<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>82566</bug_id>
          
          <creation_ts>2012-03-28 20:17:17 -0700</creation_ts>
          <short_desc>RenderTextControlSingleLine::scrollWidth/Height/Left/Top should not call back to DOM tree</short_desc>
          <delta_ts>2012-10-17 13:14:59 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>New Bugs</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>Unspecified</rep_platform>
          <op_sys>Unspecified</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>WORKSFORME</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords></keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          <blocked>66687</blocked>
          <everconfirmed>0</everconfirmed>
          <reporter name="Tien-Ren Chen">trchen</reporter>
          <assigned_to name="Nobody">webkit-unassigned</assigned_to>
          <cc>abarth</cc>
    
    <cc>aelias</cc>
    
    <cc>ap</cc>
    
    <cc>jamesr</cc>
    
    <cc>jchaffraix</cc>
    
    <cc>mitz</cc>
    
    <cc>simon.fraser</cc>
    
    <cc>tkent</cc>
    
    <cc>tonikitoo</cc>
    
    <cc>webkit.review.bot</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>590786</commentid>
    <comment_count>0</comment_count>
    <who name="Tien-Ren Chen">trchen</who>
    <bug_when>2012-03-28 20:17:17 -0700</bug_when>
    <thetext>RenderTextControlSingleLine::scrollWidth/H/L/T should not call back to DOM tree</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>590789</commentid>
    <comment_count>1</comment_count>
      <attachid>134486</attachid>
    <who name="Tien-Ren Chen">trchen</who>
    <bug_when>2012-03-28 20:19:31 -0700</bug_when>
    <thetext>Created attachment 134486
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>590793</commentid>
    <comment_count>2</comment_count>
    <who name="WebKit Review Bot">webkit.review.bot</who>
    <bug_when>2012-03-28 20:23:11 -0700</bug_when>
    <thetext>Attachment 134486 did not pass style-queue:

Failed to run &quot;[&apos;Tools/Scripts/check-webkit-style&apos;, &apos;--diff-files&apos;, u&apos;Source/WebCore/ChangeLog&apos;, u&apos;Source/WebCor...&quot; exit_code: 1
Source/WebCore/ChangeLog:11:  You should remove the &apos;No new tests&apos; and either add and list tests, or explain why no new tests were possible.  [changelog/nonewtests] [5]
Total errors found: 1 in 2 files


If any of these errors are false positives, please file a bug against check-webkit-style.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>590794</commentid>
    <comment_count>3</comment_count>
    <who name="Tien-Ren Chen">trchen</who>
    <bug_when>2012-03-28 20:27:01 -0700</bug_when>
    <thetext>I&apos;m not really certain if it is the right thing to do, since it changes the layout behavior, and Element:scrollWidth seems to do some magic calculation with zoom factors.

Also I&apos;m not sure what to do with RenderTextControlSingleLine::setScrollLeft/Top.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>597416</commentid>
    <comment_count>4</comment_count>
      <attachid>134486</attachid>
    <who name="Julien Chaffraix">jchaffraix</who>
    <bug_when>2012-04-06 09:49:36 -0700</bug_when>
    <thetext>Comment on attachment 134486
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=134486&amp;action=review

&gt; I&apos;m not really certain if it is the right thing to do, since it changes the layout behavior,

The tests are passing on cr-linux EWS so how come it changes the layout? What kind of changes do you see? It sounds like you should add a test that shows this difference? A test would also help us see the issue and advise a better way to fix it (I think your approach is sane but would love to see the incriminating test case).

&gt; Source/WebCore/ChangeLog:3
&gt; +        RenderTextControlSingleLine::scrollWidth/H/L/T should not call back to DOM tree

Please don&apos;t abbreviate, it makes your change less readable.

&gt; Source/WebCore/rendering/RenderTextControlSingleLine.cpp:694
&gt; +    if (innerTextElement() &amp;&amp; innerTextElement()-&gt;renderBox())

I wonder if we need any of the NULL-checks. Does it make sense to have a RenderTextControlSingleLine without an inner element? (the code is not consistent about those unfortunately)

I would have to look at this logic but tkent@ may know from the top of his head.

&gt; Source/WebCore/rendering/RenderTextControlSingleLine.cpp:695
&gt; +        return innerTextElement()-&gt;renderBox()-&gt;scrollWidth();

As you pointed out, there is a difference with respect to zoom factor between Element::scrollWidth and RenderBox::scrollWidth. To be truly accurate here, we should take the innerTextElement()&apos;s zoom factor into account in the same way Element::scrollWidth() does. I do fear code duplication here but I don&apos;t see a good way around that as we don&apos;t want to expose the inner gut of Element::scrollWidth to everyone.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>598708</commentid>
    <comment_count>5</comment_count>
      <attachid>136327</attachid>
    <who name="Tien-Ren Chen">trchen</who>
    <bug_when>2012-04-09 16:01:05 -0700</bug_when>
    <thetext>Created attachment 136327
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>598716</commentid>
    <comment_count>6</comment_count>
    <who name="Tien-Ren Chen">trchen</who>
    <bug_when>2012-04-09 16:10:58 -0700</bug_when>
    <thetext>(In reply to comment #4)
&gt; (From update of attachment 134486 [details])
&gt; View in context: https://bugs.webkit.org/attachment.cgi?id=134486&amp;action=review
&gt; 
&gt; &gt; I&apos;m not really certain if it is the right thing to do, since it changes the layout behavior,
&gt; 
&gt; The tests are passing on cr-linux EWS so how come it changes the layout? What kind of changes do you see? It sounds like you should add a test that shows this difference? A test would also help us see the issue and advise a better way to fix it (I think your approach is sane but would love to see the incriminating test case).

I didn&apos;t phrase it right. What I meant to say is that it &quot;might&quot; change layout behavior because we no longer request the latest layout from Element. As the bots are all green I guess I worried too much. 

