47498 2010-10-11 12:01:10 -0700 Crash while processing ill-formed SVG with cycles. 2010-10-17 12:46:55 -0700 1 1 1 Unclassified WebKit SVG 528+ (Nightly build) All All RESOLVED FIXED P2 Normal --- 0 ctruta webkit-unassigned commit-queue krit mdelaney7 ossy webkit-ews zimmermann oldest_to_newest 292596 0 ctruta 2010-10-11 12:01:10 -0700 This is the Chromium issue 55521 http://code.google.com/p/chromium/issues/detail?id=55521 The SVG cycle solver crashes when processing input like the following: <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> <filter id="crash"> <textPath fill="url(#crash)"></textPath> </filter> </svg> This happens inside SVGResourcesCycleSolver::breakCycle, where the resourceType() is FilterResourceType, but the resource leading to cycle is in fact m_resources->fill(), not m_resources->filter(). The same crash occurs when replacing fill= with stroke=. In this case, the resource leading to cycle is m_resources->stroke() instead of m_resources->filter(). Here is a stack trace: *** ASSERTION FAILED: resourceLeadingToCycle == m_resources->filter() (third_party/WebKit/WebCore/rendering/SVGResourcesCycleSolver.cpp:197 void WebCore::SVGResourcesCycleSolver::breakCycle(WebCore::RenderSVGResourceContainer*)) WebCore::SVGResourcesCycleSolver::breakCycle() [0x146ca67] WebCore::SVGResourcesCycleSolver::resolveCycles() [0x146c69c] WebCore::SVGResourcesCache::addResourcesFromRenderObject() [0x1468a82] WebCore::SVGResourcesCache::clientUpdatedFromElement() [0x146900d] WebCore::RenderSVGInline::updateFromElement() [0x1516536] WebCore::SVGStyledElement::attach() [0x14cad16] WebCore::XMLDocumentParser::startElementNs() [0xfb274c] WebCore::startElementNsHandler() [0xfb37fb] ... WebKit also crashes upon encountering other attributes (like clip= and mask=), but that happens in an entirely different place, inside SVGRenderSupport::layoutChildren. Here is a stack trace: *** SHOULD NEVER BE REACHED (third_party/WebKit/WebCore/rendering/RenderInline.h:104 virtual void WebCore::RenderInline::layout()) WebCore::RenderInline::layout() [0x123e51c] WebCore::SVGRenderSupport::layoutChildren() [0x145b4ed] WebCore::RenderSVGHiddenContainer::layout() [0x151725d] WebCore::RenderSVGResourceContainer::layout() [0x14e92fe] WebCore::SVGRenderSupport::layoutChildren() [0x145b4ed] WebCore::RenderSVGRoot::layout() [0x14f828f] WebCore::RenderBlock::layoutBlockChild() [0x11d30bd] WebCore::RenderBlock::layoutBlockChildren() [0x11d2c44] WebCore::RenderBlock::layoutBlock() [0x11d03ab] WebCore::RenderBlock::layout() [0x11cfcc2] WebCore::RenderView::layout() [0x12c7cf5] WebCore::FrameView::layout() [0x115e381] WebCore::Document::implicitClose() [0xf19084] WebCore::FrameLoader::checkCallImplicitClose() [0x10def33] WebCore::FrameLoader::checkCompleted() [0x10ded06] WebCore::FrameLoader::finishedParsing() [0x10dea75] WebCore::Document::finishedParsing() [0xf21520] WebCore::XMLDocumentParser::end() [0xfae37f] WebCore::XMLDocumentParser::finish() [0xfae3b8] WebCore::Document::finishParsing() [0xf194ee] WebCore::DocumentWriter::endIfNotLoadingMainResource() [0x10d943d] WebCore::DocumentWriter::end() [0x10d9393] WebCore::DocumentLoader::finishedLoading() [0x10cf397] WebCore::FrameLoader::finishedLoading() [0x10e5281] WebCore::MainResourceLoader::didFinishLoading() [0x10f62cb] WebCore::ResourceLoader::didFinishLoading() [0x1101b57] WebCore::ResourceHandleInternal::didFinishLoading() [0x19ccd8c] 293059 1 ctruta 2010-10-12 12:37:37 -0700 Below is the cycle solver's debug output, obtained from running the test case with DEBUG_CYCLE_DETECTION set to 1. Before cycle detection: -> this=0x7ffbb1d073f0, SVGResources(renderer=0x7ffbb1cd5f18, node=0x7ffbb1d1e1c0) | DOM Tree: #document 0x7ffbc78a9400 svg 0x7ffbb3bdb6c0 #text 0x7ffbb3bf4ba0 "\n" filter 0x7ffbb1d23c00 #text 0x7ffbb3bf4b40 "\n" * textPath 0x7ffbb1d1e1c0 | List of resources: |-> Fill : 0x7ffbb41333d8 (node=0x7ffbb1d23c00) Detecting wheter any resources references any of following objects: Local resources: |> RenderSVGResourceFilter: object=0x7ffbb41333d8 (node=0x7ffbb1d23c00) Parent resources: |> RenderSVGResourceFilter: object=0x7ffbb41333d8 (node=0x7ffbb1d23c00) ASSERTION FAILED: resourceLeadingToCycle == m_resources->filter() (third_party/WebKit/WebCore/rendering/SVGResourcesCycleSolver.cpp:197 void WebCore::SVGResourcesCycleSolver::breakCycle(WebCore::RenderSVGResourceContainer*)) Segmentation fault 293069 2 ctruta 2010-10-12 12:50:09 -0700 Here is what happens, according to Niko's interpretation of the debug output: It's processing the <textPath>, and it has "Fill" set to the filter element. That should be avoided, in advance. The failing ASSERT is placed correctly. We shouldn't store a fill resource pointing to a filter at all. Only linear/radialGradients/patterns should be allowed as fill/stroke: only clip as clipper, only mask as masker, only filter as filter. That's just missing. It should be easy to patch into SVGResources::buildCachedResources. Once that is fixed, the cycle detection logic won't run at all for these cases in "static inline RenderSVGResourceContainer* paintingResourceFromSVGPaint(Document* document, SVGPaint* paint, AtomicString& id, bool& hasPendingResource)" There's the getRenderSVGResourceContainerById() call that returns the filter here. We should check if the resource type is lingrad/radgrad or pattern. If it's not the container, it should be nulled. 294533 3 70819 ctruta 2010-10-14 19:11:02 -0700 Created attachment 70819 First attempt to fix I'm submitting this patch to ask for review and advice only, without a test, a ChangeLog entry, or an intention to commit. I am checking the resource type inside paintingResourceFromSVGPaint, instead of doing this inside buildCachedResources. The other alternative would have required doing the same check, two times: once for fill, and once for stroke. The patch also contains a series of ASSERT's that I consider useful. But this seems not to be sufficient, as the code still crashes inside RenderInline::layout. I'm probably missing a node that should be set to NULL, but I don't know where exactly should I do that. Since the filter has been invalidated, nothing should be rendered. I think there are some children at a point where shouldn't be. It is worth mentioning that the crash after applying the patch is the same, regardless what attribute (clip=, fill=, mask=, stroke=) is being used. I believe the patch that I'm submitting does solve the initialization issue discussed in comment #2, but there is another lingering issue that's causing grief. I also believe that the fix to do for the remaining issue will resolve the behavior of all of these attributes. 294534 4 webkit-ews 2010-10-14 19:19:36 -0700 Attachment 70819 did not build on qt: Build output: http://queues.webkit.org/results/4465036 294535 5 ctruta 2010-10-14 19:24:14 -0700 Here is the stack trace that comes from running the test case with <textPath clip=...> and <textPath mask=...> under the original WebKit, which is the same as the stack trace that comes from running the test case with <textPath fill=...> and <textPath stroke=...