<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>56470</bug_id>
          
          <creation_ts>2011-03-16 10:01:38 -0700</creation_ts>
          <short_desc>Crash in  JSC::MarkStack::drain Under Stress</short_desc>
          <delta_ts>2011-03-18 10:47:26 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>JavaScriptCore</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>All</rep_platform>
          <op_sys>OS X 10.5</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>InRadar, LayoutTestFailure, MakingBotsRed</keywords>
          <priority>P1</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Michael Saboff">msaboff</reporter>
          <assigned_to name="Oliver Hunt">oliver</assigned_to>
          <cc>aroben</cc>
    
    <cc>skepticus</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>368365</commentid>
    <comment_count>0</comment_count>
    <who name="Michael Saboff">msaboff</who>
    <bug_when>2011-03-16 10:01:38 -0700</bug_when>
    <thetext>When running Safari self test, I encounter a crash in JSC::MarkStack::drain.  The crash trace below MarkStack::drain() varies.  Here is one such crash on build 81173:

Thread 0 name:  Dispatch queue: com.apple.main-thread
Thread 0 Crashed:
0   com.apple.JavaScriptCore      	0x000000010fc93fde JSC::MarkStack::drain() + 184
1   com.apple.JavaScriptCore      	0x000000010fc76a27 JSC::evaluate(JSC::ExecState*, JSC::ScopeChainNode*, JSC::SourceCode const&amp;, JSC::JSValue) + 199
2   com.apple.WebCore             	0x000000011047ba9b WebCore::ScriptController::evaluateInWorld(WebCore::ScriptSourceCode const&amp;, WebCore::DOMWrapperWorld*) + 427
3   com.apple.WebCore             	0x000000011047b88c WebCore::ScriptController::evaluate(WebCore::ScriptSourceCode const&amp;) + 44
4   com.apple.WebCore             	0x0000000110e3bb0a WebCore::ScriptElement::executeScript(WebCore::ScriptSourceCode const&amp;) + 108
5   com.apple.WebCore             	0x0000000110a1af0a WebCore::HTMLScriptRunner::executePendingScriptAndDispatchEvent(WebCore::PendingScript&amp;) + 476
6   com.apple.WebCore             	0x0000000110a1b1fa WebCore::HTMLScriptRunner::executeParsingBlockingScript() + 46
7   com.apple.WebCore             	0x0000000110a1b36a WebCore::HTMLScriptRunner::execute(WTF::PassRefPtr&lt;WebCore::Element&gt;, WTF::TextPosition&lt;WTF::OneBasedNumber&gt; const&amp;) + 98
8   com.apple.WebCore             	0x00000001109eeccf WebCore::HTMLDocumentParser::runScriptsForPausedTreeBuilder() + 87
9   com.apple.WebCore             	0x00000001109eedcc WebCore::HTMLDocumentParser::canTakeNextToken(WebCore::HTMLDocumentParser::SynchronousMode, WebCore::PumpSession&amp;) + 88
10  com.apple.WebCore             	0x00000001109eeff2 WebCore::HTMLDocumentParser::pumpTokenizer(WebCore::HTMLDocumentParser::SynchronousMode) + 398
11  com.apple.WebCore             	0x00000001109ef480 WebCore::HTMLDocumentParser::append(WebCore::SegmentedString const&amp;) + 142
12  com.apple.WebCore             	0x000000011087a59d WebCore::DecodedDataDocumentParser::appendBytes(WebCore::DocumentWriter*, char const*, int, bool) + 377
13  com.apple.WebCore             	0x000000011088e287 WebCore::DocumentLoader::commitData(char const*, int) + 87
14  com.apple.WebKit              	0x000000010fe682f2 -[WebHTMLRepresentation receivedData:withDataSource:] + 98
15  com.apple.WebKit              	0x000000010fe681f0 -[WebDataSource(WebInternal) _receivedData:] + 80
16  com.apple.WebKit              	0x000000010fe6817b WebFrameLoaderClient::committedLoad(WebCore::DocumentLoader*, char const*, int) + 105
17  com.apple.WebCore             	0x0000000110434c86 WebCore::DocumentLoader::commitLoad(char const*, int) + 166
18  com.apple.WebCore             	0x00000001104346e5 WebCore::ResourceLoader::didReceiveData(char const*, int, long long, bool) + 57
