77786 2012-02-03 14:51:36 -0800 NULL ptr in WebCore::RenderBlock::layoutRunsAndFloatsInRange 2012-05-24 11:59:31 -0700 1 1 1 Unclassified WebKit DOM 528+ (Nightly build) PC Windows Vista RESOLVED FIXED InRadar P1 Normal --- 1 skylined leviw eric jamesr leviw playmobil rniwa thorton webkit-bug-importer webkit.review.bot xji oldest_to_newest 549124 0 125424 skylined 2012-02-03 14:51:36 -0800 Created attachment 125424 Repro Chromium: http://code.google.com/p/chromium/issues/detail?id=112660 Fuzzer: Cris_happyfuntime - crash stack - WebCore::RenderBlock::layoutRunsAndFloatsInRange WebCore::RenderBlock::layoutRunsAndFloats WebCore::RenderBlock::layoutInlineChildren Repro: <!> <style> .class2{float:right} b{border-style:double} </style> <script> window.onload = function(){ document.designMode="on";document.execCommand("SelectAll"); document.execCommand("InsertUnorderedList"); } </script> <p ><svg:font ></svg:font><bdi ><b class="class2"> 549132 1 jamesr 2012-02-03 14:55:35 -0800 That's not much of a stack, do you have the full thing? 549152 2 skylined 2012-02-03 15:17:48 -0800 00 0039ae64 59172e4f webkit!WebCore::BidiCharacterRun::setNext(struct WebCore::BidiCharacterRun * next = 0x00000000)+0x14 [c:\src\chromium-internal\src\third_party\webkit\source\webcore\platform\text\bidiresolver.h @ 147] 01 0039ae78 59167ce6 webkit!WebCore::BidiRunList<WebCore::BidiRun>::replaceRunWithRuns(struct WebCore::BidiRun * toReplace = 0x024fd324, class WebCore::BidiRunList<WebCore::BidiRun> * newRuns = 0x0039af30)+0x11f [c:\src\chromium-internal\src\third_party\webkit\source\webcore\platform\text\bidirunlist.h @ 164] 02 0039afd8 591662b5 webkit!WebCore::constructBidiRuns(class WebCore::BidiResolver<WebCore::InlineIterator,WebCore::BidiRun> * topResolver = 0x0039b248, class WebCore::BidiRunList<WebCore::BidiRun> * bidiRuns = 0x0039b2c4, class WebCore::InlineIterator * endOfLine = 0x0039b190, WebCore::VisualDirectionOverride override = NoVisualOverride (0n0), bool previousLineBrokeCleanly = false)+0x1c6 [c:\src\chromium-internal\src\third_party\webkit\source\webcore\rendering\renderblocklinelayout.cpp @ 996] 03 0039b1c0 59165912 webkit!WebCore::RenderBlock::layoutRunsAndFloatsInRange(class WebCore::LineLayoutState * layoutState = 0x0039b3e0, class WebCore::BidiResolver<WebCore::InlineIterator,WebCore::BidiRun> * resolver = 0x0039b248, class WebCore::InlineIterator * cleanLineStart = 0x0039b220, struct WebCore::BidiStatus * cleanLineBidiStatus = 0x0039b208, unsigned int consecutiveHyphenatedLines = 0)+0x4a5 [c:\src\chromium-internal\src\third_party\webkit\source\webcore\rendering\renderblocklinelayout.cpp @ 1267] 04 0039b360 59169547 webkit!WebCore::RenderBlock::layoutRunsAndFloats(class WebCore::LineLayoutState * layoutState = 0x0039b3e0, bool hasInlineChild = true)+0x382 [c:\src\chromium-internal\src\third_party\webkit\source\webcore\rendering\renderblocklinelayout.cpp @ 1207] 05 0039b430 5912350e webkit!WebCore::RenderBlock::layoutInlineChildren(bool relayoutChildren = false, int * repaintLogicalTop = 0x0039b53c, int * repaintLogicalBottom = 0x0039b530)+0x427 [c:\src\chromium-internal\src\third_party\webkit\source\webcore\rendering\renderblocklinelayout.cpp @ 1506] 06 0039b5cc 59122f60 webkit!WebCore::RenderBlock::layoutBlock(bool relayoutChildren = false, int pageLogicalHeight = 0n0, WebCore::RenderBlock::BlockLayoutPass layoutPass = NormalLayoutPass (0n0))+0x55e [c:\src\chromium-internal\src\third_party\webkit\source\webcore\rendering\renderblock.cpp @ 1330] 07 0039b5e8 59126ffa webkit!WebCore::RenderBlock::layout(void)+0x40 [c:\src\chromium-internal\src\third_party\webkit\source\webcore\rendering\renderblock.cpp @ 1202] 08 0039b690 59126cc8 webkit!WebCore::RenderBlock::layoutBlockChild(class WebCore::RenderBox * child = 0x0250dc0c, class WebCore::RenderBlock::MarginInfo * marginInfo = 0x0039b6f0, int * previousFloatLogicalBottom = 0x0039b6e0, int * maxFloatLogicalBottom = 0x0039b848)+0x27a [c:\src\chromium-internal\src\third_party\webkit\source\webcore\rendering\renderblock.cpp @ 2117] 09 0039b758 59123524 webkit!WebCore::RenderBlock::layoutBlockChildren(bool relayoutChildren = false, int * maxFloatLogicalBottom = 0x0039b848)+0x398 [c:\src\chromium-internal\src\third_party\webkit\source\webcore\rendering\renderblock.cpp @ 2054] 0a 0039b8f0 59122f60 webkit!WebCore::RenderBlock::layoutBlock(bool relayoutChildren = false, int pageLogicalHeight = 0n0, WebCore::RenderBlock::BlockLayoutPass layoutPass = NormalLayoutPass (0n0))+0x574 [c:\src\chromium-internal\src\third_party\webkit\source\webcore\rendering\renderblock.cpp @ 1334] 0b 0039b90c 59126ffa webkit!WebCore::RenderBlock::layout(void)+0x40 [c:\src\chromium-internal\src\third_party\webkit\source\webcore\rendering\renderblock.cpp @ 1202] 0c 0039b9b4 59126cc8 webkit!WebCore::RenderBlock::layoutBlockChild(class WebCore::RenderBox * child = 0x00a7eacc, class WebCore::RenderBlock::MarginInfo * marginInfo = 0x0039ba14, int * previousFloatLogicalBottom = 0x0039ba04, int * maxFloatLogicalBottom = 0x0039bb6c)+0x27a [c:\src\chromium-internal\src\third_party\webkit\source\webcore\rendering\renderblock.cpp @ 2117] 0d 0039ba7c 59123524 webkit!WebCore::RenderBlock::layoutBlockChildren(bool relayoutChildren = false, int * maxFloatLogicalBottom = 0x0039bb6c)+0x398 [c:\src\chromium-internal\src\third_party\webkit\source\webcore\rendering\renderblock.cpp @ 2054] 0e 0039bc14 59122f60 webkit!WebCore::RenderBlock::layoutBlock(bool relayoutChildren = false, int pageLogicalHeight = 0n0, WebCore::RenderBlock::BlockLayoutPass layoutPass = NormalLayoutPass (0n0))+0x574 [c:\src\chromium-internal\src\third_party\webkit\source\webcore\rendering\renderblock.cpp @ 1334] 0f 0039bc30 59126ffa