56773 2011-03-21 15:34:54 -0700 REGRESSION(81035): crash in RenderDetails::removeChild 2011-04-04 10:17:48 -0700 1 1 1 Unclassified WebKit Layout and Rendering 528+ (Nightly build) PC OS X 10.5 RESOLVED FIXED http://runescape.wikia.com/wiki/Special:Search InRadar P2 Normal --- 51071 1 jamesr luiz cmarcelo commit-queue dglazkov hyatt inferno luiz mitz mrobinson simon.fraser webkit.review.bot oldest_to_newest 370959 0 jamesr 2011-03-21 15:34:54 -0700 The URL above crashes after r81035. stack: #0 0x00000000016e2e3f in WebCore::RenderDetails::removeChild (this=0x7fffc0b2c6d8, oldChild=0x7fffc1306018) at third_party/WebKit/Source/WebCore/rendering/RenderDetails.cpp:94 #1 0x0000000000c032db in WebCore::RenderObject::remove (this=0x7fffc1306018) at third_party/WebKit/Source/WebCore/rendering/RenderObject.h:752 #2 0x000000000164cef2 in WebCore::RenderObject::destroy (this=0x7fffc1306018) at third_party/WebKit/Source/WebCore/rendering/RenderObject.cpp:2187 #3 0x00000000015e31a9 in WebCore::RenderBoxModelObject::destroy (this=0x7fffc1306018) at third_party/WebKit/Source/WebCore/rendering/RenderBoxModelObject.cpp:277 #4 0x00000000015d11a1 in WebCore::RenderBox::destroy (this=0x7fffc1306018) at third_party/WebKit/Source/WebCore/rendering/RenderBox.cpp:211 #5 0x0000000001589f54 in WebCore::RenderBlock::destroy (this=0x7fffc1306018) at third_party/WebKit/Source/WebCore/rendering/RenderBlock.cpp:193 #6 0x000000000164f884 in WebCore::RenderObjectChildList::destroyLeftoverChildren (this=0x7fffc0b2c768) at third_party/WebKit/Source/WebCore/rendering/RenderObjectChildList.cpp:59 #7 0x0000000001589dcc in WebCore::RenderBlock::destroy (this=0x7fffc0b2c6d8) at third_party/WebKit/Source/WebCore/rendering/RenderBlock.cpp:158 #8 0x00000000016e2c27 in WebCore::RenderDetails::destroy (this=0x7fffc0b2c6d8) at third_party/WebKit/Source/WebCore/rendering/RenderDetails.cpp:52 #9 0x0000000000c55d15 in WebCore::Node::detach (this=0x7fffc0b2bb40) at third_party/WebKit/Source/WebCore/dom/Node.cpp:1306 #10 0x0000000000be0cc9 in WebCore::ContainerNode::detach (this=0x7fffc0b2bb40) at third_party/WebKit/Source/WebCore/dom/ContainerNode.cpp:731 #11 0x0000000000c36981 in WebCore::Element::detach (this=0x7fffc0b2bb40) at third_party/WebKit/Source/WebCore/dom/Element.cpp:987 #12 0x0000000000be02af in WebCore::ContainerNode::removeChildren (this=0x7fffc1309990) at third_party/WebKit/Source/WebCore/dom/ContainerNode.cpp:536 #13 0x000000000170126a in WebCore::replaceChildrenWithFragment (element=0x7fffc1309990, fragment=..., ec=@0x7fffffffb5cc) at third_party/WebKit/Source/WebCore/html/HTMLElement.cpp:322 #14 0x0000000001701602 in WebCore::HTMLElement::setInnerHTML (this=0x7fffc1309990, html=..., ec=@0x7fffffffb5cc) at third_party/WebKit/Source/WebCore/html/HTMLElement.cpp:368 370960 1 jamesr 2011-03-21 15:36:20 -0700 innerHTML is being set on a <section> that contains a <details> element. Here's the showTree() output for the node that innerHTML is being set on immediately before the crash: * SECTION 0x7fffc0e783f0 CLASS=WikiaPagesOnWikiModule module #text 0x7fffc0e7bf50 "\n " H1 0x7fffc0e78360 #text 0x7fffc0e7bee0 "Pages on RuneScape Wiki" #text 0x7fffc0e7be70 "\n " A 0x7fffc1f5f000 CLASS=wikia-button createpage IMG 0x7fffc0e7ec40 CLASS=sprite new #text 0x7fffc1473a80 "Add a Page" #text 0x7fffc1473a10 " " DETAILS 0x7fffc1474f00 CLASS=tally #text 0x7fffc1473770 "\n " EM 0x7fffc0e78240 #text 0x7fffc1473700 "17,135" SPAN 0x7fffc0e781b0 CLASS=fixedwidth #text 0x7fffc1473620 "pages on this wiki" #text 0x7fffc14735b0 " " #text 0x7fffc1473540 "\n" 371408 2 inferno 2011-03-22 09:10:21 -0700 This introduced multiple security regressions including this one and another one in acccessibility code. See testcase in http://trac.webkit.org/changeset/81648 in Chrome. Luiz, can you please take a look. 371415 3 luiz 2011-03-22 09:21:46 -0700 (In reply to comment #2) > This introduced multiple security regressions including this one and another one in acccessibility code. See testcase in http://trac.webkit.org/changeset/81648 in Chrome. > > Luiz, can you please take a look. Looking. 371454 4 ap 2011-03-22 10:25:12 -0700 <rdar://problem/9169211> 371476 5 86477 luiz 2011-03-22 10:52:18 -0700 Created attachment 86477 patch 371505 6 86485 luiz 2011-03-22 11:28:18 -0700 Created attachment 86485 patch bad spelling in changelog. 371514 7 86485 jamesr 2011-03-22 11:39:44 -0700 Comment on attachment 86485 patch This needs at least one test 371611 8 86499 luiz 2011-03-22 13:48:43 -0700 Created attachment 86499 patch 372314 9 86499 hyatt 2011-03-23 12:01:38 -0700 Comment on attachment 86499 patch r=me 372467 10 86499 commit-queue 2011-03-23 15:04:31 -0700 Comment on attachment 86499 patch Clearing flags on attachment: 86499 Committed r81812: <http://trac.webkit.org/changeset/81812> 372468 11 commit-queue 2011-03-23 15:04:36 -0700 All reviewed patches have been landed. Closing bug. 86477 2011-03-22 10:52:18 -0700 2011-03-22 11:28:18 -0700 patch 0001-REGRESSION-81035-crash-in-RenderDetails-removeChild.patch text/plain 3735 luiz RnJvbSBjYTAzY2U1YWQ2MzExNWZmYjRhMGNmZGJkNzEyNWM5NjkzMWE5M2NkIE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiBMdWl6IEFnb3N0aW5pIDxsdWl6LmFnb3N0aW5pQG9wZW5ib3Nz YS5vcmc+CkRhdGU6IFR1ZSwgMjIgTWFyIDIwMTEgMTQ6NTA6NTcgLTAzMDAKU3ViamVjdDogW1BB VENIXSBSRUdSRVNTSU9OKDgxMDM1KTogY3Jhc2ggaW4gUmVuZGVyRGV0YWlsczo6cmVtb3ZlQ2hp bGQKIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD01Njc3MwoKUmV2aWV3 ZWQgYnkgTk9CT0RZIChPT1BTISkuCgpQcmV2ZW50aW5nIG1lcmdpbmcgb2YgUmVuZGVyRGV0YWls cydzIGFub25pbW91cyBjaGlsZHJlbi4KCiogcmVuZGVyaW5nL1JlbmRlckJsb2NrLmNwcDoKKFdl YkNvcmU6OmNhbk1lcmdlQ29udGlndW91c0Fub255bW91c0Jsb2Nrcyk6CgpGaXhpbmcgUmVuZGVy RGV0YWlsczo6cmVtb3ZlQ2hpbGQgYW5kIGNsZWFuaW5nIG1fbWFya2VyIGluIFJlbmRlckRldGFp bHM6OmRlc3Ryb3kuCgoqIHJlbmRlcmluZy9SZW5kZXJEZXRhaWxzLmNwcDoKKFdlYkNvcmU6OlJl bmRlckRldGFpbHM6OmRlc3Ryb3kpOgooV2ViQ29yZTo6UmVuZGVyRGV0YWlsczo6cmVtb3ZlQ2hp bGQpOgotLS0KIFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZyAgICAgICAgICAgICAgICAgICB8ICAg MTggKysrKysrKysrKysrKysrKysrCiBTb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyQmxv Y2suY3BwICAgfCAgICAzICsrKwogU291cmNlL1dlYkNvcmUvcmVuZGVyaW5nL1JlbmRlckRldGFp