&gt; &gt; Source/WebCore/rendering/RenderTextControlSingleLine.cpp:694
&gt; &gt; +    if (innerTextElement() &amp;&amp; innerTextElement()-&gt;renderBox())
&gt; 
&gt; I wonder if we need any of the NULL-checks. Does it make sense to have a RenderTextControlSingleLine without an inner element? (the code is not consistent about those unfortunately)
&gt; 
&gt; I would have to look at this logic but tkent@ may know from the top of his head.
&gt; &gt; Source/WebCore/rendering/RenderTextControlSingleLine.cpp:695
&gt; &gt; +        return innerTextElement()-&gt;renderBox()-&gt;scrollWidth();
&gt; 
&gt; As you pointed out, there is a difference with respect to zoom factor between Element::scrollWidth and RenderBox::scrollWidth. To be truly accurate here, we should take the innerTextElement()&apos;s zoom factor into account in the same way Element::scrollWidth() does. I do fear code duplication here but I don&apos;t see a good way around that as we don&apos;t want to expose the inner gut of Element::scrollWidth to everyone.

For real I have no idea what is going on(apply no idea dog meme here). Anyway the newly uploaded patch mimic the original behavior as much as possible, and we will go from there?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>603553</commentid>
    <comment_count>7</comment_count>
      <attachid>136327</attachid>
    <who name="Julien Chaffraix">jchaffraix</who>
    <bug_when>2012-04-16 16:32:45 -0700</bug_when>
    <thetext>Comment on attachment 136327
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=136327&amp;action=review

&gt; Source/WebCore/ChangeLog:12
&gt; +        No new tests. No change in behavior.

As asked once but I did not get any answer: do you have a test case for that change?

I don&apos;t fear the change in behavior (very unlikely), more the badness of having layout called recursively.

&gt; Source/WebCore/rendering/RenderTextControlSingleLine.cpp:695
&gt; +        RenderBox* rend = innerTextElement()-&gt;renderBox();

Again, don&apos;t abbreviate.

&gt; Source/WebCore/rendering/RenderTextControlSingleLine.cpp:714
&gt; +        return adjustForAbsoluteZoom(rend-&gt;scrollLeft(), rend);

If you are going to update the getters, I would like the setters to be updated in the same way.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>603574</commentid>
    <comment_count>8</comment_count>
    <who name="Tien-Ren Chen">trchen</who>
    <bug_when>2012-04-16 16:54:31 -0700</bug_when>
    <thetext>(In reply to comment #7)
&gt; (From update of attachment 136327 [details])
&gt; View in context: https://bugs.webkit.org/attachment.cgi?id=136327&amp;action=review
&gt; 
&gt; &gt; Source/WebCore/ChangeLog:12
&gt; &gt; +        No new tests. No change in behavior.
&gt; 
&gt; As asked once but I did not get any answer: do you have a test case for that change?
&gt; I don&apos;t fear the change in behavior (very unlikely), more the badness of having layout called recursively.

No, I mean the opposite. There should be no visible difference in layout behavior, and that is what we want. I can&apos;t observe anything weird at this time.

&gt; &gt; Source/WebCore/rendering/RenderTextControlSingleLine.cpp:695
&gt; &gt; +        RenderBox* rend = innerTextElement()-&gt;renderBox();
&gt; 
&gt; Again, don&apos;t abbreviate.

Ugh that&apos;s the same copy &amp; paste from Element. Anyway I&apos;ll change it to &quot;box&quot;, sounds better than &quot;rend&quot;.

&gt; &gt; Source/WebCore/rendering/RenderTextControlSingleLine.cpp:714
&gt; &gt; +        return adjustForAbsoluteZoom(rend-&gt;scrollLeft(), rend);
&gt; 
&gt; If you are going to update the getters, I would like the setters to be updated in the same way.

Alright. Seems like the setter on Element just calls the setter on the RenderBox anyway.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>603594</commentid>
    <comment_count>9</comment_count>
      <attachid>137437</attachid>
    <who name="Tien-Ren Chen">trchen</who>
    <bug_when>2012-04-16 17:12:11 -0700</bug_when>
    <thetext>Created attachment 137437
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>620021</commentid>
    <comment_count>10</comment_count>
    <who name="Adam Barth">abarth</who>
    <bug_when>2012-05-09 16:42:01 -0700</bug_when>
    <thetext>trchen, I don&apos;t really understand what problem this patch is solving.  Is this just a stylistic improvement, or is there a concrete benefit from this patch?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>620038</commentid>
    <comment_count>11</comment_count>
    <who name="Tien-Ren Chen">trchen</who>
    <bug_when>2012-05-09 16:57:42 -0700</bug_when>
    <thetext>(In reply to comment #10)
&gt; trchen, I don&apos;t really understand what problem this patch is solving.  Is this just a stylistic improvement, or is there a concrete benefit from this patch?

Working on the render tree should not trigger layout behavior, otherwise the tree can mutate while we&apos;re still traversing on it. This fixes a crash we have in downstream.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>620040</commentid>
    <comment_count>12</comment_count>
    <who name="Adam Barth">abarth</who>
    <bug_when>2012-05-09 17:00:00 -0700</bug_when>
    <thetext>Can we include a test case for the crash?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>620041</commentid>
    <comment_count>13</comment_count>
    <who name="Adam Barth">abarth</who>
    <bug_when>2012-05-09 17:00:19 -0700</bug_when>
    <thetext>It&apos;s fine if the test case doesn&apos;t crash yet (as long as it will crash when we finish upstreaming).</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>620076</commentid>
    <comment_count>14</comment_count>
    <who name="Tien-Ren Chen">trchen</who>
    <bug_when>2012-05-09 17:15:21 -0700</bug_when>
    <thetext>(In reply to comment #12)
&gt; Can we include a test case for the crash?

I can try but I don&apos;t know exactly know how to trigger this.

Basically we want to find a situation that calling layout once won&apos;t stabilize the render tree, leaving a single-line textbox that is dirty, and doing a layout on that textbox will cause its ancestor to be removed from the tree.

The original crash is from a complex webpage has lots of javascript and animation (and the crash is hardly reproducible). Not easy to isolate a minimal test case.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>620105</commentid>
    <comment_count>15</comment_count>
    <who name="Adam Barth">abarth</who>
    <bug_when>2012-05-09 17:38:26 -0700</bug_when>
    <thetext>As a general principle, we require tests for patches that fix crashes so that we don&apos;t regress the crash in the future.  Of course, sometimes we&apos;re not able to produce test cases, but that&apos;s the exception rather than the rule.  I don&apos;t know enough about this part of the code to know what&apos;s best here.

