<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>39670</bug_id>
          
          <creation_ts>2010-05-25 04:41:35 -0700</creation_ts>
          <short_desc>[Qt] WebView::setUrl crashes after Qt4.7</short_desc>
          <delta_ts>2011-04-19 05:15:29 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>New Bugs</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>PC</rep_platform>
          <op_sys>Linux</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>DUPLICATE</resolution>
          <dup_id>49216</dup_id>
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>Qt, QtTriaged</keywords>
          <priority>P1</priority>
          <bug_severity>Critical</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="xxx">webkit</reporter>
          <assigned_to name="Nobody">webkit-unassigned</assigned_to>
          <cc>abarth</cc>
    
    <cc>ademar</cc>
    
    <cc>benjamin</cc>
    
    <cc>eric</cc>
    
    <cc>jhanssen</cc>
    
    <cc>kling</cc>
    
    <cc>robert</cc>
    
    <cc>webkit</cc>
    
    <cc>webkit.review.bot</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>230216</commentid>
    <comment_count>0</comment_count>
      <attachid>57005</attachid>
    <who name="xxx">webkit</who>
    <bug_when>2010-05-25 04:41:35 -0700</bug_when>
    <thetext>Created attachment 57005
Qt source code to reproduce the problem

I attach a use case that causes WebKit to crash. Just press on the button, which causes setUrl to be called twice, once directly, and the second one through a user event.
I get the same crash with both Qt4.7 beta1 and latest Qt 4.8 from git.
Fyi, if I remove the link to css from the index.html, it does not crash anymore. On the other hand, it crashes no matter whether the css file exists or not

This is what I get with valgrind

==6355== Invalid write of size 4 
==6355== at 0x47FF055: WebCore::CachedResource::setDocLoader(WebCore::DocLoader*) (in /opt/qtsdk-4.70-beta1/lib/libQtWebKit.so.4.7.0) 
==6355== by 0x480E2C2: WebCore::DocLoader::~DocLoader() (in /opt/qtsdk-4.70-beta1/lib/libQtWebKit.so.4.7.0) 
==6355== by 0x4649988: void WTF::deleteOwnedPtr&lt;WebCore::DocLoader&gt;(WebCore::DocLoader*) (in /opt/qtsdk-4.70-beta1/lib/libQtWebKit.so.4.7.0) 
==6355== by 0x4646BAA: WTF::OwnPtr&lt;WebCore::DocLoader&gt;::clear() (in /opt/qtsdk-4.70-beta1/lib/libQtWebKit.so.4.7.0) 
==6355== by 0x4634342: WebCore::Document::~Document() (in /opt/qtsdk-4.70-beta1/lib/libQtWebKit.so.4.7.0) 
==6355== by 0x46327E1: WebCore::Document::removedLastRef() (in /opt/qtsdk-4.70-beta1/lib/libQtWebKit.so.4.7.0) 
==6355== by 0x41F92B0: WebCore::TreeShared&lt;WebCore::Node&gt;::deref() (in /opt/qtsdk-4.70-beta1/lib/libQtWebKit.so.4.7.0) 
==6355== by 0x4260A8E: void WTF::derefIfNotNull&lt;WebCore::Document&gt;(WebCore::Document*) (in /opt/qtsdk-4.70-beta1/lib/libQtWebKit.so.4.7.0) 
==6355== by 0x462CF20: WTF::RefPtr&lt;WebCore::Document&gt;::~RefPtr() (in /opt/qtsdk-4.70-beta1/lib/libQtWebKit.so.4.7.0) 
==6355== by 0x483EFEC: WebCore::Loader::Host::didFail(WebCore::SubresourceLoader*, bool) (in /opt/qtsdk-4.70-beta1/lib/libQtWebKit.so.4.7.0) 
==6355== by 0x483F8B2: WebCore::Loader::Host::cancelRequests(WebCore::DocLoader*) (in /opt/qtsdk-4.70-beta1/lib/libQtWebKit.so.4.7.0) 
==6355== by 0x483DE85: WebCore::Loader::cancelRequests(WebCore::DocLoader*) (in /opt/qtsdk-4.70-beta1/lib/libQtWebKit.so.4.7.0) 
==6355== Address 0x110 is not stack&apos;d, malloc&apos;d or (recently) free&apos;d 
==6355== 
==6355== 
==6355== Process terminating with default action of signal 11 (SIGSEGV) 
==6355== Access not within mapped region at address 0x110 
==6355== at 0x47FF055: WebCore::CachedResource::setDocLoader(WebCore::DocLoader*) (in /opt/qtsdk-4.70-beta1/lib/libQtWebKit.so.4.7.0) 
==6355== by 0x480E2C2: WebCore::DocLoader::~DocLoader() (in /opt/qtsdk-4.70-beta1/lib/libQtWebKit.so.4.7.0) 
==6355== by 0x4649988: void WTF::deleteOwnedPtr&lt;WebCore::DocLoader&gt;(WebCore::DocLoader*) (in /opt/qtsdk-4.70-beta1/lib/libQtWebKit.so.4.7.0) 
==6355== by 0x4646BAA: WTF::OwnPtr&lt;WebCore::DocLoader&gt;::clear() (in /opt/qtsdk-4.70-beta1/lib/libQtWebKit.so.4.7.0) 
==6355== by 0x4634342: WebCore::Document::~Document() (in /opt/qtsdk-4.70-beta1/lib/libQtWebKit.so.4.7.0) 
==6355== by 0x46327E1: WebCore::Document::removedLastRef() (in /opt/qtsdk-4.70-beta1/lib/libQtWebKit.so.4.7.0) 
==6355== by 0x41F92B0: WebCore::TreeShared&lt;WebCore::Node&gt;::deref() (in /opt/qtsdk-4.70-beta1/lib/libQtWebKit.so.4.7.0) 
==6355== by 0x4260A8E: void WTF::derefIfNotNull&lt;WebCore::Document&gt;(WebCore::Document*) (in /opt/qtsdk-4.70-beta1/lib/libQtWebKit.so.4.7.0) 
==6355== by 0x462CF20: WTF::RefPtr&lt;WebCore::Document&gt;::~RefPtr() (in /opt/qtsdk-4.70-beta1/lib/libQtWebKit.so.4.7.0)
==6355== by 0x483EFEC: WebCore::Loader::Host::didFail(WebCore::SubresourceLoader*, bool) (in /opt/qtsdk-4.70-beta1/lib/libQtWebKit.so.4.7.0)
==6355== by 0x483F8B2: WebCore::Loader::Host::cancelRequests(WebCore::DocLoader*) (in /opt/qtsdk-4.70-beta1/lib/libQtWebKit.so.4.7.0)
==6355== by 0x483DE85: WebCore::Loader::cancelRequests(WebCore::DocLoader*) (in /opt/qtsdk-4.70-beta1/lib/libQtWebKit.so.4.7.0)</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>302192</commentid>
    <comment_count>1</comment_count>
      <attachid>72416</attachid>
    <who name="Jan Erik Hanssen">jhanssen</who>
    <bug_when>2010-10-29 17:08:58 -0700</bug_when>
    <thetext>Created attachment 72416
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>302193</commentid>
    <comment_count>2</comment_count>
    <who name="Jan Erik Hanssen">jhanssen</who>
    <bug_when>2010-10-29 17:09:35 -0700</bug_when>
    <thetext>What seems to happen here is that when DocumentWriter::begin() is called while a load is in progress, setDocument(0) will be called which in turn causes the current document to be destroyed. However, the Document destructor destroys its CachedResourceLoader instance which will cancel all pending loads, but Loader::Host::didFail() tries to ref the Document that&apos;s being destroyed. This is what seems to cause the crash.

The proposed patch solves this by cancelling all requests before Document is being destroyed.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>302194</commentid>
    <comment_count>3</comment_count>
    <who name="Jan Erik Hanssen">jhanssen</who>
    <bug_when>2010-10-29 17:12:05 -0700</bug_when>
    <thetext>Note that the patch does not currently have a test case, I&apos;m not entirely sure how to write one that tests this behavior (i.e. starting a page load and then afterwards making sure that DocumentWriter::begin() is called before receiving any data.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>302261</commentid>
    <comment_count>4</comment_count>
    <who name="xxx">webkit</who>
    <bug_when>2010-10-29 23:18:03 -0700</bug_when>
    <thetext>

(In reply to comment #3)
&gt; Note that the patch does not currently have a test case, I&apos;m not entirely sure 

Jan Erik,
thank you for the patch.
I attached a test case at https://bugs.webkit.org/attachment.cgi?id=57005 that reproduces the problem. Does it not crash now with the patch?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>302295</commentid>
    <comment_count>5</comment_count>
    <who name="Jan Erik Hanssen">jhanssen</who>
    <bug_when>2010-10-30 06:36:52 -0700</bug_when>
    <thetext>(In reply to comment #4)
&gt; thank you for the patch.
&gt; I attached a test case at https://bugs.webkit.org/attachment.cgi?id=57005 that reproduces the problem. Does it not crash now with the patch?

Your test case no longer crashes with the patch applied.

However, that test case can unfortunately not be used for inclusion with the patch since it&apos;s using Qt.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>302502</commentid>
    <comment_count>6</comment_count>
      <attachid>72416</attachid>
    <who name="Adam Barth">abarth</who>
    <bug_when>2010-10-31 18:01:34 -0700</bug_when>
    <thetext>Comment on attachment 72416
Patch

We need a test.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>305699</commentid>
    <comment_count>7</comment_count>
      <attachid>73158</attachid>
    <who name="Jan Erik Hanssen">jhanssen</who>
    <bug_when>2010-11-05 19:08:28 -0700</bug_when>
    <thetext>Created attachment 73158
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>305700</commentid>
    <comment_count>8</comment_count>
    <who name="Jan Erik Hanssen">jhanssen</who>
    <bug_when>2010-11-05 19:09:29 -0700</bug_when>
    <thetext>(In reply to comment #7)
&gt; Created an attachment (id=73158) [details]
&gt; Patch

Note that this patch only implements the test case for Qt.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>315307</commentid>
    <comment_count>9</comment_count>
    <who name="Robert Hogan">robert</who>
    <bug_when>2010-11-30 14:14:31 -0800</bug_when>
    <thetext>I can&apos;t reproduce this crash against Qt 4.6 and ToT WebKit or against qt-git and ToT WebKit. There&apos;s no longer a WebCore::CachedResource::setDocLoader in WebCore. Maybe it has been fixed by a drive-by?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>315599</commentid>
    <comment_count>10</comment_count>
    <who name="Benjamin Poulain">benjamin</who>
    <bug_when>2010-12-01 04:35:30 -0800</bug_when>
    <thetext>(In reply to comment #9)
&gt; I can&apos;t reproduce this crash against Qt 4.6 and ToT WebKit or against qt-git and ToT WebKit. There&apos;s no longer a WebCore::CachedResource::setDocLoader in WebCore. Maybe it has been fixed by a drive-by?

I keep the bug open. If it is fixed in trunk, we still need to cherry-pick the patch to QtWebkit 2.0 and 2.1.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>316902</commentid>
    <comment_count>11</comment_count>
      <attachid>73158</attachid>
    <who name="Eric Seidel (no email)">eric</who>
    <bug_when>2010-12-03 10:59:26 -0800</bug_when>
    <thetext>Comment on attachment 73158
Patch

I&apos;m not sure why this bug is still open for WebKit&apos;s bug database.  Certainy this doesnt&apos; need to have r? set on it given the above commetns.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>317366</commentid>
    <comment_count>12</comment_count>
    <who name="Jan Erik Hanssen">jhanssen</who>
    <bug_when>2010-12-05 05:39:44 -0800</bug_when>
    <thetext>(In reply to comment #9)
&gt; I can&apos;t reproduce this crash against Qt 4.6 and ToT WebKit or against qt-git and ToT WebKit. There&apos;s no longer a WebCore::CachedResource::setDocLoader in WebCore. Maybe it has been fixed by a drive-by?

