0LT5s
aXN0SXRlbXMoKVtsaXN0SW5kZXhdOworICAgIGNvbnN0IFZlY3RvcjxFbGVtZW50Kj4mIGxpc3RJ
dGVtcyA9IHNlbGVjdC0+bGlzdEl0ZW1zKCk7CisgICAgaWYgKGxpc3RJbmRleCA+PSBsaXN0SXRl
bXMuc2l6ZSgpKQorICAgICAgICByZXR1cm4gU3RyaW5nKCk7CisgICAgRWxlbWVudCogZWxlbWVu
dCA9IGxpc3RJdGVtc1tsaXN0SW5kZXhdOwogICAgIGlmIChPcHRpb25Hcm91cEVsZW1lbnQqIG9w
dGlvbkdyb3VwRWxlbWVudCA9IHRvT3B0aW9uR3JvdXBFbGVtZW50KGVsZW1lbnQpKQogICAgICAg
ICByZXR1cm4gb3B0aW9uR3JvdXBFbGVtZW50LT5ncm91cExhYmVsVGV4dCgpOwogICAgIGVsc2Ug
aWYgKE9wdGlvbkVsZW1lbnQqIG9wdGlvbkVsZW1lbnQgPSB0b09wdGlvbkVsZW1lbnQoZWxlbWVu
dCkpCkBAIC0zMzQsMTQgKzMzNywyMCBAQCBTdHJpbmcgUmVuZGVyTWVudUxpc3Q6Oml0ZW1UZXh0
KHVuc2lnbmVkCiBTdHJpbmcgUmVuZGVyTWVudUxpc3Q6Oml0ZW1Ub29sVGlwKHVuc2lnbmVkIGxp
c3RJbmRleCkgY29uc3QKIHsKICAgICBTZWxlY3RFbGVtZW50KiBzZWxlY3QgPSB0b1NlbGVjdEVs
ZW1lbnQoc3RhdGljX2Nhc3Q8RWxlbWVudCo+KG5vZGUoKSkpOwotICAgIEVsZW1lbnQqIGVsZW1l
bnQgPSBzZWxlY3QtPmxpc3RJdGVtcygpW2xpc3RJbmRleF07CisgICAgY29uc3QgVmVjdG9yPEVs
ZW1lbnQqPiYgbGlzdEl0ZW1zID0gc2VsZWN0LT5saXN0SXRlbXMoKTsKKyAgICBpZiAobGlzdElu
ZGV4ID49IGxpc3RJdGVtcy5zaXplKCkpCisgICAgICAgIHJldHVybiBTdHJpbmcoKTsKKyAgICBF
bGVtZW50KiBlbGVtZW50ID0gbGlzdEl0ZW1zW2xpc3RJbmRleF07CiAgICAgcmV0dXJuIGVsZW1l
bnQtPnRpdGxlKCk7CiB9CiAKIGJvb2wgUmVuZGVyTWVudUxpc3Q6Oml0ZW1Jc0VuYWJsZWQodW5z
aWduZWQgbGlzdEluZGV4KSBjb25zdAogewogICAgIFNlbGVjdEVsZW1lbnQqIHNlbGVjdCA9IHRv
U2VsZWN0RWxlbWVudChzdGF0aWNfY2FzdDxFbGVtZW50Kj4obm9kZSgpKSk7Ci0gICAgRWxlbWVu
dCogZWxlbWVudCA9IHNlbGVjdC0+bGlzdEl0ZW1zKClbbGlzdEluZGV4XTsKKyAgICBjb25zdCBW
ZWN0b3I8RWxlbWVudCo+JiBsaXN0SXRlbXMgPSBzZWxlY3QtPmxpc3RJdGVtcygpOworICAgIGlm
IChsaXN0SW5kZXggPj0gbGlzdEl0ZW1zLnNpemUoKSkKKyAgICAgICAgcmV0dXJuIGZhbHNlOwor
ICAgIEVsZW1lbnQqIGVsZW1lbnQgPSBsaXN0SXRlbXNbbGlzdEluZGV4XTsKICAgICBpZiAoIWlz
T3B0aW9uRWxlbWVudChlbGVtZW50KSkKICAgICAgICAgcmV0dXJuIGZhbHNlOwogCkBAIC0zNTks
NyArMzY4LDE4IEBAIGJvb2wgUmVuZGVyTWVudUxpc3Q6Oml0ZW1Jc0VuYWJsZWQodW5zaWcKIFBv
cHVwTWVudVN0eWxlIFJlbmRlck1lbnVMaXN0OjppdGVtU3R5bGUodW5zaWduZWQgbGlzdEluZGV4
KSBjb25zdAogewogICAgIFNlbGVjdEVsZW1lbnQqIHNlbGVjdCA9IHRvU2VsZWN0RWxlbWVudChz
dGF0aWNfY2FzdDxFbGVtZW50Kj4obm9kZSgpKSk7Ci0gICAgRWxlbWVudCogZWxlbWVudCA9IHNl
