<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>78713</bug_id>
          <alias>CVE-2012-3686</alias>
          <creation_ts>2012-02-15 06:57:08 -0800</creation_ts>
          <short_desc>Absolute positioned elements with Inline Relative Positioned Container are not layout correctly</short_desc>
          <delta_ts>2012-06-26 12:07:42 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>Layout and Rendering</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>All</rep_platform>
          <op_sys>All</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>InRadar</keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Robin Cao">robin.webkit</reporter>
          <assigned_to name="Ken Buchanan">kenrb</assigned_to>
          <cc>ayao</cc>
    
    <cc>commit-queue</cc>
    
    <cc>eric</cc>
    
    <cc>hyatt</cc>
    
    <cc>inferno</cc>
    
    <cc>jchaffraix</cc>
    
    <cc>kenrb</cc>
    
    <cc>robert</cc>
    
    <cc>webkit.review.bot</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>557238</commentid>
    <comment_count>0</comment_count>
    <who name="Robin Cao">robin.webkit</who>
    <bug_when>2012-02-15 06:57:08 -0800</bug_when>
    <thetext>Absolute positioned elements with Inline Relative Positioned Container are not layout correctly</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>557241</commentid>
    <comment_count>1</comment_count>
      <attachid>127179</attachid>
    <who name="Robin Cao">robin.webkit</who>
    <bug_when>2012-02-15 06:59:59 -0800</bug_when>
    <thetext>Created attachment 127179
test case</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>557243</commentid>
    <comment_count>2</comment_count>
    <who name="Robin Cao">robin.webkit</who>
    <bug_when>2012-02-15 07:01:57 -0800</bug_when>
    <thetext>The test case will cause an assert failure. Here is the call stack.