Just had time to look at this again and still seeing the problem as of r73340 with Qt 4.7.1.
My patch still solves the problem.

Current valgrind output:

==31218== Invalid free() / delete / delete[]
==31218==    at 0x4025504: operator delete(void*) (vg_replace_malloc.c:387)
==31218==    by 0x46A630D: WebCore::Document::~Document() (in /home/jhanssen/dev/WebKit/WebKitBuild-qt/Release/lib/libQtWebKit.so.4.9.0)
==31218==    by 0x47C5F41: WebCore::HTMLDocument::~HTMLDocument() (in /home/jhanssen/dev/WebKit/WebKitBuild-qt/Release/lib/libQtWebKit.so.4.9.0)
==31218==    by 0x46A1D96: WebCore::Document::removedLastRef() (in /home/jhanssen/dev/WebKit/WebKitBuild-qt/Release/lib/libQtWebKit.so.4.9.0)
==31218==    by 0x492B8DB: WebCore::Frame::setDocument(WTF::PassRefPtr&lt;WebCore::Document&gt;) (in /home/jhanssen/dev/WebKit/WebKitBuild-qt/Release/lib/libQtWebKit.so.4.9.0)
==31218==    by 0x48BDCA8: WebCore::FrameLoader::clear(bool, bool, bool) (in /home/jhanssen/dev/WebKit/WebKitBuild-qt/Release/lib/libQtWebKit.so.4.9.0)
==31218==    by 0x48B7585: WebCore::DocumentWriter::begin(WebCore::KURL const&amp;, bool, WebCore::SecurityOrigin*) (in /home/jhanssen/dev/WebKit/WebKitBuild-qt/Release/lib/libQtWebKit.so.4.9.0)
==31218==    by 0x4B3816A: QWebFrame::setUrl(QUrl const&amp;) (in /home/jhanssen/dev/WebKit/WebKitBuild-qt/Release/lib/libQtWebKit.so.4.9.0)
==31218==    by 0x4B4EF03: QWebView::setUrl(QUrl const&amp;) (in /home/jhanssen/dev/WebKit/WebKitBuild-qt/Release/lib/libQtWebKit.so.4.9.0)
==31218==    by 0x804AD2D: pal::MainWindow::setUrl() (in /home/jhanssen/dev/webkit-bugs/39670/webKitSetUrlCrash)
==31218==    by 0x804AE2F: pal::MainWindow::event(QEvent*) (in /home/jhanssen/dev/webkit-bugs/39670/webKitSetUrlCrash)
==31218==    by 0x54FCF4B: QApplicationPrivate::notify_helper(QObject*, QEvent*) (in /home/jhanssen/dev/qt-everywhere-opensource-src-4.7.1/lib/libQtGui.so.4.7.1)


==31218==  Address 0x9021268 is 0 bytes inside a block of size 776 free&apos;d
==31218==    at 0x4025504: operator delete(void*) (vg_replace_malloc.c:387)
==31218==    by 0x46AC5DD: WebCore::Document::~Document() (in /home/jhanssen/dev/WebKit/WebKitBuild-qt/Release/lib/libQtWebKit.so.4.9.0)
==31218==    by 0x46A1D96: WebCore::Document::removedLastRef() (in /home/jhanssen/dev/WebKit/WebKitBuild-qt/Release/lib/libQtWebKit.so.4.9.0)
==31218==    by 0x48D4F08: WebCore::Loader::didFail(WebCore::SubresourceLoader*, bool) (in /home/jhanssen/dev/WebKit/WebKitBuild-qt/Release/lib/libQtWebKit.so.4.9.0)
==31218==    by 0x48D50AF: WebCore::Loader::cancelRequests(WebCore::CachedResourceLoader*) (in /home/jhanssen/dev/WebKit/WebKitBuild-qt/Release/lib/libQtWebKit.so.4.9.0)
==31218==    by 0x48AC54E: WebCore::CachedResourceLoader::~CachedResourceLoader() (in /home/jhanssen/dev/WebKit/WebKitBuild-qt/Release/lib/libQtWebKit.so.4.9.0)
==31218==    by 0x46A5DAE: WebCore::Document::~Document() (in /home/jhanssen/dev/WebKit/WebKitBuild-qt/Release/lib/libQtWebKit.so.4.9.0)
==31218==    by 0x47C5F41: WebCore::HTMLDocument::~HTMLDocument() (in /home/jhanssen/dev/WebKit/WebKitBuild-qt/Release/lib/libQtWebKit.so.4.9.0)
==31218==    by 0x46A1D96: WebCore::Document::removedLastRef() (in /home/jhanssen/dev/WebKit/WebKitBuild-qt/Release/lib/libQtWebKit.so.4.9.0)
==31218==    by 0x492B8DB: WebCore::Frame::setDocument(WTF::PassRefPtr&lt;WebCore::Document&gt;) (in /home/jhanssen/dev/WebKit/WebKitBuild-qt/Release/lib/libQtWebKit.so.4.9.0)
==31218==    by 0x48BDCA8: WebCore::FrameLoader::clear(bool, bool, bool) (in /home/jhanssen/dev/WebKit/WebKitBuild-qt/Release/lib/libQtWebKit.so.4.9.0)
==31218==    by 0x48B7585: WebCore::DocumentWriter::begin(WebCore::KURL const&amp;, bool, WebCore::SecurityOrigin*) (in /home/jhanssen/dev/WebKit/WebKitBuild-qt/Release/lib/libQtWebKit.so.4.9.0)</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>317632</commentid>
    <comment_count>13</comment_count>
    <who name="Benjamin Poulain">benjamin</who>
    <bug_when>2010-12-06 08:10:52 -0800</bug_when>
    <thetext>Ademar, could you please solve this bug?

Crashes are P1, this should be fixed for the next patch release of Qt 4.7.

If this crash is in 2.0, could you please update the 2.0 branch, either by finding and backporting the fix of trunk, or by reviewing the patch of Jan Erik?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>317834</commentid>
    <comment_count>14</comment_count>
    <who name="Ademar Reis">ademar</who>
    <bug_when>2010-12-06 13:59:41 -0800</bug_when>
    <thetext>(In reply to comment #12)
&gt; (In reply to comment #9)
&gt; &gt; I can&apos;t reproduce this crash against Qt 4.6 and ToT WebKit or against qt-git and ToT WebKit. There&apos;s no longer a WebCore::CachedResource::setDocLoader in WebCore. Maybe it has been fixed by a drive-by?
&gt; 
&gt; Just had time to look at this again and still seeing the problem as of r73340 with Qt 4.7.1.

I succeeded reproducing it with qtwebkit-2.0 (the version released with qt-4.7) and with trunk (r73392), but not on the qtwebkit-2.1 branch... I&apos;ll investigate more later... maybe it&apos;s a race... any ideas?

Could you prepare a patch for trunk inclusion? Backporting your current patch for 2.0 was simple, but the right thing to do is to fix this on trunk (with proper review) and then cherry-pick/backport it to stable branches.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>317893</commentid>
    <comment_count>15</comment_count>
    <who name="Jan Erik Hanssen">jhanssen</who>
    <bug_when>2010-12-06 15:55:56 -0800</bug_when>
    <thetext>(In reply to comment #14)
&gt; (In reply to comment #12)
&gt; &gt; (In reply to comment #9)
&gt; &gt; &gt; I can&apos;t reproduce this crash against Qt 4.6 and ToT WebKit or against qt-git and ToT WebKit. There&apos;s no longer a WebCore::CachedResource::setDocLoader in WebCore. Maybe it has been fixed by a drive-by?
&gt; &gt; 
&gt; &gt; Just had time to look at this again and still seeing the problem as of r73340 with Qt 4.7.1.
&gt; 
&gt; I succeeded reproducing it with qtwebkit-2.0 (the version released with qt-4.7) and with trunk (r73392), but not on the qtwebkit-2.1 branch... I&apos;ll investigate more later... maybe it&apos;s a race... any ideas?
&gt; 
&gt; Could you prepare a patch for trunk inclusion? Backporting your current patch for 2.0 was simple, but the right thing to do is to fix this on trunk (with proper review) and then cherry-pick/backport it to stable branches.

There is a race, yes. If the subresource (the css file) has been processed by the loader before the second setUrl() is called then the problem will not occur. My test case attempts to avoid this by loading the resource from a php script that calls sleep() to ensure that the subresource is still being loaded at this point.

I&apos;ll upload a new patch for trunk inclusion.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>318529</commentid>
    <comment_count>16</comment_count>
      <attachid>75858</attachid>
    <who name="Jan Erik Hanssen">jhanssen</who>
    <bug_when>2010-12-07 18:20:56 -0800</bug_when>
    <thetext>Created attachment 75858
Patch

Seems better to clear the pending loads when DocumentWriter::begin() is called (from QWebFrame), this is the existing behavior in e.g. DocumentWriter::replaceDocument(). As part of this the test case has also been ported to Qt.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>318639</commentid>
    <comment_count>17</comment_count>
    <who name="WebKit Review Bot">webkit.review.bot</who>
    <bug_when>2010-12-07 21:58:19 -0800</bug_when>
    <thetext>Attachment 75858 did not pass style-queue:

Failed to run &quot;[&apos;WebKitTools/Scripts/update-webkit&apos;]&quot; exit_code: 2
Updating OpenSource
Incomplete data: Delta source ended unexpectedly at /usr/lib/git-core/git-svn line 5061

Died at WebKitTools/Scripts/update-webkit line 132.


If any of these errors are false positives, please file a bug against check-webkit-style.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>319993</commentid>
    <comment_count>18</comment_count>
    <who name="Eric Seidel (no email)">eric</who>
    <bug_when>2010-12-10 00:09:53 -0800</bug_when>
    <thetext>I&apos;m not sure this is right.  @abarth?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>326393</commentid>
    <comment_count>19</comment_count>
      <attachid>75858</attachid>
    <who name="Adam Barth">abarth</who>
    <bug_when>2010-12-23 17:40:15 -0800</bug_when>
    <thetext>Comment on attachment 75858
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=75858&amp;action=review

&gt; WebKit/qt/Api/qwebframe.cpp:709
&gt; +    if (d-&gt;frame-&gt;loader()-&gt;isLoading())
&gt; +        d-&gt;frame-&gt;loader()-&gt;stopAllLoaders();
&gt;      d-&gt;frame-&gt;loader()-&gt;writer()-&gt;begin(absolute);
&gt;      d-&gt;frame-&gt;loader()-&gt;writer()-&gt;end();

These methods are all way too low-level to be called from WebKit.  You should call some API on FrameLoader that does what you want.  This code might well be a security vulnerability too.  I&apos;d have to look into the details.  The issue is you&apos;re spamming &quot;absolute&quot; over the document, which will give whoever has a pointer to the document access the cookies for &quot;absolute&quot;.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>326404</commentid>
    <comment_count>20</comment_count>
    <who name="Jan Erik Hanssen">jhanssen</who>
    <bug_when>2010-12-23 18:07:42 -0800</bug_when>
    <thetext>(In reply to comment #19)
&gt; (From update of attachment 75858 [details])
&gt; View in context: https://bugs.webkit.org/attachment.cgi?id=75858&amp;action=review
&gt; 
&gt; &gt; WebKit/qt/Api/qwebframe.cpp:709
&gt; &gt; +    if (d-&gt;frame-&gt;loader()-&gt;isLoading())
&gt; &gt; +        d-&gt;frame-&gt;loader()-&gt;stopAllLoaders();
&gt; &gt;      d-&gt;frame-&gt;loader()-&gt;writer()-&gt;begin(absolute);
&gt; &gt;      d-&gt;frame-&gt;loader()-&gt;writer()-&gt;end();
&gt; 
&gt; These methods are all way too low-level to be called from WebKit.  You should call some API on FrameLoader that does what you want.  This code might well be a security vulnerability too.  I&apos;d have to look into the details.  The issue is you&apos;re spamming &quot;absolute&quot; over the document, which will give whoever has a pointer to the document access the cookies for &quot;absolute&quot;.

