<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>40742</bug_id>
          
          <creation_ts>2010-06-16 15:34:40 -0700</creation_ts>
          <short_desc>WebCore crashes when removing a link element in a beforeload handler</short_desc>
          <delta_ts>2010-09-30 12:23:02 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>Page Loading</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>All</rep_platform>
          <op_sys>All</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>HasReduction, InRadar</keywords>
          <priority>P1</priority>
          <bug_severity>Major</bug_severity>
          <target_milestone>---</target_milestone>
          
          <blocked>43813</blocked>
          <everconfirmed>1</everconfirmed>
          <reporter name="Andy Estes">aestes</reporter>
          <assigned_to name="Andy Estes">aestes</assigned_to>
          <cc>aestes</cc>
    
    <cc>ap</cc>
    
    <cc>dglazkov</cc>
    
    <cc>eric</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>239117</commentid>
    <comment_count>0</comment_count>
      <attachid>58941</attachid>
    <who name="Andy Estes">aestes</who>
    <bug_when>2010-06-16 15:34:40 -0700</bug_when>
    <thetext>Created attachment 58941
test case

If a page has a beforeload handler that removes a stylesheet &lt;link&gt; element, WebCore will crash with the following backtrace:

Crash is in WebCore::Node::createRendererIfNeeded:

0   com.apple.WebCore             	0x00007fff8808d6bd WebCore::Node::createRendererIfNeeded() + 45
1   com.apple.WebCore             	0x00007fff8808d5a0 WebCore::Element::attach() + 32
2   com.apple.WebCore             	0x00007fff8808cbb1 WebCore::HTMLParser::insertNode(WebCore::Node*, bool) + 369
3   com.apple.WebCore             	0x00007fff88110fd4 WebCore::HTMLParser::parseToken(WebCore::Token*) + 868
4   com.apple.WebCore             	0x00007fff8808c621 WebCore::HTMLTokenizer::processToken() + 657
5   com.apple.WebCore             	0x00007fff8810d786 WebCore::HTMLTokenizer::parseTag(WebCore::SegmentedString&amp;, WebCore::HTMLTokenizer::State) + 4950
6   com.apple.WebCore             	0x00007fff8810bc60 WebCore::HTMLTokenizer::write(WebCore::SegmentedString const&amp;, bool) + 2720
7   com.apple.WebCore             	0x00007fff8826607e WebCore::HTMLTokenizer::executeExternalScriptsIfReady() + 1694
8   com.apple.WebCore             	0x00007fff882147fc WebCore::CachedScript::checkNotify() + 76
9   com.apple.WebCore             	0x00007fff881e9226 WebCore::Loader::Host::didFinishLoading(WebCore::SubresourceLoader*) + 358
10  com.apple.WebCore             	0x00007fff881e9021 WebCore::SubresourceLoader::didFinishLoading() + 49

The attached .html file demonstrates the crash.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>239118</commentid>
    <comment_count>1</comment_count>
    <who name="Andy Estes">aestes</who>
    <bug_when>2010-06-16 15:34:56 -0700</bug_when>
    <thetext>&lt;rdar://problem/8091385&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>239789</commentid>
    <comment_count>2</comment_count>
      <attachid>59074</attachid>
    <who name="Andy Estes">aestes</who>
    <bug_when>2010-06-18 00:30:21 -0700</bug_when>
    <thetext>Created attachment 59074
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>239795</commentid>
    <comment_count>3</comment_count>
      <attachid>59074</attachid>
    <who name="">mitz</who>
    <bug_when>2010-06-18 00:45:57 -0700</bug_when>
    <thetext>Comment on attachment 59074
Patch

&gt; +        Postpone loading of link elements until after they have been inserted into the DOM and
&gt; +        attached. This prevents mutation events triggered by beforeload handlers from firing in the
&gt; +        midst of DOM insertion, which can lead to assertion failures and crashes.

Is the problem here really the mutation events, or merely the fact that the beforeload handler mutates the DOM during insertion of the link element?

