57743 2011-04-04 00:13:39 -0700 REGRESSION(r81887): Crash in SplitElement 2011-04-08 13:19:50 -0700 1 1 1 Unclassified WebKit HTML Editing 528+ (Nightly build) Other Other RESOLVED FIXED HasReduction P1 Critical --- 58074 58078 58081 58158 1 rniwa rniwa adele ap darin enrica ojan tkent tony yutak oldest_to_newest 378676 0 rniwa 2011-04-04 00:13:39 -0700 We're getting a lot of null pointer crash reports with the following stack trace and it's a release blocker for us: 0x6caeb8da [chrome.dll - splitelementcommand.cpp:47] WebCore::SplitElementCommand::executeApply() 0x6caeba30 [chrome.dll - splitelementcommand.cpp:76] WebCore::SplitElementCommand::doApply() 0x6ca94f52 [chrome.dll - editcommand.cpp:92] WebCore::EditCommand::apply() 0x6ca81533 [chrome.dll - compositeeditcommand.cpp:102] WebCore::CompositeEditCommand::applyCommandToComposite(WTF::PassRefPtr<WebCore::EditCommand>) 0x6ca81d53 [chrome.dll - compositeeditcommand.cpp:270] WebCore::CompositeEditCommand::splitElement(WTF::PassRefPtr<WebCore::Element>,WTF::PassRefPtr<WebCore::Node>) 0x6ca994a5 [chrome.dll - replaceselectioncommand.cpp:965] WebCore::ReplaceSelectionCommand::doApply() 0x6ca94f52 [chrome.dll - editcommand.cpp:92] WebCore::EditCommand::apply() 0x6ca950db [chrome.dll - editcommand.cpp:224] WebCore::applyCommand(WTF::PassRefPtr<WebCore::EditCommand>) 0x6c9f4964 [chrome.dll - editor.cpp:438] WebCore::Editor::replaceSelectionWithFragment(WTF::PassRefPtr<WebCore::DocumentFragment>,bool,bool,bool) 0x6c9f40c8 [chrome.dll - editor.cpp:195] WebCore::Editor::handleTextEvent(WebCore::TextEvent *) 0x6c9cf16d [chrome.dll - node.cpp:3074] WebCore::Node::defaultEventHandler(WebCore::Event *) 0x6c9ce60c [chrome.dll - node.cpp:2768] WebCore::Node::dispatchEvent(WTF::PassRefPtr<WebCore::Event>) 0x6ca642a3 [chrome.dll - eventtarget.cpp:297] WebCore::EventTarget::dispatchEvent(WTF::PassRefPtr<WebCore::Event>,int &) 0x6c9f4605 [chrome.dll - editor.cpp:381] WebCore::Editor::pasteAsFragment(WTF::PassRefPtr<WebCore::DocumentFragment>,bool,bool) 0x6c9f479a [chrome.dll - editor.cpp:403] WebCore::Editor::pasteWithPasteboard(WebCore::Pasteboard *,bool) 0x6c9f698a [chrome.dll - editor.cpp:1300] WebCore::Editor::paste() As far as I can tell, node after positon is null in: splitElement(static_cast<Element*>(parentNode), insertionPos.computeNodeAfterPosition()); See: http://trac.webkit.org/changeset/81887/trunk/Source/WebCore/editing/ReplaceSelectionCommand.cpp http://crbug.com/77685 378735 1 88051 skylined 2011-04-04 04:54:44 -0700 Created attachment 88051 Repro I think I hit this during fuzzing, repro: <pre id="x"><x style="white-space: pre-wrap;"><br></x></pre> <script> var x = document.getElementById("x"); document.execCommand("selectall",false); document.designMode="on"; console.log(x.innerHTML); // <x style="white-space: pre-wrap;"><br></x> document.execCommand("InsertImage"); // replace <br> with <img> and set some state: simply changing the original // html does not reproduce the issue. console.log(x.innerHTML); // <x style="white-space: pre-wrap;"><img></x> document.execCommand("InsertImage"); console.log(x.innerHTML); // <span class="Apple-style-span" style="font-family: 'Times New Roman'; white-space: normal; "><img></span><x style="white-space: pre-wrap;"><img></x> document.execCommand("InsertImage"); // crash console.log(x.innerHTML); </script> id: chrome.dll!WebCore::SplitElementCommand::executeApply ReadAV@NULL (3a063a704d2ab72ff3cb23ae09a074fa) description: Attempt to read from unallocated NULL pointer+0x24 in chrome.dll!WebCore::SplitElementCommand::executeApply stack: chrome.dll!WebCore::SplitElementCommand::executeApply chrome.dll!WebCore::CompositeEditCommand::applyCommandToComposite chrome.dll!WebCore::CompositeEditCommand::splitElement chrome.dll!WebCore::ReplaceSelectionCommand::doApply chrome.dll!WebCore::EditCommand::apply chrome.dll!WebCore::CompositeEditCommand::applyCommandToComposite chrome.dll!WebCore::CompositeEditCommand::moveParagraphs chrome.dll!WebCore::ReplaceSelectionCommand::doApply chrome.dll!WebCore::EditCommand::apply chrome.dll!WebCore::applyCommand chrome.dll!WebCore::executeInsertFragment chrome.dll!WebCore::executeInsertNode chrome.dll!WebCore::executeInsertImage chrome.dll!WebCore::Editor::Command::execute chrome.dll!WebCore::Document::execCommand chrome.dll!WebCore::DocumentInternal::execCommandCallback chrome.dll!v8::internal::Invoke chrome.dll!v8::internal::Execution::Call ... 381348 2 rniwa 2011-04-07 08:11:34 -0700 Sorry, wrong revision number. 382304 3 88833 rniwa 2011-04-08 09:47:22 -0700 Created attachment 88833 fixes the bug 382306 4 rniwa 2011-04-08 09:49:13 -0700 This is currently one of top crashers and blocks Chromium release. 382318 5 88833 tony 2011-04-08 09:59:45 -0700 Comment on attachment 88833 fixes the bug View in context: https://bugs.webkit.org/attachment.cgi?id=88833&action=review > Source/WebCore/editing/CompositeEditCommand.cpp:1220 > PassRefPtr<Node> CompositeEditCommand::splitTreeToNode(Node* start, Node* end, bool splitAncestor) Nit: Can we rename splitAncestor to shouldSplitAncestor? > LayoutTests/editing/inserting/insert-images-in-pre-x-crash.html:1 > +<pre id="x"><x style="white-space: pre-wrap;"><br></x></pre> Did you mean to include <html> and <body> here? Maybe a doctype too. 382321 6 88833 darin 2011-04-08 10:00:32 -0700 Comment on attachment 88833 fixes the bug View in context: https://bugs.webkit.org/attachment.cgi?id=88833&action=review > Source/WebCore/editing/ReplaceSelectionCommand.cpp:957 > + if (insertionPos.containerNode()->isTextNode() && insertionPos.offsetInContainerNode() && !insertionPos.atLastEditingPositionForNode()) { > + splitTextNodeContainingElement(static_cast<Text*>(insertionPos.anchorNode()), insertionPos.offsetInContainerNode()); It would be clearer if we called insertionPos.containerNode() both times. To someone reading the code the cast seems dangerous since the type of insertionPos.containerNode() is checked and based on that the code does a typecast of static_cast<Text*>(insertionPos.anchorNode()). Someone reading should be able to see the type safety without knowing that one condition guarantees the other. 