bHMuY3BwIHwgICAxNCArKysrKysrKysrKy0tLQogMyBmaWxlcyBjaGFuZ2VkLCAzMiBpbnNlcnRp b25zKCspLCAzIGRlbGV0aW9ucygtKQoKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZyBiL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwppbmRleCA5ZGI1YTEwLi5hZWFiMDViIDEw MDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKKysrIGIvU291cmNlL1dlYkNvcmUv Q2hhbmdlTG9nCkBAIC0xLDMgKzEsMjEgQEAKKzIwMTEtMDMtMjIgIEx1aXogQWdvc3RpbmkgIDxs dWl6LmFnb3N0aW5pQG9wZW5ib3NzYS5vcmc+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZ IChPT1BTISkuCisKKyAgICAgICAgUkVHUkVTU0lPTig4MTAzNSk6IGNyYXNoIGluIFJlbmRlckRl dGFpbHM6OnJlbW92ZUNoaWxkCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3df YnVnLmNnaT9pZD01Njc3MworCisgICAgICAgIFByZXZlbnRpbmcgbWVyZ2luZyBvZiBSZW5kZXJE ZXRhaWxzJ3MgYW5vbmltb3VzIGNoaWxkcmVuLgorCisgICAgICAgICogcmVuZGVyaW5nL1JlbmRl ckJsb2NrLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OmNhbk1lcmdlQ29udGlndW91c0Fub255bW91 c0Jsb2Nrcyk6CisKKyAgICAgICAgRml4aW5nIFJlbmRlckRldGFpbHM6OnJlbW92ZUNoaWxkIGFu ZCBjbGVhbmluZyBtX21hcmtlciBpbiBSZW5kZXJEZXRhaWxzOjpkZXN0cm95LgorCisgICAgICAg ICogcmVuZGVyaW5nL1JlbmRlckRldGFpbHMuY3BwOgorICAgICAgICAoV2ViQ29yZTo6UmVuZGVy RGV0YWlsczo6ZGVzdHJveSk6CisgICAgICAgIChXZWJDb3JlOjpSZW5kZXJEZXRhaWxzOjpyZW1v dmVDaGlsZCk6CisKIDIwMTEtMDMtMjIgIFNoZXJpZmYgQm90ICA8d2Via2l0LnJldmlldy5ib3RA Z21haWwuY29tPgogCiAgICAgICAgIFVucmV2aWV3ZWQsIHJvbGxpbmcgb3V0IHI4MTY1My4KZGlm ZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL3JlbmRlcmluZy9SZW5kZXJCbG9jay5jcHAgYi9Tb3Vy Y2UvV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyQmxvY2suY3BwCmluZGV4IGZhZDk4ODIuLmY0MTFh ODQgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL3JlbmRlcmluZy9SZW5kZXJCbG9jay5jcHAK KysrIGIvU291cmNlL1dlYkNvcmUvcmVuZGVyaW5nL1JlbmRlckJsb2NrLmNwcApAQCAtOTMzLDYg KzkzMyw5IEBAIHN0YXRpYyBib29sIGNhbk1lcmdlQ29udGlndW91c0Fub255bW91c0Jsb2NrcyhS ZW5kZXJPYmplY3QqIG9sZENoaWxkLCBSZW5kZXJPYmplCiAgICAgaWYgKG9sZENoaWxkLT5kb2N1 bWVudEJlaW5nRGVzdHJveWVkKCkgfHwgb2xkQ2hpbGQtPmlzSW5saW5lKCkgfHwgb2xkQ2hpbGQt PnZpcnR1YWxDb250aW51YXRpb24oKSkKICAgICAgICAgcmV0dXJuIGZhbHNlOwogCisgICAgaWYg KG9sZENoaWxkLT5wYXJlbnQoKSAmJiBvbGRDaGlsZC0+cGFyZW50KCktPmlzRGV0YWlscygpKQor ICAgICAgICByZXR1cm4gZmFsc2U7CisKICAgICBpZiAoKHByZXYgJiYgKCFwcmV2LT5pc0Fub255 bW91c0Jsb2NrKCkgfHwgdG9SZW5kZXJCbG9jayhwcmV2KS0+Y29udGludWF0aW9uKCkgfHwgdG9S ZW5kZXJCbG9jayhwcmV2KS0+YmVpbmdEZXN0cm95ZWQoKSkpCiAgICAgICAgIHx8IChuZXh0ICYm ICghbmV4dC0+aXNBbm9ueW1vdXNCbG9jaygpIHx8IHRvUmVuZGVyQmxvY2sobmV4dCktPmNvbnRp bnVhdGlvbigpIHx8IHRvUmVuZGVyQmxvY2sobmV4dCktPmJlaW5nRGVzdHJveWVkKCkpKSkKICAg ICAgICAgcmV0dXJuIGZhbHNlOwpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvcmVuZGVyaW5n L1JlbmRlckRldGFpbHMuY3BwIGIvU291cmNlL1dlYkNvcmUvcmVuZGVyaW5nL1JlbmRlckRldGFp bHMuY3BwCmluZGV4IDg2OTE3MjcuLmJlMmI0MzUgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3Jl L3JlbmRlcmluZy9SZW5kZXJEZXRhaWxzLmNwcAorKysgYi9Tb3VyY2UvV2ViQ29yZS9yZW5kZXJp bmcvUmVuZGVyRGV0YWlscy5jcHAKQEAgLTQ2LDggKzQ2LDEwIEBAIFJlbmRlckRldGFpbHM6OlJl bmRlckRldGFpbHMoTm9kZSogbm9kZSkKIAogdm9pZCBSZW5kZXJEZXRhaWxzOjpkZXN0cm95KCkK IHsKLSAgICBpZiAobV9tYXJrZXIpCisgICAgaWYgKG1fbWFya2VyKSB7CiAgICAgICAgIG1fbWFy