Program received signal SIGSEGV, Segmentation fault.
0x00007ffb99b53a90 in WebCore::InlineTextBox::constructTextRun (this=0x1994448, style=0x19acb70, font=..., characters=0x15d2e50, length=4, maximumLength=1, charactersWithHyphen=0x0)
    at ../../../../Source/WebCore/rendering/InlineTextBox.cpp:1320
1320	    ASSERT(maximumLength &gt;= length);
(gdb) bt
#0  0x00007ffb99b53a90 in WebCore::InlineTextBox::constructTextRun (this=0x1994448, style=0x19acb70, font=..., characters=0x15d2e50, length=4, maximumLength=1, charactersWithHyphen=0x0)
    at ../../../../Source/WebCore/rendering/InlineTextBox.cpp:1320
#1  0x00007ffb99b4fb08 in WebCore::InlineTextBox::paint (this=0x1994448, paintInfo=..., paintOffset=...) at ../../../../Source/WebCore/rendering/InlineTextBox.cpp:669
#2  0x00007ffb99b4634a in WebCore::InlineFlowBox::paint (this=0x1994548, paintInfo=..., paintOffset=..., lineTop=0, lineBottom=19) at ../../../../Source/WebCore/rendering/InlineFlowBox.cpp:1069
#3  0x00007ffb99ccc9a0 in WebCore::RootInlineBox::paint (this=0x1994548, paintInfo=..., paintOffset=..., lineTop=0, lineBottom=19) at ../../../../Source/WebCore/rendering/RootInlineBox.cpp:196
#4  0x00007ffb99c4a5c5 in WebCore::RenderLineBoxList::paint (this=0x1993598, renderer=0x19934f8, paintInfo=..., paintOffset=...) at ../../../../Source/WebCore/rendering/RenderLineBoxList.cpp:262
#5  0x00007ffb99b680fb in WebCore::RenderBlock::paintContents (this=0x19934f8, paintInfo=..., paintOffset=...) at ../../../../Source/WebCore/rendering/RenderBlock.cpp:2580
#6  0x00007ffb99b6895e in WebCore::RenderBlock::paintObject (this=0x19934f8, paintInfo=..., paintOffset=...) at ../../../../Source/WebCore/rendering/RenderBlock.cpp:2690
#7  0x00007ffb99b67218 in WebCore::RenderBlock::paint (this=0x19934f8, paintInfo=..., paintOffset=...) at ../../../../Source/WebCore/rendering/RenderBlock.cpp:2435
#8  0x00007ffb99c2a679 in WebCore::RenderLayer::paintLayerContents (this=0x1993708, rootLayer=0x198a4a8, context=0x7fff5bb12080, paintDirtyRect=..., paintBehavior=0, paintingRoot=0x0, region=0x0, 
    overlapTestRequests=0x7fff5bb11e10, paintFlags=224) at ../../../../Source/WebCore/rendering/RenderLayer.cpp:2912
#9  0x00007ffb99c29ebb in WebCore::RenderLayer::paintLayerContentsAndReflection (this=0x1993708, rootLayer=0x198a4a8, context=0x7fff5bb12080, paintDirtyRect=..., paintBehavior=0, paintingRoot=0x0, region=0x0, 
    overlapTestRequests=0x7fff5bb11e10, paintFlags=224) at ../../../../Source/WebCore/rendering/RenderLayer.cpp:2813
#10 0x00007ffb99c29d98 in WebCore::RenderLayer::paintLayer (this=0x1993708, rootLayer=0x198a4a8, context=0x7fff5bb12080, paintDirtyRect=..., paintBehavior=0, paintingRoot=0x0, region=0x0, 
    overlapTestRequests=0x7fff5bb11e10, paintFlags=224) at ../../../../Source/WebCore/rendering/RenderLayer.cpp:2794
#11 0x00007ffb99c2aba1 in WebCore::RenderLayer::paintList (this=0x198cd68, list=0x1921210, rootLayer=0x198a4a8, context=0x7fff5bb12080, paintDirtyRect=..., paintBehavior=0, paintingRoot=0x0, region=0x0, 
    overlapTestRequests=0x7fff5bb11e10, paintFlags=224) at ../../../../Source/WebCore/rendering/RenderLayer.cpp:2977
#12 0x00007ffb99c2a89d in WebCore::RenderLayer::paintLayerContents (this=0x198cd68, rootLayer=0x198a4a8, context=0x7fff5bb12080, paintDirtyRect=..., paintBehavior=0, paintingRoot=0x0, region=0x0, 
    overlapTestRequests=0x7fff5bb11e10, paintFlags=224) at ../../../../Source/WebCore/rendering/RenderLayer.cpp:2933
#13 0x00007ffb99c29ebb in WebCore::RenderLayer::paintLayerContentsAndReflection (this=0x198cd68, rootLayer=0x198a4a8, context=0x7fff5bb12080, paintDirtyRect=..., paintBehavior=0, paintingRoot=0x0, region=0x0, 
    overlapTestRequests=0x7fff5bb11e10, paintFlags=224) at ../../../../Source/WebCore/rendering/RenderLayer.cpp:2813
#14 0x00007ffb99c29d98 in WebCore::RenderLayer::paintLayer (this=0x198cd68, rootLayer=0x198a4a8, context=0x7fff5bb12080, paintDirtyRect=..., paintBehavior=0, paintingRoot=0x0, region=0x0, 
    overlapTestRequests=0x7fff5bb11e10, paintFlags=224) at ../../../../Source/WebCore/rendering/RenderLayer.cpp:2794
#15 0x00007ffb99c2aba1 in WebCore::RenderLayer::paintList (this=0x198a4a8, list=0x1994f10, rootLayer=0x198a4a8, context=0x7fff5bb12080, paintDirtyRect=..., paintBehavior=0, paintingRoot=0x0, region=0x0, 
    overlapTestRequests=0x7fff5bb11e10, paintFlags=224) at ../../../../Source/WebCore/rendering/RenderLayer.cpp:2977
#16 0x00007ffb99c2a89d in WebCore::RenderLayer::paintLayerContents (this=0x198a4a8, rootLayer=0x198a4a8, context=0x7fff5bb12080, paintDirtyRect=..., paintBehavior=0, paintingRoot=0x0, region=0x0, 
    overlapTestRequests=0x7fff5bb11e10, paintFlags=224) at ../../../../Source/WebCore/rendering/RenderLayer.cpp:2933
#17 0x00007ffb99c29ebb in WebCore::RenderLayer::paintLayerContentsAndReflection (this=0x198a4a8, rootLayer=0x198a4a8, context=0x7fff5bb12080, paintDirtyRect=..., paintBehavior=0, paintingRoot=0x0, region=0x0, 
    overlapTestRequests=0x7fff5bb11e10, paintFlags=0) at ../../../../Source/WebCore/rendering/RenderLayer.cpp:2813
#18 0x00007ffb99c29d98 in WebCore::RenderLayer::paintLayer (this=0x198a4a8, rootLayer=0x198a4a8, context=0x7fff5bb12080, paintDirtyRect=..., paintBehavior=0, paintingRoot=0x0, region=0x0, 
    overlapTestRequests=0x7fff5bb11e10, paintFlags=0) at ../../../../Source/WebCore/rendering/RenderLayer.cpp:2794
#19 0x00007ffb99c2913d in WebCore::RenderLayer::paint (this=0x198a4a8, context=0x7fff5bb12080, damageRect=..., paintBehavior=0, paintingRoot=0x0, region=0x0, paintFlags=0)
    at ../../../../Source/WebCore/rendering/RenderLayer.cpp:2611
#20 0x00007ffb99a001e4 in WebCore::FrameView::paintContents (this=0x1929a90, p=0x7fff5bb12080, rect=...) at ../../../../Source/WebCore/page/FrameView.cpp:2922
#21 0x00007ffb991c01ff in QWebFramePrivate::renderRelativeCoords (this=0x7ffb80017910, context=0x7fff5bb12080, layers=..., clip=...) at ../../../Source/WebKit/qt/Api/qwebframe.cpp:393
#22 0x00007ffb991c3a85 in QWebFrame::render (this=0x7ffb80015080, painter=0x7fff5bb12150, clip=...) at ../../../Source/WebKit/qt/Api/qwebframe.cpp:1293
#23 0x00007ffb991ecac8 in QWebView::paintEvent (this=0x7ffb80024070, ev=0x7fff5bb12960) at ../../../Source/WebKit/qt/Api/qwebview.cpp:811
#24 0x00007ffb96743146 in QWidget::event(QEvent*) () from /home/robincao/src/qt/qt-4.8/lib/libQtGui.so.4
#25 0x00007ffb991ec83c in QWebView::event (this=0x7ffb80024070, e=0x7fff5bb12960) at ../../../Source/WebKit/qt/Api/qwebview.cpp:715
#26 0x00007ffb966f2a74 in QApplicationPrivate::notify_helper(QObject*, QEvent*) () from /home/robincao/src/qt/qt-4.8/lib/libQtGui.so.4
#27 0x00007ffb966f78f3 in QApplication::notify(QObject*, QEvent*) () from /home/robincao/src/qt/qt-4.8/lib/libQtGui.so.4
#28 0x00007ffb95e41ecc in QCoreApplication::notifyInternal(QObject*, QEvent*) () from /home/robincao/src/qt/qt-4.8/lib/libQtCore.so.4
#29 0x00007ffb9673ede6 in QWidgetPrivate::drawWidget(QPaintDevice*, QRegion const&amp;, QPoint const&amp;, int, QPainter*, QWidgetBackingStore*) () from /home/robincao/src/qt/qt-4.8/lib/libQtGui.so.4
#30 0x00007ffb9690b84c in ?? () from /home/robincao/src/qt/qt-4.8/lib/libQtGui.so.4
#31 0x00007ffb96735b40 in QWidgetPrivate::syncBackingStore() () from /home/robincao/src/qt/qt-4.8/lib/libQtGui.so.4
#32 0x00007ffb9674365c in QWidget::event(QEvent*) () from /home/robincao/src/qt/qt-4.8/lib/libQtGui.so.4
#33 0x00007ffb96b18c7b in QMainWindow::event(QEvent*) () from /home/robincao/src/qt/qt-4.8/lib/libQtGui.so.4
#34 0x00007ffb966f2a74 in QApplicationPrivate::notify_helper(QObject*, QEvent*) () from /home/robincao/src/qt/qt-4.8/lib/libQtGui.so.4
#35 0x00007ffb966f78f3 in QApplication::notify(QObject*, QEvent*) () from /home/robincao/src/qt/qt-4.8/lib/libQtGui.so.4
#36 0x00007ffb95e41ecc in QCoreApplication::notifyInternal(QObject*, QEvent*) () from /home/robincao/src/qt/qt-4.8/lib/libQtCore.so.4
#37 0x00007ffb95e4576a in QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) () from /home/robincao/src/qt/qt-4.8/lib/libQtCore.so.4
#38 0x00007ffb95e70ac3 in ?? () from /home/robincao/src/qt/qt-4.8/lib/libQtCore.so.4
#39 0x00007ffb93318a5d in g_main_context_dispatch () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#40 0x00007ffb93319258 in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#41 0x00007ffb93319429 in g_main_context_iteration () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
---Type &lt;return&gt; to continue, or q &lt;return&gt; to quit---</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>557286</commentid>
    <comment_count>3</comment_count>
      <attachid>127186</attachid>
    <who name="Robin Cao">robin.webkit</who>
    <bug_when>2012-02-15 08:05:34 -0800</bug_when>
    <thetext>Created attachment 127186
proposed patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>558421</commentid>
    <comment_count>4</comment_count>
    <who name="Ken Buchanan">kenrb</who>
    <bug_when>2012-02-16 12:09:25 -0800</bug_when>
    <thetext>I knew there was a problem here, related to my patch in http://trac.webkit.org/changeset/104183/ but I didn&apos;t have a test case showing it clearly. 