> under the WebKit patched with what I've just submitted for review. SHOULD NEVER BE REACHED (third_party/WebKit/WebCore/rendering/RenderInline.h:104 virtual void WebCore::RenderInline::layout()) [21085:21085:1752502611133:ERROR:base/process_util_posix.cc(105)] Received signal 11 StackTrace::StackTrace() [0x5a6e38] base::(anonymous namespace)::StackDumpSignalHandler() [0x55a461] 0x7f8b18510530 WebCore::RenderInline::layout() [0x123e51c] WebCore::SVGRenderSupport::layoutChildren() [0x145b4ed] WebCore::RenderSVGHiddenContainer::layout() [0x1517565] WebCore::RenderSVGResourceContainer::layout() [0x14e9606] WebCore::SVGRenderSupport::layoutChildren() [0x145b4ed] WebCore::RenderSVGRoot::layout() [0x14f8597] WebCore::RenderBlock::layoutBlockChild() [0x11d30bd] WebCore::RenderBlock::layoutBlockChildren() [0x11d2c44] WebCore::RenderBlock::layoutBlock() [0x11d03ab] WebCore::RenderBlock::layout() [0x11cfcc2] WebCore::RenderView::layout() [0x12c7cf5] WebCore::FrameView::layout() [0x115e381] WebCore::Document::implicitClose() [0xf19084] WebCore::FrameLoader::checkCallImplicitClose() [0x10def33] WebCore::FrameLoader::checkCompleted() [0x10ded06] WebCore::FrameLoader::finishedParsing() [0x10dea75] WebCore::Document::finishedParsing() [0xf21520] WebCore::XMLDocumentParser::end() [0xfae37f] WebCore::XMLDocumentParser::finish() [0xfae3b8] WebCore::Document::finishParsing() [0xf194ee] WebCore::DocumentWriter::endIfNotLoadingMainResource() [0x10d943d] WebCore::DocumentWriter::end() [0x10d9393] WebCore::DocumentLoader::finishedLoading() [0x10cf397] WebCore::FrameLoader::finishedLoading() [0x10e5281] WebCore::MainResourceLoader::didFinishLoading() [0x10f62cb] WebCore::ResourceLoader::didFinishLoading() [0x1101b57] WebCore::ResourceHandleInternal::didFinishLoading() [0x19cd094] ... 294536 6 ctruta 2010-10-14 19:28:14 -0700 (In reply to comment #4) > Attachment 70819 [details] did not build on qt: > Build output: http://queues.webkit.org/results/4465036 The build dies with "unused variable" warnings-as-errors. I must surround the ASSERT's with #ifndef NDEBUG guards. 294596 7 70819 ossy 2010-10-14 23:29:12 -0700 Comment on attachment 70819 First attempt to fix View in context: https://bugs.webkit.org/attachment.cgi?id=70819&action=review I'm not familiar with SVG, so I can't review the logic of the patch. r- due to build error > WebCore/rendering/SVGResources.cpp:453 > + RenderSVGResourceType resourceType = clipper->resourceType(); > + ASSERT(resourceType == ClipperResourceType); > + To avoid "unused variable" warning(error), you should use ASSERT_UNUSED, or don't use a new local variable. But I propose avoiding unnecessary local variable, which is dead code in relase mode: ASSERT(clipper->resourceType() == ClipperResourceType); > WebCore/rendering/SVGResources.cpp:476 > + RenderSVGResourceType resourceType = filter->resourceType(); > + ASSERT(resourceType == FilterResourceType); > + ditto > WebCore/rendering/SVGResources.cpp:498 > + RenderSVGResourceType resourceType = markerStart->resourceType(); > + ASSERT(resourceType == MarkerResourceType); ditto > WebCore/rendering/SVGResources.cpp:520 > + RenderSVGResourceType resourceType = markerMid->resourceType(); > + ASSERT(resourceType == MarkerResourceType); ditto > WebCore/rendering/SVGResources.cpp:542 > + RenderSVGResourceType resourceType = markerEnd->resourceType(); > + ASSERT(resourceType == MarkerResourceType); ditto > WebCore/rendering/SVGResources.cpp:564 > + RenderSVGResourceType resourceType = masker->resourceType(); > + ASSERT(resourceType == MaskerResourceType); ditto > WebCore/rendering/SVGResources.cpp:586 > + RenderSVGResourceType resourceType = fill->resourceType(); > + ASSERT(resourceType == PatternResourceType || resourceType == LinearGradientResourceType || resourceType == RadialGradientResourceType); ditto > WebCore/rendering/SVGResources.cpp:608 > + RenderSVGResourceType resourceType = stroke->resourceType(); > + ASSERT(resourceType == PatternResourceType || resourceType == LinearGradientResourceType || resourceType == RadialGradientResourceType); ditto 294650 8 70819 zimmermann 2010-10-15 02:15:25 -0700 Comment on attachment 70819 First attempt to fix View