<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>7048</bug_id>
          
          <creation_ts>2006-02-03 04:11:08 -0800</creation_ts>
          <short_desc>Reproducible crash when onscroll handler deletes the layer or its object</short_desc>
          <delta_ts>2006-04-13 01:13:27 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>Layout and Rendering</component>
          <version>420+</version>
          <rep_platform>Mac</rep_platform>
          <op_sys>OS X 10.4</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc>http://www.telephone.ru/mobile/?g_g=1&amp;tree=2,7805</bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>HasReduction</keywords>
          <priority>P1</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Rosyna">webkit-bugs</reporter>
          <assigned_to name="Darin Adler">darin</assigned_to>
          <cc>mitz</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>31149</commentid>
    <comment_count>0</comment_count>
    <who name="Rosyna">webkit-bugs</who>
    <bug_when>2006-02-03 04:11:08 -0800</bug_when>
    <thetext>Visit the page above and it&apos;ll crash. The line in the log seems to be off from the line in the source.

Date/Time:      2006-02-03 05:04:48.121 -0700
OS Version:     10.4.4 (Build 8G32)
Report Version: 3

Command: Safari
Path:    /Applications/Safari.app/Contents/MacOS/Safari
Parent:  tcsh [425]

Version:        2.0.3 (417.8)
Build Version:  1
Project Name:   WebBrowser
Source Version: 4170800

PID:    21114
Thread: 0

Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_PROTECTION_FAILURE (0x0002) at 0x00000000