382323 7 88833 darin 2011-04-08 10:01:06 -0700 Comment on attachment 88833 fixes the bug Oops. Review tool clobbered Tony’s review+. I’ll say review+ myself -- bugs.webkit.org doesn’t give me a way to restore his review. 382329 8 88833 enrica 2011-04-08 10:07:01 -0700 Comment on attachment 88833 fixes the bug View in context: https://bugs.webkit.org/attachment.cgi?id=88833&action=review > Source/WebCore/editing/CompositeEditCommand.cpp:-1225 > - for (node = start; node && node->parentNode() != end; node = node->parentNode()) { I think you should add a comment here explaining the logic, something similar to what you have in the ChangeLog. > Source/WebCore/editing/ReplaceSelectionCommand.cpp:966 > } Does this move the insertion point also when there is nothing to split? For example, if you have <b><i>hello</i></b> and the original insertion point is at offset 0 in the text node, does it move the insertion point before the b tag? 382330 9 rniwa 2011-04-08 10:07:42 -0700 Thanks for the review, Tony & Darin! (In reply to comment #5) > (From update of attachment 88833 [details]) > View in context: https://bugs.webkit.org/attachment.cgi?id=88833&action=review > > > Source/WebCore/editing/CompositeEditCommand.cpp:1220 > > PassRefPtr<Node> CompositeEditCommand::splitTreeToNode(Node* start, Node* end, bool splitAncestor) > > Nit: Can we rename splitAncestor to shouldSplitAncestor? Will do! > > LayoutTests/editing/inserting/insert-images-in-pre-x-crash.html:1 > > +<pre id="x"><x style="white-space: pre-wrap;"><br></x></pre> > > Did you mean to include <html> and <body> here? Maybe a doctype too. It tried but the crash doesn't reproduce if we have DOCTYPE, html, or body. It's a really fragile test. I'll add a comment in the test so that people don't accidentally add them in the future. (In reply to comment #6) > (From update of attachment 88833 [details]) > View in context: https://bugs.webkit.org/attachment.cgi?id=88833&action=review > > > Source/WebCore/editing/ReplaceSelectionCommand.cpp:957 > > + if (insertionPos.containerNode()->isTextNode() && insertionPos.offsetInContainerNode() && !insertionPos.atLastEditingPositionForNode()) { > > + splitTextNodeContainingElement(static_cast<Text*>(insertionPos.anchorNode()), insertionPos.offsetInContainerNode()); > > It would be clearer if we called insertionPos.containerNode() both times. To someone reading the code the cast seems dangerous since the type of insertionPos.containerNode() is checked and based on that the code does a typecast of static_cast<Text*>(insertionPos.anchorNode()). Someone reading should be able to see the type safety without knowing that one condition guarantees the other. Oops, yeah I totally agree. I must have copied & pasted from the old code and forgot to change it. Will fix! 382331 10 88833 rniwa 2011-04-08 10:09:57 -0700 Comment on attachment 88833 fixes the bug View in context: https://bugs.webkit.org/attachment.cgi?id=88833&action=review Thanks for the