That could very well be (I&apos;m not too familiar with this code yet), though the call to DocumentWriter::begin() predates this proposed bug fix, it seems to have been around for quite some time.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>326406</commentid>
    <comment_count>21</comment_count>
    <who name="Adam Barth">abarth</who>
    <bug_when>2010-12-23 18:12:02 -0800</bug_when>
    <thetext>(In reply to comment #20)
&gt; (In reply to comment #19)
&gt; &gt; (From update of attachment 75858 [details] [details])
&gt; &gt; View in context: https://bugs.webkit.org/attachment.cgi?id=75858&amp;action=review
&gt; &gt; 
&gt; &gt; &gt; WebKit/qt/Api/qwebframe.cpp:709
&gt; &gt; &gt; +    if (d-&gt;frame-&gt;loader()-&gt;isLoading())
&gt; &gt; &gt; +        d-&gt;frame-&gt;loader()-&gt;stopAllLoaders();
&gt; &gt; &gt;      d-&gt;frame-&gt;loader()-&gt;writer()-&gt;begin(absolute);
&gt; &gt; &gt;      d-&gt;frame-&gt;loader()-&gt;writer()-&gt;end();
&gt; &gt; 
&gt; &gt; These methods are all way too low-level to be called from WebKit.  You should call some API on FrameLoader that does what you want.  This code might well be a security vulnerability too.  I&apos;d have to look into the details.  The issue is you&apos;re spamming &quot;absolute&quot; over the document, which will give whoever has a pointer to the document access the cookies for &quot;absolute&quot;.
&gt; 
&gt; That could very well be (I&apos;m not too familiar with this code yet), though the call to DocumentWriter::begin() predates this proposed bug fix, it seems to have been around for quite some time.

Yeah, this has probably been wrong for a while.  The right fix is likely to remove the wrong code and call through to the appropriate high-level API for loading a URL.  One option is something like scheduleLocationChange.  That should do all the low-level state tweaking for you.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>352468</commentid>
    <comment_count>22</comment_count>
    <who name="Andreas Kling">kling</who>
    <bug_when>2011-02-16 17:02:16 -0800</bug_when>
    <thetext>

*** This bug has been marked as a duplicate of bug 49216 ***</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="0"
              isprivate="0"
          >
            <attachid>57005</attachid>
            <date>2010-05-25 04:41:35 -0700</date>
            <delta_ts>2010-05-25 04:41:35 -0700</delta_ts>
            <desc>Qt source code to reproduce the problem</desc>
            <filename>webKitSetUrlCrash.tgz</filename>
            <type>application/octet-stream</type>
            <size>1847</size>
            <attacher name="xxx">webkit</attacher>
            
              <data encoding="base64">H4sIAHsa8UsAA+1ZbXPaOBDOZ/8KjfMFcgFjIORKjDtJSl/ukqYEcvnQ6zDGCNDF2K4lh3Cd3G+/
lSy/kpDptaHTOXYmsb2SVqtH2mfXmLhjfFedsbmz82xSA2k1m/zaOKyLa02PnoXUa7UdXW8cNuv6
QU3Xd+CvddjYQbXncymVkDIrQGhnbLlkfT8c0E04tFkx+NabijHD1hguDnFv0CzAk47K8Nx3LIar
NqUqCrDTUSlbOpjOMGYqYksf8053TBMd5nhMLOhiBxi7KtLAmCaNjrzx0lRm2HE8UEZP0Cgm/tHr
/7/L3CJu1fb955zjyfhvteL4rx8e1nj8Nw628b8R2SWu7YRjjIweexMSrXfs+w6xLUY811SSVvUc
zsk1ccfeojpTFYW4DPGjU+I3VjC195E9Axz34P7246ey8kVBIFlryCpFHXmX8pFo9y2n3U5No0Wk
XlTpzFuUZKcAszCA4VV8h22uvN+yxneTzL4+Gws8Ef/1eqMRx3+z3qxD/Neb2/y/GXkswlN9SIaP
NBm9V3gUTk1Fca05pr5lYx7REPucFc6X3VvssnZ7iPl1APUC6qDakQJBnRrMhn+pd03GU8zQnm8F
MKSM2oIAgEcynWTbvmwKScnFC3RFspbK0BgxUEgqJgUC8a9Iic0IlZyiabbnuthmJd7BD+nsJGTM
c/f77968Pz4r+QGmFI9L5fI+4sP2Uf/sYlDy3GHad5h2Elbviyv7J+N16tEYO5hhcCwZo2lDArVW
xRx+ZkCYVd+jTGBXWhB3H/HlXWI8j1TMojeCQ2nVHlIWxLPfemScmx342J3iaFBPXNAeTt3oPdYX
S4jogjB7hkq4YvJaD+aRI22LYtSTm3sGA0Nrik+FhXayKRUTaDuwXMpLyDz2CI0CbN0cSTQmVuiw
9mrLfQzPysoe2QWxNDH0sziXpTIyDKTKdlWuCrOrwIlTy2eAG7Y/wTvaag64PL3pxq54EVtKEBUJ
cBROPuq1evNTNAGcZnsxLoF2H1HyN/Ym/L6MKkiXLvT6LCDuFIWBA+GhToiD25qmSXe59pcOt5p7
VjWSvLfFPQHyBR79QfBCnHjuW4//gyGZ8znyPCe3DJw5IHsoc0DIJLP3qNNJAxoW1Y1DGo6F6P1F
bmAe3yR5syDE6bYm6t6qJ1j6uk3yG5EstT/XHE/kf71Rrxfqf14IbPP/JmSXTIBJJuj8+N3763fv
X11cD98qu6AhLs4rs3k/PTVmVi1YIVcOXBHBDLZjUZqhHV7DrxQNkMxCO6kbUBv54QheHmSqEW8U
sFcMNLy8SKsKzhdyEBBVW/YvleIUxfuUVzlL5ArBiRmr+W45LsyWMVDH5GkvV+PEEwd4SijDQWox
brmCw1R+gA/ziwLn7qFcKoKXQSaj5J70hhcnv3VPB0rU3s7VI8XqihdjwodcmXKUJIliYjhS/MBj
UDLhcTvOhw/XGEk5kiYDPyC3UAjwgflKDe3xQihuR9TxGE3MP5Lojzgs98oudsewMZqWP6c/OqJ+
Lsnwf7iW/75BnuD/BpB+kf8bze3730bEeHk3d9AtrI14bkfVqzUVYdf2xlCTdtSrwevKr+pLUzFC
knZqQidTQYYgJjM9QYYWaaBpEVGNeO6oGZ5SEaf9TuZtk5tCBnCLjwO2lM1T7M3h/WEpGpERAO2I
O2TcmTVDu5MPS/6wlA8wJ5uZrRqoottIPcNkOmNmk+vlvbCpxUYNLZ78IU8WwskBYQ6WzlBRsOfW
LVWrxgo4RAwcY2ADXwaWI5WR8eKAqKKPR8gCX5VLWwtaDjYBXCtFTmDXSMFL4GsU4EsBrBcAzEJY
XPeqb/AWkrgF94lxiZw18kLWHjmWe5NFUxhOuhfmEH4CWA8C9yHJGzF2aSb5j/A1CvA9gJ6uHzyG
3otvAI9/ZUm8kuhEuTUP1hqAcvfF6MRueGIFMVBz+RjZWA9SFqNcaBYAeiQ4U3haeXgy6BQias06
BlC2ZNcBARqrIksWA7BGIdQZEteo9TjAVrweWPvcHHj+IG0yNKGMfElMrLV4wn/GiE3yasqcWA7F
/OOX5zxkad2y+lCehjSzMJooNM616VDDsZYQR/I3FcSLa0HjLRXNrWBKOMHr0SAb8p43j0ZSMWtW
E7kYsXnMQSm7c5juGFRfvFH0B4ikQok21RrjwOwxGPo7YVpqQraIFRcmzCtEFoGCzwsDG9PI5egX
O0hBVHxdDMn28+E3S7RDfUEmp4FFZ1WItu88x1Pf/5or9V/j8KC1rf82IbuVrxVlV9lFHwLvL4hF
ZAPRwQshGi1Rj53yBy9A9Zpeq9QOKnpzoL9oN2ttvcEHff1MSm8QZVH+myfUPjeEKcrg+PJNd4CE
In90lUH3/MPZ8aALjZbvK4rSv7i6PO32+fD4Q/efMjFnX425XlHedo9fdS/7YrLsz2KK8vri8rwv
3ci9MG35Zytb2crPK/8Ciwb1rgAoAAA=
</data>

          </attachment>
          <attachment
              isobsolete="1"
              ispatch="1"
              isprivate="0"
          >
            <attachid>72416</attachid>
            <date>2010-10-29 17:08:58 -0700</date>
            <delta_ts>2010-11-05 19:08:24 -0700</delta_ts>
            <desc>Patch</desc>
            <filename>bug-39670-20101029170857.patch</filename>
            <type>text/plain</type>
            <size>1572</size>
            <attacher name="Jan Erik Hanssen">jhanssen</attacher>
            