a2VyLT5kZXN0cm95KCk7CisgICAgICAgIG1fbWFya2VyID0gMDsKKyAgICB9CiAKICAgICBSZW5k ZXJCbG9jazo6ZGVzdHJveSgpOwogfQpAQCAtNzksMTMgKzgxLDE5IEBAIHZvaWQgUmVuZGVyRGV0 YWlsczo6YWRkQ2hpbGQoUmVuZGVyT2JqZWN0KiBuZXdDaGlsZCwgUmVuZGVyT2JqZWN0KiBiZWZv cmVDaGlsZCkKIAogdm9pZCBSZW5kZXJEZXRhaWxzOjpyZW1vdmVDaGlsZChSZW5kZXJPYmplY3Qq IG9sZENoaWxkKQogewotICAgIGlmIChvbGRDaGlsZCA9PSBtX3N1bW1hcnlCbG9jayB8fCBvbGRD aGlsZCA9PSBtX2NvbnRlbnRCbG9jaykgeworICAgIGlmIChvbGRDaGlsZCA9PSBtX3N1bW1hcnlC bG9jaykgewogICAgICAgICBSZW5kZXJCbG9jazo6cmVtb3ZlQ2hpbGQob2xkQ2hpbGQpOwogICAg ICAgICBtX3N1bW1hcnlCbG9jayA9IDA7CiAgICAgICAgIHJldHVybjsKICAgICB9CiAKLSAgICBp ZiAob2xkQ2hpbGQgPT0gbV9tYWluU3VtbWFyeSkgeworICAgIGlmIChvbGRDaGlsZCA9PSBtX2Nv bnRlbnRCbG9jaykgeworICAgICAgICBSZW5kZXJCbG9jazo6cmVtb3ZlQ2hpbGQob2xkQ2hpbGQp OworICAgICAgICBtX2NvbnRlbnRCbG9jayA9IDA7CisgICAgICAgIHJldHVybjsKKyAgICB9CisK KyAgICBpZiAob2xkQ2hpbGQgPT0gbV9tYWluU3VtbWFyeSAmJiBtX3N1bW1hcnlCbG9jaykgewog ICAgICAgICBtX3N1bW1hcnlCbG9jay0+cmVtb3ZlQ2hpbGQobV9tYWluU3VtbWFyeSk7CiAgICAg ICAgIHJldHVybjsKICAgICB9Ci0tIAoxLjcuMQoK 86485 2011-03-22 11:28:18 -0700 2011-03-22 13:48:43 -0700 patch 0001-REGRESSION-81035-crash-in-RenderDetails-removeChild.patch text/plain 3735 luiz RnJvbSBlODQ1OWMwM2YyNjM4OWM5ZDZiZDUxNzE5MTg1OTYwYmYxMTQwYjkxIE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiBMdWl6IEFnb3N0aW5pIDxsdWl6LmFnb3N0aW5pQG9wZW5ib3Nz YS5vcmc+CkRhdGU6IFR1ZSwgMjIgTWFyIDIwMTEgMTU6MjQ6NTggLTAzMDAKU3ViamVjdDogW1BB VENIXSBSRUdSRVNTSU9OKDgxMDM1KTogY3Jhc2ggaW4gUmVuZGVyRGV0YWlsczo6cmVtb3ZlQ2hp bGQKIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD01Njc3MwoKUmV2aWV3 ZWQgYnkgTk9CT0RZIChPT1BTISkuCgpQcmV2ZW50aW5nIG1lcmdpbmcgb2YgUmVuZGVyRGV0YWls cydzIGFub255bW91cyBjaGlsZHJlbi4KCiogcmVuZGVyaW5nL1JlbmRlckJsb2NrLmNwcDoKKFdl YkNvcmU6OmNhbk1lcmdlQ29udGlndW91c0Fub255bW91c0Jsb2Nrcyk6CgpGaXhpbmcgUmVuZGVy RGV0YWlsczo6cmVtb3ZlQ2hpbGQgYW5kIGNsZWFuaW5nIG1fbWFya2VyIGluIFJlbmRlckRldGFp bHM6OmRlc3Ryb3kuCgoqIHJlbmRlcmluZy9SZW5kZXJEZXRhaWxzLmNwcDoKKFdlYkNvcmU6OlJl bmRlckRldGFpbHM6OmRlc3Ryb3kpOgooV2ViQ29yZTo6UmVuZGVyRGV0YWlsczo6cmVtb3ZlQ2hp bGQpOgotLS0KIFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZyAgICAgICAgICAgICAgICAgICB8ICAg MTggKysrKysrKysrKysrKysrKysrCiBTb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyQmxv Y2suY3BwICAgfCAgICAzICsrKwogU291cmNlL1dlYkNvcmUvcmVuZGVyaW5nL1JlbmRlckRldGFp bHMuY3BwIHwgICAxNCArKysrKysrKysrKy0tLQogMyBmaWxlcyBjaGFuZ2VkLCAzMiBpbnNlcnRp b25zKCspLCAzIGRlbGV0aW9ucygtKQoKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZyBiL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwppbmRleCA5ZGI1YTEwLi4xODI4NjIxIDEw MDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKKysrIGIvU291cmNlL1dlYkNvcmUv Q2hhbmdlTG9nCkBAIC0xLDMgKzEsMjEgQEAKKzIwMTEtMDMtMjIgIEx1aXogQWdvc3RpbmkgIDxs dWl6LmFnb3N0aW5pQG9wZW5ib3NzYS5vcmc+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZ IChPT1BTISkuCisKKyAgICAgICAgUkVHUkVTU0lPTig4MTAzNSk6IGNyYXNoIGluIFJlbmRlckRl dGFpbHM6OnJlbW92ZUNoaWxkCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3df YnVnLmNnaT9pZD01Njc3MworCisgICAgICAgIFByZXZlbnRpbmcgbWVyZ2luZyBvZiBSZW5kZXJE