feedback, Enrica! >> Source/WebCore/editing/CompositeEditCommand.cpp:-1225 > > I think you should add a comment here explaining the logic, something similar to what you have in the ChangeLog. Which part of change log are you referring to? >> Source/WebCore/editing/ReplaceSelectionCommand.cpp:966 >> } > > Does this move the insertion point also when there is nothing to split? For example, if you have <b><i>hello</i></b> and the original insertion point is at offset 0 in the text node, does it move the insertion point before the b tag? Yes. 382333 11 enrica 2011-04-08 10:11:10 -0700 (In reply to comment #10) > (From update of attachment 88833 [details]) > View in context: https://bugs.webkit.org/attachment.cgi?id=88833&action=review > > Thanks for the feedback, Enrica! > > >> Source/WebCore/editing/CompositeEditCommand.cpp:-1225 > > > > > I think you should add a comment here explaining the logic, something similar to what you have in the ChangeLog. > > Which part of change log are you referring to? where you explain the changes to CompositeEditCommand.cpp. > > >> Source/WebCore/editing/ReplaceSelectionCommand.cpp:966 > >> } > > > > Does this move the insertion point also when there is nothing to split? For example, if you have <b><i>hello</i></b> and the original insertion point is at offset 0 in the text node, does it move the insertion point before the b tag? > > Yes. 382340 12 rniwa 2011-04-08 10:18:06 -0700 (In reply to comment #11) > (In reply to comment #10) > > Which part of change log are you referring to? > where you explain the changes to CompositeEditCommand.cpp. Oh you mean not to duplicate nodes? How about this? if (!node->parentNode()->isElementNode()) break; // Do not split a node when doing so introduces an empty node VisiblePosition positionInParent = firstPositionInNode(node->parentNode()); VisiblePosition positionInNode = firstPositionInOrBeforeNode(node.get()); if (positionInParent != positionInNode) splitElement(static_cast<Element*>(node->parentNode()), node); 382361 13 enrica 2011-04-08 10:35:12 -0700 (In reply to comment #12) > (In reply to comment #11) > > (In reply to comment #10) > > > Which part of change log are you referring to? > > where you explain the changes to CompositeEditCommand.cpp. > > Oh you mean not to duplicate nodes? How about this? > > if (!node->parentNode()->isElementNode()) > break; > // Do not split a node when doing so introduces an empty node > VisiblePosition positionInParent = firstPositionInNode(node->parentNode()); > VisiblePosition positionInNode = firstPositionInOrBeforeNode(node.get()); > if (positionInParent != positionInNode) > splitElement(static_cast<Element*>(node->parentNode()), node); Yes, thank you! 382452 14 rniwa 2011-04-08 12:29:27 -0700 Committed r83322: <http://trac.webkit.org/changeset/83322> 88051 2011-04-04 04:54:44 -0700 2011-04-04 04:54:44 -0700 Repro repro.html text/html 865 skylined PHByZSBpZD0ieCI+PHggc3R5bGU9IndoaXRlLXNwYWNlOiBwcmUtd3JhcDsiPjxicj48L3g+PC9w cmU+CjxzY3JpcHQ+CiAgdmFyIHggPSBkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgieCIpOwogIGRv Y3VtZW50LmV4ZWNDb21tYW5kKCJzZWxlY3RhbGwiLGZhbHNlKTsKICBkb2N1bWVudC5kZXNpZ25N b2RlPSJvbiI7CiAgY29uc29sZS5sb2coeC5pbm5lckhUTUwpOyAgICAgICAgICAgICAvLyA8eCBz dHlsZT0id2hpdGUtc3BhY2U6IHByZS13cmFwOyI+PGJyPjwveD4KICBkb2N1bWVudC5leGVjQ29t bWFuZCgiSW5zZXJ0SW1hZ2UiKTsgIC8vIHJlcGxhY2UgPGJyPiB3aXRoIDxpbWc+IGFuZCBzZXQg c29tZSBzdGF0ZTogc2ltcGx5IGNoYW5naW5nIHRoZSBvcmlnaW5hbAogICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgLy8gaHRtbCBkb2VzIG5vdCByZXByb2R1Y2UgdGhlIGlz c3VlLgogIGNvbnNvbGUubG9nKHguaW5uZXJIVE1MKTsgICAgICAgICAgICAgLy8gPHggc3R5bGU9 IndoaXRlLXNwYWNlOiBwcmUtd3JhcDsiPjxpbWc+PC94PgogIGRvY3VtZW50LmV4ZWNDb21tYW5k KCJJbnNlcnRJbWFnZSIpOwogIGNvbnNvbGUubG9nKHguaW5uZXJIVE1MKTsgICAgICAgICAgICAg Ly8gPHNwYW4gY2xhc3M9IkFwcGxlLXN0eWxlLXNwYW4iIHN0eWxlPSJmb250LWZhbWlseTogJ1Rp bWVzIE5ldyBSb21hbic7IHdoaXRlLXNwYWNlOiBub3JtYWw7ICI+PGltZz48L3NwYW4+PHggc3R5 bGU9IndoaXRlLXNwYWNlOiBwcmUtd3JhcDsiPjxpbWc+PC94PgogIGRvY3VtZW50LmV4ZWNDb21t YW5kKCJJbnNlcnRJbWFnZSIpOyAgLy8gY3Jhc2gKICBjb25zb2xlLmxvZyh4LmlubmVySFRNTCk7 Cjwvc2NyaXB0Pg== 88833 2011-04-08 09:47:22 -0700 2011-04-08 10:09:57 -0700 fixes the bug bug-57743-20110408194718.patch text/plain 8480 rniwa SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDgzMzA0KQorKysgU291cmNlL1dlYkNvcmUvQ2hhbmdl TG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMjggQEAKKzIwMTEtMDQtMDggIFJ5b3N1a2Ug Tml3YSAgPHJuaXdhQHdlYmtpdC5vcmc+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChP T1BTISkuCisKKyAgICAgICAgUkVHUkVTU0lPTihyODE4ODcpOiBDcmFzaCBpbiBTcGxpdEVsZW1l bnQKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTU3NzQz CisKKyAgICAgICAgVGhlIGNyYXNoIHdhcyBjYXVzZWQgYnkgUmVwbGFjZVNlbGVjdGlvbkNvbW1h bmQ6OmRvQXBwbHkncyBjYWxsaW5nIHNwbGl0RWxlbWVudCB3aXRoIGNvbXB1dGVOb2RlQWZ0ZXJQ b3NpdGlvbgorICAgICAgICBldmVuIHdoZW4gdGhlIHBvc2l0aW9uIHdhcyBhZnRlciB0aGUgbGFz dCBub2RlIGluIGl0IGNvbnRhaW5lci4gU2luY2UgYWxsIHdlIGFyZSBkb2luZyBoZXJlIGlzIHRv IHNwbGl0dGluZyB0cmVlCisgICAgICAgIHVwIHVudGlsIHRoZSBoaWdoZXN0IGFuY2VzdG9yIHdp dGggaXNJbmxpbmVOb2RlV2l0aFN0eWxlLCByZXBsYWNlZCB0aGUgd2hpbGUgbG9vcCBieSBjYWxs cyB0byBzcGxpdFRyZWVUb05vZGUKKyAgICAgICAgYW5kIGhpZ2hlc3RFbmNsb3NpbmdOb2RlT2ZU eXBlLgorCisgICAgICAgIEFsc28gZml4ZWQgYSBidWcgaW4gc3BsaXRUcmVlVG9Ob2RlIG5vdCB0 byBjaGVjayB0aGUgZGlmZmVyZW5jZSBpbiB2aXNpYmxlIHBvc2l0aW9uIHdoZW4gc3BsaXR0aW5n IHRoZSBhbmNlc3RvciwKKyAgICAgICAgd2hpY2ggd291bGQgaGF2ZSBpbnRyb2R1Y2VkIHVubmVj ZXNzYXJ5IG5vZGVzIHdoZW4gc3BsaXR0aW5nIHRyZWUgYW5kIGEgYnVnIGluIGhpZ2hlc3RFbmNs b3NpbmdOb2RlT2ZUeXBlIHRoYXQKKyAgICAgICAgaXQgaW5jb3JyZWN0bHkgY2FsbGVkIGRlcHJl Y2F0ZWROb2RlIGluc3RlYWQgb2YgY29udGFpbmVyTm9kZS4KKworICAgICAgICBUZXN0OiBlZGl0 aW5nL2luc2VydGluZy9pbnNlcnQtaW1hZ2VzLWluLXByZS14LWNyYXNoLmh0bWwKKworICAgICAg ICAqIGVkaXRpbmcvQ29tcG9zaXRlRWRpdENvbW1hbmQuY3BwOgorICAgICAgICAoV2ViQ29yZTo6 Q29tcG9zaXRlRWRpdENvbW1hbmQ6OnNwbGl0VHJlZVRvTm9kZSk6CisgICAgICAgICogZWRpdGlu Zy9SZXBsYWNlU2VsZWN0aW9uQ29tbWFuZC5jcHA6CisgICAgICAgIChXZWJDb3JlOjpSZXBsYWNl U2VsZWN0aW9uQ29tbWFuZDo6ZG9BcHBseSk6CisgICAgICAgICogZWRpdGluZy9odG1sZWRpdGlu Zy5jcHA6CisgICAgICAgIChXZWJDb3JlOjpoaWdoZXN0RW5jbG9zaW5nTm9kZU9mVHlwZSk6CisK