bGVjdC0+bGlzdEl0ZW1zKClbbGlzdEluZGV4XTsKKyAgICBjb25zdCBWZWN0b3I8RWxlbWVudCo+
JiBsaXN0SXRlbXMgPSBzZWxlY3QtPmxpc3RJdGVtcygpOworICAgIGlmIChsaXN0SW5kZXggPj0g
bGlzdEl0ZW1zLnNpemUoKSkgeworICAgICAgICAvLyBJZiB3ZSBhcmUgbWFraW5nIGFuIG91dCBv
ZiBib3VuZHMgYWNjZXNzLCB0aGVuIHdlIHdhbnQgdG8gdXNlIHRoZSBzdHlsZQorICAgICAgICAv
LyBvZiB0aGUgb3B0aW9uIGVsZW1lbnQgYmVmb3JlIHVzLiBIb3dldmVyLCBpZiB0aGVyZSBpc24n
dCBhbiBvcHRpb24gZWxlbWVudAorICAgICAgICAvLyBiZWZvcmUgdXMsIHdlIGZhbGwgYmFjayB0
byB0aGUgZGVmYXVsdCBtZW51IHN0eWxlLgorICAgICAgICBpZiAoIWxpc3RJbmRleCkKKyAgICAg
ICAgICAgIHJldHVybiBtZW51U3R5bGUoKTsKKworICAgICAgICAvLyBUcnkgdG8gcmV0cmlldmUg
dGhlIHN0eWxlIG9mIHRoZSBwcmV2aW91cyBvcHRpb24gZWxlbWVudC4KKyAgICAgICAgbGlzdElu
ZGV4LS07CisgICAgfQorICAgIEVsZW1lbnQqIGVsZW1lbnQgPSBsaXN0SXRlbXNbbGlzdEluZGV4
XTsKICAgICAKICAgICBSZW5kZXJTdHlsZSogc3R5bGUgPSBlbGVtZW50LT5yZW5kZXJTdHlsZSgp
ID8gZWxlbWVudC0+cmVuZGVyU3R5bGUoKSA6IGVsZW1lbnQtPmNvbXB1dGVkU3R5bGUoKTsKICAg
ICByZXR1cm4gc3R5bGUgPyBQb3B1cE1lbnVTdHlsZShzdHlsZS0+Y29sb3IoKSwgaXRlbUJhY2tn
cm91bmRDb2xvcihsaXN0SW5kZXgpLCBzdHlsZS0+Zm9udCgpLCBzdHlsZS0+dmlzaWJpbGl0eSgp
ID09IFZJU0lCTEUsIHN0eWxlLT50ZXh0SW5kZW50KCksIHN0eWxlLT5kaXJlY3Rpb24oKSkgOiBt
ZW51U3R5bGUoKTsKQEAgLTM2OCw3ICszODgsMTAgQEAgUG9wdXBNZW51U3R5bGUgUmVuZGVyTWVu
dUxpc3Q6Oml0ZW1TdHlsZQogQ29sb3IgUmVuZGVyTWVudUxpc3Q6Oml0ZW1CYWNrZ3JvdW5kQ29s
b3IodW5zaWduZWQgbGlzdEluZGV4KSBjb25zdAogewogICAgIFNlbGVjdEVsZW1lbnQqIHNlbGVj
dCA9IHRvU2VsZWN0RWxlbWVudChzdGF0aWNfY2FzdDxFbGVtZW50Kj4obm9kZSgpKSk7Ci0gICAg
RWxlbWVudCogZWxlbWVudCA9IHNlbGVjdC0+bGlzdEl0ZW1zKClbbGlzdEluZGV4XTsKKyAgICBj
b25zdCBWZWN0b3I8RWxlbWVudCo+JiBsaXN0SXRlbXMgPSBzZWxlY3QtPmxpc3RJdGVtcygpOwor
ICAgIGlmIChsaXN0SW5kZXggPj0gbGlzdEl0ZW1zLnNpemUoKSkKKyAgICAgICAgcmV0dXJuIHN0
eWxlKCktPmJhY2tncm91bmRDb2xvcigpOworICAgIEVsZW1lbnQqIGVsZW1lbnQgPSBsaXN0SXRl
bXNbbGlzdEluZGV4XTsKIAogICAgIENvbG9yIGJhY2tncm91bmRDb2xvcjsKICAgICBpZiAoZWxl
bWVudC0+cmVuZGVyU3R5bGUoKSkKQEAgLTQ1OSwyMSArNDgyLDMwIEBAIHZvaWQgUmVuZGVyTWVu
dUxpc3Q6OnBvcHVwRGlkSGlkZSgpCiBib29sIFJlbmRlck1lbnVMaXN0OjppdGVtSXNTZXBhcmF0