in context: https://bugs.webkit.org/attachment.cgi?id=70819&action=review > WebCore/rendering/SVGResources.cpp:166 > + RenderSVGResourceType resourceType = container->resourceType(); > + if (resourceType == PatternResourceType || resourceType == LinearGradientResourceType || resourceType == RadialGradientResourceType) > + return container; This is dangerous, if the type doesn't match, it will now set hasPendingResource to true, before returning 0. It's not a pending resource, it's just wrong resource type. So should definately add a "return 0" right after the "return container" statement, in case the types don't match. > WebCore/rendering/SVGResources.cpp:475 > + ASSERT(resourceType == FilterResourceType); These asserts are really helpful, but there's no need to store them in a local variable, that would also save ossys suggestion to add ASSERT_UNUSED. Just use ASSERT(filter->resourceType() == FilterResourceType). 294651 9 zimmermann 2010-10-15 02:16:08 -0700 (In reply to comment #8) > These asserts are really helpful, but there's no need to store them in a local variable, that would also save ossys suggestion to add ASSERT_UNUSED. > Just use ASSERT(filter->resourceType() == FilterResourceType). Just realized this was already suggested by Ossy, sorry :-) 294654 10 zimmermann 2010-10-15 02:25:37 -0700 The ASSERTION that you see, with RenderInline, is easy to reproduce: <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> <textPath/> </svg> It's _only_ textPath related. Your patch should fix the assertion for: <filter id="foo"> <rect fill="url(#foo)"/> </filter> This testcase already works as expected <filter id="foo"> <rect mask="url(#foo)"/> </filter> Same for clip, etc. The RenderInline assertion also happens for <svg><tspan/></svg>, and <tref>. All renderers that inherit from RenderSVGInline are affected. These are all elements that aren't allowed to appear without a <text> parent. It's embarassing we still have bugs like this! It needs to be fixed in the DOM, I'm just looking at it. 294662 11 zimmermann 2010-10-15 02:41:03 -0700 Okay, it's quite easy to fix: Let's check the specs content model (only showing relevant text elements now): <text> may contain: 'a', ‘altGlyph’, ‘textPath’, ‘tref’, ‘tspan’ <tspan> may contain: 'a', 'altGlyph', 'tref', 'tspan' <tref> may contain: nothing <textPath> may contain: 'a', 'tref', 'tspan' <altGlyph> may contain: any element or character data "SVGTextElement::childShouldCreateRenderer(Node* node) const" has to be added, which checks wheter the passed in node tagName is 'a', 'altGlyph', 'textPath', 'tref', 'tspan'. These are the only children which are supposed to create renderers within a <text> subtree. The same should be added for SVGTSpanElement, checking for 'a', 'altGlyph', 'tref' and 'tspan', and SVGTextPathElement, checking for 'a', 'tref' and 'tspan'. This way we assure only the right elements create renderers within a <text> subtree. The second step to solve the problem is to add "bool rendererIsNeeded(RenderStyle*)" methods to SVGTSpanElement, SVGTRefElement and SVGTextPathElement, that check wheter the _parentNode()_ has the right tag name. (see SVGGElement::rendererIsNeeded as example). SVGTSpanElement needs to check wheter its parent is 'textPath' or 'text' or 'tspan' or 'altGlyph'. SVGTRefElement needs to check wheter its parent is 'textPath' or 'text' or 'tspan' or 'altGlyph'. SVGTextPathElement needs to check wheter its parent is 'text'. This will get rid of the assertion that you see. Combined with your attached test, this will solve the problem completly. Good luck! :-) 295068 12 ctruta 2010-10-15 17:57:51 -0700 I opened the bug 47759 "Crash while processing ill-formed <textPath> ouside of <text>" to continue the work on <textPath>, and I am submitting a patch and layout test that is restricted to fixing the checks on invalid resources. 