&gt; +void HTMLLinkElement::processCallback(Node* n)
&gt; +{
&gt; +    static_cast&lt;HTMLLinkElement*&gt;(n)-&gt;process();
&gt; +}

I would assert (or ASSERT_ARG) that n is a link element before casting it.

&gt; +	&lt;link rel=&quot;stylesheet&quot; href=&quot;&quot;&gt;

href=&quot;&quot; means that the base URL (the .html file in this case) will be loaded as the stylesheet in this case. Not a big deal, but perhaps href=&quot;data:text/css,&quot; is cleaner (if it doesn’t invalidate the test).</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>239796</commentid>
    <comment_count>4</comment_count>
    <who name="Andy Estes">aestes</who>
    <bug_when>2010-06-18 00:49:11 -0700</bug_when>
    <thetext>(In reply to comment #3)
&gt; (From update of attachment 59074 [details])
&gt; &gt; +        Postpone loading of link elements until after they have been inserted into the DOM and
&gt; &gt; +        attached. This prevents mutation events triggered by beforeload handlers from firing in the
&gt; &gt; +        midst of DOM insertion, which can lead to assertion failures and crashes.
&gt; 
&gt; Is the problem here really the mutation events, or merely the fact that the beforeload handler mutates the DOM during insertion of the link element?

You&apos;re right, &quot;mutation event&quot; is the wrong term to use.  I&apos;ll reword that before landing.

&gt; 
&gt; &gt; +void HTMLLinkElement::processCallback(Node* n)
&gt; &gt; +{
&gt; &gt; +    static_cast&lt;HTMLLinkElement*&gt;(n)-&gt;process();
&gt; &gt; +}
&gt; 
&gt; I would assert (or ASSERT_ARG) that n is a link element before casting it.

Will do.

&gt; 
&gt; &gt; +	&lt;link rel=&quot;stylesheet&quot; href=&quot;&quot;&gt;
&gt; 
&gt; href=&quot;&quot; means that the base URL (the .html file in this case) will be loaded as the stylesheet in this case. Not a big deal, but perhaps href=&quot;data:text/css,&quot; is cleaner (if it doesn’t invalidate the test).

Ahh, I didn&apos;t realize that.  I&apos;ll change that and re-test before landing.

Thanks for the review!</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>239907</commentid>
    <comment_count>5</comment_count>
      <attachid>59074</attachid>
    <who name="Darin Adler">darin</who>
    <bug_when>2010-06-18 07:33:19 -0700</bug_when>
    <thetext>Comment on attachment 59074
Patch

WebCore/html/HTMLLinkElement.cpp:234
 +  void HTMLLinkElement::processCallback(Node* n)
We typically use words for variable and argument names, not letters. So &quot;node&quot; would be preferred over &quot;n&quot;.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>240069</commentid>
    <comment_count>6</comment_count>
    <who name="Andy Estes">aestes</who>
    <bug_when>2010-06-18 12:03:55 -0700</bug_when>
    <thetext>http://trac.webkit.org/changeset/61424</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>240129</commentid>
    <comment_count>7</comment_count>
    <who name="Eric Seidel (no email)">eric</who>
    <bug_when>2010-06-18 14:08:47 -0700</bug_when>
    <thetext>Test appears to fail on Tiger.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>240137</commentid>
    <comment_count>8</comment_count>
    <who name="Andy Estes">aestes</who>
    <bug_when>2010-06-18 14:22:50 -0700</bug_when>
    <thetext>(In reply to comment #7)
&gt; Test appears to fail on Tiger.

The only test I see failing on Tiger is platform/mac/accessibility/inherited-presentational-lists.html.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>287732</commentid>
    <comment_count>9</comment_count>
    <who name="Eric Seidel (no email)">eric</who>
    <bug_when>2010-09-30 12:23:02 -0700</bug_when>
    <thetext>@ap: this seems like another symptom of StyleSheet&apos;s bad node-ownership design.  If you fix that, we may be able to remove this code.</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="0"
              isprivate="0"
          >
            <attachid>58941</attachid>
            <date>2010-06-16 15:34:40 -0700</date>
            <delta_ts>2010-06-16 15:34:40 -0700</delta_ts>
            <desc>test case</desc>
            <filename>beforeload_crash.html</filename>
            <type>text/html</type>
            <size>248</size>
            <attacher name="Andy Estes">aestes</attacher>
            