Thread 0 Crashed:
0   &lt;&lt;00000000&gt;&gt; 	0x00000000 0 + 0
1   com.apple.WebCore              	0x01a75a98 WebCore::RenderLayer::scrollToOffset(int, int, bool, bool) + 316 (render_layer.cpp:573)
2   com.apple.WebCore              	0x01836098 KJS::DOMNode::putValueProperty(KJS::ExecState*, int, KJS::JSValue*, int) + 1800 (render_layer.h:244)
3   com.apple.WebCore              	0x01857774 KJS::HTMLElement::put(KJS::ExecState*, KJS::Identifier const&amp;, KJS::JSValue*, int) + 488 (lookup.h:238)
4   com.apple.JavaScriptCore       	0x01029200 KJS::AssignDotNode::evaluate(KJS::ExecState*) + 1260 (nodes.cpp:1372)
5   com.apple.JavaScriptCore       	0x0102ddfc KJS::ExprStatementNode::execute(KJS::ExecState*) + 104 (nodes.cpp:1629)
6   com.apple.JavaScriptCore       	0x01030f64 KJS::SourceElementsNode::execute(KJS::ExecState*) + 480 (completion.h:53)
7   com.apple.JavaScriptCore       	0x0102dd38 KJS::BlockNode::execute(KJS::ExecState*) + 156 (nodes.cpp:1605)
8   com.apple.JavaScriptCore       	0x0101f464 KJS::InterpreterImp::evaluate(KJS::UChar const*, int, KJS::JSValue*, KJS::UString const&amp;, int) + 820 (completion.h:48)
9   com.apple.JavaScriptCore       	0x01022630 KJS::Interpreter::evaluate(KJS::UString const&amp;, int, KJS::UChar const*, int, KJS::JSValue*) + 68 (interpreter.cpp:121)
10  com.apple.WebCore              	0x01860cfc WebCore::KJSProxyImpl::evaluate(WebCore::DOMString const&amp;, int, WebCore::DOMString const&amp;, WebCore::NodeImpl*) + 272 (RefPtr.h:41)
11  com.apple.WebCore              	0x01993390 WebCore::Frame::executeScript(QString const&amp;, int, WebCore::NodeImpl*, QString const&amp;) + 100 (RefPtr.h:41)
12  com.apple.WebCore              	0x0189b960 WebCore::HTMLTokenizer::scriptExecution(QString const&amp;, WebCore::HTMLTokenizer::State, QString, int) + 324 (htmltokenizer.cpp:490)
13  com.apple.WebCore              	0x0189c360 WebCore::HTMLTokenizer::scriptHandler(WebCore::HTMLTokenizer::State) + 1384 (htmltokenizer.cpp:420)
14  com.apple.WebCore              	0x0189c69c WebCore::HTMLTokenizer::parseSpecial(WebCore::SegmentedString&amp;, WebCore::HTMLTokenizer::State) + 564 (htmltokenizer.cpp:286)
15  com.apple.WebCore              	0x0189e474 WebCore::HTMLTokenizer::parseTag(WebCore::SegmentedString&amp;, WebCore::HTMLTokenizer::State) + 6432 (htmltokenizer.cpp:1257)
16  com.apple.WebCore              	0x0189eb0c WebCore::HTMLTokenizer::write(WebCore::SegmentedString const&amp;, bool) + 908 (htmltokenizer.cpp:1460)
17  com.apple.WebCore              	0x0189bd10 WebCore::HTMLTokenizer::notifyFinished(WebCore::CachedObject*) + 644 (KWQValueList.h:88)
18  com.apple.WebCore              	0x019d9c04 WebCore::CachedScript::checkNotify() + 80 (CachedScript.cpp:111)
19  com.apple.WebCore              	0x019d9d30 WebCore::CachedScript::data(QBuffer&amp;, bool) + 232 (CachedScript.cpp:103)
20  com.apple.WebCore              	0x019dc2f8 WebCore::Loader::slotFinished(KIO::Job*, NSData*) + 432 (loader.cpp:151)
21  com.apple.WebCore              	0x018bbe2c KWQSignal::callWithData(KIO::Job*, NSData*) const + 140 (KWQValueListImpl.h:150)
22  com.apple.WebCore              	0x018be5c4 -[KWQResourceLoader finishJobAndHandle:] + 80 (KWQResourceLoader.mm:95)
23  com.apple.WebKit               	0x00323bc4 -[WebSubresourceLoader didFinishLoading] + 80 (WebSubresourceLoader.m:218)
24  com.apple.WebKit               	0x0032b290 -[WebLoader connectionDidFinishLoading:] + 44 (WebLoader.m:663)
25  com.apple.Foundation           	0x92918cdc -[NSURLConnection(NSURLConnectionInternal) _sendDidFinishLoadingCallback] + 188
26  com.apple.Foundation           	0x92916f48 -[NSURLConnection(NSURLConnectionInternal) _sendCallbacks] + 556
27  com.apple.Foundation           	0x92916ca0 _sendCallbacks + 156
28  com.apple.CoreFoundation       	0x9075da68 __CFRunLoopDoSources0 + 384
29  com.apple.CoreFoundation       	0x9075cf98 __CFRunLoopRun + 452
30  com.apple.CoreFoundation       	0x9075ca18 CFRunLoopRunSpecific + 268
31  com.apple.HIToolbox            	0x9318e1e0 RunCurrentEventLoopInMode + 264
32  com.apple.HIToolbox            	0x9318d874 ReceiveNextEventCommon + 380
33  com.apple.HIToolbox            	0x9318d6e0 BlockUntilNextEventMatchingListInMode + 96
34  com.apple.AppKit               	0x9368c104 _DPSNextEvent + 384
35  com.apple.AppKit               	0x9368bdc8 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 116
36  com.apple.Safari               	0x000072d4 0x1000 + 25300
37  com.apple.AppKit               	0x9368830c -[NSApplication run] + 472
38  com.apple.AppKit               	0x93778e68 NSApplicationMain + 452
39  com.apple.Safari               	0x0005cfdc 0x1000 + 376796
40  com.apple.Safari               	0x0005ce80 0x1000 + 376448</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>31150</commentid>
    <comment_count>1</comment_count>
    <who name="">mitz</who>
    <bug_when>2006-02-03 05:15:14 -0800</bug_when>
    <thetext>Confirmed in WebKit-417.9 and in TOT. Reproducible crashes are P1.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>31164</commentid>
    <comment_count>2</comment_count>
      <attachid>6219</attachid>
    <who name="">mitz</who>
    <bug_when>2006-02-03 07:28:23 -0800</bug_when>
    <thetext>Created attachment 6219
Testcase (scroll to crash)

The problem is that RenderLayer::scrollToOffset calls the onscroll handler, which may delete the renderer (and the layer!).</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>31259</commentid>
    <comment_count>3</comment_count>
    <who name="Darin Adler">darin</who>
    <bug_when>2006-02-03 21:12:07 -0800</bug_when>
    <thetext>I&apos;ve got a fix in the works.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>31306</commentid>
    <comment_count>4</comment_count>
      <attachid>6247</attachid>
    <who name="Darin Adler">darin</who>
    <bug_when>2006-02-04 09:26:47 -0800</bug_when>
    <thetext>Created attachment 6247
first cut at a patch: needs test cases