295082 13 70939 ctruta 2010-10-15 18:24:29 -0700 Created attachment 70939 Fix and layout test One step at a time. To be continued in bug 47759. 295259 14 70939 zimmermann 2010-10-17 12:32:20 -0700 Comment on attachment 70939 Fix and layout test Good job, r=me. 295268 15 70939 commit-queue 2010-10-17 12:46:48 -0700 Comment on attachment 70939 Fix and layout test Clearing flags on attachment: 70939 Committed r69927: <http://trac.webkit.org/changeset/69927> 295270 16 commit-queue 2010-10-17 12:46:55 -0700 All reviewed patches have been landed. Closing bug. 70819 2010-10-14 19:11:02 -0700 2010-10-15 18:24:29 -0700 First attempt to fix patch1.diff text/plain 3786 ctruta ZGlmZiAtLWdpdCBhL1dlYkNvcmUvcmVuZGVyaW5nL1NWR1Jlc291cmNlcy5jcHAgYi9XZWJDb3Jl L3JlbmRlcmluZy9TVkdSZXNvdXJjZXMuY3BwCmluZGV4IDc5OTMwMWIuLmZlZWU5ZTggMTAwNjQ0 Ci0tLSBhL1dlYkNvcmUvcmVuZGVyaW5nL1NWR1Jlc291cmNlcy5jcHAKKysrIGIvV2ViQ29yZS9y ZW5kZXJpbmcvU1ZHUmVzb3VyY2VzLmNwcApAQCAtMTYwLDggKzE2MCwxMSBAQCBzdGF0aWMgaW5s aW5lIFJlbmRlclNWR1Jlc291cmNlQ29udGFpbmVyKiBwYWludGluZ1Jlc291cmNlRnJvbVNWR1Bh aW50KERvY3VtZW50KgogICAgICAgICByZXR1cm4gMDsKIAogICAgIGlkID0gU1ZHVVJJUmVmZXJl bmNlOjpnZXRUYXJnZXQocGFpbnQtPnVyaSgpKTsKLSAgICBpZiAoUmVuZGVyU1ZHUmVzb3VyY2VD b250YWluZXIqIGNvbnRhaW5lciA9IGdldFJlbmRlclNWR1Jlc291cmNlQ29udGFpbmVyQnlJZChk b2N1bWVudCwgaWQpKQotICAgICAgICByZXR1cm4gY29udGFpbmVyOworICAgIGlmIChSZW5kZXJT VkdSZXNvdXJjZUNvbnRhaW5lciogY29udGFpbmVyID0gZ2V0UmVuZGVyU1ZHUmVzb3VyY2VDb250 YWluZXJCeUlkKGRvY3VtZW50LCBpZCkpIHsKKyAgICAgICAgUmVuZGVyU1ZHUmVzb3VyY2VUeXBl IHJlc291cmNlVHlwZSA9IGNvbnRhaW5lci0+cmVzb3VyY2VUeXBlKCk7CisgICAgICAgIGlmIChy ZXNvdXJjZVR5cGUgPT0gUGF0dGVyblJlc291cmNlVHlwZSB8fCByZXNvdXJjZVR5cGUgPT0gTGlu ZWFyR3JhZGllbnRSZXNvdXJjZVR5cGUgfHwgcmVzb3VyY2VUeXBlID09IFJhZGlhbEdyYWRpZW50 UmVzb3VyY2VUeXBlKQorICAgICAgICAgICAgcmV0dXJuIGNvbnRhaW5lcjsKKyAgICB9CiAKICAg ICBoYXNQZW5kaW5nUmVzb3VyY2UgPSB0cnVlOwogICAgIHJldHVybiAwOwpAQCAtNDQ1LDYgKzQ0 OCw5IEBAIGJvb2wgU1ZHUmVzb3VyY2VzOjpzZXRDbGlwcGVyKFJlbmRlclNWR1Jlc291cmNlQ2xp cHBlciogY2xpcHBlcikKICAgICBpZiAoIWNsaXBwZXIpCiAgICAgICAgIHJldHVybiBmYWxzZTsK IAorICAgIFJlbmRlclNWR1Jlc291cmNlVHlwZSByZXNvdXJjZVR5cGUgPSBjbGlwcGVyLT5yZXNv dXJjZVR5cGUoKTsKKyAgICBBU1NFUlQocmVzb3VyY2VUeXBlID09IENsaXBwZXJSZXNvdXJjZVR5 cGUpOworCiAgICAgaWYgKCFtX2NsaXBwZXJGaWx0ZXJNYXNrZXJEYXRhKQogICAgICAgICBtX2Ns aXBwZXJGaWx0ZXJNYXNrZXJEYXRhID0gQ2xpcHBlckZpbHRlck1hc2tlckRhdGE6OmNyZWF0ZSgp OwogCkBAIC00NjUsNiArNDcxLDkgQEAgYm9vbCBTVkdSZXNvdXJjZXM6OnNldEZpbHRlcihSZW5k ZXJTVkdSZXNvdXJjZUZpbHRlciogZmlsdGVyKQogICAgIGlmICghZmlsdGVyKQogICAgICAgICBy ZXR1cm4gZmFsc2U7CiAKKyAgICBSZW5kZXJTVkdSZXNvdXJjZVR5cGUgcmVzb3VyY2VUeXBlID0g ZmlsdGVyLT5yZXNvdXJjZVR5cGUoKTsKKyAgICBBU1NFUlQocmVzb3VyY2VUeXBlID09IEZpbHRl clJlc291cmNlVHlwZSk7CisKICAgICBpZiAoIW1fY2xpcHBlckZpbHRlck1hc2tlckRhdGEpCiAg ICAgICAgIG1fY2xpcHBlckZpbHRlck1hc2tlckRhdGEgPSBDbGlwcGVyRmlsdGVyTWFza2VyRGF0 YTo6Y3JlYXRlKCk7CiAKQEAgLTQ4NSw2ICs0OTQsOSBAQCBib29sIFNWR1Jlc291cmNlczo6c2V0 TWFya2VyU3RhcnQoUmVuZGVyU1ZHUmVzb3VyY2VNYXJrZXIqIG1hcmtlclN0YXJ0KQogICAgIGlm ICghbWFya2VyU3RhcnQpCiAgICAgICAgIHJldHVybiBmYWxzZTsKIAorICAgIFJlbmRlclNWR1Jl c291cmNlVHlwZSByZXNvdXJjZVR5cGUgPSBtYXJrZXJTdGFydC0+cmVzb3VyY2VUeXBlKCk7Cisg ICAgQVNTRVJUKHJlc291cmNlVHlwZSA9PSBNYXJrZXJSZXNvdXJjZVR5cGUpOworCiAgICAgaWYg KCFtX21hcmtlckRhdGEpCiAgICAgICAgIG1fbWFya2VyRGF0YSA9IE1hcmtlckRhdGE6OmNyZWF0 ZSgpOwogCkBAIC01MDQsNiArNTE2LDkgQEAgYm9vbCBTVkdSZXNvdXJjZXM6OnNldE1hcmtlck1p ZChSZW5kZXJTVkdSZXNvdXJjZU1hcmtlciogbWFya2VyTWlkKQogICAgIGlmICghbWFya2VyTWlk KQogICAgICAgICByZXR1cm4gZmFsc2U7CiAKKyAgICBSZW5kZXJTVkdSZXNvdXJjZVR5cGUgcmVz b3VyY2VUeXBlID0gbWFya2VyTWlkLT5yZXNvdXJjZVR5cGUoKTsKKyAgICBBU1NFUlQocmVzb3Vy Y2VUeXBlID09IE1hcmtlclJlc291cmNlVHlwZSk7CisKICAgICBpZiAoIW1fbWFya2VyRGF0YSkK