webkit!WebCore::RenderBlock::layout(void)+0x40 [c:\src\chromium-internal\src\third_party\webkit\source\webcore\rendering\renderblock.cpp @ 1202] 10 0039bcd8 59126cc8 webkit!WebCore::RenderBlock::layoutBlockChild(class WebCore::RenderBox * child = 0x00a7ed8c, class WebCore::RenderBlock::MarginInfo * marginInfo = 0x0039bd38, int * previousFloatLogicalBottom = 0x0039bd28, int * maxFloatLogicalBottom = 0x0039be90)+0x27a [c:\src\chromium-internal\src\third_party\webkit\source\webcore\rendering\renderblock.cpp @ 2117] 11 0039bda0 59123524 webkit!WebCore::RenderBlock::layoutBlockChildren(bool relayoutChildren = false, int * maxFloatLogicalBottom = 0x0039be90)+0x398 [c:\src\chromium-internal\src\third_party\webkit\source\webcore\rendering\renderblock.cpp @ 2054] 12 0039bf38 59122f60 webkit!WebCore::RenderBlock::layoutBlock(bool relayoutChildren = false, int pageLogicalHeight = 0n0, WebCore::RenderBlock::BlockLayoutPass layoutPass = NormalLayoutPass (0n0))+0x574 [c:\src\chromium-internal\src\third_party\webkit\source\webcore\rendering\renderblock.cpp @ 1334] 13 0039bf54 5907271d webkit!WebCore::RenderBlock::layout(void)+0x40 [c:\src\chromium-internal\src\third_party\webkit\source\webcore\rendering\renderblock.cpp @ 1202] 14 0039bff8 5941f56d webkit!WebCore::RenderView::layout(void)+0x1fd [c:\src\chromium-internal\src\third_party\webkit\source\webcore\rendering\renderview.cpp @ 137] 15 0039c12c 59bea631 webkit!WebCore::FrameView::layout(bool allowSubtree = true)+0x94d [c:\src\chromium-internal\src\third_party\webkit\source\webcore\page\frameview.cpp @ 1111] 16 0039c148 59bea6e5 webkit!WebCore::Document::updateLayout(void)+0xd1 [c:\src\chromium-internal\src\third_party\webkit\source\webcore\dom\document.cpp @ 1672] 17 0039c15c 59c2b7fd webkit!WebCore::Document::updateLayoutIgnorePendingStylesheets(void)+0xa5 [c:\src\chromium-internal\src\third_party\webkit\source\webcore\dom\document.cpp @ 1705] 18 0039c168 59693559 webkit!WebCore::Node::isContentEditable(void)+0x1d [c:\src\chromium-internal\src\third_party\webkit\source\webcore\dom\node.cpp @ 707] 19 0039c22c 59694676 webkit!WebCore::ApplyStyleCommand::surroundNodeRangeWithElement(class WTF::PassRefPtr<WebCore::Node> passedStartNode = class WTF::PassRefPtr<WebCore::Node>, class WTF::PassRefPtr<WebCore::Node> endNode = class WTF::PassRefPtr<WebCore::Node>, class WTF::PassRefPtr<WebCore::Element> elementToInsert = class WTF::PassRefPtr<WebCore::Element>)+0x189 [c:\src\chromium-internal\src\third_party\webkit\source\webcore\editing\applystylecommand.cpp @ 1278] 1a 0039c5ac 596900f4 webkit!WebCore::ApplyStyleCommand::addInlineStyleIfNeeded(class WebCore::EditingStyle * style = 0x02518a90, class WTF::PassRefPtr<WebCore::Node> passedStart = class WTF::PassRefPtr<WebCore::Node>, class WTF::PassRefPtr<WebCore::Node> passedEnd = class WTF::PassRefPtr<WebCore::Node>, WebCore::ApplyStyleCommand::EAddStyledElement addStyledElement = AddStyledElement (0n0))+0xc36 [c:\src\chromium-internal\src\third_party\webkit\source\webcore\editing\applystylecommand.cpp @ 1390] 1b 0039c654 5968fcbd webkit!WebCore::ApplyStyleCommand::applyInlineStyleToNodeRange(class WebCore::EditingStyle * style = 0x02518a90, class WebCore::Node * node = 0x0250d090, class WebCore::Node * pastEndNode = 0x00000000)+0x3d4 [c:\src\chromium-internal\src\third_party\webkit\source\webcore\editing\applystylecommand.cpp @ 761] 1c 0039c6d4 5968f69f webkit!WebCore::ApplyStyleCommand::fixRangeAndApplyInlineStyle(class WebCore::EditingStyle * style = 0x02518a90, class WebCore::Position * start = 0x0039c994, class WebCore::Position * end = 0x0039c97c)+0x23d [c:\src\chromium-internal\src\third_party\webkit\source\webcore\editing\applystylecommand.cpp @ 693] 1d 0039c9c0 5968c7e7 webkit!WebCore::ApplyStyleCommand::applyInlineStyle(class WebCore::EditingStyle * style = 0x02518a90)+0xbdf [c:\src\chromium-internal\src\third_party\webkit\source\webcore\editing\applystylecommand.cpp @ 658] 1e 0039c9fc 596671dd webkit!WebCore::ApplyStyleCommand::doApply(void)+0x137 [c:\src\chromium-internal\src\third_party\webkit\source\webcore\editing\applystylecommand.cpp @ 226] 1f 0039ca3c 596674d8 webkit!WebCore::CompositeEditCommand::applyCommandToComposite(class WTF::PassRefPtr<WebCore::EditCommand> prpCommand = class WTF::PassRefPtr<WebCore::EditCommand>)+0x8d [c:\src\chromium-internal\src\third_party\webkit\source\webcore\editing\compositeeditcommand.cpp @ 256] 20 0039ca70 5966f09d webkit!WebCore::CompositeEditCommand::applyStyle(class WebCore::EditingStyle * style = 0x02518ae0, WebCore::EditAction editingAction = EditActionChangeAttributes (0n14))+0x88 [c:\src\chromium-internal\src\third_party\webkit\source\webcore\editing\compositeeditcommand.cpp @ 277] 21 0039d03c 5966e0c8 webkit!WebCore::CompositeEditCommand::moveParagraphs(class WebCore::VisiblePosition * startOfParagraphToMove = 0x0039d334, class WebCore::VisiblePosition * endOfParagraphToMove = 0x0039d318, class WebCore::VisiblePosition * destination = 0x0039d16c, bool preserveSelection = true, bool preserveStyle = true)+0xfbd [c:\src\chromium-internal\src\third_party\webkit\source\webcore\editing\compositeeditcommand.cpp @ 1209] 22 0039d05c 5968910d webkit!WebCore::CompositeEditCommand::moveParagraph(class WebCore::VisiblePosition * startOfParagraphToMove = 0x0039d334, class WebCore::VisiblePosition * endOfParagraphToMove = 0x0039d318, class WebCore::VisiblePosition * destination = 0x0039d16c, bool preserveSelection = true, bool preserveStyle = true)+0x98 [c:\src\chromium-internal\src\third_party\webkit\source\webcore\editing\compositeeditcommand.cpp @ 1099] 23 0039d35c 59687fc2 webkit!WebCore::InsertListCommand::listifyParagraph(class WebCore::VisiblePosition * originalStart = 0x0039d430, class