Hopefully jchaffraix or eric can guide us to the right solution.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>620128</commentid>
    <comment_count>16</comment_count>
    <who name="Alexandre Elias">aelias</who>
    <bug_when>2012-05-09 18:04:54 -0700</bug_when>
    <thetext>I think the invariant we need to be testing for here is that we should not be triggering a layout by calling these getters.  We don&apos;t need to explicitly test for a crash, as that&apos;s just one of the things that can go wrong due to that underlying bug.

I don&apos;t know how to check the timing of when a layout happens in a layout test, however.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>623394</commentid>
    <comment_count>17</comment_count>
    <who name="Julien Chaffraix">jchaffraix</who>
    <bug_when>2012-05-14 15:50:52 -0700</bug_when>
    <thetext>(In reply to comment #16)
&gt; I think the invariant we need to be testing for here is that we should not be triggering a layout by calling these getters.  We don&apos;t need to explicitly test for a crash, as that&apos;s just one of the things that can go wrong due to that underlying bug.

I can think of 2 ways to test:
* mutate the shadow DOM, mutate the &lt;input&gt; tag and then force a layout on the &lt;input&gt; (not sure it would crash but it&apos;s possible as we could recursively call layout in this case)
* expose a method to get the internal scroll dimensions using Internals, mutate the shadow DOM and compare the values before / after the mutation.

&gt; I don&apos;t know how to check the timing of when a layout happens in a layout test, however.

The only direct way I can think of is through the web-inspector. The other methods would be indirect (timing difference in the operation in JavaScript as layout adds some overhead, ...).</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>623402</commentid>
    <comment_count>18</comment_count>
    <who name="James Robinson">jamesr</who>
    <bug_when>2012-05-14 16:02:00 -0700</bug_when>
    <thetext>Another way to test is to add ASSERT()s in C++ code that forbid this codepath, then make a layout test that hits it and have the test be &quot;no ASSERT()s should fire in debug mode&quot;.  I think that would make more sense in this case.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>629720</commentid>
    <comment_count>19</comment_count>
      <attachid>137437</attachid>
    <who name="Ryosuke Niwa">rniwa</who>
    <bug_when>2012-05-21 16:54:12 -0700</bug_when>
    <thetext>Comment on attachment 137437
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=137437&amp;action=review

&gt; Source/WebCore/ChangeLog:9
&gt; +        Calling to Element::scrollWidth/scrolHeight/scrollLeft/scrollTop/
&gt; +        setScrollLeft/setScrollTop will call
&gt; +        Document::updateLayoutIgnorePendingStyleSheets, which can trigger
&gt; +        unexpected layout update.

How is that possible? When we&apos;re calling scrollWidth on RenderTextControlSingleLine via Element::scrollWidth(),
we should have already called updateLayoutIgnorePendingStylesheets().
The call to updateLayoutIgnorePendingStyleSheets() here should be no-op. Who is the caller?
We need to fix that caller to call updateLayoutIgnorePendingStyleSheets first. r- because this is a wrong fix.

Do we have a crash report / stack trace for this?

&gt; Source/WebCore/ChangeLog:11
&gt; +        Reviewed by NOBODY (OOPS!).

This line should appear before the long description.

&gt; Source/WebCore/ChangeLog:13
&gt; +        No new tests. No change in behavior.

There definitely is a behavior change. Please revise.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>629800</commentid>
    <comment_count>20</comment_count>
    <who name="Tien-Ren Chen">trchen</who>
    <bug_when>2012-05-21 18:04:31 -0700</bug_when>
    <thetext>(In reply to comment #19)
&gt; (From update of attachment 137437 [details])
&gt; View in context: https://bugs.webkit.org/attachment.cgi?id=137437&amp;action=review
&gt; 
&gt; &gt; Source/WebCore/ChangeLog:9
&gt; &gt; +        Calling to Element::scrollWidth/scrolHeight/scrollLeft/scrollTop/
&gt; &gt; +        setScrollLeft/setScrollTop will call
&gt; &gt; +        Document::updateLayoutIgnorePendingStyleSheets, which can trigger
&gt; &gt; +        unexpected layout update.
&gt; 
&gt; How is that possible? When we&apos;re calling scrollWidth on RenderTextControlSingleLine via Element::scrollWidth(),
&gt; we should have already called updateLayoutIgnorePendingStylesheets().
&gt; The call to updateLayoutIgnorePendingStyleSheets() here should be no-op. Who is the caller?
&gt; We need to fix that caller to call updateLayoutIgnorePendingStyleSheets first. r- because this is a wrong fix.

scrollWidth() is a virtual function. Anything that calls renderBox-&gt;scrollWidth() can potentially go to RenderTextControlSingleLine::scrollWidth().

Why is it a wrong fix when there is no layout test fails? Why query innerTextElement()-&gt;scrollWidth() from the DOM tree when there is the cached value in the render tree?

&gt; Do we have a crash report / stack trace for this?

Unfortunately this crash currently only exists in downstream Chrome for Android builds.
http://b.corp.google.com/issue?id=6101477
http://crash.corp.google.com/reportdetail?reportid=098fe31738dfc304
http://b.corp.google.com/issue?id=6237967
http://crash.corp.google.com/reportdetail?reportid=7facd3bd586667d4

The two crashes are very similar in nature. We have a RenderLayer::updateNonFastScrollableRegion function in downstream that collects all scrollable region in a RenderLayer, so the compositor thread will know when to delegate scrolling events to the WebKit thread. The function traverse through the render tree and query RenderBox::canBeScrolledAndHasScrollableArea() which will call scrollWidth(). Then unexpected layout screwed up the tree traversal.

We delayed the call until very last moment of a compositor commit, even after we called WebViewImpl::layout() for a full layout update, but layout can still happen unexpectedly.

As far as I know layout is an iterative operation. The render tree can take multiple layouts to reach to a fixed point. Means that it is virtually impossible to safely traverse the render tree while querying geometries from the RenderObjects, if you allow a RenderObject to re-layout anytime as it wishes.