Should this change be in RenderObject::container(), rather than markContainingBlocksForLayout()? I&apos;m just wondering if this container() confusion might happen in other places.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>558564</commentid>
    <comment_count>5</comment_count>
    <who name="Eric Seidel (no email)">eric</who>
    <bug_when>2012-02-16 15:00:59 -0800</bug_when>
    <thetext>Julien:  Could you look?  You&apos;ve recently strolled through the anonymous block code and could comment if this looks reasonable?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>558634</commentid>
    <comment_count>6</comment_count>
      <attachid>127186</attachid>
    <who name="Julien Chaffraix">jchaffraix</who>
    <bug_when>2012-02-16 16:06:20 -0800</bug_when>
    <thetext>Comment on attachment 127186
proposed patch

View in context: https://bugs.webkit.org/attachment.cgi?id=127186&amp;action=review

This is the wrong fix. RenderObject::container() should be patched not markContainingBlockForLayout().

The right fix (TM) is to find a way to merge container() and containingBlock() so that such bugs don&apos;t happen down the road again.

&gt; Source/WebCore/ChangeLog:12
&gt; +        This is a regression. r104183 changes containingBlock() so that it returns the container
&gt; +        of an anonymous block for positioned objects, not the anonymous block itself. We should
&gt; +        change markContainingBlocksForLayout() to match the change in containingBlock().

Your analysis is good but the conclusion is wrong. container() and containingBlock() should return the same result and here they don&apos;t.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>560150</commentid>
    <comment_count>7</comment_count>
    <who name="Robin Cao">robin.webkit</who>
    <bug_when>2012-02-20 03:36:00 -0800</bug_when>
    <thetext>Thanks for all the comments below.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>560152</commentid>
    <comment_count>8</comment_count>
    <who name="Robin Cao">robin.webkit</who>
    <bug_when>2012-02-20 03:44:04 -0800</bug_when>
    <thetext>(In reply to comment #6)
&gt; This is the wrong fix. RenderObject::container() should be patched not markContainingBlockForLayout().
&gt; 
&gt; The right fix (TM) is to find a way to merge container() and containingBlock() so that such bugs don&apos;t happen down the road again.
&gt; 
&gt; &gt; Source/WebCore/ChangeLog:12
&gt; &gt; +        This is a regression. r104183 changes containingBlock() so that it returns the container
&gt; &gt; +        of an anonymous block for positioned objects, not the anonymous block itself. We should
&gt; &gt; +        change markContainingBlocksForLayout() to match the change in containingBlock().
&gt; 
&gt; Your analysis is good but the conclusion is wrong. container() and containingBlock() should return the same result and here they don&apos;t.

I admit my patch may be incomplete, but seems we can not simply make container() and containingBlock() return the same result here.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>560984</commentid>
    <comment_count>9</comment_count>
    <who name="Julien Chaffraix">jchaffraix</who>
    <bug_when>2012-02-21 10:08:09 -0800</bug_when>
    <thetext>&gt; I admit my patch may be incomplete, but seems we can not simply make container() and containingBlock() return the same result here.

Could you get in the details as to why not? I fail to see what is preventing that from the top of my head.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>561457</commentid>
    <comment_count>10</comment_count>
    <who name="Julien Chaffraix">jchaffraix</who>
    <bug_when>2012-02-21 18:40:47 -0800</bug_when>
    <thetext>(In reply to comment #9)
&gt; &gt; I admit my patch may be incomplete, but seems we can not simply make container() and containingBlock() return the same result here.
&gt; 
&gt; Could you get in the details as to why not? I fail to see what is preventing that from the top of my head.

Re-reading the code for another bug, the answer is written at the top of container(). A lot of the code assumes that actually container() has a different behavior than containingBlock(). So much for my unification dreams...

I will do an (hopefully better) review now but dhyatt@ should really be the one reviewing.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>561509</commentid>
    <comment_count>11</comment_count>
      <attachid>127186</attachid>
    <who name="Julien Chaffraix">jchaffraix</who>
    <bug_when>2012-02-21 19:42:11 -0800</bug_when>
    <thetext>Comment on attachment 127186
proposed patch

View in context: https://bugs.webkit.org/attachment.cgi?id=127186&amp;action=review

&gt;&gt; Source/WebCore/ChangeLog:12
&gt;&gt; +        change markContainingBlocksForLayout() to match the change in containingBlock().
&gt; 
&gt; Your analysis is good but the conclusion is wrong. container() and containingBlock() should return the same result and here they don&apos;t.

Correcting myself: the conclusion is right. Sharing more code between the 2 functions is a separate issue even if it feels like markContainingBlocksForLayout() is embedding a safer alternative to containingBlock() build on top of container().

&gt; Source/WebCore/rendering/RenderObject.cpp:630
&gt;              bool willSkipRelativelyPositionedInlines = !object-&gt;isRenderBlock();

There is an issue here: |willSkipRelativelyPositionedInlines| will not be set if object-&gt;isAnonymousBlock() is true. This means that you would not update |container| below and actually still mark some of the anonymous blocks as needing layout.

It looks like this line should be:

bool willSkipRenderObjects = !object-&gt;isRenderBlock() || object-&gt;isAnonymousBlock();

&gt; Source/WebCore/rendering/RenderObject.cpp:634
&gt; +            while (object &amp;&amp; (!object-&gt;isRenderBlock() || object-&gt;isAnonymousBlock()))
&gt;                  object = object-&gt;container();

Noteworthy: this is not strictly equivalent to what containingBlock() is doing after r104183 (for example, we don&apos;t check if |object| is relatively positioned in the loop even if we mention it in the comment above). I wonder if that will bite us down the road.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>564357</commentid>
    <comment_count>12</comment_count>
    <who name="Ken Buchanan">kenrb</who>
    <bug_when>2012-02-24 09:07:22 -0800</bug_when>
    <thetext>Robin: We&apos;re seeing some consequences of this bug in Chrome, and I&apos;d like to get a fix in as soon as possible. Are you able to address Julien&apos;s comments?