b3IodW5zaWduZWQgbGlzdEluZGV4KSBjb25zdAogewogICAgIFNlbGVjdEVsZW1lbnQqIHNlbGVj
dCA9IHRvU2VsZWN0RWxlbWVudChzdGF0aWNfY2FzdDxFbGVtZW50Kj4obm9kZSgpKSk7Ci0gICAg
RWxlbWVudCogZWxlbWVudCA9IHNlbGVjdC0+bGlzdEl0ZW1zKClbbGlzdEluZGV4XTsKKyAgICBj
b25zdCBWZWN0b3I8RWxlbWVudCo+JiBsaXN0SXRlbXMgPSBzZWxlY3QtPmxpc3RJdGVtcygpOwor
ICAgIGlmIChsaXN0SW5kZXggPj0gbGlzdEl0ZW1zLnNpemUoKSkKKyAgICAgICAgcmV0dXJuIGZh
bHNlOworICAgIEVsZW1lbnQqIGVsZW1lbnQgPSBsaXN0SXRlbXNbbGlzdEluZGV4XTsKICAgICBy
ZXR1cm4gZWxlbWVudC0+aGFzVGFnTmFtZShoclRhZyk7CiB9CiAKIGJvb2wgUmVuZGVyTWVudUxp
c3Q6Oml0ZW1Jc0xhYmVsKHVuc2lnbmVkIGxpc3RJbmRleCkgY29uc3QKIHsKICAgICBTZWxlY3RF
bGVtZW50KiBzZWxlY3QgPSB0b1NlbGVjdEVsZW1lbnQoc3RhdGljX2Nhc3Q8RWxlbWVudCo+KG5v
ZGUoKSkpOwotICAgIEVsZW1lbnQqIGVsZW1lbnQgPSBzZWxlY3QtPmxpc3RJdGVtcygpW2xpc3RJ
bmRleF07CisgICAgY29uc3QgVmVjdG9yPEVsZW1lbnQqPiYgbGlzdEl0ZW1zID0gc2VsZWN0LT5s
aXN0SXRlbXMoKTsKKyAgICBpZiAobGlzdEluZGV4ID49IGxpc3RJdGVtcy5zaXplKCkpCisgICAg
ICAgIHJldHVybiBmYWxzZTsKKyAgICBFbGVtZW50KiBlbGVtZW50ID0gbGlzdEl0ZW1zW2xpc3RJ
bmRleF07CiAgICAgcmV0dXJuIGlzT3B0aW9uR3JvdXBFbGVtZW50KGVsZW1lbnQpOwogfQogCiBi
b29sIFJlbmRlck1lbnVMaXN0OjppdGVtSXNTZWxlY3RlZCh1bnNpZ25lZCBsaXN0SW5kZXgpIGNv
bnN0CiB7CiAgICAgU2VsZWN0RWxlbWVudCogc2VsZWN0ID0gdG9TZWxlY3RFbGVtZW50KHN0YXRp
Y19jYXN0PEVsZW1lbnQqPihub2RlKCkpKTsKLSAgICBFbGVtZW50KiBlbGVtZW50ID0gc2VsZWN0
LT5saXN0SXRlbXMoKVtsaXN0SW5kZXhdOworICAgIGNvbnN0IFZlY3RvcjxFbGVtZW50Kj4mIGxp
c3RJdGVtcyA9IHNlbGVjdC0+bGlzdEl0ZW1zKCk7CisgICAgaWYgKGxpc3RJbmRleCA+PSBsaXN0
SXRlbXMuc2l6ZSgpKQorICAgICAgICByZXR1cm4gZmFsc2U7CisgICAgRWxlbWVudCogZWxlbWVu
dCA9IGxpc3RJdGVtc1tsaXN0SW5kZXhdOwogICAgIGlmIChPcHRpb25FbGVtZW50KiBvcHRpb25F
bGVtZW50ID0gdG9PcHRpb25FbGVtZW50KGVsZW1lbnQpKQogICAgICAgICByZXR1cm4gb3B0aW9u
RWxlbWVudC0+c2VsZWN0ZWQoKTsKICAgICByZXR1cm4gZmFsc2U7Cg==
</data>
<flag name="review"
          id="29874"
          type_id="1"
          status="+"
          setter="jhoneycutt"
    />
    <flag name="commit-queue"
          id="29880"
          type_id="3"
          status="-"
          setter="jhoneycutt"
    />
          </attachment>
      

    </bug>

</bugzilla>