19  com.apple.WebCore             	0x00000001104344f3 WebCore::MainResourceLoader::didReceiveData(char const*, int, long long, bool) + 617
20  com.apple.WebCore             	0x000000011043425f WebCore::ResourceLoader::didReceiveData(WebCore::ResourceHandle*, char const*, int, int) + 175
21  com.apple.Foundation          	0x00007fff82d21c4e ___NSURLConnectionDidReceiveData_block_invoke_1 + 144
22  com.apple.Foundation          	0x00007fff82c42ef2 _NSURLConnectionDidReceiveData + 86
23  com.apple.CFNetwork           	0x00007fff85628362 URLConnectionClient::_clientDidReceiveData(__CFArray const*, URLConnectionClient::ClientConnectionEventQueue*) + 426
24  com.apple.CFNetwork           	0x00007fff8562763a URLConnectionClient::ClientConnectionEventQueue::processAllEventsAndConsumePayload(XConnectionEventInfo&lt;XClientEvent, XClientEventParams&gt;*, long) + 818
25  com.apple.CFNetwork           	0x00007fff85627849 URLConnectionClient::ClientConnectionEventQueue::processAllEventsAndConsumePayload(XConnectionEventInfo&lt;XClientEvent, XClientEventParams&gt;*, long) + 1345
26  com.apple.CFNetwork           	0x00007fff855627af URLConnectionClient::processEvents() + 185
27  com.apple.CFNetwork           	0x00007fff85562662 MultiplexerSource::perform() + 212
28  com.apple.CoreFoundation      	0x00007fff8829300c __CFRunLoopDoSources0 + 444
29  com.apple.CoreFoundation      	0x00007fff88292919 __CFRunLoopRun + 905
30  com.apple.CoreFoundation      	0x00007fff88292356 CFRunLoopRunSpecific + 230
31  com.apple.Foundation          	0x00007fff82ce0cdc -[NSRunLoop(NSRunLoop) limitDateForMode:] + 191
32  com.apple.Safari.framework    	0x000000010f4080f7 -[AppController application:runTest:duration:] + 685
33  com.apple.AppKit              	0x00007fff88e69c72 -[NSApplication(NSAppleEventHandling) _handleSelfTestEvent:] + 389
34  com.apple.AppKit              	0x00007fff88e69cb0 -[NSApplication(NSAppleEventHandling) _handleTestEvent:withReplyEvent:] + 60
35  com.apple.CoreFoundation      	0x00007fff8836c701 -[NSObject performSelector:withObject:withObject:] + 65
36  com.apple.Foundation          	0x00007fff82c53cec __-[NSAppleEventManager setEventHandler:andSelector:forEventClass:andEventID:]_block_invoke_1 + 101
37  com.apple.Foundation          	0x00007fff82bf6f0a -[NSAppleEventManager dispatchRawAppleEvent:withRawReply:handlerRefCon:] + 283
38  com.apple.Foundation          	0x00007fff82bf6d98 _NSAppleEventManagerGenericHandler + 105
39  com.apple.AE                  	0x00007fff86c2689a aeDispatchAppleEvent(AEDesc const*, AEDesc*, unsigned int, unsigned char*) + 200
40  com.apple.AE                  	0x00007fff86c26778 _ZL25dispatchEventAndSendReplyPK6AEDescPS_ + 38
41  com.apple.AE                  	0x00007fff86c2666c aeProcessAppleEvent + 250
42  com.apple.HIToolbox           	0x00007fff897b8a01 AEProcessAppleEvent + 102
43  com.apple.AppKit              	0x00007fff88c1321d _DPSNextEvent + 1247
44  com.apple.AppKit              	0x00007fff88c128d6 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 135
45  com.apple.Safari.framework    	0x000000010f44cca6 -[BrowserApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 171
46  com.apple.AppKit              	0x00007fff88bd753e -[NSApplication run] + 456
47  com.apple.AppKit              	0x00007fff88bd033d NSApplicationMain + 860
48  com.apple.Safari.framework    	0x000000010f60ee85 SafariMain + 197
49  RealSafari                    	0x000000010f3edf24 0x10f3ed000 + 3876</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>369099</commentid>
    <comment_count>1</comment_count>
    <who name="Adam Roben (:aroben)">aroben</who>
    <bug_when>2011-03-17 09:57:08 -0700</bug_when>
    <thetext>The SnowLeopard WebKit2 bot just hit a crash in MarkStack::drain; maybe it&apos;s the same issue?