If you&apos;re too busy to work on this I can take it over.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>564487</commentid>
    <comment_count>13</comment_count>
    <who name="Ken Buchanan">kenrb</who>
    <bug_when>2012-02-24 11:10:44 -0800</bug_when>
    <thetext>(In reply to comment #11)
&gt; &gt; Source/WebCore/rendering/RenderObject.cpp:634
&gt; &gt; +            while (object &amp;&amp; (!object-&gt;isRenderBlock() || object-&gt;isAnonymousBlock()))
&gt; &gt;                  object = object-&gt;container();
&gt; 
&gt; Noteworthy: this is not strictly equivalent to what containingBlock() is doing after r104183 (for example, we don&apos;t check if |object| is relatively positioned in the loop even if we mention it in the comment above). I wonder if that will bite us down the road.

dhyatt should comment on this. It seems to be enough that it is positioned and it is inline, though I&apos;m not sure if we might be affecting the case where we have positioned blocks within anonymous blocks.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>564506</commentid>
    <comment_count>14</comment_count>
      <attachid>128774</attachid>
    <who name="Ken Buchanan">kenrb</who>
    <bug_when>2012-02-24 11:34:30 -0800</bug_when>
    <thetext>Created attachment 128774
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>564510</commentid>
    <comment_count>15</comment_count>
    <who name="Ken Buchanan">kenrb</who>
    <bug_when>2012-02-24 11:35:47 -0800</bug_when>
    <thetext>I&apos;ve tweaked Robin&apos;s patch based on Julien&apos;s comments. I&apos;d like to get this worked out as soon as possible.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>565825</commentid>
    <comment_count>16</comment_count>
      <attachid>128774</attachid>
    <who name="Dave Hyatt">hyatt</who>
    <bug_when>2012-02-27 11:03:06 -0800</bug_when>
    <thetext>Comment on attachment 128774
Patch

r=me, although this is pretty subtle. Right now this works because anonymous blocks can&apos;t ever be positioned. If they can, this code will have to be changed.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>565862</commentid>
    <comment_count>17</comment_count>
      <attachid>128774</attachid>
    <who name="WebKit Review Bot">webkit.review.bot</who>
    <bug_when>2012-02-27 11:48:24 -0800</bug_when>
    <thetext>Comment on attachment 128774
Patch

Clearing flags on attachment: 128774

Committed r109011: &lt;http://trac.webkit.org/changeset/109011&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>565863</commentid>
    <comment_count>18</comment_count>
    <who name="WebKit Review Bot">webkit.review.bot</who>
    <bug_when>2012-02-27 11:48:35 -0800</bug_when>
    <thetext>All reviewed patches have been landed.  Closing bug.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>571047</commentid>
    <comment_count>19</comment_count>
    <who name="David Kilzer (:ddkilzer)">ddkilzer</who>
    <bug_when>2012-03-05 14:20:09 -0800</bug_when>
    <thetext>&lt;rdar://problem/10987709&gt;</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="0"
              isprivate="0"
          >
            <attachid>127179</attachid>
            <date>2012-02-15 06:59:59 -0800</date>
            <delta_ts>2012-02-15 06:59:59 -0800</delta_ts>
            <desc>test case</desc>
            <filename>positioned-in-relative-position-inline-crash.html</filename>
            <type>text/html</type>
            <size>1023</size>
            <attacher name="Robin Cao">robin.webkit</attacher>
            
              <data encoding="base64">PGh0bWw+DQo8c3R5bGUgdHlwZT0idGV4dC9jc3MiPg0KLmlubGluZUNvbnRhaW5lciB7DQogIHBv
c2l0aW9uOiByZWxhdGl2ZTsNCiAgZGlzcGxheTogaW5saW5lOw0KfQ0KI3Bvc2l0aW9uZWQgew0K
ICBwb3NpdGlvbjogYWJzb2x1dGU7DQogIHRvcDogMTAwcHg7DQp9DQo8L3N0eWxlPg0KPHNjcmlw
dCB0eXBlPSJ0ZXh0L2phdmFzY3JpcHQiPg0KZnVuY3Rpb24gZHVtcFRlc3QoKSB7DQogICAgaWYg
KHdpbmRvdy5sYXlvdXRUZXN0Q29udHJvbGxlcikgew0KICAgICAgICBsYXlvdXRUZXN0Q29udHJv
bGxlci5ub3RpZnlEb25lKCk7DQogICAgfQ0KICAgIC8vYWxlcnQoZG9jdW1lbnQuZ2V0RWxlbWVu
dEJ5SWQoJ3Bvc2l0aW9uZWQnKS5vZmZzZXRQYXJlbnQuY2hpbGROb2Rlcy5sZW5ndGgpOw0KICAg
IC8vYWxlcnQoKTsNCn0NCmZ1bmN0aW9uIHJ1blRlc3QoKSB7DQogICAgZG9jdW1lbnQuZ2V0RWxl
bWVudEJ5SWQoJ3Bvc2l0aW9uZWQnKS5pbm5lckhUTUwgPSAnMic7DQogICAgZG9jdW1lbnQuZ2V0
RWxlbWVudEJ5SWQoJ3Bvc2l0aW9uZWQnKS5zdHlsZS5jb2xvciA9ICdyZWQnOw0KICAgIC8vZG9j
dW1lbnQuYm9keS5vZmZzZXRUb3A7IC8vIEZvcmNlIGxheW91dC4NCg0KICAgIA0KICAgIHNldFRp
bWVvdXQoJ2R1bXBUZXN0KCknLCAxMCk7DQogICAgaWYgKHdpbmRvdy5sYXlvdXRUZXN0Q29udHJv
bGxlcikgew0KICAgICAgICBsYXlvdXRUZXN0Q29udHJvbGxlci53YWl0VW50aWxEb25lKCk7DQoJ
bGF5b3V0VGVzdENvbnRyb2xsZXIuZHVtcEFzVGV4dCgpOw0KICAgIH0NCn0NCi8vd2luZG93Lm9u
bG9hZCA9IHJ1blRlc3Q7DQpzZXRUaW1lb3V0KCdydW5UZXN0KCknLCAwKTsNCjwvc2NyaXB0Pg0K
PGJvZHk+DQpQQVNTLCBpZiBubyBleGNlcHRpb24gb3IgY3Jhc2ggaW4gZGVidWcNCiAgPGRpdiBj
bGFzcz0naW5saW5lQ29udGFpbmVyJz4NCiAgICA8ZGl2PmRpdjE8L2Rpdj4NCiAgICA8ZGl2IGlk
PSdwb3NpdGlvbmVkJz5kaXYyPC9kaXY+DQogIDwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K
</data>

          </attachment>
          <attachment
              isobsolete="1"
              ispatch="1"
              isprivate="0"
          >
            <attachid>127186</attachid>
            <date>2012-02-15 08:05:34 -0800</date>
            <delta_ts>2012-02-24 11:34:17 -0800</delta_ts>
            <desc>proposed patch</desc>
            <filename>bug-78713-20120216000534.patch</filename>
            <type>text/plain</type>
            <size>4657</size>
            <attacher name="Robin Cao">robin.webkit</attacher>
            