Here&apos;s a patch that fixes the problem. Unfortunately while fixing this one I noticed many other similar problems that are not as easy to fix. Also, I did not come up with automated layout test for this, but I think it&apos;s possible to make one and we should do that before reviewing and landing the fix.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>31399</commentid>
    <comment_count>5</comment_count>
      <attachid>6260</attachid>
    <who name="Darin Adler">darin</who>
    <bug_when>2006-02-05 00:05:58 -0800</bug_when>
    <thetext>Created attachment 6260
patch to fix the problem, including change log and test</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>39120</commentid>
    <comment_count>6</comment_count>
    <who name="">mitz</who>
    <bug_when>2006-04-13 01:13:27 -0700</bug_when>
    <thetext>(In reply to comment #4)
&gt; Unfortunately while fixing this one I
&gt; noticed many other similar problems that are not as easy to fix.

Opened bug 8360 to track the remaining problems.</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="0"
              isprivate="0"
          >
            <attachid>6219</attachid>
            <date>2006-02-03 07:28:23 -0800</date>
            <delta_ts>2006-02-03 07:28:23 -0800</delta_ts>
            <desc>Testcase (scroll to crash)</desc>
            <filename>7048 onscroll crash.html</filename>
            <type>text/html</type>
            <size>121</size>
            <attacher>mitz</attacher>
            
              <data encoding="base64">PGRpdiBzdHlsZT0iaGVpZ2h0OiAxMDAlOyBvdmVyZmxvdzogYXV0bzsiIG9uc2Nyb2xsPSJzdHls
ZS5kaXNwbGF5ID0gJ25vbmUnIj4KPGRpdiBzdHlsZT0iaGVpZ2h0OiAyMDAwcHg7Ij48L2Rpdj4K
PC9kaXY+Cg==
</data>

          </attachment>
          <attachment
              isobsolete="1"
              ispatch="1"
              isprivate="0"
          >
            <attachid>6247</attachid>
            <date>2006-02-04 09:26:47 -0800</date>
            <delta_ts>2006-02-05 00:05:58 -0800</delta_ts>
            <desc>first cut at a patch: needs test cases</desc>
            <filename>ScrollPatch.txt</filename>
            <type>text/plain</type>
            <size>2481</size>
            <attacher name="Darin Adler">darin</attacher>
            