&gt; &gt; Source/WebCore/ChangeLog:11
&gt; &gt; +        Reviewed by NOBODY (OOPS!).
&gt; 
&gt; This line should appear before the long description.
&gt; 
&gt; &gt; Source/WebCore/ChangeLog:13
&gt; &gt; +        No new tests. No change in behavior.
&gt; 
&gt; There definitely is a behavior change. Please revise.

Okay, we&apos;ll find a way to test this, but before that let&apos;s determine what is the correct fix.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>640997</commentid>
    <comment_count>21</comment_count>
    <who name="Adam Barth">abarth</who>
    <bug_when>2012-06-04 16:50:04 -0700</bug_when>
    <thetext>@trchen: It&apos;s fine to add tests that only crash in the chromium-android branch as long as the exercise the code you&apos;re changing here.

Progress on this patch seems to have stalled out, and I&apos;m unsure how we should proceed.  It sounds like trchen is still looking for feedback on the approach.

@rniwa: What do you think of the approach, understanding that this patch isn&apos;t complete yet due to missing tests?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>643729</commentid>
    <comment_count>22</comment_count>
      <attachid>137437</attachid>
    <who name="Julien Chaffraix">jchaffraix</who>
    <bug_when>2012-06-07 11:32:24 -0700</bug_when>
    <thetext>Comment on attachment 137437
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=137437&amp;action=review

&gt;&gt;&gt; Source/WebCore/ChangeLog:9
&gt;&gt;&gt; +        unexpected layout update.
&gt;&gt; 
&gt;&gt; How is that possible? When we&apos;re calling scrollWidth on RenderTextControlSingleLine via Element::scrollWidth(),
&gt;&gt; we should have already called updateLayoutIgnorePendingStylesheets().
&gt;&gt; The call to updateLayoutIgnorePendingStyleSheets() here should be no-op. Who is the caller?
&gt;&gt; We need to fix that caller to call updateLayoutIgnorePendingStyleSheets first. r- because this is a wrong fix.
&gt;&gt; 
&gt;&gt; Do we have a crash report / stack trace for this?
&gt; 
&gt; scrollWidth() is a virtual function. Anything that calls renderBox-&gt;scrollWidth() can potentially go to RenderTextControlSingleLine::scrollWidth().
&gt; 
&gt; Why is it a wrong fix when there is no layout test fails? Why query innerTextElement()-&gt;scrollWidth() from the DOM tree when there is the cached value in the render tree?

I stand on my ground and agree with Tien-Ren logic here: the overflow logic, that runs during layout, will query scrollWidth. This can end up in us triggering a new layout (which is slow but normally harmless). I don&apos;t deny that I don&apos;t know the condition for that to happen, just that it is an undeniable possibility.

If we put the overflow logic aside, it&apos;s a layering violation that rendering/ calls back to DOM in this case.

Fixing callers is unfeasible for several reasons: RenderTextControlSingleLine have a very different way of working than the average RenderObject (ie it wraps a shadow DOM) but mostly because you *don&apos;t* want rendering to start calling Document::updateLayoutIgnorePendingStyleSheets

&gt;&gt;&gt; Source/WebCore/ChangeLog:11
&gt;&gt;&gt; +        Reviewed by NOBODY (OOPS!).
&gt;&gt; 
&gt;&gt; This line should appear before the long description.
&gt; 
&gt; Okay, we&apos;ll find a way to test this, but before that let&apos;s determine what is the correct fix.

There is no mention of where the &quot;Reviewed by ...&quot; line should be in the coding style or any tool enforcing what you said, Ryosuke. I don&apos;t think a contributor should be penalized for that nor that a reviewer should impose his view on that.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>744523</commentid>
    <comment_count>23</comment_count>
    <who name="Adam Barth">abarth</who>
    <bug_when>2012-10-17 12:58:42 -0700</bug_when>
    <thetext>This patch does not appear to be needed anymore.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>744537</commentid>
    <comment_count>24</comment_count>
    <who name="Tien-Ren Chen">trchen</who>
    <bug_when>2012-10-17 13:11:24 -0700</bug_when>
    <thetext>(In reply to comment #23)
&gt; This patch does not appear to be needed anymore.

I don&apos;t think so. The crash bug was very difficult to reproduce in the first place. This patch is stalled only because there are other stuffs that are in more urgent .:p</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>744542</commentid>
    <comment_count>25</comment_count>
    <who name="Adam Barth">abarth</who>
    <bug_when>2012-10-17 13:14:59 -0700</bug_when>
    <thetext>Ok, please feel free to re-open this bug or create a new bug when you&apos;ve got a way to reproduce the crash.</thetext>
  </long_desc>
      
          <attachment
              isobsolete="1"
              ispatch="1"
              isprivate="0"
          >
            <attachid>134486</attachid>
            <date>2012-03-28 20:19:31 -0700</date>
            <delta_ts>2012-04-09 16:00:50 -0700</delta_ts>
            <desc>Patch</desc>
            <filename>bug-82566-20120328201930.patch</filename>
            <type>text/plain</type>
            <size>2782</size>
            <attacher name="Tien-Ren Chen">trchen</attacher>
            