WebCore::QualifiedName * listTag = 0x5e8a64d8)+0x85d [c:\src\chromium-internal\src\third_party\webkit\source\webcore\editing\insertlistcommand.cpp @ 385] 24 0039d638 59687622 webkit!WebCore::InsertListCommand::doApplyForSingleParagraph(bool forceCreateList = false, class WebCore::QualifiedName * listTag = 0x5e8a64d8, class WebCore::Range * currentSelection = 0x024d2248)+0x842 [c:\src\chromium-internal\src\third_party\webkit\source\webcore\editing\insertlistcommand.cpp @ 250] 25 0039d9e4 59666e1b webkit!WebCore::InsertListCommand::doApply(void)+0x962 [c:\src\chromium-internal\src\third_party\webkit\source\webcore\editing\insertlistcommand.cpp @ 186] 26 0039da2c 59666ad8 webkit!WebCore::CompositeEditCommand::apply(void)+0x15b [c:\src\chromium-internal\src\third_party\webkit\source\webcore\editing\compositeeditcommand.cpp @ 204] 27 0039da44 593aaa77 webkit!WebCore::applyCommand(class WTF::PassRefPtr<WebCore::CompositeEditCommand> command = class WTF::PassRefPtr<WebCore::CompositeEditCommand>)+0x38 [c:\src\chromium-internal\src\third_party\webkit\source\webcore\editing\compositeeditcommand.cpp @ 162] 28 0039da74 593aecd3 webkit!WebCore::executeInsertUnorderedList(class WebCore::Frame * frame = 0x02470260, class WebCore::Event * __formal = 0x00000000)+0x77 [c:\src\chromium-internal\src\third_party\webkit\source\webcore\editing\editorcommand.cpp @ 557] 29 0039da94 59bf5999 webkit!WebCore::Editor::Command::execute(class WTF::String * parameter = 0x0039dafc, class WebCore::Event * triggeringEvent = 0x00000000)+0x93 [c:\src\chromium-internal\src\third_party\webkit\source\webcore\editing\editorcommand.cpp @ 1664] 2a 0039dad0 5a27af7a webkit!WebCore::Document::execCommand(class WTF::String * commandName = 0x0039daf8, bool userInterface = false, class WTF::String * value = 0x0039dafc)+0x79 [c:\src\chromium-internal\src\third_party\webkit\source\webcore\dom\document.cpp @ 4188] 2b 0039db8c 660bfa0c webkit!WebCore::DocumentInternal::execCommandCallback(class v8::Arguments * args = 0x0039dc0c)+0x28a [c:\src\chromium-internal\src\build\debug\obj\global_intermediate\webcore\bindings\v8document.cpp @ 1503] 2c 0039dcb8 660ba2b4 v8!v8::internal::HandleApiCallHelper<0>(class v8::internal::`anonymous-namespace'::BuiltinArguments<1> args = class v8::internal::`anonymous-namespace'::BuiltinArguments<1>, class v8::internal::Isolate * isolate = 0x00a750f8)+0x3dc [c:\src\chromium-internal\src\v8\src\builtins.cc @ 1136] 2d 0039dccc 660ba226 v8!v8::internal::Builtin_Impl_HandleApiCall(class v8::internal::`anonymous-namespace'::BuiltinArguments<1> args = class v8::internal::`anonymous-namespace'::BuiltinArguments<1>, class v8::internal::Isolate * isolate = 0x00a750f8)+0x14 [c:\src\chromium-internal\src\v8\src\builtins.cc @ 1153] 2e 0039dce0 02a083b6 v8!v8::internal::Builtin_HandleApiCall(class v8::internal::`anonymous-namespace'::BuiltinArguments<1> args = class v8::internal::`anonymous-namespace'::BuiltinArguments<1>, class v8::internal::Isolate * isolate = 0x00a750f8)+0x46 [c:\src\chromium-internal\src\v8\src\builtins.cc @ 1152] WARNING: Frame IP not in any known module. Following frames may be wrong. 2f 0039dd8c 65ef343c 0x2a083b6 30 0039de3c 65ef31c4 v8!v8::internal::Invoke(bool is_construct = true, class v8::internal::Handle<v8::internal::JSFunction> function = class v8::internal::Handle<v8::internal::JSFunction>, class v8::internal::Handle<v8::internal::Object> receiver = class v8::internal::Handle<v8::internal::Object>, int argc = 0n3792208, class v8::internal::Handle<v8::internal::Object> * args = 0x02a1f2b2, bool * has_pending_exception = 0x03746a0d)+0x1cc [c:\src\chromium-internal\src\v8\src\execution.cc @ 118] 31 0039de7c 65e80314 v8!v8::internal::Execution::Call(class v8::internal::Handle<v8::internal::Object> callable = class v8::internal::Handle<v8::internal::Object>, class v8::internal::Handle<v8::internal::Object> receiver = class v8::internal::Handle<v8::internal::Object>, int argc = 0n1, class v8::internal::Handle<v8::internal::Object> * argv = 0x0039e06c, bool * pending_exception = 0x0039dedf, bool convert_receiver = false)+0x1a4 [c:\src\chromium-internal\src\v8\src\execution.cc @ 173] 32 0039df40 5929c7fd v8!v8::Function::Call(class v8::Handle<v8::Object> recv = class v8::Handle<v8::Object>, int argc = 0n1, class v8::Handle<v8::Value> * argv = 0x0039e06c)+0x1e4 [c:\src\chromium-internal\src\v8\src\api.cc @ 3603] 33 0039dfdc 5929c605 webkit!WebCore::V8Proxy::instrumentedCallFunction(class WebCore::Page * page = 0x024663a0, class v8::Handle<v8::Function> function = class v8::Handle<v8::Function>, class v8::Handle<v8::Object> receiver = class v8::Handle<v8::Object>, int argc = 0n1, class v8::Handle<v8::Value> * args = 0x0039e06c)+0x18d [c:\src\chromium-internal\src\third_party\webkit\source\webcore\bindings\v8\v8proxy.cpp @ 432] 34 0039e01c 59642a00 webkit!WebCore::V8Proxy::callFunction(class v8::Handle<v8::Function> function = class v8::Handle<v8::Function>, class v8::Handle<v8::Object> receiver = class v8::Handle<v8::Object>, int argc = 0n1, class v8::Handle<v8::Value> * args = 0x0039e06c)+0x75 [c:\src\chromium-internal\src\third_party\webkit\source\webcore\bindings\v8\v8proxy.cpp @ 407] 35 0039e09c 5986eba8 webkit!WebCore::V8EventListener::callListenerFunction(class WebCore::ScriptExecutionContext * context = 0x0249b110, class v8::Handle<v8::Value> jsEvent = class v8::Handle<v8::Value>, class WebCore::Event * event = 0x024be2e0)+0x120 [c:\src\chromium-internal\src\third_party\webkit\source\webcore\bindings\v8\v8eventlistener.cpp @ 89] 36 0039e150 5986e7e3 webkit!WebCore::V8AbstractEventListener::invokeEventHandler(class WebCore::ScriptExecutionContext * context = 0x0249b110, class WebCore::Event * event = 0x024be2e0, class v8::Handle<v8::Value> jsEvent = class v8::Handle<v8::Value>)+0x1c8 [c:\src\chromium-internal\src\third_party\webkit\source\webcore\bindings\v8\v8abstracteventlistener.cpp @ 152] 37 0039e1cc 59bd2f35 webkit!WebCore::V8AbstractEventListener::handleEvent(class WebCore::ScriptExecutionContext * context = 0x0249b110, class WebCore::Event * event = 0x024be2e0)+0x163 [c:\src\chromium-internal\src\third_party\webkit\source\webcore\bindings\v8\v8abstracteventlistener.cpp @ 98] 38 0039e244 59bd2dca webkit!WebCore::EventTarget::fireEventListeners(class WebCore::Event * event = 0x024be2e0, struct WebCore::EventTargetData * d = 0x0249f0f0, class WTF::Vector<WebCore::RegisteredEventListener,1> * entry = 0x00ac6518)+0x145 [c:\src\chromium-internal\src\third_party\webkit\source\webcore\dom\eventtarget.cpp @ 231] 39 0039e268 5934d3d2 webkit!WebCore::EventTarget::fireEventListeners(class WebCore::Event * event = 0x024be2e0)+0xda [c:\src\chromium-internal\src\third_party\webkit\source\webcore\dom\eventtarget.cpp @ 200] 3a 0039e2e0 5934d06e webkit!WebCore::DOMWindow::dispatchEvent(class WTF::PassRefPtr<WebCore::Event> prpEvent = class WTF::PassRefPtr<WebCore::Event>, class WTF::PassRefPtr<WebCore::EventTarget> prpTarget = class WTF::PassRefPtr<WebCore::EventTarget>)+0x152 [c:\src\chromium-internal\src\third_party\webkit\source\webcore\page\domwindow.cpp @ 1624] 3b 0039e36c 59bf35ef webkit!WebCore::DOMWindow::dispatchLoadEvent(void)+0x14e [c:\src\chromium-internal\src\third_party\webkit\source\webcore\page\domwindow.cpp @ 1599] 3c 0039e37c 59becde6 webkit!WebCore::Document::dispatchWindowLoadEvent(void)+0x5f [c:\src\chromium-internal\src\third_party\webkit\source\webcore\dom\document.cpp @ 3705] 3d 0039e3e8 5925d314 webkit!WebCore::Document::implicitClose(void)+0x1b6 [c:\src\chromium-internal\src\third_party\webkit\source\webcore\dom\document.cpp @ 2255] 3e 0039e3f4 5925d09b webkit!WebCore::FrameLoader::checkCallImplicitClose(void)+0x84 [c:\src\chromium-internal\src\third_party\webkit\source\webcore\loader\frameloader.cpp @ 795] 3f 0039e41c 5925cdbe webkit!WebCore::FrameLoader::checkCompleted(void)+0x11b [c:\src\chromium-internal\src\third_party\webkit\source\webcore\loader\frameloader.cpp @ 744] 40 0039e44c 59bf74ce webkit!WebCore::FrameLoader::finishedParsing(void)+0xbe [c:\src\chromium-internal\src\third_party\webkit\source\webcore\loader\frameloader.cpp @ 678] 41 0039e480 59b8d314 webkit!WebCore::Document::finishedParsing(void)+0x18e [c:\src\chromium-internal\src\third_party\webkit\source\webcore\dom\document.cpp @ 4452] 42 0039e490 59b258f3 webkit!WebCore::HTMLTreeBuilder::finished(void)+0x64 [c:\src\chromium-internal\src\third_party\webkit\source\webcore\html\parser\htmltreebuilder.cpp @ 2820] 43 0039e49c 59b259e6 webkit!WebCore::HTMLDocumentParser::end(void)+0x83 [c:\src\chromium-internal\src\third_party\webkit\source\webcore\html\parser\htmldocumentparser.cpp @ 382] 44 0039e4ac 59b244b9 webkit!WebCore::HTMLDocumentParser::attemptToRunDeferredScriptsAndEnd(void)+0xb6 [c:\src\chromium-internal\src\third_party\webkit\source\webcore\html\parser\htmldocumentparser.cpp @ 391] 45 0039e4d8 59b25a59 webkit!WebCore::HTMLDocumentParser::prepareToStopParsing(void)+0xe9 [c:\src\chromium-internal\src\third_party\webkit\source\webcore\html\parser\htmldocumentparser.cpp @ 154] 46 0039e4e8 59b25bb3 webkit!WebCore::HTMLDocumentParser::attemptToEnd(void)+0x39 [c:\src\chromium-internal\src\third_party\webkit\source\webcore\html\parser\htmldocumentparser.cpp @ 402] 47 0039e4f4 5939eddc webkit!WebCore::HTMLDocumentParser::finish(void)+0x33 [c:\src\chromium-internal\src\third_party\webkit\source\webcore\html\parser\htmldocumentparser.cpp @ 430] 48 0039e528 5939eca7 webkit!WebCore::DocumentWriter::endIfNotLoadingMainResource(void)+0x11c [c:\src\chromium-internal\src\third_party\webkit\source\webcore\loader\documentwriter.cpp @ 233] 49 0039e534 59389e94 webkit!WebCore::DocumentWriter::end(void)+0x27 [c:\src\chromium-internal\src\third_party\webkit\source\webcore\loader\documentwriter.cpp @ 213] 4a 0039e544 592643dc webkit!WebCore::DocumentLoader::finishedLoading(void)+0x54 [c:\src\chromium-internal\src\third_party\webkit\source\webcore\loader\documentloader.cpp @ 296] 4b 0039e57c 596e7d95 webkit!WebCore::FrameLoader::finishedLoading(void)+0x7c [c:\src\chromium-internal\src\third_party\webkit\source\webcore\loader\frameloader.cpp @ 2069] 4c 0039e5c4 596df991 webkit!WebCore::MainResourceLoader::didFinishLoading(double finishTime = 114468.22199999999)+0x145 [c:\src\chromium-internal\src\third_party\webkit\source\webcore\loader\mainresourceloader.cpp @ 485] 4d 0039e5dc 58c290c0 webkit!WebCore::ResourceLoader::didFinishLoading(class WebCore::ResourceHandle * __formal = 0x024ad2f8, double finishTime = 114468.22199999999)+0x61 [c:\src\chromium-internal\src\third_party\webkit\source\webcore\loader\resourceloader.cpp @ 451] 4e 0039e5f8 68927ca3 webkit!WebCore::ResourceHandleInternal::didFinishLoading(class WebKit::WebURLLoader * __formal = 0x0246bbf8, double finishTime = 114468.22199999999)+0x90 [c:\src\chromium-internal\src\third_party\webkit\source\webkit\chromium\src\resourcehandle.cpp @ 158] 4f 0039e7a0 5ebbfa0b glue!webkit_glue::WebURLLoaderImpl::Context::OnCompletedRequest(class net::URLRequestStatus * status = 0x0039e828, class std::basic_string<char,std::char_traits<char>,std::allocator<char> > * security_info = 0x0039e830, class base::TimeTicks * completion_time = 0x0039e7c8)+0x323 [c:\src\chromium-internal\src\webkit\glue\weburlloader_impl.cc @ 652] 50 0039e7e4 5ebcde47 content!ResourceDispatcher::OnRequestComplete(int request_id = 0n0, class net::URLRequestStatus * status = 0x0039e828, class