              <data encoding="base64">PGh0bWw+DQo8aGVhZD4NCiAgICA8c2NyaXB0Pg0KICAgICAgICBkb2N1bWVudC5hZGRFdmVudExp
c3RlbmVyKCJiZWZvcmVsb2FkIiwgZnVuY3Rpb24oZXZlbnQpIHsNCiAgICAgICAgICAgIGV2ZW50
LnRhcmdldC5wYXJlbnRFbGVtZW50LnJlbW92ZUNoaWxkKGV2ZW50LnRhcmdldCk7DQogICAgICAg
IH0sIHRydWUpOw0KICAgIDwvc2NyaXB0Pg0KCTxsaW5rIHJlbD0ic3R5bGVzaGVldCIgaHJlZj0i
Ij4NCjwvaGVhZD4NCjwvaHRtbD4=
</data>

          </attachment>
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>59074</attachid>
            <date>2010-06-18 00:30:21 -0700</date>
            <delta_ts>2010-06-18 07:33:19 -0700</delta_ts>
            <desc>Patch</desc>
            <filename>40742.patch</filename>
            <type>text/plain</type>
            <size>7785</size>
            <attacher name="Andy Estes">aestes</attacher>
            
              <data encoding="base64">SW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9n
CShyZXZpc2lvbiA2MTM4MykKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA
IC0xLDMgKzEsMzEgQEAKKzIwMTAtMDYtMTcgIEFuZHkgRXN0ZXMgIDxhZXN0ZXNAYXBwbGUuY29t
PgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIDxyZGFy
Oi8vcHJvYmxlbS84MDkxMzg1PiBQcmV2ZW50IGEgY3Jhc2ggaW4gV2ViQ29yZSB3aGVuIHJlbW92
aW5nIGEgc3R5bGVzaGVldCBsaW5rIGVsZW1lbnQgaW4KKyAgICAgICAgaW4gYSBsaXN0ZW5lciB0
byBpdHMgYmVmb3JlbG9hZCBldmVudC4KKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcv
c2hvd19idWcuY2dpP2lkPTQwNzQyCisgICAgICAgIAorICAgICAgICBQb3N0cG9uZSBsb2FkaW5n
IG9mIGxpbmsgZWxlbWVudHMgdW50aWwgYWZ0ZXIgdGhleSBoYXZlIGJlZW4gaW5zZXJ0ZWQgaW50
byB0aGUgRE9NIGFuZAorICAgICAgICBhdHRhY2hlZC4gVGhpcyBwcmV2ZW50cyBtdXRhdGlvbiBl
dmVudHMgdHJpZ2dlcmVkIGJ5IGJlZm9yZWxvYWQgaGFuZGxlcnMgZnJvbSBmaXJpbmcgaW4gdGhl
CisgICAgICAgIG1pZHN0IG9mIERPTSBpbnNlcnRpb24sIHdoaWNoIGNhbiBsZWFkIHRvIGFzc2Vy
dGlvbiBmYWlsdXJlcyBhbmQgY3Jhc2hlcy4KKworICAgICAgICBUZXN0OiBmYXN0L2RvbS9iZWZv
cmVsb2FkL3JlbW92ZS1saW5rLWluLWJlZm9yZWxvYWQtbGlzdGVuZXIuaHRtbAorCisgICAgICAg