ICAgICAgICAgbV9tYXJrZXJEYXRhID0gTWFya2VyRGF0YTo6Y3JlYXRlKCk7CiAKQEAgLTUyMyw2 ICs1MzgsOSBAQCBib29sIFNWR1Jlc291cmNlczo6c2V0TWFya2VyRW5kKFJlbmRlclNWR1Jlc291 cmNlTWFya2VyKiBtYXJrZXJFbmQpCiAgICAgaWYgKCFtYXJrZXJFbmQpCiAgICAgICAgIHJldHVy biBmYWxzZTsKIAorICAgIFJlbmRlclNWR1Jlc291cmNlVHlwZSByZXNvdXJjZVR5cGUgPSBtYXJr ZXJFbmQtPnJlc291cmNlVHlwZSgpOworICAgIEFTU0VSVChyZXNvdXJjZVR5cGUgPT0gTWFya2Vy UmVzb3VyY2VUeXBlKTsKKwogICAgIGlmICghbV9tYXJrZXJEYXRhKQogICAgICAgICBtX21hcmtl ckRhdGEgPSBNYXJrZXJEYXRhOjpjcmVhdGUoKTsKIApAQCAtNTQyLDYgKzU2MCw5IEBAIGJvb2wg U1ZHUmVzb3VyY2VzOjpzZXRNYXNrZXIoUmVuZGVyU1ZHUmVzb3VyY2VNYXNrZXIqIG1hc2tlcikK ICAgICBpZiAoIW1hc2tlcikKICAgICAgICAgcmV0dXJuIGZhbHNlOwogCisgICAgUmVuZGVyU1ZH UmVzb3VyY2VUeXBlIHJlc291cmNlVHlwZSA9IG1hc2tlci0+cmVzb3VyY2VUeXBlKCk7CisgICAg QVNTRVJUKHJlc291cmNlVHlwZSA9PSBNYXNrZXJSZXNvdXJjZVR5cGUpOworCiAgICAgaWYgKCFt X2NsaXBwZXJGaWx0ZXJNYXNrZXJEYXRhKQogICAgICAgICBtX2NsaXBwZXJGaWx0ZXJNYXNrZXJE YXRhID0gQ2xpcHBlckZpbHRlck1hc2tlckRhdGE6OmNyZWF0ZSgpOwogCkBAIC01NjEsNiArNTgy LDkgQEAgYm9vbCBTVkdSZXNvdXJjZXM6OnNldEZpbGwoUmVuZGVyU1ZHUmVzb3VyY2VDb250YWlu ZXIqIGZpbGwpCiAgICAgaWYgKCFmaWxsKQogICAgICAgICByZXR1cm4gZmFsc2U7CiAKKyAgICBS ZW5kZXJTVkdSZXNvdXJjZVR5cGUgcmVzb3VyY2VUeXBlID0gZmlsbC0+cmVzb3VyY2VUeXBlKCk7 CisgICAgQVNTRVJUKHJlc291cmNlVHlwZSA9PSBQYXR0ZXJuUmVzb3VyY2VUeXBlIHx8IHJlc291 cmNlVHlwZSA9PSBMaW5lYXJHcmFkaWVudFJlc291cmNlVHlwZSB8fCByZXNvdXJjZVR5cGUgPT0g UmFkaWFsR3JhZGllbnRSZXNvdXJjZVR5cGUpOworCiAgICAgaWYgKCFtX2ZpbGxTdHJva2VEYXRh KQogICAgICAgICBtX2ZpbGxTdHJva2VEYXRhID0gRmlsbFN0cm9rZURhdGE6OmNyZWF0ZSgpOwog CkBAIC01ODAsNiArNjA0LDkgQEAgYm9vbCBTVkdSZXNvdXJjZXM6OnNldFN0cm9rZShSZW5kZXJT VkdSZXNvdXJjZUNvbnRhaW5lciogc3Ryb2tlKQogICAgIGlmICghc3Ryb2tlKQogICAgICAgICBy ZXR1cm4gZmFsc2U7CiAKKyAgICBSZW5kZXJTVkdSZXNvdXJjZVR5cGUgcmVzb3VyY2VUeXBlID0g c3Ryb2tlLT5yZXNvdXJjZVR5cGUoKTsKKyAgICBBU1NFUlQocmVzb3VyY2VUeXBlID09IFBhdHRl cm5SZXNvdXJjZVR5cGUgfHwgcmVzb3VyY2VUeXBlID09IExpbmVhckdyYWRpZW50UmVzb3VyY2VU eXBlIHx8IHJlc291cmNlVHlwZSA9PSBSYWRpYWxHcmFkaWVudFJlc291cmNlVHlwZSk7CisKICAg ICBpZiAoIW1fZmlsbFN0cm9rZURhdGEpCiAgICAgICAgIG1fZmlsbFN0cm9rZURhdGEgPSBGaWxs U3Ryb2tlRGF0YTo6Y3JlYXRlKCk7CiAK 70939 2010-10-15 18:24:29 -0700 2010-10-17 12:46:48 -0700 Fix and layout test wk47498.diff.submit text/plain 6576 ctruta ZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL0NoYW5nZUxvZyBiL0xheW91dFRlc3RzL0NoYW5nZUxv ZwppbmRleCA1ODZiYWRjLi40NmZiMjcxIDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9DaGFuZ2VM b2cKKysrIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTYgQEAKKzIwMTAtMTAt MTUgIENvc21pbiBUcnV0YSAgPGN0cnV0YUBjaHJvbWl1bS5vcmc+CisKKyAgICAgICAgUmV2aWV3 ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgQ3Jhc2ggd2hpbGUgcHJvY2Vzc2luZyBp bGwtZm9ybWVkIFNWRyB3aXRoIGN5Y2xlcworICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9y Zy9zaG93X2J1Zy5jZ2k/aWQ9NDc0OTgKKworICAgICAgICBDaGVja2VkIHRoZSBiZWhhdmlvciBv ZiB0aGUgYXR0cmlidXRlcyBmaWxsLCBzdHJva2UsIGNsaXAgYW5kIG1hc2sKKyAgICAgICAgd2hl biB1c2VkIHdpdGggVVJMcyB0aGF0IHBvaW50IHRvIHdyb25nIGVsZW1lbnRzLgorCisgICAgICAg ICogc3ZnL2N1c3RvbS9pbnZhbGlkLXBhaW50LXNoYXBlLW1hc2suc3ZnOiBBZGRlZC4KKyAgICAg ICAgKiBzdmcvY3VzdG9tL2ludmFsaWQtcGFpbnQtc2hhcGUtbWFzay1leHBlY3RlZC5zdmc6IEFk ZGVkLgorCiAyMDEwLTEwLTE1ICBBbGV4ZXkgUHJvc2t1cnlha292ICA8YXBAYXBwbGUuY29tPgog CiAgICAgICAgIFJldmlld2VkIGJ5IERhcmluIEFkbGVyLgpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVz dHMvc3ZnL2N1c3RvbS9pbnZhbGlkLXBhaW50LXNoYXBlLW1hc2stZXhwZWN0ZWQudHh0IGIvTGF5 b3V0VGVzdHMvc3ZnL2N1c3RvbS9pbnZhbGlkLXBhaW50LXNoYXBlLW1hc2stZXhwZWN0ZWQudHh0 Cm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAuLjk2YjkxM2IKLS0tIC9kZXYvbnVs bAorKysgYi9MYXlvdXRUZXN0cy9zdmcvY3VzdG9tL2ludmFsaWQtcGFpbnQtc2hhcGUtbWFzay1l eHBlY3RlZC50eHQKQEAgLTAsMCArMSBAQAorVGhpcyBzaG91bGQgbm90IGNyYXNoLgpkaWZmIC0t