std::basic_string<char,std::char_traits<char>,std::allocator<char> > * security_info = 0x0039e830, class base::TimeTicks * browser_completion_time = 0x0039e854)+0xeb [c:\src\chromium-internal\src\content\common\resource_dispatcher.cc @ 488] 51 0039e800 5ebcc24f content!DispatchToMethod<ResourceDispatcher,void (class ResourceDispatcher * obj = 0x00a9a180, <function> * method = 0x5eaa9b3c, struct Tuple4<int,net::URLRequestStatus,std::basic_string<char,std::char_traits<char>,std::allocator<char> >,base::TimeTicks> * arg = 0x0039e824)+0x27 [c:\src\chromium-internal\src\base\tuple.h @ 566] 52 0039e870 5ebc0d47 content!ResourceMsg_RequestComplete::Dispatch<ResourceDispatcher,ResourceDispatcher,void (class IPC::Message * msg = 0x00ae51b0, class ResourceDispatcher * obj = 0x00a9a180, class ResourceDispatcher * sender = 0x00a9a180, <function> * func = 0x5eaa9b3c)+0x6f [c:\src\chromium-internal\src\content\common\resource_messages.h @ 172] 53 0039ea34 5ebbe7d7 content!ResourceDispatcher::DispatchMessageW(class IPC::Message * message = 0x00ae51b0)+0x437 [c:\src\chromium-internal\src\content\common\resource_dispatcher.cc @ 559] 54 0039ec04 5ec00528 content!ResourceDispatcher::OnMessageReceived(class IPC::Message * message = 0x00ae51b0)+0x487 [c:\src\chromium-internal\src\content\common\resource_dispatcher.cc @ 327] 55 0039edb8 6ea59185 content!ChildThread::OnMessageReceived(class IPC::Message * msg = 0x00ae51b0)+0x78 [c:\src\chromium-internal\src\content\common\child_thread.cc @ 171] 56 0039edd0 6ea61f60 ipc!IPC::ChannelProxy::Context::OnDispatchMessage(class IPC::Message * message = 0x00ae51b0)+0x85 [c:\src\chromium-internal\src\ipc\ipc_channel_proxy.cc @ 257] 57 0039ede4 6ea61dd7 ipc!base::internal::RunnableAdapter<void (class IPC::ChannelProxy::Context * object = 0x00ae3198, class IPC::Message * a1 = 0x00ae51b0)+0x30 [c:\src\chromium-internal\src\base\bind_internal.h @ 188] 58 0039edf4 6ea6198f ipc!base::internal::InvokeHelper<0,void,base::internal::RunnableAdapter<void (class base::internal::RunnableAdapter<void (__thiscall IPC::ChannelProxy::Context::*)(IPC::Message const &)> runnable = class base::internal::RunnableAdapter<void (__thiscall IPC::ChannelProxy::Context::*)(IPC::Message const &)>, class IPC::ChannelProxy::Context ** a1 = 0x00ae51a8, class IPC::Message * a2 = 0x00ae51b0)+0x27 [c:\src\chromium-internal\src\base\bind_internal.h @ 897] 59 0039ee18 6a5c2b2f ipc!base::internal::Invoker<2,base::internal::BindState<base::internal::RunnableAdapter<void (class base::internal::BindStateBase * base = 0x00ae5190)+0x6f [c:\src\chromium-internal\src\base\bind_internal.h @ 1254] 5a 0039ee30 6a5ca0a5 base!base::Callback<void __cdecl(void)+0x2f [c:\src\chromium-internal\src\base\callback.h @ 272] 5b 0039ef68 6a5ca333 base!MessageLoop::RunTask(struct base::PendingTask * pending_task = 0x0039ef9c)+0x255 [c:\src\chromium-internal\src\base\message_loop.cc @ 460] 5c 0039ef78 6a5cb1d6 base!MessageLoop::DeferOrRunPendingTask(struct base::PendingTask * pending_task = 0x0039ef9c)+0x33 [c:\src\chromium-internal\src\base\message_loop.cc @ 473] 5d 0039efe8 6a5f7b06 base!MessageLoop::DoWork(void)+0x106 [c:\src\chromium-internal\src\base\message_loop.cc @ 660] 5e 0039f0e0 6a5c9c8a base!base::MessagePumpDefault::Run(class base::MessagePump::Delegate * delegate = 0x0039f560)+0x106 [c:\src\chromium-internal\src\base\message_pump_default.cc @ 28] 5f 0039f1b4 6a5c99de base!MessageLoop::RunInternal(void)+0x13a [c:\src\chromium-internal\src\base\message_loop.cc @ 417] 60 0039f1c0 6a5c8cc0 base!MessageLoop::RunHandler(void)+0x2e [c:\src\chromium-internal\src\base\message_loop.cc @ 391] 61 0039f1f8 5f67bb03 base!MessageLoop::Run(void)+0x60 [c:\src\chromium-internal\src\base\message_loop.cc @ 301] 62 0039f6e8 5eb3d108 content!RendererMain(struct content::MainFunctionParams * parameters = 0x0039fa98)+0x5e3 [c:\src\chromium-internal\src\content\renderer\renderer_main.cc @ 241] 63 0039f7b4 5eb3d955 content!`anonymous namespace'::RunNamedProcessTypeMain(class std::basic_string<char,std::char_traits<char>,std::allocator<char> > * process_type = 0x0039fae8, struct content::MainFunctionParams * main_function_params = 0x0039fa98, class content::ContentMainDelegate * delegate = 0x0039fba0)+0x98 [c:\src\chromium-internal\src\content\app\content_main.cc @ 264] 64 0039fb7c 60ed6013 content!content::ContentMain(struct HINSTANCE__ * instance = 0x01040000, struct sandbox::SandboxInterfaceInfo * sandbox_info = 0x0039fd0c, class content::ContentMainDelegate * delegate = 0x0039fba0)+0x6a5 [c:\src\chromium-internal\src\content\app\content_main.cc @ 457] 65 0039fbc0 010430ce chrome_60ed0000!ChromeMain(struct HINSTANCE__ * instance = 0x01040000, struct sandbox::SandboxInterfaceInfo * sandbox_info = 0x0039fd0c)+0x33 [c:\src\chromium-internal\src\chrome\app\chrome_main.cc @ 28] 66 0039fc90 01041955 chrome!MainDllLoader::Launch(struct HINSTANCE__ * instance = 0x01040000, struct sandbox::SandboxInterfaceInfo * sbox_info = 0x0039fd0c)+0x22e [c:\src\chromium-internal\src\chrome\app\client_util.cc @ 342] 67 0039fd24 010d07fb chrome!wWinMain(struct HINSTANCE__ * instance = 0x01040000, struct HINSTANCE__ * __formal = 0x00000000)+0x95 [c:\src\chromium-internal\src\chrome\app\chrome_exe_main_win.cc @ 36] 68 0039fdd4 010d055f chrome!__tmainCRTStartup(void)+0x28b [f:\dd\vctools\crt_bld\self_x86\crt\src\crtexe.c @ 578] 69 0039fddc 7571339a chrome!wWinMainCRTStartup(void)+0xf [f:\dd\vctools\crt_bld\self_x86\crt\src\crtexe.c @ 403] 6a 0039fde8 775a9ef2 kernel32!BaseThreadInitThunk+0xe 6b 0039fe28 775a9ec5 ntdll32!__RtlUserThreadStart+0x70 6c 0039fe40 00000000 ntdll32!