              <data encoding="base64">U3VidmVyc2lvbiBSZXZpc2lvbjogMTEyNDg1CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D
aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggMzJkNmMzNzg5NTEwNThm
ODI2MTJhNWVlMmRlMTQ2ZjJhMzI1ZWQ0Zi4uMDdjNDU5NWFhZDE3ZGJkYTI2ZGQ4MWViNGU4ZTZj
MTBhODU5MDY1YiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv
dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDIxIEBACisyMDEyLTAzLTI4ICBUaWVu
LVJlbiBDaGVuICA8dHJjaGVuQGNocm9taXVtLm9yZz4KKworICAgICAgICBSZW5kZXJUZXh0Q29u
dHJvbFNpbmdsZUxpbmU6OnNjcm9sbFdpZHRoL0gvTC9UIHNob3VsZCBub3QgY2FsbCBiYWNrIHRv
IERPTSB0cmVlCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9p
ZD04MjU2NgorCisgICAgICAgIENhbGxpbmcgdG8gRWxlbWVudDo6c2Nyb2xsV2lkdGgvSC9ML1Qg
d2lsbCBjYWxsCisgICAgICAgIERvY3VtZW50Ojp1cGRhdGVMYXlvdXRJZ25vcmVQZW5kaW5nU3R5
bGVTaGVldHMsIHdoaWNoIGNhbiB0cmlnZ2VyCisgICAgICAgIHVuZXhwZWN0ZWQgbGF5b3V0IHVw
ZGF0ZS4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKyAgICAgICAgTm8g
bmV3IHRlc3RzLiAoT09QUyEpCisKKyAgICAgICAgKiByZW5kZXJpbmcvUmVuZGVyVGV4dENvbnRy
b2xTaW5nbGVMaW5lLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OlJlbmRlclRleHRDb250cm9sU2lu
Z2xlTGluZTo6c2Nyb2xsV2lkdGgpOgorICAgICAgICAoV2ViQ29yZTo6UmVuZGVyVGV4dENvbnRy
b2xTaW5nbGVMaW5lOjpzY3JvbGxIZWlnaHQpOgorICAgICAgICAoV2ViQ29yZTo6UmVuZGVyVGV4
dENvbnRyb2xTaW5nbGVMaW5lOjpzY3JvbGxMZWZ0KToKKyAgICAgICAgKFdlYkNvcmU6OlJlbmRl
clRleHRDb250cm9sU2luZ2xlTGluZTo6c2Nyb2xsVG9wKToKKwogMjAxMi0wMy0yOCAgVmljdG9y
IENhcmJ1bmUgIDx2Y2FyYnVuZUBhZG9iZS5jb20+CiAKICAgICAgICAgUmVtb3ZlZCBwYXJ0aWN1
bGFyIHJlbmRlcmluZyBmb3IgdGhlIHZvbHVtZSBzbGlkZXIgYW5kIHVzZWQKZGlmZiAtLWdpdCBh
L1NvdXJjZS9XZWJDb3JlL3JlbmRlcmluZy9SZW5kZXJUZXh0Q29udHJvbFNpbmdsZUxpbmUuY3Bw
IGIvU291cmNlL1dlYkNvcmUvcmVuZGVyaW5nL1JlbmRlclRleHRDb250cm9sU2luZ2xlTGluZS5j
cHAKaW5kZXggMjJiZDYzZGRkOTU0ZGZmOTJhY2ZjOGUyZjhlMjYzZDcwNzBkMjRlOS4uMDhmZWI5
NDZjYjdkOWU2ZjE2MGFlMjVmN2RlNTgxMTllNGRkZmMwNiAxMDA2NDQKLS0tIGEvU291cmNlL1dl
YkNvcmUvcmVuZGVyaW5nL1JlbmRlclRleHRDb250cm9sU2luZ2xlTGluZS5jcHAKKysrIGIvU291
cmNlL1dlYkNvcmUvcmVuZGVyaW5nL1JlbmRlclRleHRDb250cm9sU2luZ2xlTGluZS5jcHAKQEAg
LTY5MSwyOSArNjkxLDI5IEBAIHZvaWQgUmVuZGVyVGV4dENvbnRyb2xTaW5nbGVMaW5lOjphdXRv
c2Nyb2xsKCkKIAogaW50IFJlbmRlclRleHRDb250cm9sU2luZ2xlTGluZTo6c2Nyb2xsV2lkdGgo
KSBjb25zdAogewotICAgIGlmIChpbm5lclRleHRFbGVtZW50KCkpCi0gICAgICAgIHJldHVybiBp
bm5lclRleHRFbGVtZW50KCktPnNjcm9sbFdpZHRoKCk7CisgICAgaWYgKGlubmVyVGV4dEVsZW1l
bnQoKSAmJiBpbm5lclRleHRFbGVtZW50KCktPnJlbmRlckJveCgpKQorICAgICAgICByZXR1cm4g
aW5uZXJUZXh0RWxlbWVudCgpLT5yZW5kZXJCb3goKS0+c2Nyb2xsV2lkdGgoKTsKICAgICByZXR1
cm4gUmVuZGVyQmxvY2s6OnNjcm9sbFdpZHRoKCk7CiB9CiAKIGludCBSZW5kZXJUZXh0Q29udHJv
bFNpbmdsZUxpbmU6OnNjcm9sbEhlaWdodCgpIGNvbnN0CiB7Ci0gICAgaWYgKGlubmVyVGV4dEVs
ZW1lbnQoKSkKLSAgICAgICAgcmV0dXJuIGlubmVyVGV4dEVsZW1lbnQoKS0+c2Nyb2xsSGVpZ2h0
KCk7CisgICAgaWYgKGlubmVyVGV4dEVsZW1lbnQoKSAmJiBpbm5lclRleHRFbGVtZW50KCktPnJl
bmRlckJveCgpKQorICAgICAgICByZXR1cm4gaW5uZXJUZXh0RWxlbWVudCgpLT5yZW5kZXJCb3go
KS0+c2Nyb2xsSGVpZ2h0KCk7CiAgICAgcmV0dXJuIFJlbmRlckJsb2NrOjpzY3JvbGxIZWlnaHQo
KTsKIH0KIAogaW50IFJlbmRlclRleHRDb250cm9sU2luZ2xlTGluZTo6c2Nyb2xsTGVmdCgpIGNv
bnN0CiB7Ci0gICAgaWYgKGlubmVyVGV4dEVsZW1lbnQoKSkKLSAgICAgICAgcmV0dXJuIGlubmVy
VGV4dEVsZW1lbnQoKS0+c2Nyb2xsTGVmdCgpOworICAgIGlmIChpbm5lclRleHRFbGVtZW50KCkg
JiYgaW5uZXJUZXh0RWxlbWVudCgpLT5yZW5kZXJCb3goKSkKKyAgICAgICAgcmV0dXJuIGlubmVy
VGV4dEVsZW1lbnQoKS0+cmVuZGVyQm94KCktPnNjcm9sbExlZnQoKTsKICAgICByZXR1cm4gUmVu
ZGVyQmxvY2s6OnNjcm9sbExlZnQoKTsKIH0KIAogaW50IFJlbmRlclRleHRDb250cm9sU2luZ2xl
TGluZTo6c2Nyb2xsVG9wKCkgY29uc3QKIHsKLSAgICBpZiAoaW5uZXJUZXh0RWxlbWVudCgpKQot
ICAgICAgICByZXR1cm4gaW5uZXJUZXh0RWxlbWVudCgpLT5zY3JvbGxUb3AoKTsKKyAgICBpZiAo
aW5uZXJUZXh0RWxlbWVudCgpICYmIGlubmVyVGV4dEVsZW1lbnQoKS0+cmVuZGVyQm94KCkpCisg
ICAgICAgIHJldHVybiBpbm5lclRleHRFbGVtZW50KCktPnJlbmRlckJveCgpLT5zY3JvbGxUb3Ao
KTsKICAgICByZXR1cm4gUmVuZGVyQmxvY2s6OnNjcm9sbFRvcCgpOwogfQogCg==
</data>