IDIwMTEtMDQtMDUgIERpbWl0cmkgR2xhemtvdiAgPGRnbGF6a292QGNocm9taXVtLm9yZz4KIAog ICAgICAgICBSZXZpZXdlZCBieSBEYXJpbiBBZGxlci4KSW5kZXg6IFNvdXJjZS9XZWJDb3JlL2Vk aXRpbmcvQ29tcG9zaXRlRWRpdENvbW1hbmQuY3BwCj09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9XZWJD b3JlL2VkaXRpbmcvQ29tcG9zaXRlRWRpdENvbW1hbmQuY3BwCShyZXZpc2lvbiA4MzI3NCkKKysr IFNvdXJjZS9XZWJDb3JlL2VkaXRpbmcvQ29tcG9zaXRlRWRpdENvbW1hbmQuY3BwCSh3b3JraW5n IGNvcHkpCkBAIC0xMjE5LDIxICsxMjE5LDI0IEBAIFBvc2l0aW9uIENvbXBvc2l0ZUVkaXRDb21t YW5kOjpwb3NpdGlvbkEKIC8vIHRvIGRldGVybWluZSBpZiB0aGUgc3BsaXQgaXMgbmVjZXNzYXJ5 LiBSZXR1cm5zIHRoZSBsYXN0IHNwbGl0IG5vZGUuCiBQYXNzUmVmUHRyPE5vZGU+IENvbXBvc2l0 ZUVkaXRDb21tYW5kOjpzcGxpdFRyZWVUb05vZGUoTm9kZSogc3RhcnQsIE5vZGUqIGVuZCwgYm9v bCBzcGxpdEFuY2VzdG9yKQogeworICAgIEFTU0VSVChzdGFydCk7CisgICAgQVNTRVJUKGVuZCk7 CiAgICAgQVNTRVJUKHN0YXJ0ICE9IGVuZCk7CiAKICAgICBSZWZQdHI8Tm9kZT4gbm9kZTsKLSAg ICBmb3IgKG5vZGUgPSBzdGFydDsgbm9kZSAmJiBub2RlLT5wYXJlbnROb2RlKCkgIT0gZW5kOyBu b2RlID0gbm9kZS0+cGFyZW50Tm9kZSgpKSB7CisgICAgaWYgKHNwbGl0QW5jZXN0b3IgJiYgZW5k LT5wYXJlbnROb2RlKCkpCisgICAgICAgIGVuZCA9IGVuZC0+cGFyZW50Tm9kZSgpOworCisgICAg UmVmUHRyPE5vZGU+IGVuZE5vZGUgPSBlbmQ7CisgICAgZm9yIChub2RlID0gc3RhcnQ7IG5vZGUg JiYgbm9kZS0+cGFyZW50Tm9kZSgpICE9IGVuZE5vZGU7IG5vZGUgPSBub2RlLT5wYXJlbnROb2Rl KCkpIHsKICAgICAgICAgaWYgKCFub2RlLT5wYXJlbnROb2RlKCktPmlzRWxlbWVudE5vZGUoKSkK ICAgICAgICAgICAgIGJyZWFrOwotICAgICAgICBWaXNpYmxlUG9zaXRpb24gcG9zaXRpb25JblBh cmVudChmaXJzdFBvc2l0aW9uSW5Ob2RlKG5vZGUtPnBhcmVudE5vZGUoKSksIERPV05TVFJFQU0p OwotICAgICAgICBWaXNpYmxlUG9zaXRpb24gcG9zaXRpb25Jbk5vZGUoZmlyc3RQb3NpdGlvbklu T3JCZWZvcmVOb2RlKG5vZGUuZ2V0KCkpLCBET1dOU1RSRUFNKTsKKyAgICAgICAgVmlzaWJsZVBv c2l0aW9uIHBvc2l0aW9uSW5QYXJlbnQgPSBmaXJzdFBvc2l0aW9uSW5Ob2RlKG5vZGUtPnBhcmVu dE5vZGUoKSk7CisgICAgICAgIFZpc2libGVQb3NpdGlvbiBwb3NpdGlvbkluTm9kZSA9IGZpcnN0 UG9zaXRpb25Jbk9yQmVmb3JlTm9kZShub2RlLmdldCgpKTsKICAgICAgICAgaWYgKHBvc2l0aW9u SW5QYXJlbnQgIT0gcG9zaXRpb25Jbk5vZGUpCi0gICAgICAgICAgICBhcHBseUNvbW1hbmRUb0Nv bXBvc2l0ZShTcGxpdEVsZW1lbnRDb21tYW5kOjpjcmVhdGUoc3RhdGljX2Nhc3Q8RWxlbWVudCo+ KG5vZGUtPnBhcmVudE5vZGUoKSksIG5vZGUpKTsKLSAgICB9Ci0gICAgaWYgKHNwbGl0QW5jZXN0 b3IpIHsKLSAgICAgICAgc3BsaXRFbGVtZW50KHN0YXRpY19jYXN0PEVsZW1lbnQqPihlbmQpLCBu b2RlKTsKLSAgICAgICAgcmV0dXJuIG5vZGUtPnBhcmVudE5vZGUoKTsKKyAgICAgICAgICAgIHNw bGl0RWxlbWVudChzdGF0aWNfY2FzdDxFbGVtZW50Kj4obm9kZS0+cGFyZW50Tm9kZSgpKSwgbm9k ZSk7CiAgICAgfQorCiAgICAgcmV0dXJuIG5vZGUucmVsZWFzZSgpOwogfQogCkluZGV4OiBTb3Vy Y2UvV2ViQ29yZS9lZGl0aW5nL1JlcGxhY2VTZWxlY3Rpb25Db21tYW5kLmNwcAo9PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 Ci0tLSBTb3VyY2UvV2ViQ29yZS9lZGl0aW5nL1JlcGxhY2VTZWxlY3Rpb25Db21tYW5kLmNwcAko cmV2aXNpb24gODMyNzQpCisrKyBTb3VyY2UvV2ViQ29yZS9lZGl0aW5nL1JlcGxhY2VTZWxlY3Rp b25Db21tYW5kLmNwcAkod29ya2luZyBjb3B5KQpAQCAtOTUyLDIwICs5NTIsMTcgQEAgdm9pZCBS ZXBsYWNlU2VsZWN0aW9uQ29tbWFuZDo6ZG9BcHBseSgpCiAgICAgLy8gV2UgY2FuIHNraXAgdGhp cyBvcHRpbWl6YXRpb24gZm9yIGZyYWdtZW50cyBub3Qgd3JhcHBlZCBpbiBvbmUgb2YKICAgICAv LyBvdXIgc3R5bGUgc3BhbnMgYW5kIGZvciBwb3NpdGlvbnMgaW5zaWRlIGxpc3QgaXRlbXMKICAg ICAvLyBzaW5jZSBpbnNlcnRBc0xpc3RJdGVtcyBhbHJlYWR5IGRvZXMgdGhlIHJpZ2h0IHRoaW5n