http://build.webkit.org/results/SnowLeopard%20Intel%20Release%20(WebKit2%20Tests)/r81355%20(9789)/svg/zoom/page/zoom-getBoundingClientRect-crash-log.txt</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>369102</commentid>
    <comment_count>2</comment_count>
    <who name="Adam Roben (:aroben)">aroben</who>
    <bug_when>2011-03-17 09:59:29 -0700</bug_when>
    <thetext>Just happened again!

http://build.webkit.org/results/SnowLeopard%20Intel%20Release%20(WebKit2%20Tests)/r81356%20(9790)/results.html</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>369113</commentid>
    <comment_count>3</comment_count>
    <who name="Michael Saboff">msaboff</who>
    <bug_when>2011-03-17 10:09:42 -0700</bug_when>
    <thetext>I would characterize the two bot crashes as the same defect.  I found various variations of the crash and these two look consistent with other crashes I saw.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>369135</commentid>
    <comment_count>4</comment_count>
    <who name="Sam Weinig">sam</who>
    <bug_when>2011-03-17 10:41:49 -0700</bug_when>
    <thetext>&lt;rdar://problem/9149155&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>369392</commentid>
    <comment_count>5</comment_count>
      <attachid>86110</attachid>
    <who name="Oliver Hunt">oliver</who>
    <bug_when>2011-03-17 16:34:03 -0700</bug_when>
    <thetext>Created attachment 86110
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>369398</commentid>
    <comment_count>6</comment_count>
    <who name="Adam Roben (:aroben)">aroben</who>
    <bug_when>2011-03-17 16:39:45 -0700</bug_when>
    <thetext>Here&apos;s another one: http://build.webkit.org/results/SnowLeopard%20Intel%20Release%20(WebKit2%20Tests)/r81398%20(9804)/svg/zoom/page/zoom-getBoundingClientRect-crash-log.txt</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>369406</commentid>
    <comment_count>7</comment_count>
      <attachid>86110</attachid>
    <who name="Geoffrey Garen">ggaren</who>
    <bug_when>2011-03-17 16:53:36 -0700</bug_when>
    <thetext>Comment on attachment 86110
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=86110&amp;action=review

r=me