          </attachment>
          <attachment
              isobsolete="1"
              ispatch="1"
              isprivate="0"
          >
            <attachid>136327</attachid>
            <date>2012-04-09 16:01:05 -0700</date>
            <delta_ts>2012-04-16 17:12:01 -0700</delta_ts>
            <desc>Patch</desc>
            <filename>bug-82566-20120409160104.patch</filename>
            <type>text/plain</type>
            <size>3153</size>
            <attacher name="Tien-Ren Chen">trchen</attacher>
            
              <data encoding="base64">U3VidmVyc2lvbiBSZXZpc2lvbjogMTEzNjI4CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D
aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggZTFlMTI1NjE2NGQ1ZTZk
Zjc1ZTM2M2RlMGM5NjEyOWNlZGEwNzcwYi4uZjFkOTFhNThmYmUwMjEzNWIxYjA3MTJiN2E5OTNh
MmQyY2ZjYWE4ZSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv
dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDIyIEBACisyMDEyLTA0LTA5ICBUaWVu
LVJlbiBDaGVuICA8dHJjaGVuQGNocm9taXVtLm9yZz4KKworICAgICAgICBSZW5kZXJUZXh0Q29u
dHJvbFNpbmdsZUxpbmU6OnNjcm9sbFdpZHRoL3Njcm9sSGVpZ2h0L3Njcm9sbExlZnQvc2Nyb2xs
VG9wIHNob3VsZCBub3QgY2FsbCBiYWNrIHRvIERPTSB0cmVlCisgICAgICAgIGh0dHBzOi8vYnVn
cy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD04MjU2NgorCisgICAgICAgIENhbGxpbmcgdG8g
RWxlbWVudDo6c2Nyb2xsV2lkdGgvc2Nyb2xIZWlnaHQvc2Nyb2xsTGVmdC9zY3JvbGxUb3Agd2ls
bAorICAgICAgICBjYWxsIERvY3VtZW50Ojp1cGRhdGVMYXlvdXRJZ25vcmVQZW5kaW5nU3R5bGVT
aGVldHMsIHdoaWNoIGNhbiB0cmlnZ2VyCisgICAgICAgIHVuZXhwZWN0ZWQgbGF5b3V0IHVwZGF0
ZS4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBObyBu
ZXcgdGVzdHMuIE5vIGNoYW5nZSBpbiBiZWhhdmlvci4KKworICAgICAgICAqIHJlbmRlcmluZy9S
ZW5kZXJUZXh0Q29udHJvbFNpbmdsZUxpbmUuY3BwOgorICAgICAgICAoV2ViQ29yZTo6UmVuZGVy
VGV4dENvbnRyb2xTaW5nbGVMaW5lOjpzY3JvbGxXaWR0aCk6CisgICAgICAgIChXZWJDb3JlOjpS
ZW5kZXJUZXh0Q29udHJvbFNpbmdsZUxpbmU6OnNjcm9sbEhlaWdodCk6CisgICAgICAgIChXZWJD
b3JlOjpSZW5kZXJUZXh0Q29udHJvbFNpbmdsZUxpbmU6OnNjcm9sbExlZnQpOgorICAgICAgICAo
V2ViQ29yZTo6UmVuZGVyVGV4dENvbnRyb2xTaW5nbGVMaW5lOjpzY3JvbGxUb3ApOgorCiAyMDEy
LTA0LTA5ICBUaW0gSG9ydG9uICA8dGltb3RoeV9ob3J0b25AYXBwbGUuY29tPgogCiAgICAgICAg
IEZyYW1lRGF0YSBjb25zdHJ1Y3RvciB6ZXJvZXMgYWxsIGZpZWxkcywgY2F1c2luZyBJbWFnZU9y
aWVudGF0aW9uIHRvIGJlIDAKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL3JlbmRlcmluZy9S
ZW5kZXJUZXh0Q29udHJvbFNpbmdsZUxpbmUuY3BwIGIvU291cmNlL1dlYkNvcmUvcmVuZGVyaW5n
L1JlbmRlclRleHRDb250cm9sU2luZ2xlTGluZS5jcHAKaW5kZXggMjJiZDYzZGRkOTU0ZGZmOTJh