              <data encoding="base64">ZGlmZiAtLWdpdCBhL1dlYkNvcmUvQ2hhbmdlTG9nIGIvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXgg
NDQ3MTRiNzc1Nzk3NTZjODk5ZTdiZDY4ZTZhZjQ3Y2JkMWM5ZDU1ZS4uOWRlNGIwNTVmMDc4YjBk
M2ZjZWYwOGY2ZjdjNTMyOWZhNTIyYjg2NyAxMDA2NDQKLS0tIGEvV2ViQ29yZS9DaGFuZ2VMb2cK
KysrIGIvV2ViQ29yZS9DaGFuZ2VMb2cKQEAgLTEsMyArMSwxOSBAQAorMjAxMC0xMC0yOSAgSmFu
IEVyaWsgSGFuc3NlbiAgPGpoYW5zc2VuQHNlbmNoYS5jb20+CisKKyAgICAgICAgUmV2aWV3ZWQg
YnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgQ3Jhc2ggaW4gTG9hZGVyOjpIb3N0OjpkaWRG
YWlsKCkgd2hlbiBzdGFydGluZyB0d28gZG9jdW1lbnQgbG9hZHMgaW4gcmFwaWQgc3VjY2Vzc2lv
bgorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9Mzk2NzAK
KworICAgICAgICBMb2FkZXI6Okhvc3Q6OmRpZEZhaWwoKSB0cmllcyB0byByZWYgdGhlIERvY3Vt
ZW50IHdoaWxlIGl0J3MgYmVpbmcgZGVzdHJveWVkIGlmCisgICAgICAgIERvY3VtZW50V3JpdGVy
OjpiZWdpbigpIGlzIGNhbGxlZCBhZnRlciBhIHByZXZpb3VzIHBhZ2UgbG9hZCBidXQgYmVmb3Jl
IHJlY2VpdmluZyBhbnkKKyAgICAgICAgZGF0YS4KKworICAgICAgICBObyBuZXcgdGVzdHMuIChP
T1BTISkKKworICAgICAgICAqIGxvYWRlci9GcmFtZUxvYWRlci5jcHA6CisgICAgICAgIChXZWJD
b3JlOjpGcmFtZUxvYWRlcjo6Y2xlYXIpOgorCiAyMDEwLTEwLTI5ICBSeW9zdWtlIE5pd2EgIDxy
bml3YUB3ZWJraXQub3JnPgogCiAgICAgICAgIFJldmlld2VkIGJ5IERhcmluIEFkbGVyLgpkaWZm
IC0tZ2l0IGEvV2ViQ29yZS9sb2FkZXIvRnJhbWVMb2FkZXIuY3BwIGIvV2ViQ29yZS9sb2FkZXIv
RnJhbWVMb2FkZXIuY3BwCmluZGV4IGRmYzFhZDA3MjljZGY2Y2Q5Y2FjYjgzZmQ5NzYyNGUzNWQy
N2ZiZGIuLmIyOWQ0NWNkMjkyMDEwN2E2YWU1OTk5M2IwMWIyNTZhNjEwYzg1OGIgMTAwNjQ0Ci0t
LSBhL1dlYkNvcmUvbG9hZGVyL0ZyYW1lTG9hZGVyLmNwcAorKysgYi9XZWJDb3JlL2xvYWRlci9G
cmFtZUxvYWRlci5jcHAKQEAgLTU5MCw2ICs1OTAsOCBAQCB2b2lkIEZyYW1lTG9hZGVyOjpjbGVh
cihib29sIGNsZWFyV2luZG93UHJvcGVydGllcywgYm9vbCBjbGVhclNjcmlwdE9iamVjdHMsIGJv
bwogCiAgICAgLy8gRG8gbm90IGRyb3AgdGhlIGRvY3VtZW50IGJlZm9yZSB0aGUgU2NyaXB0Q29u
dHJvbGxlciBhbmQgdmlldyBhcmUgY2xlYXJlZAogICAgIC8vIGFzIHNvbWUgZGVzdHJ1Y3RvcnMg
bWlnaHQgc3RpbGwgdHJ5IHRvIGFjY2VzcyB0aGUgZG9jdW1lbnQuCisgICAgaWYgKENhY2hlZFJl
c291cmNlTG9hZGVyKiBjYWNoZWRSZXNvdXJjZUxvYWRlciA9IG1fZnJhbWUtPmRvY3VtZW50KCkt
PmNhY2hlZFJlc291cmNlTG9hZGVyKCkpCisgICAgICAgIGNhY2hlKCktPmxvYWRlcigpLT5jYW5j
ZWxSZXF1ZXN0cyhjYWNoZWRSZXNvdXJjZUxvYWRlcik7CiAgICAgbV9mcmFtZS0+c2V0RG9jdW1l
bnQoMCk7CiAgICAgd3JpdGVyKCktPmNsZWFyKCk7CiAK
</data>

          </attachment>
          <attachment
              isobsolete="1"
              ispatch="1"
              isprivate="0"
          >
            <attachid>73158</attachid>
            <date>2010-11-05 19:08:28 -0700</date>
            <delta_ts>2010-12-07 18:20:52 -0800</delta_ts>
            <desc>Patch</desc>
            <filename>bug-39670-20101105190826.patch</filename>
            <type>text/plain</type>
            <size>12381</size>
            <attacher name="Jan Erik Hanssen">jhanssen</attacher>
            