              <data encoding="base64">U3VidmVyc2lvbiBSZXZpc2lvbjogMTA3NjIxCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D
aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggN2IxNjU3OTI2M2UwYjU5
NThiYTlhZDk1MTY3YmI3NWFmMWYzNzQzZi4uYjJhZDQxNWI4MGUzNmRhYWVlOGEyMjgxMmZjMmZk
MzdhMWY2NzIwOCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv
dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE5IEBACisyMDEyLTAyLTE1ICBSb2Jp
biBDYW8gIDxyb2Jpbi5jYW9AdG9yY2htb2JpbGUuY29tLmNuPgorCisgICAgICAgIEFic29sdXRl
IHBvc2l0aW9uZWQgZWxlbWVudHMgd2l0aCBJbmxpbmUgUmVsYXRpdmUgUG9zaXRpb25lZCBDb250
YWluZXIgYXJlIG5vdCBsYXlvdXQgY29ycmVjdGx5CisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJr
aXQub3JnL3Nob3dfYnVnLmNnaT9pZD03ODcxMworCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9E
WSAoT09QUyEpLgorCisgICAgICAgIFRlc3Q6IGZhc3QvY3NzL3Bvc2l0aW9uZWQtaW4tcmVsYXRp
dmUtcG9zaXRpb24taW5saW5lLWNyYXNoLmh0bWwKKworICAgICAgICBUaGlzIGlzIGEgcmVncmVz
c2lvbi4gcjEwNDE4MyBjaGFuZ2VzIGNvbnRhaW5pbmdCbG9jaygpIHNvIHRoYXQgaXQgcmV0dXJu
cyB0aGUgY29udGFpbmVyCisgICAgICAgIG9mIGFuIGFub255bW91cyBibG9jayBmb3IgcG9zaXRp
b25lZCBvYmplY3RzLCBub3QgdGhlIGFub255bW91cyBibG9jayBpdHNlbGYuIFdlIHNob3VsZAor
ICAgICAgICBjaGFuZ2UgbWFya0NvbnRhaW5pbmdCbG9ja3NGb3JMYXlvdXQoKSB0byBtYXRjaCB0
aGUgY2hhbmdlIGluIGNvbnRhaW5pbmdCbG9jaygpLgorCisgICAgICAgICogcmVuZGVyaW5nL1Jl
bmRlck9iamVjdC5jcHA6CisgICAgICAgIChXZWJDb3JlOjpSZW5kZXJPYmplY3Q6Om1hcmtDb250
YWluaW5nQmxvY2tzRm9yTGF5b3V0KToKKwogMjAxMi0wMi0xMyAgVG9ueSBDaGFuZyAgPHRvbnlA
Y2hyb21pdW0ub3JnPgogCiAgICAgICAgIFVucmV2aWV3ZWQsIHJvbGxpbmcgb3V0IHIxMDc1ODIu
CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyT2JqZWN0LmNwcCBi
L1NvdXJjZS9XZWJDb3JlL3JlbmRlcmluZy9SZW5kZXJPYmplY3QuY3BwCmluZGV4IDk0Zjg4YzAy
ZWFhMDE5OGUyYzIzOWQ1YTIzMDQ1YzA1YjdlYzQ2MzUuLmRmZjNiNDgzNTA5MmMwM2FmNDU4YzE2
YWFjY2M0OTcwMDM2ZDQyODMgMTAwNzU1Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL3JlbmRlcmluZy9S
ZW5kZXJPYmplY3QuY3BwCisrKyBiL1NvdXJjZS9XZWJDb3JlL3JlbmRlcmluZy9SZW5kZXJPYmpl
Y3QuY3BwCkBAIC02MjgsNyArNjI4LDkgQEAgdm9pZCBSZW5kZXJPYmplY3Q6Om1hcmtDb250YWlu
aW5nQmxvY2tzRm9yTGF5b3V0KGJvb2wgc2NoZWR1bGVSZWxheW91dCwgUmVuZGVyT2IKICAgICAg
ICAgICAgIHJldHVybjsKICAgICAgICAgaWYgKCFsYXN0LT5pc1RleHQoKSAmJiBsYXN0LT5zdHls
ZSgpLT5pc1Bvc2l0aW9uZWQoKSkgewogICAgICAgICAgICAgYm9vbCB3aWxsU2tpcFJlbGF0aXZl
bHlQb3NpdGlvbmVkSW5saW5lcyA9ICFvYmplY3QtPmlzUmVuZGVyQmxvY2soKTsKLSAgICAgICAg
ICAgIHdoaWxlIChvYmplY3QgJiYgIW9iamVjdC0+aXNSZW5kZXJCbG9jaygpKSAvLyBTa2lwIHJl
bGF0aXZlbHkgcG9zaXRpb25lZCBpbmxpbmVzIGFuZCBnZXQgdG8gdGhlIGVuY2xvc2luZyBSZW5k
ZXJCbG9jay4KKyAgICAgICAgICAgIC8vIFNraXAgcmVsYXRpdmVseSBwb3NpdGlvbmVkIGlubGlu
ZXMgYW5kIGFub255bW91cyBibG9ja3MgdG8gZ2V0IHRvIHRoZSBlbmNsb3NpbmcgUmVuZGVyQmxv
Y2suCisgICAgICAgICAgICAvLyBUaGlzIGlzIHRvIG1hdGNoIHRoZSBsb2dpYyBpbiBSZW5kZXJP
YmplY3Q6OmNvbnRhaW5pbmdCbG9jaygpLgorICAgICAgICAgICAgd2hpbGUgKG9iamVjdCAmJiAo
IW9iamVjdC0+aXNSZW5kZXJCbG9jaygpIHx8IG9iamVjdC0+aXNBbm9ueW1vdXNCbG9jaygpKSkK
ICAgICAgICAgICAgICAgICBvYmplY3QgPSBvYmplY3QtPmNvbnRhaW5lcigpOwogICAgICAgICAg
ICAgaWYgKCFvYmplY3QgfHwgb2JqZWN0LT5wb3NDaGlsZE5lZWRzTGF5b3V0KCkpCiAgICAgICAg
ICAgICAgICAgcmV0dXJuOwpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nIGIvTGF5
b3V0VGVzdHMvQ2hhbmdlTG9nCmluZGV4IDU0YjlmZTNlNWE4MTI1MjVhY2FlMDQ3MzBmYzk5Y2Q4