ZXRhaWxzJ3MgYW5vbnltb3VzIGNoaWxkcmVuLgorCisgICAgICAgICogcmVuZGVyaW5nL1JlbmRl ckJsb2NrLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OmNhbk1lcmdlQ29udGlndW91c0Fub255bW91 c0Jsb2Nrcyk6CisKKyAgICAgICAgRml4aW5nIFJlbmRlckRldGFpbHM6OnJlbW92ZUNoaWxkIGFu ZCBjbGVhbmluZyBtX21hcmtlciBpbiBSZW5kZXJEZXRhaWxzOjpkZXN0cm95LgorCisgICAgICAg ICogcmVuZGVyaW5nL1JlbmRlckRldGFpbHMuY3BwOgorICAgICAgICAoV2ViQ29yZTo6UmVuZGVy RGV0YWlsczo6ZGVzdHJveSk6CisgICAgICAgIChXZWJDb3JlOjpSZW5kZXJEZXRhaWxzOjpyZW1v dmVDaGlsZCk6CisKIDIwMTEtMDMtMjIgIFNoZXJpZmYgQm90ICA8d2Via2l0LnJldmlldy5ib3RA Z21haWwuY29tPgogCiAgICAgICAgIFVucmV2aWV3ZWQsIHJvbGxpbmcgb3V0IHI4MTY1My4KZGlm ZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL3JlbmRlcmluZy9SZW5kZXJCbG9jay5jcHAgYi9Tb3Vy Y2UvV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyQmxvY2suY3BwCmluZGV4IGZhZDk4ODIuLmY0MTFh ODQgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL3JlbmRlcmluZy9SZW5kZXJCbG9jay5jcHAK KysrIGIvU291cmNlL1dlYkNvcmUvcmVuZGVyaW5nL1JlbmRlckJsb2NrLmNwcApAQCAtOTMzLDYg KzkzMyw5IEBAIHN0YXRpYyBib29sIGNhbk1lcmdlQ29udGlndW91c0Fub255bW91c0Jsb2NrcyhS ZW5kZXJPYmplY3QqIG9sZENoaWxkLCBSZW5kZXJPYmplCiAgICAgaWYgKG9sZENoaWxkLT5kb2N1 bWVudEJlaW5nRGVzdHJveWVkKCkgfHwgb2xkQ2hpbGQtPmlzSW5saW5lKCkgfHwgb2xkQ2hpbGQt PnZpcnR1YWxDb250aW51YXRpb24oKSkKICAgICAgICAgcmV0dXJuIGZhbHNlOwogCisgICAgaWYg KG9sZENoaWxkLT5wYXJlbnQoKSAmJiBvbGRDaGlsZC0+cGFyZW50KCktPmlzRGV0YWlscygpKQor ICAgICAgICByZXR1cm4gZmFsc2U7CisKICAgICBpZiAoKHByZXYgJiYgKCFwcmV2LT5pc0Fub255 bW91c0Jsb2NrKCkgfHwgdG9SZW5kZXJCbG9jayhwcmV2KS0+Y29udGludWF0aW9uKCkgfHwgdG9S ZW5kZXJCbG9jayhwcmV2KS0+YmVpbmdEZXN0cm95ZWQoKSkpCiAgICAgICAgIHx8IChuZXh0ICYm ICghbmV4dC0+aXNBbm9ueW1vdXNCbG9jaygpIHx8IHRvUmVuZGVyQmxvY2sobmV4dCktPmNvbnRp bnVhdGlvbigpIHx8IHRvUmVuZGVyQmxvY2sobmV4dCktPmJlaW5nRGVzdHJveWVkKCkpKSkKICAg ICAgICAgcmV0dXJuIGZhbHNlOwpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvcmVuZGVyaW5n L1JlbmRlckRldGFpbHMuY3BwIGIvU291cmNlL1dlYkNvcmUvcmVuZGVyaW5nL1JlbmRlckRldGFp bHMuY3BwCmluZGV4IDg2OTE3MjcuLmJlMmI0MzUgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3Jl L3JlbmRlcmluZy9SZW5kZXJEZXRhaWxzLmNwcAorKysgYi9Tb3VyY2UvV2ViQ29yZS9yZW5kZXJp bmcvUmVuZGVyRGV0YWlscy5jcHAKQEAgLTQ2LDggKzQ2LDEwIEBAIFJlbmRlckRldGFpbHM6OlJl bmRlckRldGFpbHMoTm9kZSogbm9kZSkKIAogdm9pZCBSZW5kZXJEZXRhaWxzOjpkZXN0cm95KCkK IHsKLSAgICBpZiAobV9tYXJrZXIpCisgICAgaWYgKG1fbWFya2VyKSB7CiAgICAgICAgIG1fbWFy a2VyLT5kZXN0cm95KCk7CisgICAgICAgIG1fbWFya2VyID0gMDsKKyAgICB9CiAKICAgICBSZW5k ZXJCbG9jazo6ZGVzdHJveSgpOwogfQpAQCAtNzksMTMgKzgxLDE5IEBAIHZvaWQgUmVuZGVyRGV0 YWlsczo6YWRkQ2hpbGQoUmVuZGVyT2JqZWN0KiBuZXdDaGlsZCwgUmVuZGVyT2JqZWN0KiBiZWZv cmVDaGlsZCkKIAogdm9pZCBSZW5kZXJEZXRhaWxzOjpyZW1vdmVDaGlsZChSZW5kZXJPYmplY3Qq IG9sZENoaWxkKQogewotICAgIGlmIChvbGRDaGlsZCA9PSBtX3N1bW1hcnlCbG9jayB8fCBvbGRD aGlsZCA9PSBtX2NvbnRlbnRCbG9jaykgeworICAgIGlmIChvbGRDaGlsZCA9PSBtX3N1bW1hcnlC bG9jaykgewogICAgICAgICBSZW5kZXJCbG9jazo6cmVtb3ZlQ2hpbGQob2xkQ2hpbGQpOwogICAg ICAgICBtX3N1bW1hcnlCbG9jayA9IDA7CiAgICAgICAgIHJldHVybjsKICAgICB9CiAKLSAgICBp ZiAob2xkQ2hpbGQgPT0gbV9tYWluU3VtbWFyeSkgeworICAgIGlmIChvbGRDaGlsZCA9PSBtX2Nv