Y2ZjOGUyZjhlMjYzZDcwNzBkMjRlOS4uODg4Yzc2NzBmMjk2NTk4Y2UxZjU5OGUzYTY0M2Q1YjA2
YWEwYzgwZiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvcmVuZGVyaW5nL1JlbmRlclRleHRD
b250cm9sU2luZ2xlTGluZS5jcHAKKysrIGIvU291cmNlL1dlYkNvcmUvcmVuZGVyaW5nL1JlbmRl
clRleHRDb250cm9sU2luZ2xlTGluZS5jcHAKQEAgLTY5MSwyOSArNjkxLDM3IEBAIHZvaWQgUmVu
ZGVyVGV4dENvbnRyb2xTaW5nbGVMaW5lOjphdXRvc2Nyb2xsKCkKIAogaW50IFJlbmRlclRleHRD
b250cm9sU2luZ2xlTGluZTo6c2Nyb2xsV2lkdGgoKSBjb25zdAogewotICAgIGlmIChpbm5lclRl
eHRFbGVtZW50KCkpCi0gICAgICAgIHJldHVybiBpbm5lclRleHRFbGVtZW50KCktPnNjcm9sbFdp
ZHRoKCk7CisgICAgaWYgKGlubmVyVGV4dEVsZW1lbnQoKSAmJiBpbm5lclRleHRFbGVtZW50KCkt
PnJlbmRlckJveCgpKSB7CisgICAgICAgIFJlbmRlckJveCogcmVuZCA9IGlubmVyVGV4dEVsZW1l
bnQoKS0+cmVuZGVyQm94KCk7CisgICAgICAgIHJldHVybiBhZGp1c3RGb3JBYnNvbHV0ZVpvb20o
cmVuZC0+c2Nyb2xsV2lkdGgoKSwgcmVuZCk7CisgICAgfQogICAgIHJldHVybiBSZW5kZXJCbG9j
azo6c2Nyb2xsV2lkdGgoKTsKIH0KIAogaW50IFJlbmRlclRleHRDb250cm9sU2luZ2xlTGluZTo6
c2Nyb2xsSGVpZ2h0KCkgY29uc3QKIHsKLSAgICBpZiAoaW5uZXJUZXh0RWxlbWVudCgpKQotICAg
ICAgICByZXR1cm4gaW5uZXJUZXh0RWxlbWVudCgpLT5zY3JvbGxIZWlnaHQoKTsKKyAgICBpZiAo
aW5uZXJUZXh0RWxlbWVudCgpICYmIGlubmVyVGV4dEVsZW1lbnQoKS0+cmVuZGVyQm94KCkpIHsK
KyAgICAgICAgUmVuZGVyQm94KiByZW5kID0gaW5uZXJUZXh0RWxlbWVudCgpLT5yZW5kZXJCb3go
KTsKKyAgICAgICAgcmV0dXJuIGFkanVzdEZvckFic29sdXRlWm9vbShyZW5kLT5zY3JvbGxIZWln
aHQoKSwgcmVuZCk7CisgICAgfQogICAgIHJldHVybiBSZW5kZXJCbG9jazo6c2Nyb2xsSGVpZ2h0
KCk7CiB9CiAKIGludCBSZW5kZXJUZXh0Q29udHJvbFNpbmdsZUxpbmU6OnNjcm9sbExlZnQoKSBj
b25zdAogewotICAgIGlmIChpbm5lclRleHRFbGVtZW50KCkpCi0gICAgICAgIHJldHVybiBpbm5l
clRleHRFbGVtZW50KCktPnNjcm9sbExlZnQoKTsKKyAgICBpZiAoaW5uZXJUZXh0RWxlbWVudCgp
ICYmIGlubmVyVGV4dEVsZW1lbnQoKS0+cmVuZGVyQm94KCkpIHsKKyAgICAgICAgUmVuZGVyQm94
KiByZW5kID0gaW5uZXJUZXh0RWxlbWVudCgpLT5yZW5kZXJCb3goKTsKKyAgICAgICAgcmV0dXJu
IGFkanVzdEZvckFic29sdXRlWm9vbShyZW5kLT5zY3JvbGxMZWZ0KCksIHJlbmQpOworICAgIH0K
ICAgICByZXR1cm4gUmVuZGVyQmxvY2s6OnNjcm9sbExlZnQoKTsKIH0KIAogaW50IFJlbmRlclRl
eHRDb250cm9sU2luZ2xlTGluZTo6c2Nyb2xsVG9wKCkgY29uc3QKIHsKLSAgICBpZiAoaW5uZXJU
ZXh0RWxlbWVudCgpKQotICAgICAgICByZXR1cm4gaW5uZXJUZXh0RWxlbWVudCgpLT5zY3JvbGxU
b3AoKTsKKyAgICBpZiAoaW5uZXJUZXh0RWxlbWVudCgpICYmIGlubmVyVGV4dEVsZW1lbnQoKS0+
cmVuZGVyQm94KCkpIHsKKyAgICAgICAgUmVuZGVyQm94KiByZW5kID0gaW5uZXJUZXh0RWxlbWVu
dCgpLT5yZW5kZXJCb3goKTsKKyAgICAgICAgcmV0dXJuIGFkanVzdEZvckFic29sdXRlWm9vbShy
ZW5kLT5zY3JvbGxUb3AoKSwgcmVuZCk7CisgICAgfQogICAgIHJldHVybiBSZW5kZXJCbG9jazo6
c2Nyb2xsVG9wKCk7CiB9CiAK
</data>