MGRmMzZmZjAuLjQyMjJmYWFlZWNmN2I0YzIxOWFhNDdmNmU0MDE0NDFmNmEwODNjODUgMTAwNjQ0
Ci0tLSBhL0xheW91dFRlc3RzL0NoYW5nZUxvZworKysgYi9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cK
QEAgLTEsMyArMSwxMyBAQAorMjAxMi0wMi0xNSAgUm9iaW4gQ2FvICA8cm9iaW4uY2FvQHRvcmNo
bW9iaWxlLmNvbS5jbj4KKworICAgICAgICBBYnNvbHV0ZSBwb3NpdGlvbmVkIGVsZW1lbnRzIHdp
dGggSW5saW5lIFJlbGF0aXZlIFBvc2l0aW9uZWQgQ29udGFpbmVyIGFyZSBub3QgbGF5b3V0IGNv
cnJlY3RseQorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9
Nzg3MTMKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICAq
IGZhc3QvY3NzL3Bvc2l0aW9uZWQtaW4tcmVsYXRpdmUtcG9zaXRpb24taW5saW5lLWNyYXNoLWV4
cGVjdGVkLnR4dDogQWRkZWQuCisgICAgICAgICogZmFzdC9jc3MvcG9zaXRpb25lZC1pbi1yZWxh
dGl2ZS1wb3NpdGlvbi1pbmxpbmUtY3Jhc2guaHRtbDogQWRkZWQuCisKIDIwMTItMDItMTMgIFRv
bnkgQ2hhbmcgIDx0b255QGNocm9taXVtLm9yZz4KIAogICAgICAgICBbY2hyb21pdW1dIFVucmV2
aWV3ZWQsIHNraXAgaHR0cC90ZXN0cy9uYXZpZ2F0aW9uL2h0dHBzLWluLXBhZ2UtY2FjaGUuaHRt
bApkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvZmFzdC9jc3MvcG9zaXRpb25lZC1pbi1yZWxhdGl2
ZS1wb3NpdGlvbi1pbmxpbmUtY3Jhc2gtZXhwZWN0ZWQudHh0IGIvTGF5b3V0VGVzdHMvZmFzdC9j
c3MvcG9zaXRpb25lZC1pbi1yZWxhdGl2ZS1wb3NpdGlvbi1pbmxpbmUtY3Jhc2gtZXhwZWN0ZWQu
dHh0Cm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw
MDAwMDAwMDAwMDAwMDAuLmQwMWI5Nzg1ZTM5ZTU5ZGU4ZTczZWVmOGYzNDQzYTc4MjNlOGE0M2UK
LS0tIC9kZXYvbnVsbAorKysgYi9MYXlvdXRUZXN0cy9mYXN0L2Nzcy9wb3NpdGlvbmVkLWluLXJl
bGF0aXZlLXBvc2l0aW9uLWlubGluZS1jcmFzaC1leHBlY3RlZC50eHQKQEAgLTAsMCArMSwzIEBA
CitQQVNTLCBpZiBubyBleGNlcHRpb24gb3IgY3Jhc2ggaW4gZGVidWcKK2RpdjEKKzIKZGlmZiAt
LWdpdCBhL0xheW91dFRlc3RzL2Zhc3QvY3NzL3Bvc2l0aW9uZWQtaW4tcmVsYXRpdmUtcG9zaXRp
b24taW5saW5lLWNyYXNoLmh0bWwgYi9MYXlvdXRUZXN0cy9mYXN0L2Nzcy9wb3NpdGlvbmVkLWlu
LXJlbGF0aXZlLXBvc2l0aW9uLWlubGluZS1jcmFzaC5odG1sCm5ldyBmaWxlIG1vZGUgMTAwNjQ0
CmluZGV4IDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAuLmQzNjJlYjdm
ZTFlNjA3NTc3ZTYxYjg4ODcxZjQ5ZjIxZGYyMTU5OGEKLS0tIC9kZXYvbnVsbAorKysgYi9MYXlv
dXRUZXN0cy9mYXN0L2Nzcy9wb3NpdGlvbmVkLWluLXJlbGF0aXZlLXBvc2l0aW9uLWlubGluZS1j
cmFzaC5odG1sCkBAIC0wLDAgKzEsMzcgQEAKKzxodG1sPg0KKzxzdHlsZSB0eXBlPSJ0ZXh0L2Nz
cyI+DQorLmlubGluZUNvbnRhaW5lciB7DQorICBwb3NpdGlvbjogcmVsYXRpdmU7DQorICBkaXNw
bGF5OiBpbmxpbmU7DQorfQ0KKyNwb3NpdGlvbmVkIHsNCisgIHBvc2l0aW9uOiBhYnNvbHV0ZTsN
CisgIHRvcDogMTAwcHg7DQorfQ0KKzwvc3R5bGU+DQorPHNjcmlwdCB0eXBlPSJ0ZXh0L2phdmFz
Y3JpcHQiPg0KK2lmICh3aW5kb3cubGF5b3V0VGVzdENvbnRyb2xsZXIpIHsNCisgICAgbGF5b3V0
VGVzdENvbnRyb2xsZXIud2FpdFVudGlsRG9uZSgpOw0KKyAgICBsYXlvdXRUZXN0Q29udHJvbGxl
ci5kdW1wQXNUZXh0KCk7DQorfQ0KKw0KK2Z1bmN0aW9uIGR1bXBUZXN0KCkgew0KKyAgICBpZiAo
d2luZG93LmxheW91dFRlc3RDb250cm9sbGVyKSB7DQorICAgICAgICBsYXlvdXRUZXN0Q29udHJv
bGxlci5ub3RpZnlEb25lKCk7DQorICAgIH0NCit9DQorZnVuY3Rpb24gcnVuVGVzdCgpIHsNCisg
ICAgZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoJ3Bvc2l0aW9uZWQnKS5pbm5lckhUTUwgPSAnMic7
DQorICAgIGRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCdwb3NpdGlvbmVkJykuc3R5bGUuY29sb3Ig
PSAncmVkJzsNCisgICAgc2V0VGltZW91dCgnZHVtcFRlc3QoKScsIDEwKTsNCit9DQorc2V0VGlt
ZW91dCgncnVuVGVzdCgpJywgMCk7DQorPC9zY3JpcHQ+DQorPGJvZHk+DQorUEFTUywgaWYgbm8g
ZXhjZXB0aW9uIG9yIGNyYXNoIGluIGRlYnVnDQorICA8ZGl2IGNsYXNzPSdpbmxpbmVDb250YWlu
ZXInPg0KKyAgICA8ZGl2PmRpdjE8L2Rpdj4NCisgICAgPGRpdiBpZD0ncG9zaXRpb25lZCc+ZGl2
MjwvZGl2Pg0KKyAgPC9kaXY+DQorPC9ib2R5Pg0KKzwvaHRtbD4NCg==
</data>