Z2l0IGEvTGF5b3V0VGVzdHMvc3ZnL2N1c3RvbS9pbnZhbGlkLXBhaW50LXNoYXBlLW1hc2suc3Zn IGIvTGF5b3V0VGVzdHMvc3ZnL2N1c3RvbS9pbnZhbGlkLXBhaW50LXNoYXBlLW1hc2suc3ZnCm5l dyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAuLmNjZGI0NjEKLS0tIC9kZXYvbnVsbAor KysgYi9MYXlvdXRUZXN0cy9zdmcvY3VzdG9tL2ludmFsaWQtcGFpbnQtc2hhcGUtbWFzay5zdmcK QEAgLTAsMCArMSwyMyBAQAorPHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmci IHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIj4KKworPHNjcmlwdD4K KyAgICBpZiAod2luZG93LmxheW91dFRlc3RDb250cm9sbGVyKQorICAgICAgICBsYXlvdXRUZXN0 Q29udHJvbGxlci5kdW1wQXNUZXh0KCk7Cis8L3NjcmlwdD4KKworPGZpbHRlciBpZD0iaW52YWxp ZF9wYWludCI+CisgICAgPHJlY3Qgd2lkdGg9IjEwIiBoZWlnaHQ9IjEwIiBmaWxsPSJ1cmwoI2lu dmFsaWRfcGFpbnQpIi8+CisgICAgPHJlY3Qgd2lkdGg9IjEwIiBoZWlnaHQ9IjEwIiBzdHJva2U9 InVybCgjaW52YWxpZF9wYWludCkiLz4KKzwvZmlsdGVyPgorCis8ZmlsdGVyIGlkPSJpbnZhbGlk X3NoYXBlIj4KKyAgICA8cmVjdCB3aWR0aD0iMTAiIGhlaWdodD0iMTAiIGNsaXA9InVybCgjaW52 YWxpZF9zaGFwZSkiLz4KKzwvZmlsdGVyPgorCis8ZmlsdGVyIGlkPSJpbnZhbGlkX21hc2siPgor ICAgIDxyZWN0IHdpZHRoPSIxMCIgaGVpZ2h0PSIxMCIgbWFzaz0idXJsKCNpbnZhbGlkX21hc2sp Ii8+Cis8L2ZpbHRlcj4KKworPHRleHQgeD0iMjAiIHk9IjIwIj5UaGlzIHNob3VsZCBub3QgY3Jh c2guPC90ZXh0PgorCis8L3N2Zz4KZGlmZiAtLWdpdCBhL1dlYkNvcmUvQ2hhbmdlTG9nIGIvV2Vi Q29yZS9DaGFuZ2VMb2cKaW5kZXggODZhYTMwYS4uOWZkZDQ5OSAxMDA2NDQKLS0tIGEvV2ViQ29y ZS9DaGFuZ2VMb2cKKysrIGIvV2ViQ29yZS9DaGFuZ2VMb2cKQEAgLTEsMyArMSwyNSBAQAorMjAx MC0xMC0xNSAgQ29zbWluIFRydXRhICA8Y3RydXRhQGNocm9taXVtLm9yZz4KKworICAgICAgICBS ZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBDcmFzaCB3aGlsZSBwcm9jZXNz aW5nIGlsbC1mb3JtZWQgU1ZHIHdpdGggY3ljbGVzCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJr aXQub3JnL3Nob3dfYnVnLmNnaT9pZD00NzQ5OAorCisgICAgICAgIFRlc3Q6IHN2Zy9jdXN0b20v aW52YWxpZC1wYWludC1zaGFwZS1tYXNrLnN2ZworCisgICAgICAgICogcmVuZGVyaW5nL1NWR1Jl c291cmNlcy5jcHA6CisgICAgICAgIChwYWludGluZ1Jlc291cmNlRnJvbVNWR1BhaW50KTogRW5z dXJlZCB0aGF0IHRoZSBwYWludGluZyByZXNvdXJjZSBpcworICAgICAgICBlaXRoZXIgYSBwYXR0 ZXJuIHJlc291cmNlIG9yIGEgZ3JhZGllbnQgcmVzb3VyY2UuCisgICAgICAgIChTVkdSZXNvdXJj ZXM6OnNldENsaXBwZXIpOgorICAgICAgICAoU1ZHUmVzb3VyY2VzOjpzZXRGaWx0ZXIpOgorICAg ICAgICAoU1ZHUmVzb3VyY2VzOjpzZXRNYXJrZXJTdGFydCk6CisgICAgICAgIChTVkdSZXNvdXJj ZXM6OnNldE1hcmtlck1pZCk6CisgICAgICAgIChTVkdSZXNvdXJjZXM6OnNldE1hcmtlckVuZCk6 CisgICAgICAgIChTVkdSZXNvdXJjZXM6OnNldE1hc2tlcik6CisgICAgICAgIChTVkdSZXNvdXJj ZXM6OnNldEZpbGwpOgorICAgICAgICAoU1ZHUmVzb3VyY2VzOjpzZXRTdHJva2UpOiBBZGRlZCBB U1NFUlQgc3RhdGVtZW50cyBmb3IgcHJldmlvdXNseS11bmNoZWNrZWQKKyAgICAgICAgcHJlY29u ZGl0aW9ucy4KKwogMjAxMC0xMC0xNSAgRGFuIEJlcm5zdGVpbiAgPG1pdHpAYXBwbGUuY29tPgog CiAgICAgICAgIFJldmlld2VkIGJ5IEFkZWxlIFBldGVyc29uLgpkaWZmIC0tZ2l0IGEvV2ViQ29y ZS9yZW5kZXJpbmcvU1ZHUmVzb3VyY2VzLmNwcCBiL1dlYkNvcmUvcmVuZGVyaW5nL1NWR1Jlc291 cmNlcy5jcHAKaW5kZXggNzk5MzAxYi4uZjc5NmYzYiAxMDA2NDQKLS0tIGEvV2ViQ29yZS9yZW5k ZXJpbmcvU1ZHUmVzb3VyY2VzLmNwcAorKysgYi9XZWJDb3JlL3JlbmRlcmluZy9TVkdSZXNvdXJj ZXMuY3BwCkBAIC0xNjAsMTEgKzE2MCwxNyBAQCBzdGF0aWMgaW5saW5lIFJlbmRlclNWR1Jlc291 cmNlQ29udGFpbmVyKiBwYWludGluZ1Jlc291cmNlRnJvbVNWR1BhaW50KERvY3VtZW50KgogICAg ICAgICByZXR1cm4gMDsKIAogICAgIGlkID0gU1ZHVVJJUmVmZXJlbmNlOjpnZXRUYXJnZXQocGFp bnQtPnVyaSgpKTsKLSAgICBpZiAoUmVuZGVyU1ZHUmVzb3VyY2VDb250YWluZXIqIGNvbnRhaW5l ciA9IGdldFJlbmRlclNWR1Jlc291cmNlQ29udGFpbmVyQnlJZChkb2N1bWVudCwgaWQpKQotICAg ICAgICByZXR1cm4gY29udGFpbmVyOworICAgIFJlbmRlclNWR1Jlc291cmNlQ29udGFpbmVyKiBj b250YWluZXIgPSBnZXRSZW5kZXJTVkdSZXNvdXJjZUNvbnRhaW5lckJ5SWQoZG9jdW1lbnQsIGlk KTsKKyAgICBpZiAoIWNvbnRhaW5lcikgeworICAgICAgICBoYXNQZW5kaW5nUmVzb3VyY2UgPSB0 cnVlOworICAgICAgICByZXR1cm4gMDsKKyAgICB9CisKKyAgICBSZW5kZXJTVkdSZXNvdXJjZVR5 cGUgcmVzb3VyY2VUeXBlID0gY29udGFpbmVyLT5yZXNvdXJjZVR5cGUoKTsKKyAgICBpZiAocmVz b3VyY2VUeXBlICE9IFBhdHRlcm5SZXNvdXJjZVR5cGUgJiYgcmVzb3VyY2VUeXBlICE9IExpbmVh