LgotICAgIGlmICghbV9tYXRjaFN0eWxlICYmICFlbmNsb3NpbmdMaXN0KGluc2VydGlvblBvcy5h bmNob3JOb2RlKCkpICYmIGlzU3R5bGVTcGFuKGZyYWdtZW50LmZpcnN0Q2hpbGQoKSkpIHsKLSAg ICAgICAgTm9kZSogcGFyZW50Tm9kZSA9IGluc2VydGlvblBvcy5hbmNob3JOb2RlKCktPnBhcmVu dE5vZGUoKTsKLSAgICAgICAgd2hpbGUgKHBhcmVudE5vZGUgJiYgcGFyZW50Tm9kZS0+cmVuZGVy ZXIoKSAmJiBpc0lubGluZU5vZGVXaXRoU3R5bGUocGFyZW50Tm9kZSkpIHsKLSAgICAgICAgICAg IC8vIElmIHdlIGFyZSBpbiB0aGUgbWlkZGxlIG9mIGEgdGV4dCBub2RlLCB3ZSBuZWVkIHRvIHNw bGl0IGl0IGJlZm9yZSB3ZSBjYW4KLSAgICAgICAgICAgIC8vIG1vdmUgdGhlIGluc2VydGlvbiBw b3NpdGlvbi4KLSAgICAgICAgICAgIGlmIChpbnNlcnRpb25Qb3MuYW5jaG9yTm9kZSgpLT5pc1Rl eHROb2RlKCkgJiYgaW5zZXJ0aW9uUG9zLmFuY2hvclR5cGUoKSA9PSBQb3NpdGlvbjo6UG9zaXRp b25Jc09mZnNldEluQW5jaG9yICYmIGluc2VydGlvblBvcy5vZmZzZXRJbkNvbnRhaW5lck5vZGUo KSAmJiAhaW5zZXJ0aW9uUG9zLmF0TGFzdEVkaXRpbmdQb3NpdGlvbkZvck5vZGUoKSkKLSAgICAg ICAgICAgICAgICBzcGxpdFRleHROb2RlQ29udGFpbmluZ0VsZW1lbnQoc3RhdGljX2Nhc3Q8VGV4 dCo+KGluc2VydGlvblBvcy5hbmNob3JOb2RlKCkpLCBpbnNlcnRpb25Qb3Mub2Zmc2V0SW5Db250 YWluZXJOb2RlKCkpOwotICAgICAgICAgICAgCi0gICAgICAgICAgICAvLyBJZiB0aGUgc3R5bGUg ZWxlbWVudCBoYXMgbW9yZSB0aGFuIG9uZSBjaGlsZCwgd2UgbmVlZCB0byBzcGxpdCBpdC4KLSAg ICAgICAgICAgIGlmIChwYXJlbnROb2RlLT5maXJzdENoaWxkKCktPm5leHRTaWJsaW5nKCkpCi0g ICAgICAgICAgICAgICAgc3BsaXRFbGVtZW50KHN0YXRpY19jYXN0PEVsZW1lbnQqPihwYXJlbnRO b2RlKSwgaW5zZXJ0aW9uUG9zLmNvbXB1dGVOb2RlQWZ0ZXJQb3NpdGlvbigpKTsKLSAgICAgICAg ICAgIAotICAgICAgICAgICAgaW5zZXJ0aW9uUG9zID0gcG9zaXRpb25JblBhcmVudEJlZm9yZU5v ZGUocGFyZW50Tm9kZSk7Ci0gICAgICAgICAgICBwYXJlbnROb2RlID0gcGFyZW50Tm9kZS0+cGFy ZW50Tm9kZSgpOworICAgIGlmICghbV9tYXRjaFN0eWxlICYmICFlbmNsb3NpbmdMaXN0KGluc2Vy dGlvblBvcy5jb250YWluZXJOb2RlKCkpICYmIGlzU3R5bGVTcGFuKGZyYWdtZW50LmZpcnN0Q2hp bGQoKSkpIHsKKyAgICAgICAgaWYgKGluc2VydGlvblBvcy5jb250YWluZXJOb2RlKCktPmlzVGV4 dE5vZGUoKSAmJiBpbnNlcnRpb25Qb3Mub2Zmc2V0SW5Db250YWluZXJOb2RlKCkgJiYgIWluc2Vy dGlvblBvcy5hdExhc3RFZGl0aW5nUG9zaXRpb25Gb3JOb2RlKCkpIHsKKyAgICAgICAgICAgIHNw bGl0VGV4dE5vZGVDb250YWluaW5nRWxlbWVudChzdGF0aWNfY2FzdDxUZXh0Kj4oaW5zZXJ0aW9u UG9zLmFuY2hvck5vZGUoKSksIGluc2VydGlvblBvcy5vZmZzZXRJbkNvbnRhaW5lck5vZGUoKSk7 CisgICAgICAgICAgICBpbnNlcnRpb25Qb3MgPSBmaXJzdFBvc2l0aW9uSW5Ob2RlKGluc2VydGlv blBvcy5jb250YWluZXJOb2RlKCkpOworICAgICAgICB9CisKKyAgICAgICAgLy8gRklYTUU6IGlz SW5saW5lTm9kZVdpdGhTdHlsZSBkb2VzIG5vdCBjaGVjayBlZGl0YWJpbGl0eS4KKyAgICAgICAg aWYgKFJlZlB0cjxOb2RlPiBub2RlVG9TcGxpdFRvID0gaGlnaGVzdEVuY2xvc2luZ05vZGVPZlR5 cGUoaW5zZXJ0aW9uUG9zLCBpc0lubGluZU5vZGVXaXRoU3R5bGUpKSB7CisgICAgICAgICAgICBp ZiAoaW5zZXJ0aW9uUG9zLmNvbnRhaW5lck5vZGUoKSAhPSBub2RlVG9TcGxpdFRvKQorICAgICAg ICAgICAgICAgIG5vZGVUb1NwbGl0VG8gPSBzcGxpdFRyZWVUb05vZGUoaW5zZXJ0aW9uUG9zLmFu Y2hvck5vZGUoKSwgbm9kZVRvU3BsaXRUby5nZXQoKSwgdHJ1ZSkuZ2V0KCk7CisgICAgICAgICAg ICBpbnNlcnRpb25Qb3MgPSBwb3NpdGlvbkluUGFyZW50QmVmb3JlTm9kZShub2RlVG9TcGxpdFRv LmdldCgpKTsKICAgICAgICAgfQogICAgIH0KIApJbmRleDogU291cmNlL1dlYkNvcmUvZWRpdGlu Zy9odG1sZWRpdGluZy5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL1dlYkNvcmUvZWRpdGluZy9o dG1sZWRpdGluZy5jcHAJKHJldmlzaW9uIDgzMjc0KQorKysgU291cmNlL1dlYkNvcmUvZWRpdGlu