bnRlbnRCbG9jaykgeworICAgICAgICBSZW5kZXJCbG9jazo6cmVtb3ZlQ2hpbGQob2xkQ2hpbGQp OworICAgICAgICBtX2NvbnRlbnRCbG9jayA9IDA7CisgICAgICAgIHJldHVybjsKKyAgICB9CisK KyAgICBpZiAob2xkQ2hpbGQgPT0gbV9tYWluU3VtbWFyeSAmJiBtX3N1bW1hcnlCbG9jaykgewog ICAgICAgICBtX3N1bW1hcnlCbG9jay0+cmVtb3ZlQ2hpbGQobV9tYWluU3VtbWFyeSk7CiAgICAg ICAgIHJldHVybjsKICAgICB9Ci0tIAoxLjcuMQoK 86499 2011-03-22 13:48:43 -0700 2011-03-23 15:04:31 -0700 patch 0001-REGRESSION-81035-crash-in-RenderDetails-removeChild.patch text/plain 6254 luiz RnJvbSAzZjI2ZWM2OTkzOWM4YThjZGYxZDE3Y2E5MTkwOWM1NTcyMTQyZWM0IE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiBMdWl6IEFnb3N0aW5pIDxsdWl6LmFnb3N0aW5pQG9wZW5ib3Nz YS5vcmc+CkRhdGU6IFR1ZSwgMjIgTWFyIDIwMTEgMTc6Mjc6MjcgLTAzMDAKU3ViamVjdDogW1BB VENIXSBSRUdSRVNTSU9OKDgxMDM1KTogY3Jhc2ggaW4gUmVuZGVyRGV0YWlsczo6cmVtb3ZlQ2hp bGQKIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD01Njc3MwoKUmV2aWV3 ZWQgYnkgTk9CT0RZIChPT1BTISkuCgpTb3VyY2UvV2ViQ29yZToKClRlc3Q6IGZhc3QvaHRtbC9k ZXRhaWxzLWNoaWxkcmVuLW1lcmdlLWNyYXNoLmh0bWwKClByZXZlbnRpbmcgbWVyZ2luZyBvZiBS ZW5kZXJEZXRhaWxzJ3MgYW5vbnltb3VzIGNoaWxkcmVuLgoKKiByZW5kZXJpbmcvUmVuZGVyQmxv Y2suY3BwOgooV2ViQ29yZTo6Y2FuTWVyZ2VDb250aWd1b3VzQW5vbnltb3VzQmxvY2tzKToKCkZp eGluZyBSZW5kZXJEZXRhaWxzOjpyZW1vdmVDaGlsZCBhbmQgY2xlYW5pbmcgbV9tYXJrZXIgaW4g UmVuZGVyRGV0YWlsczo6ZGVzdHJveS4KCiogcmVuZGVyaW5nL1JlbmRlckRldGFpbHMuY3BwOgoo V2ViQ29yZTo6UmVuZGVyRGV0YWlsczo6ZGVzdHJveSk6CihXZWJDb3JlOjpSZW5kZXJEZXRhaWxz OjpyZW1vdmVDaGlsZCk6CgpMYXlvdXRUZXN0czoKCiogZmFzdC9odG1sL2RldGFpbHMtY2hpbGRy ZW4tbWVyZ2UtY3Jhc2gtZXhwZWN0ZWQudHh0OiBBZGRlZC4KKiBmYXN0L2h0bWwvZGV0YWlscy1j aGlsZHJlbi1tZXJnZS1jcmFzaC5odG1sOiBBZGRlZC4KLS0tCiBMYXlvdXRUZXN0cy9DaGFuZ2VM b2cgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8ICAgMTAgKysrKysrCiAuLi4vaHRtbC9k ZXRhaWxzLWNoaWxkcmVuLW1lcmdlLWNyYXNoLWV4cGVjdGVkLnR4dCB8ICAgIDIgKwogLi4uL2Zh c3QvaHRtbC9kZXRhaWxzLWNoaWxkcmVuLW1lcmdlLWNyYXNoLmh0bWwgICAgfCAgIDMxICsrKysr KysrKysrKysrKysrKysrCiBTb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cgICAgICAgICAgICAgICAg ICAgICAgICAgICB8ICAgMjAgKysrKysrKysrKysrKwogU291cmNlL1dlYkNvcmUvcmVuZGVyaW5n L1JlbmRlckJsb2NrLmNwcCAgICAgICAgICAgfCAgICAzICsrCiBTb3VyY2UvV2ViQ29yZS9yZW5k ZXJpbmcvUmVuZGVyRGV0YWlscy5jcHAgICAgICAgICB8ICAgMTQgKysrKysrKy0tCiA2IGZpbGVz IGNoYW5nZWQsIDc3IGluc2VydGlvbnMoKyksIDMgZGVsZXRpb25zKC0pCiBjcmVhdGUgbW9kZSAx MDA2NDQgTGF5b3V0VGVzdHMvZmFzdC9odG1sL2RldGFpbHMtY2hpbGRyZW4tbWVyZ2UtY3Jhc2gt ZXhwZWN0ZWQudHh0CiBjcmVhdGUgbW9kZSAxMDA2NDQgTGF5b3V0VGVzdHMvZmFzdC9odG1sL2Rl dGFpbHMtY2hpbGRyZW4tbWVyZ2UtY3Jhc2guaHRtbAoKZGlmZiAtLWdpdCBhL0xheW91dFRlc3Rz L0NoYW5nZUxvZyBiL0xheW91dFRlc3RzL0NoYW5nZUxvZwppbmRleCBjZjRkMDE4Li4xYWYzYWIz IDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKKysrIGIvTGF5b3V0VGVzdHMvQ2hh bmdlTG9nCkBAIC0xLDMgKzEsMTMgQEAKKzIwMTEtMDMtMjIgIEx1aXogQWdvc3RpbmkgIDxsdWl6 LmFnb3N0aW5pQG9wZW5ib3NzYS5vcmc+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChP T1BTISkuCisKKyAgICAgICAgUkVHUkVTU0lPTig4MTAzNSk6IGNyYXNoIGluIFJlbmRlckRldGFp bHM6OnJlbW92ZUNoaWxkCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVn LmNnaT9pZD01Njc3MworCisgICAgICAgICogZmFzdC9odG1sL2RldGFpbHMtY2hpbGRyZW4tbWVy