              <data encoding="base64">SW5kZXg6IHJlbmRlcmluZy9yZW5kZXJfbGF5ZXIuY3BwCj09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIHJlbmRlcmlu
Zy9yZW5kZXJfbGF5ZXIuY3BwCShyZXZpc2lvbiAxMjU1NSkKKysrIHJlbmRlcmluZy9yZW5kZXJf
bGF5ZXIuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC0xMDUsOCArMTA1LDcgQEAKICAgICByZW5kZXJB
cmVuYS0+ZnJlZSgqKHNpemVfdCAqKXRoaXMsIHRoaXMpOwogfQogCi12b2lkCi1SZW5kZXJTY3Jv
bGxNZWRpYXRvcjo6c2xvdFZhbHVlQ2hhbmdlZChpbnQgdmFsKQordm9pZCBSZW5kZXJTY3JvbGxN
ZWRpYXRvcjo6c2xvdFZhbHVlQ2hhbmdlZChpbnQgdmFsKQogewogICAgIG1fbGF5ZXItPnVwZGF0
ZVNjcm9sbFBvc2l0aW9uRnJvbVNjcm9sbGJhcnMoKTsKIH0KQEAgLTUyNCw4ICs1MjMsNyBAQAog
ICAgIHkgLT0gc2Nyb2xsWU9mZnNldCgpOwogfQogCi12b2lkCi1SZW5kZXJMYXllcjo6c2Nyb2xs
VG9PZmZzZXQoaW50IHgsIGludCB5LCBib29sIHVwZGF0ZVNjcm9sbGJhcnMsIGJvb2wgcmVwYWlu
dCkKK3ZvaWQgUmVuZGVyTGF5ZXI6OnNjcm9sbFRvT2Zmc2V0KGludCB4LCBpbnQgeSwgYm9vbCB1
cGRhdGVTY3JvbGxiYXJzLCBib29sIHJlcGFpbnQpCiB7CiAgICAgaWYgKHJlbmRlcmVyKCktPnN0
eWxlKCktPm92ZXJmbG93KCkgIT0gT01BUlFVRUUpIHsKICAgICAgICAgaWYgKHggPCAwKSB4ID0g
MDsKQEAgLTU2Myw5ICs1NjEsNiBAQAogICAgICAgICBtX29iamVjdC0+Y2FudmFzKCktPnVwZGF0
ZVdpZGdldFBvc2l0aW9ucygpOwogICAgIH0KIAotICAgIC8vIEZpcmUgdGhlIHNjcm9sbCBET00g
ZXZlbnQuCi0gICAgbV9vYmplY3QtPmVsZW1lbnQoKS0+ZGlzcGF0Y2hIVE1MRXZlbnQoc2Nyb2xs
RXZlbnQsIHRydWUsIGZhbHNlKTsKLQogICAgIC8vIEp1c3Qgc2NoZWR1bGUgYSBmdWxsIHJlcGFp
bnQgb2Ygb3VyIG9iamVjdC4KICAgICBpZiAocmVwYWludCkKICAgICAgICAgbV9vYmplY3QtPnJl
cGFpbnQoKTsKQEAgLTU3Niw2ICs1NzEsOSBAQAogICAgICAgICBpZiAobV92QmFyKQogICAgICAg
ICAgICAgbV92QmFyLT5zZXRWYWx1ZShtX3Njcm9sbFkpOwogICAgIH0KKworICAgIC8vIEZpcmUg
dGhlIHNjcm9sbCBET00gZXZlbnQuCisgICAgbV9vYmplY3QtPmVsZW1lbnQoKS0+ZGlzcGF0Y2hI
VE1MRXZlbnQoc2Nyb2xsRXZlbnQsIHRydWUsIGZhbHNlKTsKIH0KIAogdm9pZCBSZW5kZXJMYXll