          </attachment>
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>128774</attachid>
            <date>2012-02-24 11:34:30 -0800</date>
            <delta_ts>2012-02-27 11:48:24 -0800</delta_ts>
            <desc>Patch</desc>
            <filename>bug-78713-20120224143413.patch</filename>
            <type>text/plain</type>
            <size>4899</size>
            <attacher name="Ken Buchanan">kenrb</attacher>
            
              <data encoding="base64">U3VidmVyc2lvbiBSZXZpc2lvbjogMTA4NDgyCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D
aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggNTEyMjlhZTVkMGEzMThm
YWQ4NGNhYTM3ZTI4MzYyYjE4MjA5YTdhNS4uMmFkZTQ0M2M0NjAyOGI3NmRiOTBjNTNmYzJjNGU0
YmZlOGNlZDY0ZCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv
dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDIxIEBACisyMDEyLTAyLTI0ICBLZW4g
QnVjaGFuYW4gIDxrZW5yYkBjaHJvbWl1bS5vcmc+CisKKyAgICAgICAgQWJzb2x1dGUgcG9zaXRp
b25lZCBlbGVtZW50cyB3aXRoIElubGluZSBSZWxhdGl2ZSBQb3NpdGlvbmVkIENvbnRhaW5lciBh
cmUgbm90IGxheW91dCBjb3JyZWN0bHkKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcv
c2hvd19idWcuY2dpP2lkPTc4NzEzCisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BT
ISkuCisKKyAgICAgICAgVGVzdDogZmFzdC9jc3MvcG9zaXRpb25lZC1pbi1yZWxhdGl2ZS1wb3Np
dGlvbi1pbmxpbmUtY3Jhc2guaHRtbAorCisgICAgICAgIFBhdGNoIG9yaWdpbmFsbHkgYnkgUm9i
aW4gQ2FvLgorCisgICAgICAgIFRoaXMgaXMgYSByZWdyZXNzaW9uLiByMTA0MTgzIGNoYW5nZXMg
Y29udGFpbmluZ0Jsb2NrKCkgc28gdGhhdCBpdCByZXR1cm5zIHRoZSBjb250YWluZXIKKyAgICAg
ICAgb2YgYW4gYW5vbnltb3VzIGJsb2NrIGZvciBwb3NpdGlvbmVkIG9iamVjdHMsIG5vdCB0aGUg
YW5vbnltb3VzIGJsb2NrIGl0c2VsZi4gV2Ugc2hvdWxkCisgICAgICAgIGNoYW5nZSBtYXJrQ29u
dGFpbmluZ0Jsb2Nrc0ZvckxheW91dCgpIHRvIG1hdGNoIHRoZSBjaGFuZ2UgaW4gY29udGFpbmlu
Z0Jsb2NrKCkuCisKKyAgICAgICAgKiByZW5kZXJpbmcvUmVuZGVyT2JqZWN0LmNwcDoKKyAgICAg
ICAgKFdlYkNvcmU6OlJlbmRlck9iamVjdDo6bWFya0NvbnRhaW5pbmdCbG9ja3NGb3JMYXlvdXQp
OgorCiAyMDEyLTAyLTIyICBTaGlueWEgS2F3YW5ha2EgIDxzaGlueWFrQGNocm9taXVtLm9yZz4K
IAogICAgICAgICBmaXJzdFJlbmRlcmVyT2YoKSBzaG91bGQgYWxzbyByZXR1cm4gYSBmYWxsYmFj
ayBlbGVtZW50IHJlbmRlcmVyIGluIE5vZGVSZW5kZXJpbmdDb250ZXh0LgpkaWZmIC0tZ2l0IGEv
U291cmNlL1dlYkNvcmUvcmVuZGVyaW5nL1JlbmRlck9iamVjdC5jcHAgYi9Tb3VyY2UvV2ViQ29y
ZS9yZW5kZXJpbmcvUmVuZGVyT2JqZWN0LmNwcAppbmRleCA0ODEzZGI4OTg5YmVkZjVlYzQxMWM2
NGRiNzVlMWZiYWNiMTFhMGQ1Li5jZjQzYmIzNmJkNWRhZmI3ZGQ5ZTJjMGVkZTgxNTJmNzJlNmEw
MDdhIDEwMDc1NQotLS0gYS9Tb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyT2JqZWN0LmNw
cAorKysgYi9Tb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyT2JqZWN0LmNwcApAQCAtNjMz
LDggKzYzMyw5IEBAIHZvaWQgUmVuZGVyT2JqZWN0OjptYXJrQ29udGFpbmluZ0Jsb2Nrc0Zvckxh
eW91dChib29sIHNjaGVkdWxlUmVsYXlvdXQsIFJlbmRlck9iCiAgICAgICAgIGlmICghY29udGFp
bmVyICYmICFvYmplY3QtPmlzUmVuZGVyVmlldygpKQogICAgICAgICAgICAgcmV0dXJuOwogICAg
ICAgICBpZiAoIWxhc3QtPmlzVGV4dCgpICYmIGxhc3QtPnN0eWxlKCktPmlzUG9zaXRpb25lZCgp
KSB7Ci0gICAgICAgICAgICBib29sIHdpbGxTa2lwUmVsYXRpdmVseVBvc2l0aW9uZWRJbmxpbmVz
ID0gIW9iamVjdC0+aXNSZW5kZXJCbG9jaygpOwotICAgICAgICAgICAgd2hpbGUgKG9iamVjdCAm
JiAhb2JqZWN0LT5pc1JlbmRlckJsb2NrKCkpIC8vIFNraXAgcmVsYXRpdmVseSBwb3NpdGlvbmVk
IGlubGluZXMgYW5kIGdldCB0byB0aGUgZW5jbG9zaW5nIFJlbmRlckJsb2NrLgorICAgICAgICAg
ICAgYm9vbCB3aWxsU2tpcFJlbGF0aXZlbHlQb3NpdGlvbmVkSW5saW5lcyA9ICFvYmplY3QtPmlz
UmVuZGVyQmxvY2soKSB8fCBvYmplY3QtPmlzQW5vbnltb3VzQmxvY2soKTsKKyAgICAgICAgICAg
IC8vIFNraXAgcmVsYXRpdmVseSBwb3NpdGlvbmVkIGlubGluZXMgYW5kIGFub255bW91cyBibG9j
a3MgdG8gZ2V0IHRvIHRoZSBlbmNsb3NpbmcgUmVuZGVyQmxvY2suCisgICAgICAgICAgICB3aGls
ZSAob2JqZWN0ICYmICghb2JqZWN0LT5pc1JlbmRlckJsb2NrKCkgfHwgb2JqZWN0LT5pc0Fub255
bW91c0Jsb2NrKCkpKQogICAgICAgICAgICAgICAgIG9iamVjdCA9IG9iamVjdC0+Y29udGFpbmVy
KCk7CiAgICAgICAgICAgICBpZiAoIW9iamVjdCB8fCBvYmplY3QtPnBvc0NoaWxkTmVlZHNMYXlv