              <data encoding="base64">ZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL0NoYW5nZUxvZyBiL0xheW91dFRlc3RzL0NoYW5nZUxv
ZwppbmRleCA4MzUzZmE0MGMwMmM1ZmU2ZmE1ZmViMjkyNzJkODQ2MDQyNzVmOWNiLi5iNzJjZjBm
MzU4OTgzNDk4YzY5N2E0ZDY1NGE3NTZiMTViNDhmNTA4IDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0
cy9DaGFuZ2VMb2cKKysrIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMjMgQEAK
KzIwMTAtMTEtMDUgIEphbiBFcmlrIEhhbnNzZW4gIDxqaGFuc3NlbkBzZW5jaGEuY29tPgorCisg
ICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIENyYXNoIGluIExv
YWRlcjo6SG9zdDo6ZGlkRmFpbCgpIHdoZW4gY2xlYXJpbmcgdGhlIEZyYW1lTG9hZGVyIHdoaWxl
IGEgbG9hZCBpcyBpbiBwcm9ncmVzcworICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9z
aG93X2J1Zy5jZ2k/aWQ9Mzk2NzAKKworICAgICAgICBMb2FkZXI6Okhvc3Q6OmRpZEZhaWwoKSB0
cmllcyB0byByZWYgdGhlIERvY3VtZW50IHdoaWxlIGl0J3MgYmVpbmcgZGVzdHJveWVkIGlmCisg
ICAgICAgIERvY3VtZW50V3JpdGVyOjpiZWdpbigpIGlzIGNhbGxlZCBhZnRlciBhIHByZXZpb3Vz
IHBhZ2UgbG9hZCBidXQgYmVmb3JlIHJlY2VpdmluZyBhbnkKKyAgICAgICAgZGF0YS4KKworICAg
ICAgICAqIGh0dHAvdGVzdHMvbG9hZGluZy9sb2FkLXR3by1yZXNvdXJjZXMtYmVmb3JlLXJlc3Bv
bnNlLWV4cGVjdGVkLnR4dDogQWRkZWQuCisgICAgICAgICogaHR0cC90ZXN0cy9sb2FkaW5nL2xv
YWQtdHdvLXJlc291cmNlcy1iZWZvcmUtcmVzcG9uc2UuaHRtbDogQWRkZWQuCisgICAgICAgICog
aHR0cC90ZXN0cy9sb2FkaW5nL3Jlc291cmNlcy9sb2FkLXR3by1yZXNvdXJjZXMtYmVmb3JlLXJl
c3BvbnNlLmh0bWw6IEFkZGVkLgorICAgICAgICAqIGh0dHAvdGVzdHMvbG9hZGluZy9yZXNvdXJj
ZXMvbG9hZC10d28tcmVzb3VyY2VzLWJlZm9yZS1yZXNwb25zZS5waHA6IEFkZGVkLgorICAgICAg
ICAqIHBsYXRmb3JtL2Nocm9taXVtL3Rlc3RfZXhwZWN0YXRpb25zLnR4dDoKKyAgICAgICAgKiBw
bGF0Zm9ybS9ndGsvU2tpcHBlZDoKKyAgICAgICAgKiBwbGF0Zm9ybS9tYWMvU2tpcHBlZDoKKyAg
ICAgICAgKiBwbGF0Zm9ybS93aW4vU2tpcHBlZDoKKwogMjAxMC0xMS0wNSAgQ2hyaXMgTWFycmlu
ICA8Y21hcnJpbkBhcHBsZS5jb20+CiAKICAgICAgICAgUmV2aWV3ZWQgYnkgU2ltb24gRnJhc2Vy
LgpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy9sb2FkaW5nL2xvYWQtdHdvLXJl
c291cmNlcy1iZWZvcmUtcmVzcG9uc2UtZXhwZWN0ZWQudHh0IGIvTGF5b3V0VGVzdHMvaHR0cC90
ZXN0cy9sb2FkaW5nL2xvYWQtdHdvLXJlc291cmNlcy1iZWZvcmUtcmVzcG9uc2UtZXhwZWN0ZWQu
dHh0Cm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw
MDAwMDAwMDAwMDAwMDAuLmY4ZjAwNTA1ODg2MjRjNDRhNTNmMzA5YjAzNzU1YThlMzk1NzdjNmUK
LS0tIC9kZXYvbnVsbAorKysgYi9MYXlvdXRUZXN0cy9odHRwL3Rlc3RzL2xvYWRpbmcvbG9hZC10
d28tcmVzb3VyY2VzLWJlZm9yZS1yZXNwb25zZS1leHBlY3RlZC50eHQKQEAgLTAsMCArMSwxNSBA
QAorbWFpbiBmcmFtZSAtIGRpZFN0YXJ0UHJvdmlzaW9uYWxMb2FkRm9yRnJhbWUKK21haW4gZnJh
bWUgLSBkaWRDb21taXRMb2FkRm9yRnJhbWUKK21haW4gZnJhbWUgLSBkaWRGaW5pc2hEb2N1bWVu
dExvYWRGb3JGcmFtZQorbWFpbiBmcmFtZSAtIGRpZEhhbmRsZU9ubG9hZEV2ZW50c0ZvckZyYW1l
CittYWluIGZyYW1lIC0gZGlkU3RhcnRQcm92aXNpb25hbExvYWRGb3JGcmFtZQorbWFpbiBmcmFt
ZSAtIGRpZEZpbmlzaERvY3VtZW50TG9hZEZvckZyYW1lCittYWluIGZyYW1lIC0gZGlkSGFuZGxl
T25sb2FkRXZlbnRzRm9yRnJhbWUKK21haW4gZnJhbWUgLSBkaWRGaW5pc2hMb2FkRm9yRnJhbWUK
K21haW4gZnJhbWUgLSBkaWRDb21taXRMb2FkRm9yRnJhbWUKK21haW4gZnJhbWUgLSBkaWRGaW5p
c2hEb2N1bWVudExvYWRGb3JGcmFtZQorbWFpbiBmcmFtZSAtIGRpZEZpbmlzaERvY3VtZW50TG9h
ZEZvckZyYW1lCittYWluIGZyYW1lIC0gZGlkSGFuZGxlT25sb2FkRXZlbnRzRm9yRnJhbWUKK21h
aW4gZnJhbWUgLSBkaWRGYWlsTG9hZFdpdGhFcnJvcgorbWFpbiBmcmFtZSAtIGRpZFN0YXJ0UHJv
dmlzaW9uYWxMb2FkRm9yRnJhbWUKKwpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvaHR0cC90ZXN0
cy9sb2FkaW5nL2xvYWQtdHdvLXJlc291cmNlcy1iZWZvcmUtcmVzcG9uc2UuaHRtbCBiL0xheW91
dFRlc3RzL2h0dHAvdGVzdHMvbG9hZGluZy9sb2FkLXR3by1yZXNvdXJjZXMtYmVmb3JlLXJlc3Bv
bnNlLmh0bWwKbmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMDAwMDAwMDAwMDAwMDAw
MDAwMDAwMDAwMDAwMDAwMDAwMC4uMWUwZjM5YjJhNTExMGNmM2FjNTY3ZTEyMjhkMDU0OWMyMzg3
ZmM4ZQotLS0gL2Rldi9udWxsCisrKyBiL0xheW91dFRlc3RzL2h0dHAvdGVzdHMvbG9hZGluZy9s
b2FkLXR3by1yZXNvdXJjZXMtYmVmb3JlLXJlc3BvbnNlLmh0bWwKQEAgLTAsMCArMSwxOSBAQAor
PGh0bWw+Cis8aGVhZD4KKzxzY3JpcHQ+CitpZiAod2luZG93LmxheW91dFRlc3RDb250cm9sbGVy
KSB7CisgICAgbGF5b3V0VGVzdENvbnRyb2xsZXIuZHVtcEFzVGV4dCgpOworICAgIGxheW91dFRl
c3RDb250cm9sbGVyLmNsZWFyQW5kTG9hZFVybCgiaHR0cDovLzEyNy4wLjAuMTo4MDgwL2xvYWRp
bmcvcmVzb3VyY2VzL2xvYWQtdHdvLXJlc291cmNlcy1iZWZvcmUtcmVzcG9uc2UuaHRtbCIpOwor
ICAgIHNldFRpbWVvdXQoZnVuY3Rpb24oKSB7CisgICAgICAgIGxheW91dFRlc3RDb250cm9sbGVy
LmNsZWFyQW5kTG9hZFVybCgiaHR0cDovLzEyNy4wLjAuMTo4MDgwL2xvYWRpbmcvcmVzb3VyY2Vz
L2xvYWQtdHdvLXJlc291cmNlcy1iZWZvcmUtcmVzcG9uc2UuaHRtbCIpOworICAgICAgICBzZXRU
aW1lb3V0KGZ1bmN0aW9uKCkgeworICAgICAgICAgICAgbGF5b3V0VGVzdENvbnRyb2xsZXIubm90
aWZ5RG9uZSgpOworICAgICAgICB9LCA1MDApOworICAgIH0sIDUwMCk7CisgICAgbGF5b3V0VGVz
dENvbnRyb2xsZXIud2FpdFVudGlsRG9uZSgpOworfQorPC9zY3JpcHQ+Cis8L2hlYWQ+Cis8Ym9k
eT4KKzwvYm9keT4KKzwvaHRtbD4KZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL2h0dHAvdGVzdHMv
bG9hZGluZy9yZXNvdXJjZXMvbG9hZC10d28tcmVzb3VyY2VzLWJlZm9yZS1yZXNwb25zZS5odG1s
IGIvTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy9sb2FkaW5nL3Jlc291cmNlcy9sb2FkLXR3by1yZXNv
dXJjZXMtYmVmb3JlLXJlc3BvbnNlLmh0bWwKbmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAw
MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMC4uYjJmNWRiMzM5NzUzZTllODRi
MjFlY2Q4OTlkZTBlZTAzYzUyNmExNgotLS0gL2Rldi9udWxsCisrKyBiL0xheW91dFRlc3RzL2h0
dHAvdGVzdHMvbG9hZGluZy9yZXNvdXJjZXMvbG9hZC10d28tcmVzb3VyY2VzLWJlZm9yZS1yZXNw
b25zZS5odG1sCkBAIC0wLDAgKzEsOCBAQAorPGh0bWw+Cis8aGVhZD4KKzxsaW5rIGhyZWY9Ii9s
b2FkaW5nL3Jlc291cmNlcy9sb2FkLXR3by1yZXNvdXJjZXMtYmVmb3JlLXJlc3BvbnNlLnBocCIg
cmVsPSJzdHlsZXNoZWV0IiB0eXBlPSJ0ZXh0L2NzcyIgbWVkaWE9InNjcmVlbiIgLz4KKzwvaGVh
ZD4KKzxib2R5PgorPHA+SGVsbG88L3A+Cis8L2JvZHk+Cis8L2h0bWw+CmRpZmYgLS1naXQgYS9M
YXlvdXRUZXN0cy9odHRwL3Rlc3RzL2xvYWRpbmcvcmVzb3VyY2VzL2xvYWQtdHdvLXJlc291cmNl
cy1iZWZvcmUtcmVzcG9uc2UucGhwIGIvTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy9sb2FkaW5nL3Jl
c291cmNlcy9sb2FkLXR3by1yZXNvdXJjZXMtYmVmb3JlLXJlc3BvbnNlLnBocApuZXcgZmlsZSBt
b2RlIDEwMDY0NAppbmRleCAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw
Li5mMDcyNjFlOTZlNDQxOTEyOWEzNzBhNzU4NThmNjg2Y2M2MGZmZDc0Ci0tLSAvZGV2L251bGwK
KysrIGIvTGF5b3V0VGVzdHMvaHR0cC90ZXN0cy9sb2FkaW5nL3Jlc291cmNlcy9sb2FkLXR3by1y
ZXNvdXJjZXMtYmVmb3JlLXJlc3BvbnNlLnBocApAQCAtMCwwICsxLDMgQEAKKzw/cGhwCisgICAg
c2xlZXAoMSk7Cis/PgpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvcGxhdGZvcm0vY2hyb21pdW0v
dGVzdF9leHBlY3RhdGlvbnMudHh0IGIvTGF5b3V0VGVzdHMvcGxhdGZvcm0vY2hyb21pdW0vdGVz
dF9leHBlY3RhdGlvbnMudHh0CmluZGV4IGNlZTNiYWNmZTJmMDk4N2RmNjVhOTUzMzE1MjY4OWQw
NTE4ZWJjMGYuLmI1YjYxZjYzYTAyMzk5ZDYwZWFkMzZjZTZjN2UxMjc4YjkyYzg2MWMgMTAwNjQ0
Ci0tLSBhL0xheW91dFRlc3RzL3BsYXRmb3JtL2Nocm9taXVtL3Rlc3RfZXhwZWN0YXRpb25zLnR4
dAorKysgYi9MYXlvdXRUZXN0cy9wbGF0Zm9ybS9jaHJvbWl1bS90ZXN0X2V4cGVjdGF0aW9ucy50
eHQKQEAgLTM0MDMsMyArMzQwMyw1IEBAIFdPTlRGSVggU0tJUCA6IHBsYXRmb3JtL3dpbi9wbHVn
aW5zL2RyYXdzLWdyYWRpZW50Lmh0bWwgPSBJTUFHRStURVhUCiAvLyBBZGRlZCBpbiBXSyByNzE0
MjQKIEJVRzYyMTM4IDogYW5pbWF0aW9ucy9zdG9wLWFuaW1hdGlvbi1vbi1zdXNwZW5kLmh0bWwg
PSBURVhUCiAKKy8vIExheW91dFRlc3RDb250cm9sbGVyOjpxdWV1ZUNsZWFyQW5kTG9hZFVybCgp
IG5vdCB5ZXQgaW1wbGVtZW50ZWQgZm9yIHRoaXMgcG9ydAorQlVHMzk2NzAgU0tJUCA6IGh0dHAv
dGVzdHMvbG9hZGluZy9sb2FkLXR3by1yZXNvdXJjZXMtYmVmb3JlLXJlc3BvbnNlLmh0bWwgPSBG
QUlMCmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9wbGF0Zm9ybS9ndGsvU2tpcHBlZCBiL0xheW91
dFRlc3RzL3BsYXRmb3JtL2d0ay9Ta2lwcGVkCmluZGV4IGUxYjQzNWI0YzZmZjlkNzdlZTA5OTU0
NzVkNGI5M2FkZWEyZjJiYzQuLjM3ZDk2NTc5MDFjMDcyNDZjYjZmNmNjNDViM2ZkNzM3ZDgyMTNj
NjYgMTAwNjQ0Ci0tLSBhL0xheW91dFRlc3RzL3BsYXRmb3JtL2d0ay9Ta2lwcGVkCisrKyBiL0xh
eW91dFRlc3RzL3BsYXRmb3JtL2d0ay9Ta2lwcGVkCkBAIC01NjYwLDMgKzU2NjAsNyBAQCBtYXRo
bWwvcHJlc2VudGF0aW9uCiAjIGl0IGlzIGFuIGlzc3VlIHdpdGggdGhlIHZlcnNpb24gb2YgQ2Fp
cm8gb24gdGhlIGJvdHMuCiAjIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9p
ZD00OTA1MgogZmFzdC9jYW52YXMvcG9pbnRJblBhdGguaHRtbAorCisjIExheW91dFRlc3RDb250
cm9sbGVyOjpxdWV1ZUNsZWFyQW5kTG9hZFVybCgpIG5vdCB5ZXQgaW1wbGVtZW50ZWQgZm9yIHRo
aXMgcG9ydAorIyBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9Mzk2NzAK
K2h0dHAvdGVzdHMvbG9hZGluZy9sb2FkLXR3by1yZXNvdXJjZXMtYmVmb3JlLXJlc3BvbnNlLmh0
bWwKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL3BsYXRmb3JtL21hYy9Ta2lwcGVkIGIvTGF5b3V0
VGVzdHMvcGxhdGZvcm0vbWFjL1NraXBwZWQKaW5kZXggYjA2Mzg5NmQzMDI4ODA1NzNiZTM5MDIw
YWZiMTBkY2QyMWZkNjZlNS4uZTUzMzAzYjJjOGRkZTMwMmE1NzQ1ZWI2N2Q2OTBkNzAwMTEzMjdh
OSAxMDA2NDQKLS0tIGEvTGF5b3V0VGVzdHMvcGxhdGZvcm0vbWFjL1NraXBwZWQKKysrIGIvTGF5
b3V0VGVzdHMvcGxhdGZvcm0vbWFjL1NraXBwZWQKQEAgLTI3NiwzICsyNzYsNyBAQCBmYXN0L2Nh
bnZhcy9jYW52YXMtZ2V0SW1hZ2VEYXRhLW5lZ2F0aXZlLXNvdXJjZS5odG1sCiAKICMgVGltZXMg
b3V0IGJlY2F1c2UgcGx1Z2lucyBhcmVuJ3QgYWxsb3dlZCB0byBleGVjdXRlIEpTIGFmdGVyIE5Q
UF9EZXN0cm95IGhhcyBiZWVuIGNhbGxlZCBpbiBXZWJLaXQxJ3MgT09QIHBsdWdpbnMgaW1wbGVt
ZW50YXRpb24gaHR0cDovL3dlYmtpdC5vcmcvYi80ODkyOQogcGx1Z2lucy9ldmFsdWF0ZS1qcy1h
ZnRlci1yZW1vdmluZy1wbHVnaW4tZWxlbWVudC5odG1sCisKKyMgTGF5b3V0VGVzdENvbnRyb2xs
ZXI6OnF1ZXVlQ2xlYXJBbmRMb2FkVXJsKCkgbm90IHlldCBpbXBsZW1lbnRlZCBmb3IgdGhpcyBw
b3J0CisjIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0zOTY3MAoraHR0
cC90ZXN0cy9sb2FkaW5nL2xvYWQtdHdvLXJlc291cmNlcy1iZWZvcmUtcmVzcG9uc2UuaHRtbApk
aWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvcGxhdGZvcm0vd2luL1NraXBwZWQgYi9MYXlvdXRUZXN0
cy9wbGF0Zm9ybS93aW4vU2tpcHBlZAppbmRleCA2Y2FmNDJiNmNmYjQ1OWUzNmMxMWY3NTg3OGI0
N2FlNzBhN2UwMzk1Li44ZmU5OGZmYTExNDAxNmJmMjdlYTk2NTllZTc1ZDZlNGVlZGNjNzY4IDEw
MDY0NAotLS0gYS9MYXlvdXRUZXN0cy9wbGF0Zm9ybS93aW4vU2tpcHBlZAorKysgYi9MYXlvdXRU
ZXN0cy9wbGF0Zm9ybS93aW4vU2tpcHBlZApAQCAtMTA3MywzICsxMDczLDcgQEAgZmFzdC9ldmVu
dHMvY2xpY2stZm9jdXMtY29udHJvbC5odG1sCiAKICMgUmVxdWlyZXMgV2ViUCBzdXBwb3J0Lgog
ZmFzdC9pbWFnZXMvd2VicC1pbWFnZS1kZWNvZGluZy5odG1sCisKKyMgTGF5b3V0VGVzdENvbnRy
b2xsZXI6OnF1ZXVlQ2xlYXJBbmRMb2FkVXJsKCkgbm90IHlldCBpbXBsZW1lbnRlZCBmb3IgdGhp
cyBwb3J0CisjIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0zOTY3MAor
aHR0cC90ZXN0cy9sb2FkaW5nL2xvYWQtdHdvLXJlc291cmNlcy1iZWZvcmUtcmVzcG9uc2UuaHRt
bApkaWZmIC0tZ2l0IGEvV2ViQ29yZS9DaGFuZ2VMb2cgYi9XZWJDb3JlL0NoYW5nZUxvZwppbmRl
eCAwMGMxNTAxNjU4NzE1ZDAxNjIxZTliNzNkYmY2MTJiODRlYWY2NDRiLi5lNzRmNzlkY2U0MWEx
ZjEyNzVhNjJjZjUyZGI5OTFlZDM1YzdjNTM3IDEwMDY0NAotLS0gYS9XZWJDb3JlL0NoYW5nZUxv
ZworKysgYi9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE5IEBACisyMDEwLTExLTA1ICBK
YW4gRXJpayBIYW5zc2VuICA8amhhbnNzZW5Ac2VuY2hhLmNvbT4KKworICAgICAgICBSZXZpZXdl
ZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBDcmFzaCBpbiBMb2FkZXI6Okhvc3Q6OmRp
ZEZhaWwoKSB3aGVuIGNsZWFyaW5nIHRoZSBGcmFtZUxvYWRlciB3aGlsZSBhIGxvYWQgaXMgaW4g
cHJvZ3Jlc3MKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lk
PTM5NjcwCisKKyAgICAgICAgTG9hZGVyOjpIb3N0OjpkaWRGYWlsKCkgdHJpZXMgdG8gcmVmIHRo
ZSBEb2N1bWVudCB3aGlsZSBpdCdzIGJlaW5nIGRlc3Ryb3llZCBpZgorICAgICAgICBEb2N1bWVu
dFdyaXRlcjo6YmVnaW4oKSBpcyBjYWxsZWQgYWZ0ZXIgYSBwcmV2aW91cyBwYWdlIGxvYWQgYnV0
IGJlZm9yZSByZWNlaXZpbmcgYW55CisgICAgICAgIGRhdGEuCisKKyAgICAgICAgVGVzdDogaHR0
cC90ZXN0cy9sb2FkaW5nL2xvYWQtdHdvLXJlc291cmNlcy1iZWZvcmUtcmVzcG9uc2UuaHRtbAor
CisgICAgICAgICogbG9hZGVyL0ZyYW1lTG9hZGVyLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OkZy
YW1lTG9hZGVyOjpjbGVhcik6CisKIDIwMTAtMTEtMDUgIEppYW4gTGkgIDxqaWFubGlAY2hyb21p
dW0ub3JnPgogCiAgICAgICAgIFJldmlld2VkIGJ5IERtaXRyeSBUaXRvdi4KZGlmZiAtLWdpdCBh
L1dlYkNvcmUvbG9hZGVyL0ZyYW1lTG9hZGVyLmNwcCBiL1dlYkNvcmUvbG9hZGVyL0ZyYW1lTG9h
ZGVyLmNwcAppbmRleCAwNTJhODViMjk2NzVjZjgyN2UyYjcxODRlYjA4NDUzMTg4NTRlNWRmLi4y
MWU0ZTBjMDFjODU0MzJlOTE5OTg0NDQ4NWIxZDFmYjljN2VhZTVkIDEwMDY0NAotLS0gYS9XZWJD
b3JlL2xvYWRlci9GcmFtZUxvYWRlci5jcHAKKysrIGIvV2ViQ29yZS9sb2FkZXIvRnJhbWVMb2Fk
ZXIuY3BwCkBAIC01OTEsNiArNTkxLDggQEAgdm9pZCBGcmFtZUxvYWRlcjo6Y2xlYXIoYm9vbCBj
bGVhcldpbmRvd1Byb3BlcnRpZXMsIGJvb2wgY2xlYXJTY3JpcHRPYmplY3RzLCBib28KIAogICAg
IC8vIERvIG5vdCBkcm9wIHRoZSBkb2N1bWVudCBiZWZvcmUgdGhlIFNjcmlwdENvbnRyb2xsZXIg