cjo6c2Nyb2xsUmVjdFRvVmlzaWJsZShjb25zdCBJbnRSZWN0ICZyZWN0LCBjb25zdCBTY3JvbGxB
bGlnbm1lbnQmIGFsaWduWCwgY29uc3QgU2Nyb2xsQWxpZ25tZW50JiBhbGlnblkpCkBAIC01OTks
NiArNTk3LDggQEAKICAgICAgICAgICAgIGludCBkaWZmWCA9IHNjcm9sbFhPZmZzZXQoKTsKICAg
ICAgICAgICAgIGludCBkaWZmWSA9IG1fc2Nyb2xsWTsKICAgICAgICAgICAgIHNjcm9sbFRvT2Zm
c2V0KHhPZmZzZXQsIHlPZmZzZXQpOworICAgICAgICAgICAgLy8gRklYTUU6IEF0IHRoaXMgcG9p
bnQgYSBzY3JvbGwgZXZlbnQgZmlyZWQsIHdoaWNoIGNvdWxkIGhhdmUgZGVsZXRlZCB0aGlzIGxh
eWVyLgorICAgICAgICAgICAgLy8gTmVlZCB0byBoYW5kbGUgdGhpcyBjYXNlLgogICAgICAgICAg
ICAgZGlmZlggPSBzY3JvbGxYT2Zmc2V0KCkgLSBkaWZmWDsKICAgICAgICAgICAgIGRpZmZZID0g
bV9zY3JvbGxZIC0gZGlmZlk7CiAgICAgICAgICAgICBuZXdSZWN0LnNldFgocmVjdC54KCkgLSBk
aWZmWCk7CkBAIC04NzQsNiArODc0LDggQEAKICAgICAgICAgaW50IG5ld1kgPSBrTWF4KDAsIGtN
aW4obV9zY3JvbGxZLCBzY3JvbGxIZWlnaHQoKSAtIG1fb2JqZWN0LT5jbGllbnRIZWlnaHQoKSkp
OwogICAgICAgICBpZiAobmV3WCAhPSBzY3JvbGxYT2Zmc2V0KCkgfHwgbmV3WSAhPSBtX3Njcm9s
bFkpCiAgICAgICAgICAgICBzY3JvbGxUb09mZnNldChuZXdYLCBuZXdZKTsKKyAgICAgICAgLy8g
RklYTUU6IEF0IHRoaXMgcG9pbnQgYSBzY3JvbGwgZXZlbnQgZmlyZWQsIHdoaWNoIGNvdWxkIGhh
dmUgZGVsZXRlZCB0aGlzIGxheWVyLgorICAgICAgICAvLyBOZWVkIHRvIGhhbmRsZSB0aGlzIGNh
c2UuCiAgICAgfQogCiAgICAgYm9vbCBoYXZlSG9yaXpvbnRhbEJhciA9IG1faEJhcjsKQEAgLTE2
NDcsNiArMTY0OSw4IEBACiAgICAgICAgICAgICBlbHNlCiAgICAgICAgICAgICAgICAgbV9sYXll
ci0+c2Nyb2xsVG9PZmZzZXQoMCwgbV9zdGFydCwgZmFsc2UsIGZhbHNlKTsKICAgICAgICAgfQor
ICAgICAgICAvLyBGSVhNRTogQXQgdGhpcyBwb2ludCBhIHNjcm9sbCBldmVudCBmaXJlZCwgd2hp
Y2ggY291bGQgaGF2ZSBkZWxldGVkIHRoaXMgbGF5ZXIsCisgICAgICAgIC8vIGluY2x1ZGluZyB0
aGUgbWFycXVlZS4gTmVlZCB0byBoYW5kbGUgdGhpcyBjYXNlLgogICAgIH0KICAgICBlbHNlIHsK
ICAgICAgICAgbV9zdXNwZW5kZWQgPSBmYWxzZTsK
</data>