&gt; Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp:301
&gt; +        if (symbolTable-&gt;size() != expectedSize)
&gt; +            CRASH();

Should be ASSERT.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>369414</commentid>
    <comment_count>8</comment_count>
    <who name="Oliver Hunt">oliver</who>
    <bug_when>2011-03-17 16:58:22 -0700</bug_when>
    <thetext>Committed r81411: &lt;http://trac.webkit.org/changeset/81411&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>369721</commentid>
    <comment_count>9</comment_count>
    <who name="Oliver Hunt">oliver</who>
    <bug_when>2011-03-18 10:47:26 -0700</bug_when>
    <thetext>*** Bug 56641 has been marked as a duplicate of this bug. ***</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>86110</attachid>
            <date>2011-03-17 16:34:03 -0700</date>
            <delta_ts>2011-03-17 16:53:36 -0700</delta_ts>
            <desc>Patch</desc>
            <filename>bug-56470-20110317163402.patch</filename>
            <type>text/plain</type>
            <size>5393</size>
            <attacher name="Oliver Hunt">oliver</attacher>
            
              <data encoding="base64">U3VidmVyc2lvbiBSZXZpc2lvbjogODE0MDYKZGlmZiAtLWdpdCBhL1NvdXJjZS9KYXZhU2NyaXB0
Q29yZS9DaGFuZ2VMb2cgYi9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvQ2hhbmdlTG9nCmluZGV4IDZj
MWU1MjI0YTA4MWIwZTA4YjgxZjdlZjU0ZWE4MjIzNTRmNTkwOWMuLjc0NDgwYjRjNDRiMTBhOWYy
YmY4NTkxZDNmY2JkYzc3Y2M5ZTA0NDIgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9KYXZhU2NyaXB0Q29y
ZS9DaGFuZ2VMb2cKKysrIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwpAQCAtMSwz
ICsxLDI4IEBACisyMDExLTAzLTE3ICBPbGl2ZXIgSHVudCAgPG9saXZlckBhcHBsZS5jb20+CisK
KyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgQ3Jhc2ggaW4g
IEpTQzo6TWFya1N0YWNrOjpkcmFpbiBVbmRlciBTdHJlc3MKKyAgICAgICAgaHR0cHM6Ly9idWdz
LndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTU2NDcwCisKKyAgICAgICAgV2UgcGVyZm9ybSBh
IG51bWJlciBvZiBnYyBhbGxvY2F0aW9ucyB3aGlsZSB3aGVuCisgICAgICAgIHdlIGFyZSBzZXR0
aW5nIHVwIG5ldyBnbG9iYWxzIGluIGEgcGllY2Ugb2YgZ2xvYmFsCisgICAgICAgIGNvZGUuICBX
ZSBkbyB0aGlzIGJ5IGFkZGluZyBuZXcgcHJvcGVydGllcyB0byB0aGUKKyAgICAgICAgc3ltYm9s