ICogaHRtbC9IVE1MTGlua0VsZW1lbnQuY3BwOgorICAgICAgICAoV2ViQ29yZTo6SFRNTExpbmtF
bGVtZW50OjpIVE1MTGlua0VsZW1lbnQpOiBJbml0aWFsaXplIG1fc2hvdWxkUHJvY2Vzc0FmdGVy
QXR0YWNoIHRvIGZhbHNlLgorICAgICAgICAoV2ViQ29yZTo6SFRNTExpbmtFbGVtZW50Ojpwcm9j
ZXNzQ2FsbGJhY2spOiBBZGQgYSBzdGF0aWMgY2FsbGJhY2sgZnVuY3Rpb24gd2hpY2ggY2FsbHMK
KyAgICAgICAgSFRNTExpbmtFbGVtZW50Ojpwcm9jZXNzKCkuCisgICAgICAgIChXZWJDb3JlOjpI
VE1MTGlua0VsZW1lbnQ6Omluc2VydGVkSW50b0RvY3VtZW50KTogSW5zdGVhZCBvZiBjYWxsaW5n
IHByb2Nlc3MoKSBkaXJlY3RseSwgc2V0CisgICAgICAgIG1fc2hvdWxkUHJvY2Vzc0FmdGVyQXR0
YWNoIHRvIHRydWUgdG8gaW5kaWNhdGUgdGhhdCBwcm9jZXNzKCkgc2hvdWxkIGJlIGNhbGxlZCBh
ZnRlciBhdHRhY2goKS4KKyAgICAgICAgKFdlYkNvcmU6OkhUTUxMaW5rRWxlbWVudDo6cmVtb3Zl
ZEZyb21Eb2N1bWVudCk6IFNldCBtX3Nob3VsZFByb2Nlc3NBZnRlckF0dGFjaCB0byBmYWxzZS4K
KyAgICAgICAgKFdlYkNvcmU6OkhUTUxMaW5rRWxlbWVudDo6YXR0YWNoKTogSWYgbV9zaG91bGRQ
cm9jZXNzQWZ0ZXJBdHRhY2ggaXMgdHJ1ZSwgcmVnaXN0ZXIKKyAgICAgICAgSFRNTExpbmtFbGVt
ZW50Ojpwcm9jZXNzQ2FsbGJhY2soKSBhcyBhIHBvc3QtYXR0YWNoIGNhbGxiYWNrLgorICAgICAg
ICAqIGh0bWwvSFRNTExpbmtFbGVtZW50Lmg6IEFkZCBtX3Nob3VsZFByb2Nlc3NBZnRlckF0dGFj
aC4KKyAgICAgICAgKFdlYkNvcmU6OkhUTUxMaW5rRWxlbWVudDo6Y2FuTGF6eUF0dGFjaCk6IE92
ZXJyaWRlIGNhbkxhenlBdHRhY2goKSB0byByZXR1cm4gZmFsc2UgdG8KKyAgICAgICAgaW5kaWNh
dGUgdGhhdCBhIGZ1bGwgYXR0YWNoIHNob3VsZCBiZSBwZXJmb3JtZWQuICBUaGlzIGVuc3VyZXMg
dGhlIHBvc3QtYXR0YWNoIGNhbGxiYWNrcyBhcmUKKyAgICAgICAgZmlyZWQuCisKIDIwMTAtMDYt
MTcgIFJvYiBCdWlzICA8cndsYnVpc0BnbWFpbC5jb20+CiAKICAgICAgICAgUmV2aWV3ZWQgYnkg
RGF2ZSBIeWF0dC4KSW5kZXg6IFdlYkNvcmUvaHRtbC9IVE1MTGlua0VsZW1lbnQuY3BwCj09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT0KLS0tIFdlYkNvcmUvaHRtbC9IVE1MTGlua0VsZW1lbnQuY3BwCShyZXZpc2lvbiA2MTM4
MykKKysrIFdlYkNvcmUvaHRtbC9IVE1MTGlua0VsZW1lbnQuY3BwCSh3b3JraW5nIGNvcHkpCkBA
IC01MSw2ICs1MSw3IEBAIGlubGluZSBIVE1MTGlua0VsZW1lbnQ6OkhUTUxMaW5rRWxlbWVudCgK
ICAgICAsIG1fZGlzYWJsZWRTdGF0ZShVbnNldCkKICAgICAsIG1fbG9hZGluZyhmYWxzZSkKICAg