Zy9odG1sZWRpdGluZy5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTYzOCw3ICs2MzgsNyBAQCBOb2Rl KiBoaWdoZXN0RW5jbG9zaW5nTm9kZU9mVHlwZShjb25zdCBQCiB7CiAgICAgTm9kZSogaGlnaGVz dCA9IDA7CiAgICAgTm9kZSogcm9vdCA9IHJ1bGUgPT0gQ2Fubm90Q3Jvc3NFZGl0aW5nQm91bmRh cnkgPyBoaWdoZXN0RWRpdGFibGVSb290KHApIDogMDsKLSAgICBmb3IgKE5vZGUqIG4gPSBwLmRl cHJlY2F0ZWROb2RlKCk7IG47IG4gPSBuLT5wYXJlbnROb2RlKCkpIHsKKyAgICBmb3IgKE5vZGUq IG4gPSBwLmNvbnRhaW5lck5vZGUoKTsgbjsgbiA9IG4tPnBhcmVudE5vZGUoKSkgewogICAgICAg ICBpZiAocm9vdCAmJiAhbi0+cmVuZGVyZXJJc0VkaXRhYmxlKCkpCiAgICAgICAgICAgICBjb250 aW51ZTsKICAgICAgICAgaWYgKG5vZGVJc09mVHlwZShuKSkKSW5kZXg6IExheW91dFRlc3RzL0No YW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9DaGFuZ2VMb2cJKHJldmlzaW9uIDgz MzA0KQorKysgTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEs MTUgQEAKKzIwMTEtMDQtMDggIFJ5b3N1a2UgTml3YSAgPHJuaXdhQHdlYmtpdC5vcmc+CisKKyAg ICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgUkVHUkVTU0lPTihy ODE4ODcpOiBDcmFzaCBpbiBTcGxpdEVsZW1lbnQKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtp dC5vcmcvc2hvd19idWcuY2dpP2lkPTU3NzQzCisKKyAgICAgICAgQWRkZWQgYSByZWdyZXNzaW9u IHRlc3QgZm9yIGEgY3Jhc2ggaW4gUmVwbGFjZVNlbGVjdGlvbkNvbW1hbmQuCisKKyAgICAgICAg KiBlZGl0aW5nL2luc2VydGluZy9pbnNlcnQtaW1hZ2VzLWluLXByZS14LWNyYXNoLWV4cGVjdGVk LnR4dDogQWRkZWQuCisgICAgICAgICogZWRpdGluZy9pbnNlcnRpbmcvaW5zZXJ0LWltYWdlcy1p bi1wcmUteC1jcmFzaC5odG1sOiBBZGRlZC4KKwogMjAxMS0wNC0wOCAgU2VyZ2lvIFZpbGxhciBT ZW5pbiAgPHN2aWxsYXJAaWdhbGlhLmNvbT4KIAogICAgICAgICBVbnJldmlld2VkLCBsb29rcyBs aWtlIHRoZSB0ZXN0IGlzIHdvcmtpbmcgZmluZSBub3cuCkluZGV4OiBMYXlvdXRUZXN0cy9lZGl0 aW5nL2luc2VydGluZy9pbnNlcnQtaW1hZ2VzLWluLXByZS14LWNyYXNoLWV4cGVjdGVkLnR4dAo9 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9lZGl0aW5nL2luc2VydGluZy9pbnNlcnQtaW1hZ2Vz LWluLXByZS14LWNyYXNoLWV4cGVjdGVkLnR4dAkocmV2aXNpb24gMCkKKysrIExheW91dFRlc3Rz L2VkaXRpbmcvaW5zZXJ0aW5nL2luc2VydC1pbWFnZXMtaW4tcHJlLXgtY3Jhc2gtZXhwZWN0ZWQu dHh0CShyZXZpc2lvbiAwKQpAQCAtMCwwICsxLDMgQEAKK1RoaXMgdGVzdCBlbnN1cmVzIFdlYktp dCBkb2VzIG5vdCBjcmFzaC4KKworUEFTUwpJbmRleDogTGF5b3V0VGVzdHMvZWRpdGluZy9pbnNl cnRpbmcvaW5zZXJ0LWltYWdlcy1pbi1wcmUteC1jcmFzaC5odG1sCj09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExh eW91dFRlc3RzL2VkaXRpbmcvaW5zZXJ0aW5nL2luc2VydC1pbWFnZXMtaW4tcHJlLXgtY3Jhc2gu aHRtbAkocmV2aXNpb24gMCkKKysrIExheW91dFRlc3RzL2VkaXRpbmcvaW5zZXJ0aW5nL2luc2Vy dC1pbWFnZXMtaW4tcHJlLXgtY3Jhc2guaHRtbAkocmV2aXNpb24gMCkKQEAgLTAsMCArMSwxOSBA QAorPHByZSBpZD0ieCI+PHggc3R5bGU9IndoaXRlLXNwYWNlOiBwcmUtd3JhcDsiPjxicj48L3g+ PC9wcmU+Cis8c2NyaXB0PgorCitpZiAod2luZG93LmxheW91dFRlc3RDb250cm9sbGVyKQorICAg IGxheW91dFRlc3RDb250cm9sbGVyLmR1bXBBc1RleHQoKTsKKwordmFyIHggPSBkb2N1bWVudC5n ZXRFbGVtZW50QnlJZCgieCIpOworZG9jdW1lbnQuZXhlY0NvbW1hbmQoInNlbGVjdGFsbCIsZmFs c2UpOworZG9jdW1lbnQuZGVzaWduTW9kZT0ib24iOworZG9jdW1lbnQuZXhlY0NvbW1hbmQoIklu c2VydEltYWdlIik7Citkb2N1bWVudC5leGVjQ29tbWFuZCgiSW5zZXJ0SW1hZ2UiKTsKK2RvY3Vt ZW50LmV4ZWNDb21tYW5kKCJJbnNlcnRJbWFnZSIpOworCitkb2N1bWVudC5vcGVuKCk7Citkb2N1 bWVudC53cml0ZWxuKCdUaGlzIHRlc3QgZW5zdXJlcyBXZWJLaXQgZG9lcyBub3QgY3Jhc2guPGJy Pjxicj5QQVNTJyk7CisKKzwvc2NyaXB0PgorPC9ib2R5PgorPC9odG1sPgo=