IHRhYmxlLCBhbmQgdGhlbiBleHBhbmRpbmcgdGhlIHN0b3JhZ2UgdG8gZml0CisgICAgICAgIGF0
IHRoZSBlbmQuCisKKyAgICAgICAgSWYgYSBHQyBoYXBwZW5zIGR1cmluZyB0aGlzIHRpbWUgd2Ug
d2lsbCByZXBvcnQgYW4KKyAgICAgICAgaW5jb3JyZWN0IHNpemUgZm9yIHRoZSBnbG9iYWwgb2Jq
ZWN0J3Mgc3ltYm9sIHRhYmxlCisgICAgICAgIHN0b3JhZ2UuCisKKyAgICAgICAgVGhpcyBwYXRj
aCBjb3JyZWN0cyB0aGlzIGJ5IGdyb3dpbmcgdGhlIHN0b3JhZ2Ugc2l6ZQorICAgICAgICBiZWZv
cmUgd2Ugc3RhcnRpbmcgYWRkaW5nIGVudHJpZXMgdG8gdGhlIHN5bWJvbCB0YWJsZS4KKworICAg
ICAgICAqIGJ5dGVjb21waWxlci9CeXRlY29kZUdlbmVyYXRvci5jcHA6CisgICAgICAgIChKU0M6
OkJ5dGVjb2RlR2VuZXJhdG9yOjpCeXRlY29kZUdlbmVyYXRvcik6CisgICAgICAgICogcnVudGlt
ZS9KU0dsb2JhbE9iamVjdC5jcHA6CisgICAgICAgIChKU0M6OkpTR2xvYmFsT2JqZWN0OjpyZXNp
emVSZWdpc3RlcnMpOgorCiAyMDExLTAzLTE3ICBHYXZpbiBCYXJyYWNsb3VnaCAgPGJhcnJhY2xv
dWdoQGFwcGxlLmNvbT4KIAogICAgICAgICBSZXZpZXdlZCBieSBTYW0gV2VpbmlnLgpkaWZmIC0t
Z2l0IGEvU291cmNlL0phdmFTY3JpcHRDb3JlL2J5dGVjb21waWxlci9CeXRlY29kZUdlbmVyYXRv
ci5jcHAgYi9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvYnl0ZWNvbXBpbGVyL0J5dGVjb2RlR2VuZXJh
dG9yLmNwcAppbmRleCBiNzE0ZDU1MjE2ODk2MmMwN2RkZTA2MTMyY2I1ODIzMDRiMTUxMThiLi5k
YmRiYjViZjNjNDI0M2M3ODExODg5YjQ3YWNkOGIwNTAwNTNhODk2IDEwMDY0NAotLS0gYS9Tb3Vy
Y2UvSmF2YVNjcmlwdENvcmUvYnl0ZWNvbXBpbGVyL0J5dGVjb2RlR2VuZXJhdG9yLmNwcAorKysg
Yi9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvYnl0ZWNvbXBpbGVyL0J5dGVjb2RlR2VuZXJhdG9yLmNw
cApAQCAtMjU4LDI3ICsyNTgsNDkgQEAgQnl0ZWNvZGVHZW5lcmF0b3I6OkJ5dGVjb2RlR2VuZXJh
dG9yKFByb2dyYW1Ob2RlKiBwcm9ncmFtTm9kZSwgU2NvcGVDaGFpbk5vZGUqIHMKICAgICAgICAg
Ly8gU2hpZnQgbmV3IHN5bWJvbHMgc28gdGhleSBnZXQgc3RvcmVkIHByaW9yIHRvIGV4aXN0aW5n
IHN5bWJvbHMuCiAgICAgICAgIG1fbmV4dEdsb2JhbEluZGV4IC09IHN5bWJvbFRhYmxlLT5zaXpl
KCk7CiAKLSAgICAgICAgc2l6ZV90IG9sZFN5bWJvbFRhYmxlU2l6ZSA9IHN5bWJvbFRhYmxlLT5z
aXplKCk7Ci0KKyAgICAgICAgSGFzaFNldDxTdHJpbmdJbXBsKiwgSWRlbnRpZmllclJlcEhhc2g+
IG5ld0dsb2JhbHM7CisgICAgICAgIFZlY3RvcjxzdGQ6OnBhaXI8aW50LCBib29sPiwgMTY+IGZ1
bmN0aW9uSW5mbyhmdW5jdGlvblN0YWNrLnNpemUoKSk7CiAgICAgICAgIGZvciAoc2l6ZV90IGkg
PSAwOyBpIDwgZnVuY3Rpb25TdGFjay5zaXplKCk7ICsraSkgewogICAgICAgICAgICAgRnVuY3Rp
b25Cb2R5Tm9kZSogZnVuY3Rpb24gPSBmdW5jdGlvblN0YWNrW2ldOwogICAgICAgICAgICAgZ2xv
YmFsT2JqZWN0LT5yZW1vdmVEaXJlY3QoZnVuY3Rpb24tPmlkZW50KCkpOyAvLyBNYWtlIHN1cmUg