_RtlUserThreadStart+0x1b 605454 3 playmobil 2012-04-19 02:25:24 -0700 Also filed as http://crbug.com/123438 605643 4 leviw 2012-04-19 09:56:23 -0700 (In reply to comment #3) > Also filed as http://crbug.com/123438 Does this only occur on Windows? I tried the most recent Dev and Canary Mac Chrome builds but can't reproduce the crash. 624641 5 142074 leviw 2012-05-15 15:16:08 -0700 Created attachment 142074 Repro 2 The test case attached to this bug doesn't repro the problem for me, but those on crbug.com/123438 and crbug.com/126607 do. The issue comes from an assumption that we'll have BiDi runs inside the isolate to populate the fake run created in the first UBA pass. In the new test case attached, the early return from https://bugs.webkit.org/show_bug.cgi?id=58176 causes us to avoid creating a BiDi run for the contained positioned div. 625725 6 142320 leviw 2012-05-16 12:16:31 -0700 Created attachment 142320 Patch 625744 7 142320 eric 2012-05-16 12:33:08 -0700 Comment on attachment 142320 Patch It's unclear to me what happens when we let a fake run like this "escape" past the UBA. I would have expected we would have ASSERTED against this. :) We should probably at least document this possibility? 625835 8 leviw 2012-05-16 13:56:50 -0700 (In reply to comment #7) > (From update of attachment 142320 [details]) > It's unclear to me what happens when we let a fake run like this "escape" past the UBA. I would have expected we would have ASSERTED against this. :) We should probably at least document this possibility? It's not obvious to me where this documentation would belong. Any proposals on how we should document this where the right people will notice? 626929 9 142320 rniwa 2012-05-17 13:53:14 -0700 Comment on attachment 142320 Patch looks sane to me. 626930 10 rniwa 2012-05-17 13:54:08 -0700 Oops, missed Eric's comment. Please address eric's comment before you land it. 630973 11 143411 leviw 2012-05-22 17:33:47 -0700 Created attachment 143411 Patch for landing 631142 12 143411 webkit.review.bot 2012-05-22 21:00:04 -0700 Comment on attachment 143411 Patch for landing Clearing flags on attachment: 143411 Committed r118114: <http://trac.webkit.org/changeset/118114> 631143 13 webkit.review.bot 2012-05-22 21:00:10 -0700 All reviewed patches have been landed. Closing bug. 631240 14 143411 darin 2012-05-22 22:56:22 -0700 Comment on attachment 143411 Patch for landing View in context: https://bugs.webkit.org/attachment.cgi?id=143411&action=review > Source/WebCore/rendering/RenderBlockLineLayout.cpp:1004 > + // We're not guarnateed to get any BidiRuns in the previous step. If we don't, we allow the placeholder guaranteed is misspelled here 631329 15 143411 rniwa 2012-05-23 00:36:17 -0700 Comment on attachment 143411 Patch for landing View in context: https://bugs.webkit.org/attachment.cgi?id=143411&action=review >> Source/WebCore/rendering/RenderBlockLineLayout.cpp:1004 >> + // We're not guarnateed to get any BidiRuns in the previous step. If we don't, we allow the placeholder > > guaranteed is misspelled here Fixed in r118139. 633025 16 webkit-bug-importer 2012-05-24 11:59:31 -0700 <rdar://problem/11526831> 125424 2012-02-03 14:51:36 -0800 2012-02-03 14:51:36 -0800 Repro repro.html text/html 281 skylined PCE+CjxzdHlsZT4KLmNsYXNzMntmbG9hdDpyaWdodH0KYntib3JkZXItc3R5bGU6ZG91YmxlfQo8 L3N0eWxlPgo8c2NyaXB0PgogIHdpbmRvdy5vbmxvYWQgPSBmdW5jdGlvbigpewogICAgZG9jdW1l bnQuZGVzaWduTW9kZT0ib24iO2RvY3VtZW50LmV4ZWNDb21tYW5kKCJTZWxlY3RBbGwiKTsKICAg IGRvY3VtZW50LmV4ZWNDb21tYW5kKCJJbnNlcnRVbm9yZGVyZWRMaXN0Iik7CiAgfQo8L3Njcmlw dD4KPHAgPjxzdmc6Zm9udCA+PC9zdmc6Zm9udD48YmRpID48YiBjbGFzcz0iY2xhc3MyIj4= 142074 2012-05-15 15:16:08 -0700 2012-05-15 15:16:08 -0700 Repro 2 test (2).htm text/html 56 leviw YTxvdXRwdXQ+PGRpdiBzdHlsZT0icG9zaXRpb246YWJzb2x1dGU7Ij48L2Rpdj48L291dHB1dD4= 142320 2012-05-16 12:16:31 -0700 2012-05-22 17:33:40 -0700 Patch bug-77786-20120516121630.patch text/plain 4759 leviw SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDExNzE3MCkKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDI4IEBACisyMDEyLTA1LTE1ICBMZXZpIFdl aW50cmF1YiAgPGxldml3QGNocm9taXVtLm9yZz4KKworICAgICAgICBOVUxMIHB0ciBpbiBXZWJD b3JlOjpSZW5kZXJCbG9jazo6bGF5b3V0UnVuc0FuZEZsb2F0c0luUmFuZ2UKKyAgICAgICAgaHR0 cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTc3Nzg2CisKKyAgICAgICAgUmV2 aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgSW5saW5lQmlkaVJlc29sdmVyIGFk ZHMgb25lIGZha2UgVGV4dFJ1biBmb3IgaXNvbGF0ZWQgaW5saW5lcyBpbiB0aGUgcHJvY2VzcyBv ZiBjcmVhdGluZyB0aGUKKyAgICAgICAgbGlzdCBvZiBUZXh0UnVucyB0byBzZW5kIHRvIHRoZSBV QkEuIEFmdGVyIHRoZSBVQkEgaGFzIGJlZW4gcnVuIGFuZCB0aGUgVGV4dFJ1bnMgcmVvcmRlcmVk LAorICAgICAgICB3ZSByZS1ydW4gSW5saW5lQmlkaVJlc29sdmVyIHJvb3RlZCBpbiB0aGUgaXNv bGF0ZSBhbmQgcmVwbGFjZSB0aGUgZmFrZSBydW4gd2l0aCB0aG9zZQorICAgICAgICBnZW5lcmF0 ZWQgYnkgdGhlIHN1YnNlcXVlbnQgcGFzcyBieSBjYWxsaW5nIHRoZSBtZXRob2QgQmlkaVJ1bkxp c3Q6OnJlcGxhY2VSdW5XaXRoUnVucy4KKyAgICAgICAgVGhpcyBtZXRob2QgYXNzdW1lcyB0aGVy ZSBhcmUgcnVucyB0byByZXBsYWNlIHRoZSBmYWtlIHJ1biB3aXRoLgorCisgICAgICAgIFBvc2l0 aW9uZWQgaW5saW5lIGNoaWxkcmVuIGFyZSBpZ25vcmVkIHdoZW4gY3JlYXRpbmcgVGV4dFJ1bnMs IHNvIHdoZW4gYW4gaXNvbGF0ZWQgaW5saW5lCisgICAgICAgIGhhcyBvbmx5IHBvc2l0aW9uZWQg Y2hpbGRyZW4gd2UgZW5kIHVwIHdpdGggYW4gZW1wdHkgc2V0IG9mIHJ1bnMgdG8gcGFzcyB0byBy ZXBsYWNlUnVuV2l0aFJ1bnMuCisgICAgICAgIElkZWFsbHksIHdlJ2QgcmVtb3ZlIHRoZSBmYWtl IHJ1biBhbmQgbm90IHJlcGxhY2UgaXQgd2l0aCBhbnl0aGluZywgYnV0IEJpZGlSdW5MaXN0IGtl ZXBzCisgICAgICAgIGEgcG9pbnRlciB0byB0aGUgbG9naWNhbGx5IGxhc3QgcnVuLCB3aGljaCB3 ZSdyZSB1bmFibGUgdG8gZWFzaWx5IHJlLWRldGVybWluZSBhZnRlciB0aGUgVUJBCisgICAgICAg IGhhcyBiZWVuIHJ1bi4gSW5zdGVhZCwgd2UgbGVhdmUgdGhlIGZha2UgcnVuIGluIHRoZSBsaXN0 IGFuZCBzaW1wbHkgYXZvaWQgY2FsbGluZworICAgICAgICByZXBsYWNlUnVuV2l0aFJ1bnMgd2hl biB3ZSBkb24ndCBoYXZlIGFueSByZXBsYWNlbWVudCBydW5zLgorCisgICAgICAgIFRlc3Q6IGZh c3QvYmxvY2svbGluZS1sYXlvdXQvY3Jhc2gtaW4taXNvbGF0ZS13aXRoLXBvc2l0aW9uZWQtY2hp