Z2UtY3Jhc2gtZXhwZWN0ZWQudHh0OiBBZGRlZC4KKyAgICAgICAgKiBmYXN0L2h0bWwvZGV0YWls cy1jaGlsZHJlbi1tZXJnZS1jcmFzaC5odG1sOiBBZGRlZC4KKwogMjAxMS0wMy0yMiAgU2hlcmlm ZiBCb3QgIDx3ZWJraXQucmV2aWV3LmJvdEBnbWFpbC5jb20+CiAKICAgICAgICAgVW5yZXZpZXdl ZCwgcm9sbGluZyBvdXQgcjgxNjY0LgpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvZmFzdC9odG1s L2RldGFpbHMtY2hpbGRyZW4tbWVyZ2UtY3Jhc2gtZXhwZWN0ZWQudHh0IGIvTGF5b3V0VGVzdHMv ZmFzdC9odG1sL2RldGFpbHMtY2hpbGRyZW4tbWVyZ2UtY3Jhc2gtZXhwZWN0ZWQudHh0Cm5ldyBm aWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAuLjEwNDJjNzYKLS0tIC9kZXYvbnVsbAorKysg Yi9MYXlvdXRUZXN0cy9mYXN0L2h0bWwvZGV0YWlscy1jaGlsZHJlbi1tZXJnZS1jcmFzaC1leHBl Y3RlZC50eHQKQEAgLTAsMCArMSwyIEBACitUZXN0IHBhc3NlcyBpZiBpdCBkb2VzIG5vdCBjcmFz aC4KKwpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvZmFzdC9odG1sL2RldGFpbHMtY2hpbGRyZW4t bWVyZ2UtY3Jhc2guaHRtbCBiL0xheW91dFRlc3RzL2Zhc3QvaHRtbC9kZXRhaWxzLWNoaWxkcmVu LW1lcmdlLWNyYXNoLmh0bWwKbmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMC4uNmU4 MjA1NgotLS0gL2Rldi9udWxsCisrKyBiL0xheW91dFRlc3RzL2Zhc3QvaHRtbC9kZXRhaWxzLWNo aWxkcmVuLW1lcmdlLWNyYXNoLmh0bWwKQEAgLTAsMCArMSwzMSBAQAorCis8c2NyaXB0PgorCit2 YXIgcnVuVGVzdHMgPSBmdW5jdGlvbiAoKSB7CisKKyAgICBpZiAoIXdpbmRvdy5sYXlvdXRUZXN0 Q29udHJvbGxlcikKKyAgICAgICAgcmV0dXJuOworCisgICAgbGF5b3V0VGVzdENvbnRyb2xsZXIu ZHVtcEFzVGV4dCgpOworICAgIGxheW91dFRlc3RDb250cm9sbGVyLndhaXRVbnRpbERvbmUoKTsK KworICAgIHZhciBkID0gZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoImQxIik7CisKKyAgICBzZXRU aW1lb3V0KGZ1bmN0aW9uICgpIHsKKyAgICAgICAgZC5vcGVuID0gZmFsc2U7CisgICAgICAgIHNl dFRpbWVvdXQoZnVuY3Rpb24gKCkgeworICAgICAgICAgICAgZC5vcGVuID0gdHJ1ZTsKKyAgICAg ICAgICAgIHNldFRpbWVvdXQoZnVuY3Rpb24gKCkgeworICAgICAgICAgICAgICAgIGQub3BlbiA9 IGZhbHNlOworICAgICAgICAgICAgICAgIGxheW91dFRlc3RDb250cm9sbGVyLm5vdGlmeURvbmUo KTsKKyAgICAgICAgICAgIH0sIDEpOworICAgICAgICB9LCAxKTsKKyAgICB9LCAxKTsKK307CisK Kzwvc2NyaXB0PgorCis8Ym9keSBvbmxvYWQ9InJ1blRlc3RzKCkiPgorICAgIFRlc3QgcGFzc2Vz IGlmIGl0IGRvZXMgbm90IGNyYXNoLgorICAgIDxsaT48ZGV0YWlscyBvcGVuIGlkPSJkMSI+c29t ZSB0ZXh0PC9kZXRhaWxzPjwvbGk+Cis8L2JvZHk+CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29y ZS9DaGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggOWRiNWExMC4uNjc4 MjYzZCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9X ZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDIzIEBACisyMDExLTAzLTIyICBMdWl6IEFnb3N0 aW5pICA8bHVpei5hZ29zdGluaUBvcGVuYm9zc2Eub3JnPgorCisgICAgICAgIFJldmlld2VkIGJ5 IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIFJFR1JFU1NJT04oODEwMzUpOiBjcmFzaCBpbiBS ZW5kZXJEZXRhaWxzOjpyZW1vdmVDaGlsZAorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9y Zy9zaG93X2J1Zy5jZ2k/aWQ9NTY3NzMKKworICAgICAgICBUZXN0OiBmYXN0L2h0bWwvZGV0YWls cy1jaGlsZHJlbi1tZXJnZS1jcmFzaC5odG1sCisKKyAgICAgICAgUHJldmVudGluZyBtZXJnaW5n IG9mIFJlbmRlckRldGFpbHMncyBhbm9ueW1vdXMgY2hpbGRyZW4uCisKKyAgICAgICAgKiByZW5k ZXJpbmcvUmVuZGVyQmxvY2suY3BwOgorICAgICAgICAoV2ViQ29yZTo6Y2FuTWVyZ2VDb250aWd1 b3VzQW5vbnltb3VzQmxvY2tzKToKKworICAgICAgICBGaXhpbmcgUmVuZGVyRGV0YWlsczo6cmVt b3ZlQ2hpbGQgYW5kIGNsZWFuaW5nIG1fbWFya2VyIGluIFJlbmRlckRldGFpbHM6OmRlc3Ryb3ku