dXQoKSkKICAgICAgICAgICAgICAgICByZXR1cm47CmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9D
aGFuZ2VMb2cgYi9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKaW5kZXggODc4OWNhZGRjMzMwNWQ2YThl
ZTI4ZmRmYTk1MjQ0OTA1ZjhkNjlmMi4uYTQzODMwZjM2ZmM5N2U1ODMyNDdmMTljNDM2Yjk3NjU2
YmUxYWUwZiAxMDA2NDQKLS0tIGEvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCisrKyBiL0xheW91dFRl
c3RzL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE2IEBACisyMDEyLTAyLTI0ICBLZW4gQnVjaGFuYW4g
IDxrZW5yYkBjaHJvbWl1bS5vcmc+CisKKyAgICAgICAgQWJzb2x1dGUgcG9zaXRpb25lZCBlbGVt
ZW50cyB3aXRoIElubGluZSBSZWxhdGl2ZSBQb3NpdGlvbmVkIENvbnRhaW5lciBhcmUgbm90IGxh
eW91dCBjb3JyZWN0bHkKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcu
Y2dpP2lkPTc4NzEzCisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAg
ICAgICAgVGVzdCBjYXNlIG9yaWdpbmFsbHkgYnkgUm9iaW4gQ2FvLiBUaGlzIGV4ZXJjaXNlcyB0
aGUgY3Jhc2hpbmcKKyAgICAgICAgY29uZGl0aW9uIGluIGJ1ZyA3ODcxMy4KKworICAgICAgICAq
IGZhc3QvY3NzL3Bvc2l0aW9uZWQtaW4tcmVsYXRpdmUtcG9zaXRpb24taW5saW5lLWNyYXNoLWV4
cGVjdGVkLnR4dDogQWRkZWQuCisgICAgICAgICogZmFzdC9jc3MvcG9zaXRpb25lZC1pbi1yZWxh
dGl2ZS1wb3NpdGlvbi1pbmxpbmUtY3Jhc2guaHRtbDogQWRkZWQuCisKIDIwMTItMDItMjIgIFl1
dGEgS2l0YW11cmEgIDx5dXRha0BjaHJvbWl1bS5vcmc+CiAKICAgICAgICAgW0Nocm9taXVtXSBV
bnJldmlld2VkLCByZWd1bGFyIG1haW50ZW5hbmNlIG9mIHRlc3QgZXhwZWN0YXRpb25zLgpkaWZm
IC0tZ2l0IGEvTGF5b3V0VGVzdHMvZmFzdC9jc3MvcG9zaXRpb25lZC1pbi1yZWxhdGl2ZS1wb3Np
dGlvbi1pbmxpbmUtY3Jhc2gtZXhwZWN0ZWQudHh0IGIvTGF5b3V0VGVzdHMvZmFzdC9jc3MvcG9z
aXRpb25lZC1pbi1yZWxhdGl2ZS1wb3NpdGlvbi1pbmxpbmUtY3Jhc2gtZXhwZWN0ZWQudHh0Cm5l
dyBmaWxlIG1vZGUgMTAwNzU1CmluZGV4IDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw
MDAwMDAwMDAuLmQwMWI5Nzg1ZTM5ZTU5ZGU4ZTczZWVmOGYzNDQzYTc4MjNlOGE0M2UKLS0tIC9k
ZXYvbnVsbAorKysgYi9MYXlvdXRUZXN0cy9mYXN0L2Nzcy9wb3NpdGlvbmVkLWluLXJlbGF0aXZl
LXBvc2l0aW9uLWlubGluZS1jcmFzaC1leHBlY3RlZC50eHQKQEAgLTAsMCArMSwzIEBACitQQVNT
LCBpZiBubyBleGNlcHRpb24gb3IgY3Jhc2ggaW4gZGVidWcKK2RpdjEKKzIKZGlmZiAtLWdpdCBh
L0xheW91dFRlc3RzL2Zhc3QvY3NzL3Bvc2l0aW9uZWQtaW4tcmVsYXRpdmUtcG9zaXRpb24taW5s
aW5lLWNyYXNoLmh0bWwgYi9MYXlvdXRUZXN0cy9mYXN0L2Nzcy9wb3NpdGlvbmVkLWluLXJlbGF0
aXZlLXBvc2l0aW9uLWlubGluZS1jcmFzaC5odG1sCm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4
IDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAuLjIyYjNjZTM5NmNlZjJh
MmU3NDg4ZjJjOGYzN2EwYjdhYmI5Y2VhNDAKLS0tIC9kZXYvbnVsbAorKysgYi9MYXlvdXRUZXN0
cy9mYXN0L2Nzcy9wb3NpdGlvbmVkLWluLXJlbGF0aXZlLXBvc2l0aW9uLWlubGluZS1jcmFzaC5o
dG1sCkBAIC0wLDAgKzEsMzcgQEAKKzxodG1sPgorPHN0eWxlIHR5cGU9InRleHQvY3NzIj4KKy5p
bmxpbmVDb250YWluZXIgeworICBwb3NpdGlvbjogcmVsYXRpdmU7CisgIGRpc3BsYXk6IGlubGlu
ZTsKK30KKyNwb3NpdGlvbmVkIHsKKyAgcG9zaXRpb246IGFic29sdXRlOworICB0b3A6IDEwMHB4
OworfQorPC9zdHlsZT4KKzxzY3JpcHQgdHlwZT0idGV4dC9qYXZhc2NyaXB0Ij4KK2lmICh3aW5k
b3cubGF5b3V0VGVzdENvbnRyb2xsZXIpIHsKKyAgICBsYXlvdXRUZXN0Q29udHJvbGxlci53YWl0
VW50aWxEb25lKCk7CisgICAgbGF5b3V0VGVzdENvbnRyb2xsZXIuZHVtcEFzVGV4dCgpOworfQor
CitmdW5jdGlvbiBkdW1wVGVzdCgpIHsKKyAgICBpZiAod2luZG93LmxheW91dFRlc3RDb250cm9s
bGVyKSB7CisgICAgICAgIGxheW91dFRlc3RDb250cm9sbGVyLm5vdGlmeURvbmUoKTsKKyAgICB9
Cit9CitmdW5jdGlvbiBydW5UZXN0KCkgeworICAgIGRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCdw
b3NpdGlvbmVkJykuaW5uZXJIVE1MID0gJzInOworICAgIGRvY3VtZW50LmdldEVsZW1lbnRCeUlk
KCdwb3NpdGlvbmVkJykuc3R5bGUuY29sb3IgPSAncmVkJzsKKyAgICBzZXRUaW1lb3V0KCdkdW1w
VGVzdCgpJywgMTApOworfQorc2V0VGltZW91dCgncnVuVGVzdCgpJywgMCk7Cis8L3NjcmlwdD4K
Kzxib2R5PgorUEFTUywgaWYgbm8gZXhjZXB0aW9uIG9yIGNyYXNoIGluIGRlYnVnCisgIDxkaXYg
Y2xhc3M9J2lubGluZUNvbnRhaW5lcic+CisgICAgPGRpdj5kaXYxPC9kaXY+CisgICAgPGRpdiBp
ZD0ncG9zaXRpb25lZCc+ZGl2MjwvZGl2PgorICA8L2Rpdj4KKzwvYm9keT4KKzwvaHRtbD4K
</data>

          </attachment>
      

    </bug>

</bugzilla>