bGQuaHRtbAorCisgICAgICAgICogcmVuZGVyaW5nL1JlbmRlckJsb2NrTGluZUxheW91dC5jcHA6 CisgICAgICAgIChXZWJDb3JlOjpjb25zdHJ1Y3RCaWRpUnVucyk6CisKIDIwMTItMDUtMTUgIEFs ZXhhbmRyZSBFbGlhcyAgPGFlbGlhc0Bnb29nbGUuY29tPgogCiAgICAgICAgIFtjaHJvbWl1bV0g Rml4IHVuc2FmZSB2aWV3cG9ydCB0YWcgZGlzcGF0Y2gKSW5kZXg6IFNvdXJjZS9XZWJDb3JlL3Jl bmRlcmluZy9SZW5kZXJCbG9ja0xpbmVMYXlvdXQuY3BwCj09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9X ZWJDb3JlL3JlbmRlcmluZy9SZW5kZXJCbG9ja0xpbmVMYXlvdXQuY3BwCShyZXZpc2lvbiAxMTcx MDQpCisrKyBTb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyQmxvY2tMaW5lTGF5b3V0LmNw cAkod29ya2luZyBjb3B5KQpAQCAtMTAwMSw3ICsxMDAxLDggQEAgc3RhdGljIGlubGluZSB2b2lk IGNvbnN0cnVjdEJpZGlSdW5zKElubAogICAgICAgICAvLyBybml3YSBzYXlzIHByZXZpb3VzTGlu ZUJyb2tlQ2xlYW5seSBpcyBqdXN0IGEgV2luSUUgaGFjayBhbmQgY291bGQgYWx3YXlzIGJlIGZh bHNlIGhlcmU/CiAgICAgICAgIGlzb2xhdGVkUmVzb2x2ZXIuY3JlYXRlQmlkaVJ1bnNGb3JMaW5l KGVuZE9mTGluZSwgTm9WaXN1YWxPdmVycmlkZSwgcHJldmlvdXNMaW5lQnJva2VDbGVhbmx5KTsK ICAgICAgICAgLy8gTm90ZSB0aGF0IHdlIGRvIG5vdCBkZWxldGUgdGhlIHJ1bnMgZnJvbSB0aGUg cmVzb2x2ZXIuCi0gICAgICAgIGJpZGlSdW5zLnJlcGxhY2VSdW5XaXRoUnVucyhpc29sYXRlZFJ1 biwgaXNvbGF0ZWRSZXNvbHZlci5ydW5zKCkpOworICAgICAgICBpZiAoaXNvbGF0ZWRSZXNvbHZl ci5ydW5zKCkucnVuQ291bnQoKSkKKyAgICAgICAgICAgIGJpZGlSdW5zLnJlcGxhY2VSdW5XaXRo UnVucyhpc29sYXRlZFJ1biwgaXNvbGF0ZWRSZXNvbHZlci5ydW5zKCkpOwogCiAgICAgICAgIC8v IElmIHdlIGVuY291bnRlcmVkIGFueSBuZXN0ZWQgaXNvbGF0ZSBydW5zLCBqdXN0IG1vdmUgdGhl bQogICAgICAgICAvLyB0byB0aGUgdG9wIHJlc29sdmVyJ3MgbGlzdCBmb3IgbGF0ZXIgcHJvY2Vz c2luZy4KSW5kZXg6IExheW91dFRlc3RzL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRU ZXN0cy9DaGFuZ2VMb2cJKHJldmlzaW9uIDExNzE3MCkKKysrIExheW91dFRlc3RzL0NoYW5nZUxv Zwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDEzIEBACisyMDEyLTA1LTE1ICBMZXZpIFdlaW50 cmF1YiAgPGxldml3QGNocm9taXVtLm9yZz4KKworICAgICAgICBOVUxMIHB0ciBpbiBXZWJDb3Jl OjpSZW5kZXJCbG9jazo6bGF5b3V0UnVuc0FuZEZsb2F0c0luUmFuZ2UKKyAgICAgICAgaHR0cHM6 Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTc3Nzg2CisKKyAgICAgICAgUmV2aWV3 ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgKiBmYXN0L2Jsb2NrL2xpbmUtbGF5b3V0 L2NyYXNoLWluLWlzb2xhdGUtd2l0aC1wb3NpdGlvbmVkLWNoaWxkLWV4cGVjdGVkLnR4dDogQWRk ZWQuCisgICAgICAgICogZmFzdC9ibG9jay9saW5lLWxheW91dC9jcmFzaC1pbi1pc29sYXRlLXdp dGgtcG9zaXRpb25lZC1jaGlsZC5odG1sOiBBZGRlZC4KKwogMjAxMi0wNS0xNSAgRXJpayBBcnZp ZHNzb24gIDxhcnZAY2hyb21pdW0ub3JnPgogCiAgICAgICAgIFJlc3VsdCBvZiBmYXN0L2RvbS9E T01FeGNlcHRpb24vc3RhY2stdHJhY2UuaHRtbCBkZXBlbmRzIG9uIHBhdGggKHRlc3QgaW50cm9k dWNlZCBpbiByMTE3MDE2KQpJbmRleDogTGF5b3V0VGVzdHMvZmFzdC9ibG9jay9saW5lLWxheW91 dC9jcmFzaC1pbi1pc29sYXRlLXdpdGgtcG9zaXRpb25lZC1jaGlsZC1leHBlY3RlZC50eHQKPT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PQotLS0gTGF5b3V0VGVzdHMvZmFzdC9ibG9jay9saW5lLWxheW91dC9jcmFzaC1pbi1p c29sYXRlLXdpdGgtcG9zaXRpb25lZC1jaGlsZC1leHBlY3RlZC50eHQJKHJldmlzaW9uIDApCisr KyBMYXlvdXRUZXN0cy9mYXN0L2Jsb2NrL2xpbmUtbGF5b3V0L2NyYXNoLWluLWlzb2xhdGUtd2l0 aC1wb3NpdGlvbmVkLWNoaWxkLWV4cGVjdGVkLnR4dAkocmV2aXNpb24gMCkKQEAgLTAsMCArMSBA QAorVGhpcyB0ZXN0cyB0aGF0IGEgcG9zaXRpb25lZCBvYmplY3QgYXMgdGhlIG9ubHkgY2hpbGQg b2YgYW4gaXNvbGF0ZWQgaW5saW5lIGRvZXNuJ3QgY3Jhc2guIFNlZSBodHRwczovL2J1Z3Mud2Vi a2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9Nzc3ODYgZm9yIGRldGFpbHMuCkluZGV4OiBMYXlvdXRU ZXN0cy9mYXN0L2Jsb2NrL2xpbmUtbGF5b3V0L2NyYXNoLWluLWlzb2xhdGUtd2l0aC1wb3NpdGlv bmVkLWNoaWxkLmh0bWwKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvZmFzdC9ibG9jay9saW5l LWxheW91dC9jcmFzaC1pbi1pc29sYXRlLXdpdGgtcG9zaXRpb25lZC1jaGlsZC5odG1sCShyZXZp c2lvbiAwKQorKysgTGF5b3V0VGVzdHMvZmFzdC9ibG9jay9saW5lLWxheW91dC9jcmFzaC1pbi1p c29sYXRlLXdpdGgtcG9zaXRpb25lZC1jaGlsZC5odG1sCShyZXZpc2lvbiAwKQpAQCAtMCwwICsx LDExIEBACis8IURPQ1RZUEUgaHRtbD4KKzxodG1sPgorPGJvZHk+CitUaGlzIHRlc3RzIHRoYXQg YSBwb3NpdGlvbmVkIG9iamVjdCBhcyB0aGUgb25seSBjaGlsZCBvZiBhbiBpc29sYXRlZCBpbmxp bmUgZG9lc24ndCBjcmFzaC4gU2VlIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNn aT9pZD03Nzc4NiBmb3IgZGV0YWlscy4KKzxzcGFuIHN0eWxlPSJ1bmljb2RlLWJpZGk6LXdlYmtp dC1pc29sYXRlOyI+PGRpdiBzdHlsZT0icG9zaXRpb246YWJzb2x1dGU7Ij48L2Rpdj48L3NwYW4+ Cis8L2JvZHk+Cis8c2NyaXB0PgoraWYgKHdpbmRvdy5sYXlvdXRUZXN0Q29udHJvbGxlcikKKyAg ICBsYXlvdXRUZXN0Q29udHJvbGxlci5kdW1wQXNUZXh0KCk7Cis8L3NjcmlwdD4KKzwvaHRtbD4K XCBObyBuZXdsaW5lIGF0IGVuZCBvZiBmaWxlCg== 143411 2012-05-22 17:33:47 -0700 2012-05-23 00:36:17 -0700 Patch for landing bug-77786-20120522173346.patch text/plain 5271 leviw U3VidmVyc2lvbiBSZXZpc2lvbjogMTE4MDU0CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggYTBkMzQ5NjRlMDdiOWRi ZjQ3YTU0ODM0YWY4N2RmMGRkNGZhNWFmMy4uNzU0NjEwNWE0MTk3ZDUzNzBlODBiODc2MTUzYjc2 YzEwNmQ0MDQxZCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDI4IEBACisyMDEyLTA1LTIyICBMZXZp IFdlaW50cmF1YiAgPGxldml3QGNocm9taXVtLm9yZz4KKworICAgICAgICBOVUxMIHB0ciBpbiBX ZWJDb3JlOjpSZW5kZXJCbG9jazo6bGF5b3V0UnVuc0FuZEZsb2F0c0luUmFuZ2UKKyAgICAgICAg aHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTc3Nzg2CisKKyAgICAgICAg UmV2aWV3ZWQgYnkgUnlvc3VrZSBOaXdhLgorCisgICAgICAgIElubGluZUJpZGlSZXNvbHZlciBh ZGRzIG9uZSBmYWtlIFRleHRSdW4gZm9yIGlzb2xhdGVkIGlubGluZXMgaW4gdGhlIHByb2Nlc3Mg b2YgY3JlYXRpbmcgdGhlCisgICAgICAgIGxpc3Qgb2YgVGV4dFJ1bnMgdG8gc2VuZCB0byB0aGUg VUJBLiBBZnRlciB0aGUgVUJBIGhhcyBiZWVuIHJ1biBhbmQgdGhlIFRleHRSdW5zIHJlb3JkZXJl ZCwKKyAgICAgICAgd2UgcmUtcnVuIElubGluZUJpZGlSZXNvbHZlciByb290ZWQgaW4gdGhlIGlz b2xhdGUgYW5kIHJlcGxhY2UgdGhlIGZha2UgcnVuIHdpdGggdGhvc2UKKyAgICAgICAgZ2VuZXJh dGVkIGJ5IHRoZSBzdWJzZXF1ZW50IHBhc3MgYnkgY2FsbGluZyB0aGUgbWV0aG9kIEJpZGlSdW5M aXN0OjpyZXBsYWNlUnVuV2l0aFJ1bnMuCisgICAgICAgIFRoaXMgbWV0aG9kIGFzc3VtZXMgdGhl cmUgYXJlIHJ1bnMgdG8gcmVwbGFjZSB0aGUgZmFrZSBydW4gd2l0aC4KKworICAgICAgICBQb3Np dGlvbmVkIGlubGluZSBjaGlsZHJlbiBhcmUgaWdub3JlZCB3aGVuIGNyZWF0aW5nIFRleHRSdW5z