YW5kIHZpZXcgYXJlIGNsZWFyZWQKICAgICAvLyBhcyBzb21lIGRlc3RydWN0b3JzIG1pZ2h0IHN0
aWxsIHRyeSB0byBhY2Nlc3MgdGhlIGRvY3VtZW50LgorICAgIGlmIChDYWNoZWRSZXNvdXJjZUxv
YWRlciogY2FjaGVkUmVzb3VyY2VMb2FkZXIgPSBtX2ZyYW1lLT5kb2N1bWVudCgpLT5jYWNoZWRS
ZXNvdXJjZUxvYWRlcigpKQorICAgICAgICBjYWNoZSgpLT5sb2FkZXIoKS0+Y2FuY2VsUmVxdWVz
dHMoY2FjaGVkUmVzb3VyY2VMb2FkZXIpOwogICAgIG1fZnJhbWUtPnNldERvY3VtZW50KDApOwog
ICAgIHdyaXRlcigpLT5jbGVhcigpOwogCmRpZmYgLS1naXQgYS9XZWJLaXRUb29scy9DaGFuZ2VM
b2cgYi9XZWJLaXRUb29scy9DaGFuZ2VMb2cKaW5kZXggNjY4NzNkNDk4YmIyNDdjYTY3Y2I2Nzkx
ZTllZDZmNjdmMGJlYTExNy4uNTE3NTAwNjU2OGZlNTNiZGU5YjI3OTBkZDkwMWM3NDhmMTk2ZDk4
ZCAxMDA2NDQKLS0tIGEvV2ViS2l0VG9vbHMvQ2hhbmdlTG9nCisrKyBiL1dlYktpdFRvb2xzL0No
YW5nZUxvZwpAQCAtMSwzICsxLDIwIEBACisyMDEwLTExLTA1ICBKYW4gRXJpayBIYW5zc2VuICA8
amhhbnNzZW5Ac2VuY2hhLmNvbT4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMh
KS4KKworICAgICAgICBBZGQgTGF5b3V0VGVzdENvbnRyb2xsZXI6OmNsZWFyQW5kTG9hZFVybCgp
CisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0zOTY3MAor
CisgICAgICAgIFRoaXMgZnVuY3Rpb24gaXMgdXNlZCBmb3IgdGVzdGluZyB3ZXRoZXIgY2xlYXJp
bmcgdGhlIEZyYW1lTG9hZGVyIHdoaWxlCisgICAgICAgIGEgbG9hZCBpcyBhbHJlYWR5IGluIHBy
b2dyZXNzIGNhdXNlcyBhIGNyYXNoLgorCisgICAgICAgICogRHVtcFJlbmRlclRyZWUvcXQvTGF5
b3V0VGVzdENvbnRyb2xsZXJRdC5jcHA6CisgICAgICAgIChMYXlvdXRUZXN0Q29udHJvbGxlcjo6
TGF5b3V0VGVzdENvbnRyb2xsZXIpOgorICAgICAgICAoTGF5b3V0VGVzdENvbnRyb2xsZXI6On5M
YXlvdXRUZXN0Q29udHJvbGxlcik6CisgICAgICAgIChMYXlvdXRUZXN0Q29udHJvbGxlcjo6cmVz
ZXQpOgorICAgICAgICAoTGF5b3V0VGVzdENvbnRyb2xsZXI6OmNsZWFyQW5kTG9hZFVybCk6Cisg
ICAgICAgICogRHVtcFJlbmRlclRyZWUvcXQvTGF5b3V0VGVzdENvbnRyb2xsZXJRdC5oOgorCiAy
MDEwLTExLTA1ICBDaHJpcyBNYXJyaW4gIDxjbWFycmluQGFwcGxlLmNvbT4KIAogICAgICAgICBS
ZXZpZXdlZCBieSBTaW1vbiBGcmFzZXIuCmRpZmYgLS1naXQgYS9XZWJLaXRUb29scy9EdW1wUmVu
ZGVyVHJlZS9xdC9MYXlvdXRUZXN0Q29udHJvbGxlclF0LmNwcCBiL1dlYktpdFRvb2xzL0R1bXBS
ZW5kZXJUcmVlL3F0L0xheW91dFRlc3RDb250cm9sbGVyUXQuY3BwCmluZGV4IDNlNTBlMDZhNGE3
MzJkZDcwMGNkZjRjZjljYzdhMmMwOWNhZDM2NWIuLjhmZGE0Zjg4YzIzZjA0N2Y4YTc5NTc1MmQ0
ZGRiODNjYWM3YzEzNmMgMTAwNjQ0Ci0tLSBhL1dlYktpdFRvb2xzL0R1bXBSZW5kZXJUcmVlL3F0
L0xheW91dFRlc3RDb250cm9sbGVyUXQuY3BwCisrKyBiL1dlYktpdFRvb2xzL0R1bXBSZW5kZXJU
cmVlL3F0L0xheW91dFRlc3RDb250cm9sbGVyUXQuY3BwCkBAIC0zOSw2ICszOSw3IEBACiAKIExh
eW91dFRlc3RDb250cm9sbGVyOjpMYXlvdXRUZXN0Q29udHJvbGxlcihXZWJDb3JlOjpEdW1wUmVu
ZGVyVHJlZSogZHJ0KQogICAgIDogUU9iamVjdCgpCisgICAgLCBtX25ld1BhZ2UoMCkKICAgICAs
IG1fZHJ0KGRydCkKIHsKICAgICBxUmVnaXN0ZXJNZXRhVHlwZTxRV2ViRWxlbWVudD4oIlFXZWJF
bGVtZW50Iik7CkBAIC00Niw2ICs0NywxMSBAQCBMYXlvdXRUZXN0Q29udHJvbGxlcjo6TGF5b3V0
VGVzdENvbnRyb2xsZXIoV2ViQ29yZTo6RHVtcFJlbmRlclRyZWUqIGRydCkKICAgICBEdW1wUmVu
ZGVyVHJlZVN1cHBvcnRRdDo6ZHVtcE5vdGlmaWNhdGlvbih0cnVlKTsKIH0KIAorTGF5b3V0VGVz
dENvbnRyb2xsZXI6On5MYXlvdXRUZXN0Q29udHJvbGxlcigpCit7CisgICAgZGVsZXRlIG1fbmV3
UGFnZTsKK30KKwogdm9pZCBMYXlvdXRUZXN0Q29udHJvbGxlcjo6cmVzZXQoKQogewogICAgIG1f
aGFzRHVtcGVkID0gZmFsc2U7CkBAIC03MCw2ICs3Niw4IEBAIHZvaWQgTGF5b3V0VGVzdENvbnRy
b2xsZXI6OnJlc2V0KCkKICAgICBtX2lnbm9yZURlc2t0b3BOb3RpZmljYXRpb24gPSBmYWxzZTsK
ICAgICBtX2lzR2VvbG9jYXRpb25QZXJtaXNzaW9uU2V0ID0gZmFsc2U7CiAgICAgbV9nZW9sb2Nh
dGlvblBlcm1pc3Npb24gPSBmYWxzZTsKKyAgICBkZWxldGUgbV9uZXdQYWdlOworICAgIG1fbmV3
UGFnZSA9IDA7CiAKICAgICBEdW1wUmVuZGVyVHJlZVN1cHBvcnRRdDo6ZHVtcEVkaXRpbmdDYWxs
YmFja3MoZmFsc2UpOwogICAgIER1bXBSZW5kZXJUcmVlU3VwcG9ydFF0OjpkdW1wRnJhbWVMb2Fk
ZXIoZmFsc2UpOwpAQCAtMzMyLDYgKzM0MCwxMyBAQCB2b2lkIExheW91dFRlc3RDb250cm9sbGVy
OjpxdWV1ZU5vbkxvYWRpbmdTY3JpcHQoY29uc3QgUVN0cmluZyYgc2NyaXB0KQogICAgIFdvcmtR
dWV1ZTo6c2hhcmVkKCktPnF1ZXVlKG5ldyBOb25Mb2FkaW5nU2NyaXB0SXRlbShzY3JpcHQsIG1f
ZHJ0LT53ZWJQYWdlKCkpKTsKIH0KIAordm9pZCBMYXlvdXRUZXN0Q29udHJvbGxlcjo6Y2xlYXJB
bmRMb2FkVXJsKGNvbnN0IFFTdHJpbmcmIHVybCkKK3sKKyAgICBpZiAoIW1fbmV3UGFnZSkKKyAg
ICAgICAgbV9uZXdQYWdlID0gbmV3IFFXZWJQYWdlOworICAgIG1fbmV3UGFnZS0+bWFpbkZyYW1l
KCktPnNldFVybChRVXJsKHVybCwgUVVybDo6VG9sZXJhbnRNb2RlKSk7Cit9CisKIHZvaWQgTGF5
b3V0VGVzdENvbnRyb2xsZXI6OnByb3Zpc2lvbmFsTG9hZCgpCiB7CiAgICAgUVdlYkZyYW1lKiBm
cmFtZSA9IHFvYmplY3RfY2FzdDxRV2ViRnJhbWUqPihzZW5kZXIoKSk7CmRpZmYgLS1naXQgYS9X
ZWJLaXRUb29scy9EdW1wUmVuZGVyVHJlZS9xdC9MYXlvdXRUZXN0Q29udHJvbGxlclF0LmggYi9X
ZWJLaXRUb29scy9EdW1wUmVuZGVyVHJlZS9xdC9MYXlvdXRUZXN0Q29udHJvbGxlclF0LmgKaW5k
ZXggZGZiMTJmZTI4ZTdiMzRlZjk1MWNmN2NiYWI4MTljOTQ2OTFmYTIzYi4uMDEwYjJjOWQ1ZGIx
OWVhY2IwMTNiZWRmNTI0MDA1NDQxODcwZGE3NiAxMDA2NDQKLS0tIGEvV2ViS2l0VG9vbHMvRHVt
cFJlbmRlclRyZWUvcXQvTGF5b3V0VGVzdENvbnRyb2xsZXJRdC5oCisrKyBiL1dlYktpdFRvb2xz
L0R1bXBSZW5kZXJUcmVlL3F0L0xheW91dFRlc3RDb250cm9sbGVyUXQuaApAQCAtNTgsNiArNTgs
NyBAQCBjbGFzcyBMYXlvdXRUZXN0Q29udHJvbGxlciA6IHB1YmxpYyBRT2JqZWN0IHsKICAgICBR
X1BST1BFUlRZKGJvb2wgZ2xvYmFsRmxhZyBSRUFEIGdsb2JhbEZsYWcgV1JJVEUgc2V0R2xvYmFs
RmxhZykKIHB1YmxpYzoKICAgICBMYXlvdXRUZXN0Q29udHJvbGxlcihXZWJDb3JlOjpEdW1wUmVu
ZGVyVHJlZSogZHJ0KTsKKyAgICB+TGF5b3V0VGVzdENvbnRyb2xsZXIoKTsKIAogICAgIGJvb2wg
c2hvdWxkRHVtcEFzVGV4dCgpIGNvbnN0IHsgcmV0dXJuIG1fdGV4dER1bXA7IH0KICAgICBib29s
IHNob3VsZER1bXBCYWNrRm9yd2FyZExpc3QoKSBjb25zdCB7IHJldHVybiBtX2R1bXBCYWNrRm9y
d2FyZExpc3Q7IH0KQEAgLTEyMSw2ICsxMjIsNyBAQCBwdWJsaWMgc2xvdHM6CiAgICAgdm9pZCBx
dWV1ZVJlbG9hZCgpOwogICAgIHZvaWQgcXVldWVMb2FkaW5nU2NyaXB0KGNvbnN0IFFTdHJpbmcm
IHNjcmlwdCk7CiAgICAgdm9pZCBxdWV1ZU5vbkxvYWRpbmdTY3JpcHQoY29uc3QgUVN0cmluZyYg
c2NyaXB0KTsKKyAgICB2b2lkIGNsZWFyQW5kTG9hZFVybChjb25zdCBRU3RyaW5nJiB1cmwpOwog
ICAgIHZvaWQgcHJvdmlzaW9uYWxMb2FkKCk7CiAgICAgdm9pZCBzZXRDbG9zZVJlbWFpbmluZ1dp
bmRvd3NXaGVuQ29tcGxldGUoYm9vbCA9IGZhbHNlKSB7fQogICAgIGludCB3aW5kb3dDb3VudCgp
OwpAQCAtMjY5LDYgKzI3MSw4IEBAIHByaXZhdGU6CiAgICAgYm9vbCBtX2lzR2VvbG9jYXRpb25Q
ZXJtaXNzaW9uU2V0OwogICAgIGJvb2wgbV9nZW9sb2NhdGlvblBlcm1pc3Npb247CiAKKyAgICBR
V2ViUGFnZSogbV9uZXdQYWdlOworCiAgICAgUVVybCBtX3VzZXJTdHlsZVNoZWV0TG9jYXRpb247
CiAgICAgUUJhc2ljVGltZXIgbV90aW1lb3V0VGltZXI7CiAgICAgUVdlYkZyYW1lKiBtX3RvcExv
YWRpbmdGcmFtZTsK
</data>