ICAsIG1fY3JlYXRlZEJ5UGFyc2VyKGNyZWF0ZWRCeVBhcnNlcikKKyAgICAsIG1fc2hvdWxkUHJv
Y2Vzc0FmdGVyQXR0YWNoKGZhbHNlKQogewogICAgIEFTU0VSVChoYXNUYWdOYW1lKGxpbmtUYWcp
KTsKIH0KQEAgLTIyOSwxMiArMjMwLDIyIEBAIHZvaWQgSFRNTExpbmtFbGVtZW50Ojpwcm9jZXNz
KCkKICAgICAgICAgZG9jdW1lbnQoKS0+dXBkYXRlU3R5bGVTZWxlY3RvcigpOwogICAgIH0KIH0K
KyAgICAKK3ZvaWQgSFRNTExpbmtFbGVtZW50Ojpwcm9jZXNzQ2FsbGJhY2soTm9kZSogbikKK3sK
KyAgICBzdGF0aWNfY2FzdDxIVE1MTGlua0VsZW1lbnQqPihuKS0+cHJvY2VzcygpOworfQogCiB2
b2lkIEhUTUxMaW5rRWxlbWVudDo6aW5zZXJ0ZWRJbnRvRG9jdW1lbnQoKQogewogICAgIEhUTUxF
bGVtZW50OjppbnNlcnRlZEludG9Eb2N1bWVudCgpOwogICAgIGRvY3VtZW50KCktPmFkZFN0eWxl
U2hlZXRDYW5kaWRhdGVOb2RlKHRoaXMsIG1fY3JlYXRlZEJ5UGFyc2VyKTsKLSAgICBwcm9jZXNz
KCk7CisKKyAgICAvLyBTaW5jZSBwcm9jZXNzaW5nIGEgc3R5bGVzaGVldCBsaW5rIGNhdXNlcyBh
IGJlZm9yZWxvYWQgZXZlbnQKKyAgICAvLyB0byBmaXJlLCBpdCBpcyBwb3NzaWJsZSBmb3IgSmF2
YVNjcmlwdCB0byByZW1vdmUgdGhlIGVsZW1lbnQgaW4gdGhlIG1pZHN0CisgICAgLy8gb2YgaXQg
YmVpbmcgaW5zZXJ0ZWQgaW50byB0aGUgRE9NLCB3aGljaCBjYW4gbGVhZCB0byBhc3NlcnRpb24g
ZXJyb3JzIG9yCisgICAgLy8gY3Jhc2hlcy4gQXZvaWQgdGhpcyBieSBwb3N0cG9uaW5nIHRoZSBi
ZWZvcmVsb2FkL2xvYWQgdW50aWwgYWZ0ZXIgYXR0YWNoLgorICAgIG1fc2hvdWxkUHJvY2Vzc0Fm
dGVyQXR0YWNoID0gdHJ1ZTsKIH0KIAogdm9pZCBIVE1MTGlua0VsZW1lbnQ6OnJlbW92ZWRGcm9t
RG9jdW1lbnQoKQpAQCAtMjQ2LDggKzI1NywyMCBAQCB2b2lkIEhUTUxMaW5rRWxlbWVudDo6cmVt
b3ZlZEZyb21Eb2N1bWVuCiAgICAgLy8gRklYTUU6IEl0J3MgdGVycmlibGUgdG8gZG8gYSBzeW5j
aHJvbm91cyB1cGRhdGUgb2YgdGhlIHN0eWxlIHNlbGVjdG9yIGp1c3QgYmVjYXVzZSBhIDxzdHls
ZT4gb3IgPGxpbms+IGVsZW1lbnQgZ290IHJlbW92ZWQuCiAgICAgaWYgKGRvY3VtZW50KCktPnJl
bmRlcmVyKCkpCiAgICAgICAgIGRvY3VtZW50KCktPnVwZGF0ZVN0eWxlU2VsZWN0b3IoKTsKKyAg
ICAKKyAgICBtX3Nob3VsZFByb2Nlc3NBZnRlckF0dGFjaCA9IGZhbHNlOwogfQogCit2b2lkIEhU
TUxMaW5rRWxlbWVudDo6YXR0YWNoKCkKK3sKKyAgICBpZiAobV9zaG91bGRQcm9jZXNzQWZ0ZXJB
dHRhY2gpIHsKKyAgICAgICAgbV9zaG91bGRQcm9jZXNzQWZ0ZXJBdHRhY2ggPSBmYWxzZTsKKyAg