b3VyIG5ldyBmdW5jdGlvbiBpcyBub3Qgc2hhZG93ZWQgYnkgYW4gb2xkIHByb3BlcnR5LgotICAg
ICAgICAgICAgZW1pdE5ld0Z1bmN0aW9uKGFkZEdsb2JhbFZhcihmdW5jdGlvbi0+aWRlbnQoKSwg
ZmFsc2UpLCBmdW5jdGlvbik7CisgICAgICAgICAgICBTeW1ib2xUYWJsZUVudHJ5IGVudHJ5ID0g
c3ltYm9sVGFibGUtPmlubGluZUdldChmdW5jdGlvbi0+aWRlbnQoKS5pbXBsKCkpOworICAgICAg
ICAgICAgCisgICAgICAgICAgICBpZiAoZW50cnkuaXNOdWxsKCkpCisgICAgICAgICAgICAgICAg
bmV3R2xvYmFscy5hZGQoZnVuY3Rpb24tPmlkZW50KCkuaW1wbCgpKTsKKyAgICAgICAgICAgIGZ1
bmN0aW9uSW5mb1tpXSA9IG1ha2VfcGFpcihlbnRyeS5nZXRJbmRleCgpLCBlbnRyeS5pc1JlYWRP
bmx5KCkpOwogICAgICAgICB9Ci0KLSAgICAgICAgVmVjdG9yPFJlZ2lzdGVySUQqLCAzMj4gbmV3
VmFyczsKKyAgICAgICAgCisgICAgICAgIFZlY3Rvcjxib29sLCAxNj4gc2hvdWxkQ3JlYXRlVmFy
KHZhclN0YWNrLnNpemUoKSk7CiAgICAgICAgIGZvciAoc2l6ZV90IGkgPSAwOyBpIDwgdmFyU3Rh
Y2suc2l6ZSgpOyArK2kpIHsKLSAgICAgICAgICAgIGlmIChnbG9iYWxPYmplY3QtPnN5bWJvbFRh
YmxlSGFzUHJvcGVydHkoKnZhclN0YWNrW2ldLmZpcnN0KSB8fCBnbG9iYWxPYmplY3QtPmhhc1By
b3BlcnR5KGV4ZWMsICp2YXJTdGFja1tpXS5maXJzdCkpCisgICAgICAgICAgICBpZiAobmV3R2xv
YmFscy5jb250YWlucyh2YXJTdGFja1tpXS5maXJzdC0+aW1wbCgpKSB8fCBnbG9iYWxPYmplY3Qt
Pmhhc1Byb3BlcnR5KGV4ZWMsICp2YXJTdGFja1tpXS5maXJzdCkpIHsKKyAgICAgICAgICAgICAg
ICBzaG91bGRDcmVhdGVWYXJbaV0gPSBmYWxzZTsKICAgICAgICAgICAgICAgICBjb250aW51ZTsK
LSAgICAgICAgICAgIG5ld1ZhcnMuYXBwZW5kKGFkZEdsb2JhbFZhcigqdmFyU3RhY2tbaV0uZmly
c3QsIHZhclN0YWNrW2ldLnNlY29uZCAmIERlY2xhcmF0aW9uU3RhY2tzOjpJc0NvbnN0YW50KSk7
CisgICAgICAgICAgICB9CisgICAgICAgICAgICBzaG91bGRDcmVhdGVWYXJbaV0gPSB0cnVlOwor
ICAgICAgICAgICAgbmV3R2xvYmFscy5hZGQodmFyU3RhY2tbaV0uZmlyc3QtPmltcGwoKSk7CiAg
ICAgICAgIH0KIAotICAgICAgICBnbG9iYWxPYmplY3QtPnJlc2l6ZVJlZ2lzdGVycyhvbGRTeW1i
b2xUYWJsZVNpemUsIHN5bWJvbFRhYmxlLT5zaXplKCkpOworICAgICAgICBpbnQgZXhwZWN0ZWRT
aXplID0gc3ltYm9sVGFibGUtPnNpemUoKSArIG5ld0dsb2JhbHMuc2l6ZSgpOworICAgICAgICBn
bG9iYWxPYmplY3QtPnJlc2l6ZVJlZ2lzdGVycyhzeW1ib2xUYWJsZS0+c2l6ZSgpLCBleHBlY3Rl
ZFNpemUpOworICAgIAorICAgICAgICBmb3IgKHNpemVfdCBpID0gMDsgaSA8IGZ1bmN0aW9uU3Rh
Y2suc2l6ZSgpOyArK2kpIHsKKyAgICAgICAgICAgIEZ1bmN0aW9uQm9keU5vZGUqIGZ1bmN0aW9u
ID0gZnVuY3Rpb25TdGFja1tpXTsKKyAgICAgICAgICAgIGlmIChmdW5jdGlvbkluZm9baV0uc2Vj
b25kKQorICAgICAgICAgICAgICAgIGNvbnRpbnVlOworICAgICAgICAgICAgUmVnaXN0ZXJJRCog
ZHN0ID0gYWRkR2xvYmFsVmFyKGZ1bmN0aW9uLT5pZGVudCgpLCBmYWxzZSk7CisgICAgICAgICAg