          </attachment>
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>75858</attachid>
            <date>2010-12-07 18:20:56 -0800</date>
            <delta_ts>2010-12-23 17:40:14 -0800</delta_ts>
            <desc>Patch</desc>
            <filename>bug-39670-20101207182055.patch</filename>
            <type>text/plain</type>
            <size>5492</size>
            <attacher name="Jan Erik Hanssen">jhanssen</attacher>
            
              <data encoding="base64">ZGlmZiAtLWdpdCBhL1dlYktpdC9xdC9BcGkvcXdlYmZyYW1lLmNwcCBiL1dlYktpdC9xdC9BcGkv
cXdlYmZyYW1lLmNwcAppbmRleCAzY2RiZWYyNmM3YmEwNDk3MDkzZGU2Y2YyYWFjMjljNTZmZDY0
NTM0Li4zZDZlODYyZGY2ZWEwOTIxNzNhM2Q4OGQ2NThmZjI5YzNiNTZkNTRjIDEwMDY0NAotLS0g
YS9XZWJLaXQvcXQvQXBpL3F3ZWJmcmFtZS5jcHAKKysrIGIvV2ViS2l0L3F0L0FwaS9xd2ViZnJh
bWUuY3BwCkBAIC03MDMsNiArNzAzLDggQEAgc3RhdGljIGlubGluZSBRVXJsIGVuc3VyZUFic29s
dXRlVXJsKGNvbnN0IFFVcmwgJnVybCkKIHZvaWQgUVdlYkZyYW1lOjpzZXRVcmwoY29uc3QgUVVy
bCAmdXJsKQogewogICAgIGNvbnN0IFFVcmwgYWJzb2x1dGUgPSBlbnN1cmVBYnNvbHV0ZVVybCh1
cmwpOworICAgIGlmIChkLT5mcmFtZS0+bG9hZGVyKCktPmlzTG9hZGluZygpKQorICAgICAgICBk
LT5mcmFtZS0+bG9hZGVyKCktPnN0b3BBbGxMb2FkZXJzKCk7CiAgICAgZC0+ZnJhbWUtPmxvYWRl
cigpLT53cml0ZXIoKS0+YmVnaW4oYWJzb2x1dGUpOwogICAgIGQtPmZyYW1lLT5sb2FkZXIoKS0+
d3JpdGVyKCktPmVuZCgpOwogICAgIGxvYWQoYWJzb2x1dGUpOwpkaWZmIC0tZ2l0IGEvV2ViS2l0
L3F0L0NoYW5nZUxvZyBiL1dlYktpdC9xdC9DaGFuZ2VMb2cKaW5kZXggNmQzNDFiYWMyZmFiZjA0
MTgzODEwN2ZkNjVlMDJjZGM5MjNlZTA3Yi4uZjMxYmEzOWM0ODkzYjZhZmQ1NjVjMDIyYjg0ZTgz
MzkwMmY2ZDU0NyAxMDA2NDQKLS0tIGEvV2ViS2l0L3F0L0NoYW5nZUxvZworKysgYi9XZWJLaXQv
cXQvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTkgQEAKKzIwMTAtMTItMDcgIEphbiBFcmlrIEhhbnNz
ZW4gIDxqaGFuc3NlbkBzZW5jaGEuY29tPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAo
T09QUyEpLgorCisgICAgICAgIFtRdF0gV2ViVmlldzo6c2V0VXJsIGNyYXNoZXMgYWZ0ZXIgUXQ0
LjcKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTM5Njcw
CisKKyAgICAgICAgTWFrZSBzdXJlIHRvIGNsZWFyIGFueSBwZW5kaW5nIGxvYWRzIGZyb20gRnJh
bWVMb2FkZXIgCisgICAgICAgIGJlZm9yZSBpc3N1aW5nIGEgbmV3IGxvYWQuCisKKyAgICAgICAg
KiBBcGkvcXdlYmZyYW1lLmNwcDoKKyAgICAgICAgKFFXZWJGcmFtZTo6c2V0VXJsKToKKyAgICAg
ICAgKiB0ZXN0cy9xd2ViZnJhbWUvcmVzb3VyY2VzL2xvYWRwZW5kaW5nLmh0bWw6IEFkZGVkLgor
ICAgICAgICAqIHRlc3RzL3F3ZWJmcmFtZS90c3RfcXdlYmZyYW1lLmNwcDoKKyAgICAgICAgKiB0
ZXN0cy9xd2ViZnJhbWUvdHN0X3F3ZWJmcmFtZS5xcmM6CisKIDIwMTAtMTItMDcgIERhcmluIEFk
bGVyICA8ZGFyaW5AYXBwbGUuY29tPgogCiAgICAgICAgIFRyeSB0byBmaXggYnVpbGQuCmRpZmYg
LS1naXQgYS9XZWJLaXQvcXQvdGVzdHMvcXdlYmZyYW1lL3Jlc291cmNlcy9sb2FkcGVuZGluZy5o
dG1sIGIvV2ViS2l0L3F0L3Rlc3RzL3F3ZWJmcmFtZS9yZXNvdXJjZXMvbG9hZHBlbmRpbmcuaHRt
bApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw
MDAwMDAwMDAwMDAwLi5iNWE2ZjYxMzQ4ZWEzMDRlNjNkNWJjYTcxNGI2ODU1YWM3ZjBkMGE0Ci0t
LSAvZGV2L251bGwKKysrIGIvV2ViS2l0L3F0L3Rlc3RzL3F3ZWJmcmFtZS9yZXNvdXJjZXMvbG9h
ZHBlbmRpbmcuaHRtbApAQCAtMCwwICsxLDcgQEAKKzxodG1sPgorPGhlYWQ+Cis8bGluayBocmVm
PSJxcmM6L2RlbGF5Lmh0bWwiIHJlbD0ic3R5bGVzaGVldCIgdHlwZT0idGV4dC9jc3MiIG1lZGlh
PSJzY3JlZW4iPjwvbGluaz4KKzwvaGVhZD4KKzxib2R5PgorPC9ib2R5PgorPC9odG1sPgpkaWZm
IC0tZ2l0IGEvV2ViS2l0L3F0L3Rlc3RzL3F3ZWJmcmFtZS90c3RfcXdlYmZyYW1lLmNwcCBiL1dl
YktpdC9xdC90ZXN0cy9xd2ViZnJhbWUvdHN0X3F3ZWJmcmFtZS5jcHAKaW5kZXggZWIzYWUwYTll
Y2QzZWI4NzQ1NTgzYmExZmIyYTk5MTkxYmEzNmI0Zi4uMjIwZjM2ZTI2ODYwZWExMDBmOTkwMWE4
YWJkMzM0NGRkOGM4M2UzOCAxMDA2NDQKLS0tIGEvV2ViS2l0L3F0L3Rlc3RzL3F3ZWJmcmFtZS90
c3RfcXdlYmZyYW1lLmNwcAorKysgYi9XZWJLaXQvcXQvdGVzdHMvcXdlYmZyYW1lL3RzdF9xd2Vi
ZnJhbWUuY3BwCkBAIC02MjUsNiArNjI1LDcgQEAgcHJpdmF0ZSBzbG90czoKICAgICB2b2lkIGlu
dHJvc3BlY3RRdE1ldGhvZHMoKTsKICAgICB2b2lkIHNldENvbnRlbnRfZGF0YSgpOwogICAgIHZv
aWQgc2V0Q29udGVudCgpOworICAgIHZvaWQgc2V0VXJsV2hpbGVMb2FkUGVuZGluZygpOwogCiBw
cml2YXRlOgogICAgIFFTdHJpbmcgIGV2YWxKUyhjb25zdCBRU3RyaW5nJnMpIHsKQEAgLTMwNjgs
NSArMzA2OSwxMDkgQEAgdm9pZCB0c3RfUVdlYkZyYW1lOjpzZXRDb250ZW50KCkKICAgICBRQ09N
UEFSRShleHBlY3RlZCAsIG1haW5GcmFtZS0+dG9QbGFpblRleHQoKSk7CiB9CiAKK2NsYXNzIERl
bGF5UmVwbHkgOiBwdWJsaWMgUU5ldHdvcmtSZXBseSB7CisgICAgUV9PQkpFQ1QKK3B1YmxpYzoK
KyAgICBEZWxheVJlcGx5KGNvbnN0IFFOZXR3b3JrUmVxdWVzdCYgcmVxdWVzdCwgUU9iamVjdCog
cGFyZW50ID0gMCkKKyAgICAgICAgOiBRTmV0d29ya1JlcGx5KHBhcmVudCkKKyAgICB7CisgICAg
ICAgIHNldE9wZXJhdGlvbihRTmV0d29ya0FjY2Vzc01hbmFnZXI6OkdldE9wZXJhdGlvbik7Cisg
ICAgICAgIHNldFJlcXVlc3QocmVxdWVzdCk7CisKKyAgICAgICAgb3BlbihRSU9EZXZpY2U6OlJl
YWRPbmx5KTsKKyAgICAgICAgUVRpbWVyOjpzaW5nbGVTaG90KDEwMDAsIHRoaXMsIFNMT1QodGlt
ZW91dCgpKSk7CisgICAgfQorICAgIH5EZWxheVJlcGx5KCkKKyAgICB7CisgICAgICAgIGNsb3Nl
KCk7CisgICAgfQorICAgIHZpcnR1YWwgdm9pZCBhYm9ydCgpCisgICAgeworICAgICAgICBlbWl0
IGFib3J0ZWQoKTsKKyAgICB9CisgICAgdmlydHVhbCB2b2lkIGNsb3NlKCkge30KKworc2lnbmFs
czoKKyAgICB2b2lkIGFib3J0ZWQoKTsKKworcHJvdGVjdGVkOgorICAgIHFpbnQ2NCByZWFkRGF0
YShjaGFyKiwgcWludDY0KQorICAgIHsKKyAgICAgICAgcmV0dXJuIDA7CisgICAgfQorCitwcml2
YXRlIHNsb3RzOgorICAgIHZvaWQgdGltZW91dCgpCisgICAgeworICAgICAgICBlbWl0IHJlYWR5
UmVhZCgpOworICAgICAgICBlbWl0IGZpbmlzaGVkKCk7CisgICAgfQorfTsKKworY2xhc3MgRGVs
YXlOZXR3b3JrTWFuYWdlciA6IHB1YmxpYyBRTmV0d29ya0FjY2Vzc01hbmFnZXIgeworICAgIFFf
T0JKRUNUCitwdWJsaWM6CisgICAgRGVsYXlOZXR3b3JrTWFuYWdlcihRT2JqZWN0KiBwYXJlbnQp
CisgICAgICAgIDogUU5ldHdvcmtBY2Nlc3NNYW5hZ2VyKHBhcmVudCksIG1fYWJvcnRlZCgwKQor
ICAgIHsKKyAgICB9CisKKyAgICBpbnQgYWJvcnRlZCgpIGNvbnN0CisgICAgeworICAgICAgICBy
ZXR1cm4gbV9hYm9ydGVkOworICAgIH0KKworc2lnbmFsczoKKyAgICB2b2lkIGRlbGF5TG9hZFN0
YXJ0ZWQoKTsKKworcHJvdGVjdGVkOgorICAgIHZpcnR1YWwgUU5ldHdvcmtSZXBseSogY3JlYXRl
UmVxdWVzdChPcGVyYXRpb24gb3AsIGNvbnN0IFFOZXR3b3JrUmVxdWVzdCYgcmVxdWVzdCwgUUlP
RGV2aWNlKiBvdXRnb2luZ0RhdGEpCisgICAgeworICAgICAgICBRU3RyaW5nIHVybCA9IHJlcXVl
c3QudXJsKCkudG9TdHJpbmcoKTsKKyAgICAgICAgaWYgKG9wID09IFFOZXR3b3JrQWNjZXNzTWFu
YWdlcjo6R2V0T3BlcmF0aW9uKSB7CisgICAgICAgICAgICBpZiAodXJsID09ICJxcmM6L2RlbGF5
Lmh0bWwiKSB7CisgICAgICAgICAgICAgICAgUVRpbWVyOjpzaW5nbGVTaG90KDAsIHRoaXMsIFNM
T1QoZW1pdERlbGF5TG9hZFN0YXJ0ZWQoKSkpOworCisgICAgICAgICAgICAgICAgRGVsYXlSZXBs
eSogcmVwbHkgPSBuZXcgRGVsYXlSZXBseShyZXF1ZXN0LCB0aGlzKTsKKyAgICAgICAgICAgICAg
ICBjb25uZWN0KHJlcGx5LCBTSUdOQUwoYWJvcnRlZCgpKSwgdGhpcywgU0xPVChyZXBseUFib3J0
ZWQoKSkpOworCisgICAgICAgICAgICAgICAgcmV0dXJuIHJlcGx5OworICAgICAgICAgICAgfQor
ICAgICAgICB9CisKKyAgICAgICByZXR1cm4gUU5ldHdvcmtBY2Nlc3NNYW5hZ2VyOjpjcmVhdGVS
ZXF1ZXN0KG9wLCByZXF1ZXN0LCBvdXRnb2luZ0RhdGEpOworICAgIH0KKworcHJpdmF0ZSBzbG90
czoKKyAgICB2b2lkIGVtaXREZWxheUxvYWRTdGFydGVkKCkKKyAgICB7CisgICAgICAgIGVtaXQg
ZGVsYXlMb2FkU3RhcnRlZCgpOworICAgIH0KKworICAgIHZvaWQgcmVwbHlBYm9ydGVkKCkKKyAg
ICB7CisgICAgICAgICsrbV9hYm9ydGVkOworICAgIH0KKworcHJpdmF0ZToKKyAgICBpbnQgbV9h
Ym9ydGVkOworfTsKKwordm9pZCB0c3RfUVdlYkZyYW1lOjpzZXRVcmxXaGlsZUxvYWRQZW5kaW5n
KCkKK3sKKyAgICBRV2ViUGFnZSBwYWdlOworICAgIERlbGF5TmV0d29ya01hbmFnZXIqIG1hbmFn
ZXIgPSBuZXcgRGVsYXlOZXR3b3JrTWFuYWdlcigmcGFnZSk7CisgICAgcGFnZS5zZXROZXR3b3Jr
QWNjZXNzTWFuYWdlcihtYW5hZ2VyKTsKKworICAgIFFXZWJGcmFtZSogZnJhbWUgPSBwYWdlLm1h
aW5GcmFtZSgpOworICAgIGZyYW1lLT5zZXRVcmwoUVVybCgicXJjOi9sb2FkcGVuZGluZy5odG1s
IikpOworCisgICAgUVZFUklGWSg6OndhaXRGb3JTaWduYWwobWFuYWdlciwgU0lHTkFMKGRlbGF5
TG9hZFN0YXJ0ZWQoKSkpKTsKKworICAgIGZyYW1lLT5zZXRVcmwoUVVybCgicXJjOi9sb2FkcGVu
ZGluZy5odG1sIikpOworCisgICAgUVZFUklGWShtYW5hZ2VyLT5hYm9ydGVkKCkgPT0gMSk7Cit9
CisKIFFURVNUX01BSU4odHN0X1FXZWJGcmFtZSkKICNpbmNsdWRlICJ0c3RfcXdlYmZyYW1lLm1v
YyIKZGlmZiAtLWdpdCBhL1dlYktpdC9xdC90ZXN0cy9xd2ViZnJhbWUvdHN0X3F3ZWJmcmFtZS5x
cmMgYi9XZWJLaXQvcXQvdGVzdHMvcXdlYmZyYW1lL3RzdF9xd2ViZnJhbWUucXJjCmluZGV4IDJh
N2QwYjljMjgyNWZmODUwNWFhNjFhZDg3NTNmYzU2MWQ2MjFlY2IuLjYyMDcyY2M4ZTRhYTNiYjkw
NjdkOGQyNDA3NWM2MjEyZDk5NTlmOWEgMTAwNjQ0Ci0tLSBhL1dlYktpdC9xdC90ZXN0cy9xd2Vi
ZnJhbWUvdHN0X3F3ZWJmcmFtZS5xcmMKKysrIGIvV2ViS2l0L3F0L3Rlc3RzL3F3ZWJmcmFtZS90
c3RfcXdlYmZyYW1lLnFyYwpAQCAtNiw1ICs2LDYgQEAKIDxmaWxlIGFsaWFzPSJ0ZXN0Mi5odG1s
Ij5yZXNvdXJjZXMvdGVzdDIuaHRtbDwvZmlsZT4KIDxmaWxlIGFsaWFzPSJ0ZXN0aWZyYW1lLmh0
bWwiPnJlc291cmNlcy90ZXN0aWZyYW1lLmh0bWw8L2ZpbGU+CiA8ZmlsZSBhbGlhcz0idGVzdGlm
cmFtZTIuaHRtbCI+cmVzb3VyY2VzL3Rlc3RpZnJhbWUyLmh0bWw8L2ZpbGU+Cis8ZmlsZSBhbGlh
cz0ibG9hZHBlbmRpbmcuaHRtbCI+cmVzb3VyY2VzL2xvYWRwZW5kaW5nLmh0bWw8L2ZpbGU+CiA8
L3FyZXNvdXJjZT4KIDwvUkNDPgo=
</data>
<flag name="review"
          id="66710"
          type_id="1"
          status="-"
          setter="abarth"
    />
    <flag name="commit-queue"
          id="66711"
          type_id="3"
          status="-"
          setter="abarth"
    />
          </attachment>
      

    </bug>

</bugzilla>