LCBzbyB3aGVuIGFuIGlzb2xhdGVkIGlubGluZQorICAgICAgICBoYXMgb25seSBwb3NpdGlvbmVk IGNoaWxkcmVuIHdlIGVuZCB1cCB3aXRoIGFuIGVtcHR5IHNldCBvZiBydW5zIHRvIHBhc3MgdG8g cmVwbGFjZVJ1bldpdGhSdW5zLgorICAgICAgICBJZGVhbGx5LCB3ZSdkIHJlbW92ZSB0aGUgZmFr ZSBydW4gYW5kIG5vdCByZXBsYWNlIGl0IHdpdGggYW55dGhpbmcsIGJ1dCBCaWRpUnVuTGlzdCBr ZWVwcworICAgICAgICBhIHBvaW50ZXIgdG8gdGhlIGxvZ2ljYWxseSBsYXN0IHJ1biwgd2hpY2gg d2UncmUgdW5hYmxlIHRvIGVhc2lseSByZS1kZXRlcm1pbmUgYWZ0ZXIgdGhlIFVCQQorICAgICAg ICBoYXMgYmVlbiBydW4uIEluc3RlYWQsIHdlIGxlYXZlIHRoZSBmYWtlIHJ1biBpbiB0aGUgbGlz dCBhbmQgc2ltcGx5IGF2b2lkIGNhbGxpbmcKKyAgICAgICAgcmVwbGFjZVJ1bldpdGhSdW5zIHdo ZW4gd2UgZG9uJ3QgaGF2ZSBhbnkgcmVwbGFjZW1lbnQgcnVucy4KKworICAgICAgICBUZXN0OiBm YXN0L2Jsb2NrL2xpbmUtbGF5b3V0L2NyYXNoLWluLWlzb2xhdGUtd2l0aC1wb3NpdGlvbmVkLWNo aWxkLmh0bWwKKworICAgICAgICAqIHJlbmRlcmluZy9SZW5kZXJCbG9ja0xpbmVMYXlvdXQuY3Bw OgorICAgICAgICAoV2ViQ29yZTo6Y29uc3RydWN0QmlkaVJ1bnMpOgorCiAyMDEyLTA1LTIyICBT aW1vbiBGcmFzZXIgIDxzaW1vbi5mcmFzZXJAYXBwbGUuY29tPgogCiAgICAgICAgIFVzZSB0aGUg c2FtZSBhbmltYXRpb24gYmVnaW4gdGltZSB3aGlsZSB1cGRhdGluZyBjb21wb3NpdGluZyBsYXll cnMKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL3JlbmRlcmluZy9SZW5kZXJCbG9ja0xpbmVM YXlvdXQuY3BwIGIvU291cmNlL1dlYkNvcmUvcmVuZGVyaW5nL1JlbmRlckJsb2NrTGluZUxheW91 dC5jcHAKaW5kZXggOTIyZTcyZmE1ZjJhODA3ZjNhYzYwMDVkN2RhYjM1ZGVkNDdmZGQzOS4uYzQ0 MmJlMzM3NzdjYTJkOTA4MmUyMWM5ODI1MTMwZjZhZWNmMTRlOCAxMDA3NTUKLS0tIGEvU291cmNl L1dlYkNvcmUvcmVuZGVyaW5nL1JlbmRlckJsb2NrTGluZUxheW91dC5jcHAKKysrIGIvU291cmNl L1dlYkNvcmUvcmVuZGVyaW5nL1JlbmRlckJsb2NrTGluZUxheW91dC5jcHAKQEAgLTEwMDEsNyAr MTAwMSwxMSBAQCBzdGF0aWMgaW5saW5lIHZvaWQgY29uc3RydWN0QmlkaVJ1bnMoSW5saW5lQmlk aVJlc29sdmVyJiB0b3BSZXNvbHZlciwgQmlkaVJ1bkxpcwogICAgICAgICAvLyBybml3YSBzYXlz IHByZXZpb3VzTGluZUJyb2tlQ2xlYW5seSBpcyBqdXN0IGEgV2luSUUgaGFjayBhbmQgY291bGQg YWx3YXlzIGJlIGZhbHNlIGhlcmU/CiAgICAgICAgIGlzb2xhdGVkUmVzb2x2ZXIuY3JlYXRlQmlk aVJ1bnNGb3JMaW5lKGVuZE9mTGluZSwgTm9WaXN1YWxPdmVycmlkZSwgcHJldmlvdXNMaW5lQnJv a2VDbGVhbmx5KTsKICAgICAgICAgLy8gTm90ZSB0aGF0IHdlIGRvIG5vdCBkZWxldGUgdGhlIHJ1 bnMgZnJvbSB0aGUgcmVzb2x2ZXIuCi0gICAgICAgIGJpZGlSdW5zLnJlcGxhY2VSdW5XaXRoUnVu cyhpc29sYXRlZFJ1biwgaXNvbGF0ZWRSZXNvbHZlci5ydW5zKCkpOworICAgICAgICAvLyBXZSdy ZSBub3QgZ3Vhcm5hdGVlZCB0byBnZXQgYW55IEJpZGlSdW5zIGluIHRoZSBwcmV2aW91cyBzdGVw LiBJZiB3ZSBkb24ndCwgd2UgYWxsb3cgdGhlIHBsYWNlaG9sZGVyCisgICAgICAgIC8vIGl0c2Vs ZiB0byBiZSB0dXJuZWQgaW50byBhbiBJbmxpbmVCb3guIFdlIGNhbid0IHJlbW92ZSBpdCBoZXJl IHdpdGhvdXQgcG90ZW50aWFsbHkgbG9zaW5nIHRyYWNrIG9mCisgICAgICAgIC8vIHRoZSBsb2dp Y2FsbHkgbGFzdCBydW4uCisgICAgICAgIGlmIChpc29sYXRlZFJlc29sdmVyLnJ1bnMoKS5ydW5D b3VudCgpKQorICAgICAgICAgICAgYmlkaVJ1bnMucmVwbGFjZVJ1bldpdGhSdW5zKGlzb2xhdGVk UnVuLCBpc29sYXRlZFJlc29sdmVyLnJ1bnMoKSk7CiAKICAgICAgICAgLy8gSWYgd2UgZW5jb3Vu dGVyZWQgYW55IG5lc3RlZCBpc29sYXRlIHJ1bnMsIGp1c3QgbW92ZSB0aGVtCiAgICAgICAgIC8v IHRvIHRoZSB0b3AgcmVzb2x2ZXIncyBsaXN0IGZvciBsYXRlciBwcm9jZXNzaW5nLgpkaWZmIC0t Z2l0IGEvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCmluZGV4 IDQ2OTM1OGI5MDg2NzllMWFlNTA1YTMxZWNhMzNmNmRkMWNkNmVlODcuLmViOTcyOTMxZDMyZWFl NDllNzY0NmViYTQ1NDcwYmM4MjE4YjBjNWYgMTAwNjQ0Ci0tLSBhL0xheW91dFRlc3RzL0NoYW5n ZUxvZworKysgYi9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKQEAgLTEsMyArMSwxMyBAQAorMjAxMi0w NS0yMiAgTGV2aSBXZWludHJhdWIgIDxsZXZpd0BjaHJvbWl1bS5vcmc+CisKKyAgICAgICAgTlVM TCBwdHIgaW4gV2ViQ29yZTo6UmVuZGVyQmxvY2s6OmxheW91dFJ1bnNBbmRGbG9hdHNJblJhbmdl CisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD03Nzc4Ngor CisgICAgICAgIFJldmlld2VkIGJ5IFJ5b3N1a2UgTml3YS4KKworICAgICAgICAqIGZhc3QvYmxv Y2svbGluZS1sYXlvdXQvY3Jhc2gtaW4taXNvbGF0ZS13aXRoLXBvc2l0aW9uZWQtY2hpbGQtZXhw ZWN0ZWQudHh0OiBBZGRlZC4KKyAgICAgICAgKiBmYXN0L2Jsb2NrL2xpbmUtbGF5b3V0L2NyYXNo LWluLWlzb2xhdGUtd2l0aC1wb3NpdGlvbmVkLWNoaWxkLmh0bWw6IEFkZGVkLgorCiAyMDEyLTA1 LTIyICBKZXNzaWUgQmVybGluICA8amJlcmxpbkBhcHBsZS5jb20+CiAKICAgICAgICAgV1RSIG5l ZWRzIGFuIGltcGxlbWVudGF0aW9uIG9mIHNldEF1dG9tYXRpY0xpbmtEZXRlY3Rpb25FbmFibGVk CmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9mYXN0L2Jsb2NrL2xpbmUtbGF5b3V0L2NyYXNoLWlu LWlzb2xhdGUtd2l0aC1wb3NpdGlvbmVkLWNoaWxkLWV4cGVjdGVkLnR4dCBiL0xheW91dFRlc3Rz L2Zhc3QvYmxvY2svbGluZS1sYXlvdXQvY3Jhc2gtaW4taXNvbGF0ZS13aXRoLXBvc2l0aW9uZWQt Y2hpbGQtZXhwZWN0ZWQudHh0Cm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAuLjEyZDgzZDY2MmQ4MDBhNmViM2ZhZGZkZTIy MTA1NjY3NGZmZmEyNGEKLS0tIC9kZXYvbnVsbAorKysgYi9MYXlvdXRUZXN0cy9mYXN0L2Jsb2Nr L2xpbmUtbGF5b3V0L2NyYXNoLWluLWlzb2xhdGUtd2l0aC1wb3NpdGlvbmVkLWNoaWxkLWV4cGVj dGVkLnR4dApAQCAtMCwwICsxIEBACitUaGlzIHRlc3RzIHRoYXQgYSBwb3NpdGlvbmVkIG9iamVj dCBhcyB0aGUgb25seSBjaGlsZCBvZiBhbiBpc29sYXRlZCBpbmxpbmUgZG9lc24ndCBjcmFzaC4g U2VlIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD03Nzc4NiBmb3IgZGV0 YWlscy4KZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL2Zhc3QvYmxvY2svbGluZS1sYXlvdXQvY3Jh c2gtaW4taXNvbGF0ZS13aXRoLXBvc2l0aW9uZWQtY2hpbGQuaHRtbCBiL0xheW91dFRlc3RzL2Zh c3QvYmxvY2svbGluZS1sYXlvdXQvY3Jhc2gtaW4taXNvbGF0ZS13aXRoLXBvc2l0aW9uZWQtY2hp bGQuaHRtbApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwLi5jYmFjZmIzMGIwODI3ZmI5YmM3MGUwMTkxNzEwZjg3ZGUyNzUy ODk2Ci0tLSAvZGV2L251bGwKKysrIGIvTGF5b3V0VGVzdHMvZmFzdC9ibG9jay9saW5lLWxheW91 dC9jcmFzaC1pbi1pc29sYXRlLXdpdGgtcG9zaXRpb25lZC1jaGlsZC5odG1sCkBAIC0wLDAgKzEs MTEgQEAKKzwhRE9DVFlQRSBodG1sPgorPGh0bWw+Cis8Ym9keT4KK1RoaXMgdGVzdHMgdGhhdCBh IHBvc2l0aW9uZWQgb2JqZWN0IGFzIHRoZSBvbmx5IGNoaWxkIG9mIGFuIGlzb2xhdGVkIGlubGlu ZSBkb2Vzbid0IGNyYXNoLiBTZWUgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dp P2lkPTc3Nzg2IGZvciBkZXRhaWxzLgorPHNwYW4gc3R5bGU9InVuaWNvZGUtYmlkaTotd2Via2l0 LWlzb2xhdGU7Ij48ZGl2IHN0eWxlPSJwb3NpdGlvbjphYnNvbHV0ZTsiPjwvZGl2Pjwvc3Bhbj4K KzwvYm9keT4KKzxzY3JpcHQ+CitpZiAod2luZG93LmxheW91dFRlc3RDb250cm9sbGVyKQorICAg IGxheW91dFRlc3RDb250cm9sbGVyLmR1bXBBc1RleHQoKTsKKzwvc2NyaXB0PgorPC9odG1sPgpc IE5vIG5ld2xpbmUgYXQgZW5kIG9mIGZpbGUK