ICBKU1ZhbHVlIHZhbHVlID0gbmV3IChleGVjKSBKU0Z1bmN0aW9uKGV4ZWMsIG1ha2VGdW5jdGlv
bihleGVjLCBmdW5jdGlvbiksIHNjb3BlQ2hhaW4pOworICAgICAgICAgICAgZ2xvYmFsT2JqZWN0
LT5yZWdpc3RlckF0KGRzdC0+aW5kZXgoKSAtIG1fZ2xvYmFsVmFyU3RvcmFnZU9mZnNldCkuc2V0
KCptX2dsb2JhbERhdGEsIGdsb2JhbE9iamVjdCwgdmFsdWUpOworICAgICAgICB9CiAKLSAgICAg
ICAgcHJlc2VydmVMYXN0VmFyKCk7CisgICAgICAgIGZvciAoc2l6ZV90IGkgPSAwOyBpIDwgdmFy
U3RhY2suc2l6ZSgpOyArK2kpIHsKKyAgICAgICAgICAgIGlmICghc2hvdWxkQ3JlYXRlVmFyW2ld
KQorICAgICAgICAgICAgICAgIGNvbnRpbnVlOworICAgICAgICAgICAgYWRkR2xvYmFsVmFyKCp2
YXJTdGFja1tpXS5maXJzdCwgdmFyU3RhY2tbaV0uc2Vjb25kICYgRGVjbGFyYXRpb25TdGFja3M6
OklzQ29uc3RhbnQpOworICAgICAgICB9CisgICAgICAgIGlmIChzeW1ib2xUYWJsZS0+c2l6ZSgp
ICE9IGV4cGVjdGVkU2l6ZSkKKyAgICAgICAgICAgIENSQVNIKCk7CiAKLSAgICAgICAgZm9yIChz
aXplX3QgaSA9IDA7IGkgPCBuZXdWYXJzLnNpemUoKTsgKytpKQotICAgICAgICAgICAgZW1pdExv
YWQobmV3VmFyc1tpXSwganNVbmRlZmluZWQoKSk7CisgICAgICAgIHByZXNlcnZlTGFzdFZhcigp
OwogICAgIH0gZWxzZSB7CiAgICAgICAgIGZvciAoc2l6ZV90IGkgPSAwOyBpIDwgZnVuY3Rpb25T
dGFjay5zaXplKCk7ICsraSkgewogICAgICAgICAgICAgRnVuY3Rpb25Cb2R5Tm9kZSogZnVuY3Rp
b24gPSBmdW5jdGlvblN0YWNrW2ldOwpkaWZmIC0tZ2l0IGEvU291cmNlL0phdmFTY3JpcHRDb3Jl
L3J1bnRpbWUvSlNHbG9iYWxPYmplY3QuY3BwIGIvU291cmNlL0phdmFTY3JpcHRDb3JlL3J1bnRp
bWUvSlNHbG9iYWxPYmplY3QuY3BwCmluZGV4IGE5NmRlYzExMTVjNzUyMzU5MjQ4NGFkNzUzYzYx
YmM1MjQ4ZGU3NDkuLmFkZTA1NGIxYmUzNTg0MWZkZjVjZGZmZmEyMzlkM2ZhYjkyNjZkOWIgMTAw
NjQ0Ci0tLSBhL1NvdXJjZS9KYXZhU2NyaXB0Q29yZS9ydW50aW1lL0pTR2xvYmFsT2JqZWN0LmNw
cAorKysgYi9Tb3VyY2UvSmF2YVNjcmlwdENvcmUvcnVudGltZS9KU0dsb2JhbE9iamVjdC5jcHAK
QEAgLTQxNCw3ICs0MTQsNyBAQCB2b2lkIEpTR2xvYmFsT2JqZWN0Ojpjb3B5R2xvYmFsc1RvKFJl
Z2lzdGVyRmlsZSYgcmVnaXN0ZXJGaWxlKQogCiB2b2lkIEpTR2xvYmFsT2JqZWN0OjpyZXNpemVS
ZWdpc3RlcnMoaW50IG9sZFNpemUsIGludCBuZXdTaXplKQogewotICAgIEFTU0VSVChzeW1ib2xU
YWJsZSgpLnNpemUoKSA9PSBuZXdTaXplKTsKKyAgICBBU1NFUlQob2xkU2l6ZSA8PSBuZXdTaXpl
KTsKICAgICBpZiAobmV3U2l6ZSA9PSBvbGRTaXplKQogICAgICAgICByZXR1cm47CiAgICAgQVNT
RVJUKG5ld1NpemUgJiYgbmV3U2l6ZSA+IG9sZFNpemUpOwo=
</data>
<flag name="review"
          id="78342"
          type_id="1"
          status="+"
          setter="ggaren"
    />
          </attachment>
      

    </bug>

</bugzilla>