          </attachment>
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>6260</attachid>
            <date>2006-02-05 00:05:58 -0800</date>
            <delta_ts>2006-02-05 01:10:15 -0800</delta_ts>
            <desc>patch to fix the problem, including change log and test</desc>
            <filename>ScrollEventCrashPatch.txt</filename>
            <type>text/plain</type>
            <size>5577</size>
            <attacher name="Darin Adler">darin</attacher>
            
              <data encoding="base64">SW5kZXg6IFdlYkNvcmUvcmVuZGVyaW5nL3JlbmRlcl9sYXllci5jcHAKPT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0g
V2ViQ29yZS9yZW5kZXJpbmcvcmVuZGVyX2xheWVyLmNwcAkocmV2aXNpb24gMTI1NjgpCisrKyBX
ZWJDb3JlL3JlbmRlcmluZy9yZW5kZXJfbGF5ZXIuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC0xMDUs
OCArMTA1LDcgQEAKICAgICByZW5kZXJBcmVuYS0+ZnJlZSgqKHNpemVfdCAqKXRoaXMsIHRoaXMp
OwogfQogCi12b2lkCi1SZW5kZXJTY3JvbGxNZWRpYXRvcjo6c2xvdFZhbHVlQ2hhbmdlZChpbnQg
dmFsKQordm9pZCBSZW5kZXJTY3JvbGxNZWRpYXRvcjo6c2xvdFZhbHVlQ2hhbmdlZChpbnQgdmFs
KQogewogICAgIG1fbGF5ZXItPnVwZGF0ZVNjcm9sbFBvc2l0aW9uRnJvbVNjcm9sbGJhcnMoKTsK
IH0KQEAgLTUyNCw4ICs1MjMsNyBAQAogICAgIHkgLT0gc2Nyb2xsWU9mZnNldCgpOwogfQogCi12
b2lkCi1SZW5kZXJMYXllcjo6c2Nyb2xsVG9PZmZzZXQoaW50IHgsIGludCB5LCBib29sIHVwZGF0
ZVNjcm9sbGJhcnMsIGJvb2wgcmVwYWludCkKK3ZvaWQgUmVuZGVyTGF5ZXI6OnNjcm9sbFRvT2Zm
c2V0KGludCB4LCBpbnQgeSwgYm9vbCB1cGRhdGVTY3JvbGxiYXJzLCBib29sIHJlcGFpbnQpCiB7
CiAgICAgaWYgKHJlbmRlcmVyKCktPnN0eWxlKCktPm92ZXJmbG93KCkgIT0gT01BUlFVRUUpIHsK
ICAgICAgICAgaWYgKHggPCAwKSB4ID0gMDsKQEAgLTU2Myw5ICs1NjEsNiBAQAogICAgICAgICBt
X29iamVjdC0+Y2FudmFzKCktPnVwZGF0ZVdpZGdldFBvc2l0aW9ucygpOwogICAgIH0KIAotICAg
IC8vIEZpcmUgdGhlIHNjcm9sbCBET00gZXZlbnQuCi0gICAgbV9vYmplY3QtPmVsZW1lbnQoKS0+
ZGlzcGF0Y2hIVE1MRXZlbnQoc2Nyb2xsRXZlbnQsIHRydWUsIGZhbHNlKTsKLQogICAgIC8vIEp1
c3Qgc2NoZWR1bGUgYSBmdWxsIHJlcGFpbnQgb2Ygb3VyIG9iamVjdC4KICAgICBpZiAocmVwYWlu
dCkKICAgICAgICAgbV9vYmplY3QtPnJlcGFpbnQoKTsKQEAgLTU3Niw2ICs1NzEsOSBAQAogICAg
ICAgICBpZiAobV92QmFyKQogICAgICAgICAgICAgbV92QmFyLT5zZXRWYWx1ZShtX3Njcm9sbFkp
OwogICAgIH0KKworICAgIC8vIEZpcmUgdGhlIHNjcm9sbCBET00gZXZlbnQuCisgICAgbV9vYmpl
Y3QtPmVsZW1lbnQoKS0+ZGlzcGF0Y2hIVE1MRXZlbnQoc2Nyb2xsRXZlbnQsIHRydWUsIGZhbHNl
KTsKIH0KIAogdm9pZCBSZW5kZXJMYXllcjo6c2Nyb2xsUmVjdFRvVmlzaWJsZShjb25zdCBJbnRS
ZWN0ICZyZWN0LCBjb25zdCBTY3JvbGxBbGlnbm1lbnQmIGFsaWduWCwgY29uc3QgU2Nyb2xsQWxp
Z25tZW50JiBhbGlnblkpCkBAIC01OTksNiArNTk3LDggQEAKICAgICAgICAgICAgIGludCBkaWZm
WCA9IHNjcm9sbFhPZmZzZXQoKTsKICAgICAgICAgICAgIGludCBkaWZmWSA9IG1fc2Nyb2xsWTsK
ICAgICAgICAgICAgIHNjcm9sbFRvT2Zmc2V0KHhPZmZzZXQsIHlPZmZzZXQpOworICAgICAgICAg
ICAgLy8gRklYTUU6IEF0IHRoaXMgcG9pbnQgYSBzY3JvbGwgZXZlbnQgZmlyZWQsIHdoaWNoIGNv