ckdyYWRpZW50UmVzb3VyY2VUeXBlICYmIHJlc291cmNlVHlwZSAhPSBSYWRpYWxHcmFkaWVudFJl c291cmNlVHlwZSkKKyAgICAgICAgcmV0dXJuIDA7CiAKLSAgICBoYXNQZW5kaW5nUmVzb3VyY2Ug PSB0cnVlOwotICAgIHJldHVybiAwOworICAgIHJldHVybiBjb250YWluZXI7CiB9CiAKIHN0YXRp YyBpbmxpbmUgdm9pZCByZWdpc3RlclBlbmRpbmdSZXNvdXJjZShTVkdEb2N1bWVudEV4dGVuc2lv bnMqIGV4dGVuc2lvbnMsIGNvbnN0IEF0b21pY1N0cmluZyYgaWQsIFNWR0VsZW1lbnQqIGVsZW1l bnQpCkBAIC00NDUsNiArNDUxLDggQEAgYm9vbCBTVkdSZXNvdXJjZXM6OnNldENsaXBwZXIoUmVu ZGVyU1ZHUmVzb3VyY2VDbGlwcGVyKiBjbGlwcGVyKQogICAgIGlmICghY2xpcHBlcikKICAgICAg ICAgcmV0dXJuIGZhbHNlOwogCisgICAgQVNTRVJUKGNsaXBwZXItPnJlc291cmNlVHlwZSgpID09 IENsaXBwZXJSZXNvdXJjZVR5cGUpOworCiAgICAgaWYgKCFtX2NsaXBwZXJGaWx0ZXJNYXNrZXJE YXRhKQogICAgICAgICBtX2NsaXBwZXJGaWx0ZXJNYXNrZXJEYXRhID0gQ2xpcHBlckZpbHRlck1h c2tlckRhdGE6OmNyZWF0ZSgpOwogCkBAIC00NjUsNiArNDczLDggQEAgYm9vbCBTVkdSZXNvdXJj ZXM6OnNldEZpbHRlcihSZW5kZXJTVkdSZXNvdXJjZUZpbHRlciogZmlsdGVyKQogICAgIGlmICgh ZmlsdGVyKQogICAgICAgICByZXR1cm4gZmFsc2U7CiAKKyAgICBBU1NFUlQoZmlsdGVyLT5yZXNv dXJjZVR5cGUoKSA9PSBGaWx0ZXJSZXNvdXJjZVR5cGUpOworCiAgICAgaWYgKCFtX2NsaXBwZXJG aWx0ZXJNYXNrZXJEYXRhKQogICAgICAgICBtX2NsaXBwZXJGaWx0ZXJNYXNrZXJEYXRhID0gQ2xp cHBlckZpbHRlck1hc2tlckRhdGE6OmNyZWF0ZSgpOwogCkBAIC00ODUsNiArNDk1LDggQEAgYm9v bCBTVkdSZXNvdXJjZXM6OnNldE1hcmtlclN0YXJ0KFJlbmRlclNWR1Jlc291cmNlTWFya2VyKiBt YXJrZXJTdGFydCkKICAgICBpZiAoIW1hcmtlclN0YXJ0KQogICAgICAgICByZXR1cm4gZmFsc2U7 CiAKKyAgICBBU1NFUlQobWFya2VyU3RhcnQtPnJlc291cmNlVHlwZSgpID09IE1hcmtlclJlc291 cmNlVHlwZSk7CisKICAgICBpZiAoIW1fbWFya2VyRGF0YSkKICAgICAgICAgbV9tYXJrZXJEYXRh ID0gTWFya2VyRGF0YTo6Y3JlYXRlKCk7CiAKQEAgLTUwNCw2ICs1MTYsOCBAQCBib29sIFNWR1Jl c291cmNlczo6c2V0TWFya2VyTWlkKFJlbmRlclNWR1Jlc291cmNlTWFya2VyKiBtYXJrZXJNaWQp CiAgICAgaWYgKCFtYXJrZXJNaWQpCiAgICAgICAgIHJldHVybiBmYWxzZTsKIAorICAgIEFTU0VS VChtYXJrZXJNaWQtPnJlc291cmNlVHlwZSgpID09IE1hcmtlclJlc291cmNlVHlwZSk7CisKICAg ICBpZiAoIW1fbWFya2VyRGF0YSkKICAgICAgICAgbV9tYXJrZXJEYXRhID0gTWFya2VyRGF0YTo6 Y3JlYXRlKCk7CiAKQEAgLTUyMyw2ICs1MzcsOCBAQCBib29sIFNWR1Jlc291cmNlczo6c2V0TWFy a2VyRW5kKFJlbmRlclNWR1Jlc291cmNlTWFya2VyKiBtYXJrZXJFbmQpCiAgICAgaWYgKCFtYXJr ZXJFbmQpCiAgICAgICAgIHJldHVybiBmYWxzZTsKIAorICAgIEFTU0VSVChtYXJrZXJFbmQtPnJl c291cmNlVHlwZSgpID09IE1hcmtlclJlc291cmNlVHlwZSk7CisKICAgICBpZiAoIW1fbWFya2Vy RGF0YSkKICAgICAgICAgbV9tYXJrZXJEYXRhID0gTWFya2VyRGF0YTo6Y3JlYXRlKCk7CiAKQEAg LTU0Miw2ICs1NTgsOCBAQCBib29sIFNWR1Jlc291cmNlczo6c2V0TWFza2VyKFJlbmRlclNWR1Jl c291cmNlTWFza2VyKiBtYXNrZXIpCiAgICAgaWYgKCFtYXNrZXIpCiAgICAgICAgIHJldHVybiBm YWxzZTsKIAorICAgIEFTU0VSVChtYXNrZXItPnJlc291cmNlVHlwZSgpID09IE1hc2tlclJlc291 cmNlVHlwZSk7CisKICAgICBpZiAoIW1fY2xpcHBlckZpbHRlck1hc2tlckRhdGEpCiAgICAgICAg IG1fY2xpcHBlckZpbHRlck1hc2tlckRhdGEgPSBDbGlwcGVyRmlsdGVyTWFza2VyRGF0YTo6Y3Jl YXRlKCk7CiAKQEAgLTU2MSw2ICs1NzksMTAgQEAgYm9vbCBTVkdSZXNvdXJjZXM6OnNldEZpbGwo UmVuZGVyU1ZHUmVzb3VyY2VDb250YWluZXIqIGZpbGwpCiAgICAgaWYgKCFmaWxsKQogICAgICAg ICByZXR1cm4gZmFsc2U7CiAKKyAgICBBU1NFUlQoZmlsbC0+cmVzb3VyY2VUeXBlKCkgPT0gUGF0 dGVyblJlc291cmNlVHlwZQorICAgICAgICAgICB8fCBmaWxsLT5yZXNvdXJjZVR5cGUoKSA9PSBM aW5lYXJHcmFkaWVudFJlc291cmNlVHlwZQorICAgICAgICAgICB8fCBmaWxsLT5yZXNvdXJjZVR5 cGUoKSA9PSBSYWRpYWxHcmFkaWVudFJlc291cmNlVHlwZSk7CisKICAgICBpZiAoIW1fZmlsbFN0 cm9rZURhdGEpCiAgICAgICAgIG1fZmlsbFN0cm9rZURhdGEgPSBGaWxsU3Ryb2tlRGF0YTo6Y3Jl YXRlKCk7CiAKQEAgLTU4MCw2ICs2MDIsMTAgQEAgYm9vbCBTVkdSZXNvdXJjZXM6OnNldFN0cm9r ZShSZW5kZXJTVkdSZXNvdXJjZUNvbnRhaW5lciogc3Ryb2tlKQogICAgIGlmICghc3Ryb2tlKQog ICAgICAgICByZXR1cm4gZmFsc2U7CiAKKyAgICBBU1NFUlQoc3Ryb2tlLT5yZXNvdXJjZVR5cGUo KSA9PSBQYXR0ZXJuUmVzb3VyY2VUeXBlCisgICAgICAgICAgIHx8IHN0cm9rZS0+cmVzb3VyY2VU eXBlKCkgPT0gTGluZWFyR3JhZGllbnRSZXNvdXJjZVR5cGUKKyAgICAgICAgICAgfHwgc3Ryb2tl LT5yZXNvdXJjZVR5cGUoKSA9PSBSYWRpYWxHcmFkaWVudFJlc291cmNlVHlwZSk7CisKICAgICBp ZiAoIW1fZmlsbFN0cm9rZURhdGEpCiAgICAgICAgIG1fZmlsbFN0cm9rZURhdGEgPSBGaWxsU3Ry b2tlRGF0YTo6Y3JlYXRlKCk7CiAK