ICAgICAgcXVldWVQb3N0QXR0YWNoQ2FsbGJhY2soJkhUTUxMaW5rRWxlbWVudDo6cHJvY2Vzc0Nh
bGxiYWNrLCB0aGlzKTsKKyAgICB9CisKKyAgICBIVE1MRWxlbWVudDo6YXR0YWNoKCk7Cit9Cisg
ICAgCiB2b2lkIEhUTUxMaW5rRWxlbWVudDo6ZmluaXNoUGFyc2luZ0NoaWxkcmVuKCkKIHsKICAg
ICBtX2NyZWF0ZWRCeVBhcnNlciA9IGZhbHNlOwpJbmRleDogV2ViQ29yZS9odG1sL0hUTUxMaW5r
RWxlbWVudC5oCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvaHRtbC9IVE1MTGlua0VsZW1lbnQuaAko
cmV2aXNpb24gNjEzODMpCisrKyBXZWJDb3JlL2h0bWwvSFRNTExpbmtFbGVtZW50LmgJKHdvcmtp
bmcgY29weSkKQEAgLTgxLDYgKzgxLDkgQEAgcHVibGljOgogICAgIGJvb2wgaXNEaXNhYmxlZCgp
IGNvbnN0IHsgcmV0dXJuIG1fZGlzYWJsZWRTdGF0ZSA9PSBEaXNhYmxlZDsgfQogICAgIGJvb2wg
aXNFbmFibGVkVmlhU2NyaXB0KCkgY29uc3QgeyByZXR1cm4gbV9kaXNhYmxlZFN0YXRlID09IEVu
YWJsZWRWaWFTY3JpcHQ7IH0KICAgICBib29sIGlzSWNvbigpIGNvbnN0IHsgcmV0dXJuIG1fcmVs
QXR0cmlidXRlLm1faXNJY29uOyB9CisgICAgCisgICAgdmlydHVhbCB2b2lkIGF0dGFjaCgpOwor
ICAgIHZpcnR1YWwgYm9vbCBjYW5MYXp5QXR0YWNoKCkgeyByZXR1cm4gZmFsc2U7IH0KIAogcHJp
dmF0ZToKICAgICB2aXJ0dWFsIEhUTUxUYWdTdGF0dXMgZW5kVGFnUmVxdWlyZW1lbnQoKSBjb25z
dCB7IHJldHVybiBUYWdTdGF0dXNGb3JiaWRkZW47IH0KQEAgLTg5LDYgKzkyLDcgQEAgcHJpdmF0
ZToKICAgICB2aXJ0dWFsIHZvaWQgcGFyc2VNYXBwZWRBdHRyaWJ1dGUoQXR0cmlidXRlKik7CiAK
ICAgICB2b2lkIHByb2Nlc3MoKTsKKyAgICBzdGF0aWMgdm9pZCBwcm9jZXNzQ2FsbGJhY2soTm9k
ZSopOwogCiAgICAgdmlydHVhbCB2b2lkIGluc2VydGVkSW50b0RvY3VtZW50KCk7CiAgICAgdmly
dHVhbCB2b2lkIHJlbW92ZWRGcm9tRG9jdW1lbnQoKTsKQEAgLTEwMiw3ICsxMDYsNyBAQCBwcml2
YXRlOgogICAgIHZvaWQgc2V0RGlzYWJsZWRTdGF0ZShib29sIF9kaXNhYmxlZCk7CiAKICAgICB2
aXJ0dWFsIGJvb2wgaXNVUkxBdHRyaWJ1dGUoQXR0cmlidXRlKikgY29uc3Q7Ci0gICAgCisKIHB1
YmxpYzoKICAgICBzdGF0aWMgdm9pZCB0b2tlbml6ZVJlbEF0dHJpYnV0ZShjb25zdCBBdG9taWNT
dHJpbmcmIHZhbHVlLCBSZWxBdHRyaWJ1dGUmKTsKIApAQCAtMTI5LDYgKzEzMyw3IEBAIHByaXZh
dGU6CiAgICAgUmVsQXR0cmlidXRlIG1fcmVsQXR0cmlidXRlOwogICAgIGJvb2wgbV9sb2FkaW5n
OwogICAgIGJvb2wgbV9jcmVhdGVkQnlQYXJzZXI7CisgICAgYm9vbCBtX3Nob3VsZFByb2Nlc3NB
ZnRlckF0dGFjaDsKIH07CiAKIH0gLy9uYW1lc3BhY2UKSW5kZXg6IExheW91dFRlc3RzL0NoYW5n
ZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9DaGFuZ2VMb2cJKHJldmlzaW9uIDYxMzgz
KQorKysgTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTQg
QEAKKzIwMTAtMDYtMTcgIEFuZHkgRXN0ZXMgIDxhZXN0ZXNAYXBwbGUuY29tPgorCisgICAgICAg
IFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIDxyZGFyOi8vcHJvYmxlbS84
MDkxMzg1PiBUZXN0IHRoYXQgcmVtb3ZpbmcgYSBzdHlsZXNoZWV0IGxpbmsgZWxlbWVudCBpbiBh
IGxpc3RlbmVyIHRvIGl0cworICAgICAgICBiZWZvcmVsb2FkIGV2ZW50IGRvZXMgbm90IGNyYXNo
IFdlYkNvcmUuCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9p
ZD00MDc0MgorCisgICAgICAgICogZmFzdC9kb20vYmVmb3JlbG9hZC9yZW1vdmUtbGluay1pbi1i
ZWZvcmVsb2FkLWxpc3RlbmVyLWV4cGVjdGVkLnR4dDogQWRkZWQuCisgICAgICAgICogZmFzdC9k
b20vYmVmb3JlbG9hZC9yZW1vdmUtbGluay1pbi1iZWZvcmVsb2FkLWxpc3RlbmVyLmh0bWw6IEFk
ZGVkLgorCiAyMDEwLTA2LTE3ICBSb2IgQnVpcyAgPHJ3bGJ1aXNAZ21haWwuY29tPgogCiAgICAg
ICAgIFJldmlld2VkIGJ5IERhdmUgSHlhdHQuCkluZGV4OiBMYXlvdXRUZXN0cy9mYXN0L2RvbS9i
ZWZvcmVsb2FkL3JlbW92ZS1saW5rLWluLWJlZm9yZWxvYWQtbGlzdGVuZXItZXhwZWN0ZWQudHh0
Cj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT0KLS0tIExheW91dFRlc3RzL2Zhc3QvZG9tL2JlZm9yZWxvYWQvcmVtb3ZlLWxp
bmstaW4tYmVmb3JlbG9hZC1saXN0ZW5lci1leHBlY3RlZC50eHQJKHJldmlzaW9uIDApCisrKyBM
YXlvdXRUZXN0cy9mYXN0L2RvbS9iZWZvcmVsb2FkL3JlbW92ZS1saW5rLWluLWJlZm9yZWxvYWQt
bGlzdGVuZXItZXhwZWN0ZWQudHh0CShyZXZpc2lvbiAwKQpAQCAtMCwwICsxLDMgQEAKK1RoaXMg
cGFnZSB0ZXN0cyB0aGF0IHlvdSBjYW4gY29ycmVjdGx5IHJlbW92ZSBhIHN0eWxlc2hlZXQgbGlu
ayBlbGVtZW50IGluIGl0cyBiZWZvcmVsb2FkIGxpc3RlbmVyIHdpdGhvdXQgY2F1c2luZyBhIGNy
YXNoLgorCitQQVNTCkluZGV4OiBMYXlvdXRUZXN0cy9mYXN0L2RvbS9iZWZvcmVsb2FkL3JlbW92
ZS1saW5rLWluLWJlZm9yZWxvYWQtbGlzdGVuZXIuaHRtbAo9PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRU
ZXN0cy9mYXN0L2RvbS9iZWZvcmVsb2FkL3JlbW92ZS1saW5rLWluLWJlZm9yZWxvYWQtbGlzdGVu
ZXIuaHRtbAkocmV2aXNpb24gMCkKKysrIExheW91dFRlc3RzL2Zhc3QvZG9tL2JlZm9yZWxvYWQv