dWxkIGhhdmUgZGVsZXRlZCB0aGlzIGxheWVyLgorICAgICAgICAgICAgLy8gTmVlZCB0byBoYW5k
bGUgdGhpcyBjYXNlLgogICAgICAgICAgICAgZGlmZlggPSBzY3JvbGxYT2Zmc2V0KCkgLSBkaWZm
WDsKICAgICAgICAgICAgIGRpZmZZID0gbV9zY3JvbGxZIC0gZGlmZlk7CiAgICAgICAgICAgICBu
ZXdSZWN0LnNldFgocmVjdC54KCkgLSBkaWZmWCk7CkBAIC04NzQsNiArODc0LDggQEAKICAgICAg
ICAgaW50IG5ld1kgPSBrTWF4KDAsIGtNaW4obV9zY3JvbGxZLCBzY3JvbGxIZWlnaHQoKSAtIG1f
b2JqZWN0LT5jbGllbnRIZWlnaHQoKSkpOwogICAgICAgICBpZiAobmV3WCAhPSBzY3JvbGxYT2Zm
c2V0KCkgfHwgbmV3WSAhPSBtX3Njcm9sbFkpCiAgICAgICAgICAgICBzY3JvbGxUb09mZnNldChu
ZXdYLCBuZXdZKTsKKyAgICAgICAgLy8gRklYTUU6IEF0IHRoaXMgcG9pbnQgYSBzY3JvbGwgZXZl
bnQgZmlyZWQsIHdoaWNoIGNvdWxkIGhhdmUgZGVsZXRlZCB0aGlzIGxheWVyLgorICAgICAgICAv
LyBOZWVkIHRvIGhhbmRsZSB0aGlzIGNhc2UuCiAgICAgfQogCiAgICAgYm9vbCBoYXZlSG9yaXpv
bnRhbEJhciA9IG1faEJhcjsKQEAgLTE2NDcsNiArMTY0OSw4IEBACiAgICAgICAgICAgICBlbHNl
CiAgICAgICAgICAgICAgICAgbV9sYXllci0+c2Nyb2xsVG9PZmZzZXQoMCwgbV9zdGFydCwgZmFs
c2UsIGZhbHNlKTsKICAgICAgICAgfQorICAgICAgICAvLyBGSVhNRTogQXQgdGhpcyBwb2ludCBh
IHNjcm9sbCBldmVudCBmaXJlZCwgd2hpY2ggY291bGQgaGF2ZSBkZWxldGVkIHRoaXMgbGF5ZXIs
CisgICAgICAgIC8vIGluY2x1ZGluZyB0aGUgbWFycXVlZS4gTmVlZCB0byBoYW5kbGUgdGhpcyBj
YXNlLgogICAgIH0KICAgICBlbHNlIHsKICAgICAgICAgbV9zdXNwZW5kZWQgPSBmYWxzZTsKSW5k
ZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9nCShy
ZXZpc2lvbiAxMjU2OCkKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBAIC0x
LDMgKzEsMTYgQEAKKzIwMDYtMDItMDUgIERhcmluIEFkbGVyICA8ZGFyaW5AYXBwbGUuY29tPgor
CisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIC0gZml4IGh0
dHA6Ly9idWd6aWxsYS5vcGVuZGFyd2luLm9yZy9zaG93X2J1Zy5jZ2k/aWQ9NzA0OAorICAgICAg
ICAgIFJlcHJvZHVjaWJsZSBjcmFzaCB3aGVuIG9uc2Nyb2xsIGhhbmRsZXIgZGVsZXRlcyB0aGUg
bGF5ZXIgb3IgaXRzIG9iamVjdAorCisgICAgICAgIFRlc3Q6IG9uc2Nyb2xsLWxheWVyLXNlbGYt
ZGVzdHJ1Y3QuaHRtbAorCisgICAgICAgICogcmVuZGVyaW5nL3JlbmRlcl9sYXllci5jcHA6IChX
ZWJDb3JlOjpSZW5kZXJMYXllcjo6c2Nyb2xsVG9PZmZzZXQpOgorICAgICAgICBEb24ndCBzZW5k
IHRoZSBzY3JvbGwgZXZlbnQgdW50aWwgYWZ0ZXIgd2UndmUgZG9uZSBldmVyeXRoaW5nIGVsc2Ug
d2UKKyAgICAgICAgbmVlZCB0byBkby4KKwogMjAwNi0wMi0wNCAgTWFjaWVqIFN0YWNob3dpYWsg
IDxtanNAYXBwbGUuY29tPgogCiAgICAgICAgIFJldmlld2VkIGJ5IERhcmluLgpJbmRleDogTGF5
b3V0VGVzdHMvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExheW91dFRlc3RzL0NoYW5nZUxvZwko
cmV2aXNpb24gMTI1NjgpCisrKyBMYXlvdXRUZXN0cy9DaGFuZ2VMb2cJKHdvcmtpbmcgY29weSkK
QEAgLTEsMyArMSwxMyBAQAorMjAwNi0wMi0wNSAgRGFyaW4gQWRsZXIgIDxkYXJpbkBhcHBsZS5j
b20+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgLSB0
ZXN0IGZvciBodHRwOi8vYnVnemlsbGEub3BlbmRhcndpbi5vcmcvc2hvd19idWcuY2dpP2lkPTcw
NDgKKyAgICAgICAgICBSZXByb2R1Y2libGUgY3Jhc2ggd2hlbiBvbnNjcm9sbCBoYW5kbGVyIGRl