CisKKyAgICAgICAgKiByZW5kZXJpbmcvUmVuZGVyRGV0YWlscy5jcHA6CisgICAgICAgIChXZWJD b3JlOjpSZW5kZXJEZXRhaWxzOjpkZXN0cm95KToKKyAgICAgICAgKFdlYkNvcmU6OlJlbmRlckRl dGFpbHM6OnJlbW92ZUNoaWxkKToKKwogMjAxMS0wMy0yMiAgU2hlcmlmZiBCb3QgIDx3ZWJraXQu cmV2aWV3LmJvdEBnbWFpbC5jb20+CiAKICAgICAgICAgVW5yZXZpZXdlZCwgcm9sbGluZyBvdXQg cjgxNjUzLgpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvcmVuZGVyaW5nL1JlbmRlckJsb2Nr LmNwcCBiL1NvdXJjZS9XZWJDb3JlL3JlbmRlcmluZy9SZW5kZXJCbG9jay5jcHAKaW5kZXggZmFk OTg4Mi4uZjQxMWE4NCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvcmVuZGVyaW5nL1JlbmRl ckJsb2NrLmNwcAorKysgYi9Tb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyQmxvY2suY3Bw CkBAIC05MzMsNiArOTMzLDkgQEAgc3RhdGljIGJvb2wgY2FuTWVyZ2VDb250aWd1b3VzQW5vbnlt b3VzQmxvY2tzKFJlbmRlck9iamVjdCogb2xkQ2hpbGQsIFJlbmRlck9iamUKICAgICBpZiAob2xk Q2hpbGQtPmRvY3VtZW50QmVpbmdEZXN0cm95ZWQoKSB8fCBvbGRDaGlsZC0+aXNJbmxpbmUoKSB8 fCBvbGRDaGlsZC0+dmlydHVhbENvbnRpbnVhdGlvbigpKQogICAgICAgICByZXR1cm4gZmFsc2U7 CiAKKyAgICBpZiAob2xkQ2hpbGQtPnBhcmVudCgpICYmIG9sZENoaWxkLT5wYXJlbnQoKS0+aXNE ZXRhaWxzKCkpCisgICAgICAgIHJldHVybiBmYWxzZTsKKwogICAgIGlmICgocHJldiAmJiAoIXBy ZXYtPmlzQW5vbnltb3VzQmxvY2soKSB8fCB0b1JlbmRlckJsb2NrKHByZXYpLT5jb250aW51YXRp b24oKSB8fCB0b1JlbmRlckJsb2NrKHByZXYpLT5iZWluZ0Rlc3Ryb3llZCgpKSkKICAgICAgICAg fHwgKG5leHQgJiYgKCFuZXh0LT5pc0Fub255bW91c0Jsb2NrKCkgfHwgdG9SZW5kZXJCbG9jayhu ZXh0KS0+Y29udGludWF0aW9uKCkgfHwgdG9SZW5kZXJCbG9jayhuZXh0KS0+YmVpbmdEZXN0cm95 ZWQoKSkpKQogICAgICAgICByZXR1cm4gZmFsc2U7CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29y ZS9yZW5kZXJpbmcvUmVuZGVyRGV0YWlscy5jcHAgYi9Tb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcv UmVuZGVyRGV0YWlscy5jcHAKaW5kZXggODY5MTcyNy4uYmUyYjQzNSAxMDA2NDQKLS0tIGEvU291 cmNlL1dlYkNvcmUvcmVuZGVyaW5nL1JlbmRlckRldGFpbHMuY3BwCisrKyBiL1NvdXJjZS9XZWJD b3JlL3JlbmRlcmluZy9SZW5kZXJEZXRhaWxzLmNwcApAQCAtNDYsOCArNDYsMTAgQEAgUmVuZGVy RGV0YWlsczo6UmVuZGVyRGV0YWlscyhOb2RlKiBub2RlKQogCiB2b2lkIFJlbmRlckRldGFpbHM6 OmRlc3Ryb3koKQogewotICAgIGlmIChtX21hcmtlcikKKyAgICBpZiAobV9tYXJrZXIpIHsKICAg ICAgICAgbV9tYXJrZXItPmRlc3Ryb3koKTsKKyAgICAgICAgbV9tYXJrZXIgPSAwOworICAgIH0K IAogICAgIFJlbmRlckJsb2NrOjpkZXN0cm95KCk7CiB9CkBAIC03OSwxMyArODEsMTkgQEAgdm9p ZCBSZW5kZXJEZXRhaWxzOjphZGRDaGlsZChSZW5kZXJPYmplY3QqIG5ld0NoaWxkLCBSZW5kZXJP YmplY3QqIGJlZm9yZUNoaWxkKQogCiB2b2lkIFJlbmRlckRldGFpbHM6OnJlbW92ZUNoaWxkKFJl bmRlck9iamVjdCogb2xkQ2hpbGQpCiB7Ci0gICAgaWYgKG9sZENoaWxkID09IG1fc3VtbWFyeUJs b2NrIHx8IG9sZENoaWxkID09IG1fY29udGVudEJsb2NrKSB7CisgICAgaWYgKG9sZENoaWxkID09 IG1fc3VtbWFyeUJsb2NrKSB7CiAgICAgICAgIFJlbmRlckJsb2NrOjpyZW1vdmVDaGlsZChvbGRD aGlsZCk7CiAgICAgICAgIG1fc3VtbWFyeUJsb2NrID0gMDsKICAgICAgICAgcmV0dXJuOwogICAg IH0KIAotICAgIGlmIChvbGRDaGlsZCA9PSBtX21haW5TdW1tYXJ5KSB7CisgICAgaWYgKG9sZENo aWxkID09IG1fY29udGVudEJsb2NrKSB7CisgICAgICAgIFJlbmRlckJsb2NrOjpyZW1vdmVDaGls ZChvbGRDaGlsZCk7CisgICAgICAgIG1fY29udGVudEJsb2NrID0gMDsKKyAgICAgICAgcmV0dXJu OworICAgIH0KKworICAgIGlmIChvbGRDaGlsZCA9PSBtX21haW5TdW1tYXJ5ICYmIG1fc3VtbWFy eUJsb2NrKSB7CiAgICAgICAgIG1fc3VtbWFyeUJsb2NrLT5yZW1vdmVDaGlsZChtX21haW5TdW1t YXJ5KTsKICAgICAgICAgcmV0dXJuOwogICAgIH0KLS0gCjEuNy4xCgo=