cmVtb3ZlLWxpbmstaW4tYmVmb3JlbG9hZC1saXN0ZW5lci5odG1sCShyZXZpc2lvbiAwKQpAQCAt
MCwwICsxLDM0IEBACis8aHRtbD4KKzxoZWFkPgorICAgIDxzY3JpcHQ+CisgICAgICAgIGlmICh3
aW5kb3cubGF5b3V0VGVzdENvbnRyb2xsZXIpCisgICAgICAgICAgICBsYXlvdXRUZXN0Q29udHJv
bGxlci5kdW1wQXNUZXh0KCk7CisKKyAgICAgICAgZG9jdW1lbnQuYWRkRXZlbnRMaXN0ZW5lcigi
YmVmb3JlbG9hZCIsIGZ1bmN0aW9uKGV2ZW50KSB7CisgICAgICAgICAgICBldmVudC50YXJnZXQu
cGFyZW50RWxlbWVudC5yZW1vdmVDaGlsZChldmVudC50YXJnZXQpOworICAgICAgICB9LCB0cnVl
KTsKKyAgICA8L3NjcmlwdD4KKwk8bGluayByZWw9InN0eWxlc2hlZXQiIGhyZWY9IiI+Cis8L2hl
YWQ+Cis8Ym9keT4KKyAgICA8cD5UaGlzIHBhZ2UgdGVzdHMgdGhhdCB5b3UgY2FuIGNvcnJlY3Rs
eSByZW1vdmUgYSBzdHlsZXNoZWV0IGxpbmsgZWxlbWVudCBpbiBpdHMgYmVmb3JlbG9hZCBsaXN0
ZW5lciB3aXRob3V0IGNhdXNpbmcgYSBjcmFzaC48L3A+CisgICAgPGRpdiBpZD0iY29uc29sZSI+
PC9kaXY+CisgICAgPHNjcmlwdD4KKyAgICAgICAgZnVuY3Rpb24gcHJpbnQobWVzc2FnZSwgY29s
b3IpIAorICAgICAgICB7CisgICAgICAgICAgICB2YXIgcGFyYWdyYXBoID0gZG9jdW1lbnQuY3Jl
YXRlRWxlbWVudCgiZGl2Iik7CisgICAgICAgICAgICBwYXJhZ3JhcGguYXBwZW5kQ2hpbGQoZG9j
dW1lbnQuY3JlYXRlVGV4dE5vZGUobWVzc2FnZSkpOworICAgICAgICAgICAgcGFyYWdyYXBoLnN0
eWxlLmZvbnRGYW1pbHkgPSAibW9ub3NwYWNlIjsKKyAgICAgICAgICAgIGlmIChjb2xvcikKKyAg
ICAgICAgICAgICAgICBwYXJhZ3JhcGguc3R5bGUuY29sb3IgPSBjb2xvcjsKKyAgICAgICAgICAg
IGRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCJjb25zb2xlIikuYXBwZW5kQ2hpbGQocGFyYWdyYXBo
KTsKKyAgICAgICAgfQorICAgICAgICAKKyAgICAgICAgaWYgKGRvY3VtZW50LmdldEVsZW1lbnRz
QnlUYWdOYW1lKCJsaW5rIikubGVuZ3RoKQorICAgICAgICAgICAgcHJpbnQoIkZBSUwiLCAicmVk
Iik7CisgICAgICAgIGVsc2UKKyAgICAgICAgICAgIHByaW50KCJQQVNTIiwgImdyZWVuIik7Cisg
ICAgPC9zY3JpcHQ+Cis8L2JvZHk+Cis8L2h0bWw+CisK
</data>
<flag name="review"
          id="45700"
          type_id="1"
          status="+"
          setter="mitz"
    />
    <flag name="commit-queue"
          id="45701"
          type_id="3"
          status="-"
          setter="aestes"
    />
          </attachment>
      

    </bug>

</bugzilla>