bGV0ZXMgdGhlIGxheWVyIG9yIGl0cyBvYmplY3QKKworICAgICAgICAqIGZhc3Qvb3ZlcmZsb3cv
b25zY3JvbGwtbGF5ZXItc2VsZi1kZXN0cnVjdC5odG1sOiBBZGRlZC4KKyAgICAgICAgKiBmYXN0
L292ZXJmbG93L29uc2Nyb2xsLWxheWVyLXNlbGYtZGVzdHJ1Y3QtZXhwZWN0ZWQudHh0OiBBZGRl
ZC4KKwogMjAwNi0wMi0wNCAgTWFjaWVqIFN0YWNob3dpYWsgIDxtanNAYXBwbGUuY29tPgogCiAg
ICAgICAgIC0gcmV2ZXJ0ZWQgQ1NTIG1lZGlhIHF1ZXJpZXMgcGF0Y2gsIGFzIGl0IGNhdXNlcyBy
YW5kb20gY3Jhc2hlcyBvbiB0aGUKSW5kZXg6IExheW91dFRlc3RzL2Zhc3Qvb3ZlcmZsb3cvb25z
Y3JvbGwtbGF5ZXItc2VsZi1kZXN0cnVjdC1leHBlY3RlZC50eHQKPT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5
b3V0VGVzdHMvZmFzdC9vdmVyZmxvdy9vbnNjcm9sbC1sYXllci1zZWxmLWRlc3RydWN0LWV4cGVj
dGVkLnR4dAkocmV2aXNpb24gMCkKKysrIExheW91dFRlc3RzL2Zhc3Qvb3ZlcmZsb3cvb25zY3Jv
bGwtbGF5ZXItc2VsZi1kZXN0cnVjdC1leHBlY3RlZC50eHQJKHJldmlzaW9uIDApCkBAIC0wLDAg
KzEsMyBAQAorVGhpcyB0ZXN0IGludm9sdmVzIGEgbGF5ZXIgdGhhdCBzZWxmLWRlc3RydWN0cyB3
aGVuIHNjcm9sbGVkLiBJZiB0aGVyZSdzIG5vIGNyYXNoLCB0aGVuIHRoZSB0ZXN0IHN1Y2NlZWRl
ZC4KKworCgpQcm9wZXJ0eSBjaGFuZ2VzIG9uOiBMYXlvdXRUZXN0cy9mYXN0L292ZXJmbG93L29u
c2Nyb2xsLWxheWVyLXNlbGYtZGVzdHJ1Y3QtZXhwZWN0ZWQudHh0Cl9fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KTmFtZTog
c3ZuOmVvbC1zdHlsZQogICArIG5hdGl2ZQoKSW5kZXg6IExheW91dFRlc3RzL2Zhc3Qvb3ZlcmZs
b3cvb25zY3JvbGwtbGF5ZXItc2VsZi1kZXN0cnVjdC5odG1sCj09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExheW91
dFRlc3RzL2Zhc3Qvb3ZlcmZsb3cvb25zY3JvbGwtbGF5ZXItc2VsZi1kZXN0cnVjdC5odG1sCShy
ZXZpc2lvbiAwKQorKysgTGF5b3V0VGVzdHMvZmFzdC9vdmVyZmxvdy9vbnNjcm9sbC1sYXllci1z
ZWxmLWRlc3RydWN0Lmh0bWwJKHJldmlzaW9uIDApCkBAIC0wLDAgKzEsMTQgQEAKKzxoZWFkPgor
PHNjcmlwdD4KK2Z1bmN0aW9uIHRlc3QoKSB7CisgICAgaWYgKHdpbmRvdy5sYXlvdXRUZXN0Q29u
dHJvbGxlcikKKyAgICAgICAgbGF5b3V0VGVzdENvbnRyb2xsZXIuZHVtcEFzVGV4dCgpOworICAg
IGRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCJpdCIpLnNjcm9sbFRvcCA9IDEwMDsKK30KKzwvc2Ny
aXB0PgorPGJvZHkgb25sb2FkPSJ0ZXN0KCkiPgorPHA+VGhpcyB0ZXN0IGludm9sdmVzIGEgbGF5
ZXIgdGhhdCBzZWxmLWRlc3RydWN0cyB3aGVuIHNjcm9sbGVkLiBJZiB0aGVyZSdzIG5vIGNyYXNo
LCB0aGVuIHRoZSB0ZXN0IHN1Y2NlZWRlZC48L3A+Cis8ZGl2IGlkPSJpdCIgc3R5bGU9ImhlaWdo
dDogMTAwJTsgb3ZlcmZsb3c6IGF1dG87IiBvbnNjcm9sbD0ic3R5bGUuZGlzcGxheSA9ICdub25l
JyI+Cis8ZGl2IHN0eWxlPSJoZWlnaHQ6IDIwMDBweDsiPjwvZGl2PgorPC9kaXY+Cis8L2JvZHk+
CgpQcm9wZXJ0eSBjaGFuZ2VzIG9uOiBMYXlvdXRUZXN0cy9mYXN0L292ZXJmbG93L29uc2Nyb2xs
LWxheWVyLXNlbGYtZGVzdHJ1Y3QuaHRtbApfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCk5hbWU6IHN2bjptaW1lLXR5cGUK
ICAgKyB0ZXh0L2h0bWwKTmFtZTogc3ZuOmVvbC1zdHlsZQogICArIG5hdGl2ZQoK
</data>
<flag name="review"
          id="1512"
          type_id="1"
          status="+"
          setter="mjs"
    />
          </attachment>
      

    </bug>

</bugzilla>