          </attachment>
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>137437</attachid>
            <date>2012-04-16 17:12:11 -0700</date>
            <delta_ts>2012-06-07 11:32:24 -0700</delta_ts>
            <desc>Patch</desc>
            <filename>bug-82566-20120416171210.patch</filename>
            <type>text/plain</type>
            <size>4078</size>
            <attacher name="Tien-Ren Chen">trchen</attacher>
            
              <data encoding="base64">U3VidmVyc2lvbiBSZXZpc2lvbjogMTEzNjI4CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D
aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggZTFlMTI1NjE2NGQ1ZTZk
Zjc1ZTM2M2RlMGM5NjEyOWNlZGEwNzcwYi4uZjMzOTQ2NWQ3NWQyYjM3OGRlNWRmYTI2NDlmZmI1
ZTk2NzQ1MzM5MyAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv
dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDIzIEBACisyMDEyLTA0LTA5ICBUaWVu
LVJlbiBDaGVuICA8dHJjaGVuQGNocm9taXVtLm9yZz4KKworICAgICAgICBSZW5kZXJUZXh0Q29u
dHJvbFNpbmdsZUxpbmU6OnNjcm9sbFdpZHRoL3Njcm9sSGVpZ2h0L3Njcm9sbExlZnQvc2Nyb2xs
VG9wL3NldFNjcm9sbExlZnQvc2V0U2Nyb2xsVG9wIHNob3VsZCBub3QgY2FsbCBiYWNrIHRvIERP
TSB0cmVlCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD04
MjU2NgorCisgICAgICAgIENhbGxpbmcgdG8gRWxlbWVudDo6c2Nyb2xsV2lkdGgvc2Nyb2xIZWln
aHQvc2Nyb2xsTGVmdC9zY3JvbGxUb3AvCisgICAgICAgIHNldFNjcm9sbExlZnQvc2V0U2Nyb2xs
VG9wIHdpbGwgY2FsbAorICAgICAgICBEb2N1bWVudDo6dXBkYXRlTGF5b3V0SWdub3JlUGVuZGlu
Z1N0eWxlU2hlZXRzLCB3aGljaCBjYW4gdHJpZ2dlcgorICAgICAgICB1bmV4cGVjdGVkIGxheW91
dCB1cGRhdGUuCisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAg
ICAgTm8gbmV3IHRlc3RzLiBObyBjaGFuZ2UgaW4gYmVoYXZpb3IuCisKKyAgICAgICAgKiByZW5k
ZXJpbmcvUmVuZGVyVGV4dENvbnRyb2xTaW5nbGVMaW5lLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6
OlJlbmRlclRleHRDb250cm9sU2luZ2xlTGluZTo6c2Nyb2xsV2lkdGgpOgorICAgICAgICAoV2Vi
Q29yZTo6UmVuZGVyVGV4dENvbnRyb2xTaW5nbGVMaW5lOjpzY3JvbGxIZWlnaHQpOgorICAgICAg
ICAoV2ViQ29yZTo6UmVuZGVyVGV4dENvbnRyb2xTaW5nbGVMaW5lOjpzY3JvbGxMZWZ0KToKKyAg
ICAgICAgKFdlYkNvcmU6OlJlbmRlclRleHRDb250cm9sU2luZ2xlTGluZTo6c2Nyb2xsVG9wKToK
KwogMjAxMi0wNC0wOSAgVGltIEhvcnRvbiAgPHRpbW90aHlfaG9ydG9uQGFwcGxlLmNvbT4KIAog
ICAgICAgICBGcmFtZURhdGEgY29uc3RydWN0b3IgemVyb2VzIGFsbCBmaWVsZHMsIGNhdXNpbmcg
SW1hZ2VPcmllbnRhdGlvbiB0byBiZSAwCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9yZW5k
ZXJpbmcvUmVuZGVyVGV4dENvbnRyb2xTaW5nbGVMaW5lLmNwcCBiL1NvdXJjZS9XZWJDb3JlL3Jl
bmRlcmluZy9SZW5kZXJUZXh0Q29udHJvbFNpbmdsZUxpbmUuY3BwCmluZGV4IDIyYmQ2M2RkZDk1
NGRmZjkyYWNmYzhlMmY4ZTI2M2Q3MDcwZDI0ZTkuLmEyYzk4OGVjMGM3NDdhOTc2MDRjMjU1NGYw
MDQwOTEwMjM5ZmQ2NTUgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL3JlbmRlcmluZy9SZW5k
ZXJUZXh0Q29udHJvbFNpbmdsZUxpbmUuY3BwCisrKyBiL1NvdXJjZS9XZWJDb3JlL3JlbmRlcmlu
Zy9SZW5kZXJUZXh0Q29udHJvbFNpbmdsZUxpbmUuY3BwCkBAIC02OTEsNDIgKzY5MSw1NCBAQCB2
b2lkIFJlbmRlclRleHRDb250cm9sU2luZ2xlTGluZTo6YXV0b3Njcm9sbCgpCiAKIGludCBSZW5k
ZXJUZXh0Q29udHJvbFNpbmdsZUxpbmU6OnNjcm9sbFdpZHRoKCkgY29uc3QKIHsKLSAgICBpZiAo
aW5uZXJUZXh0RWxlbWVudCgpKQotICAgICAgICByZXR1cm4gaW5uZXJUZXh0RWxlbWVudCgpLT5z
Y3JvbGxXaWR0aCgpOworICAgIGlmIChpbm5lclRleHRFbGVtZW50KCkgJiYgaW5uZXJUZXh0RWxl
bWVudCgpLT5yZW5kZXJCb3goKSkgeworICAgICAgICBSZW5kZXJCb3gqIGJveCA9IGlubmVyVGV4
dEVsZW1lbnQoKS0+cmVuZGVyQm94KCk7CisgICAgICAgIHJldHVybiBhZGp1c3RGb3JBYnNvbHV0
ZVpvb20oYm94LT5zY3JvbGxXaWR0aCgpLCBib3gpOworICAgIH0KICAgICByZXR1cm4gUmVuZGVy
QmxvY2s6OnNjcm9sbFdpZHRoKCk7CiB9CiAKIGludCBSZW5kZXJUZXh0Q29udHJvbFNpbmdsZUxp
bmU6OnNjcm9sbEhlaWdodCgpIGNvbnN0CiB7Ci0gICAgaWYgKGlubmVyVGV4dEVsZW1lbnQoKSkK
LSAgICAgICAgcmV0dXJuIGlubmVyVGV4dEVsZW1lbnQoKS0+c2Nyb2xsSGVpZ2h0KCk7CisgICAg
aWYgKGlubmVyVGV4dEVsZW1lbnQoKSAmJiBpbm5lclRleHRFbGVtZW50KCktPnJlbmRlckJveCgp
KSB7CisgICAgICAgIFJlbmRlckJveCogYm94ID0gaW5uZXJUZXh0RWxlbWVudCgpLT5yZW5kZXJC
b3goKTsKKyAgICAgICAgcmV0dXJuIGFkanVzdEZvckFic29sdXRlWm9vbShib3gtPnNjcm9sbEhl
aWdodCgpLCBib3gpOworICAgIH0KICAgICByZXR1cm4gUmVuZGVyQmxvY2s6OnNjcm9sbEhlaWdo
dCgpOwogfQogCiBpbnQgUmVuZGVyVGV4dENvbnRyb2xTaW5nbGVMaW5lOjpzY3JvbGxMZWZ0KCkg
Y29uc3QKIHsKLSAgICBpZiAoaW5uZXJUZXh0RWxlbWVudCgpKQotICAgICAgICByZXR1cm4gaW5u
ZXJUZXh0RWxlbWVudCgpLT5zY3JvbGxMZWZ0KCk7CisgICAgaWYgKGlubmVyVGV4dEVsZW1lbnQo
KSAmJiBpbm5lclRleHRFbGVtZW50KCktPnJlbmRlckJveCgpKSB7CisgICAgICAgIFJlbmRlckJv
eCogYm94ID0gaW5uZXJUZXh0RWxlbWVudCgpLT5yZW5kZXJCb3goKTsKKyAgICAgICAgcmV0dXJu
IGFkanVzdEZvckFic29sdXRlWm9vbShib3gtPnNjcm9sbExlZnQoKSwgYm94KTsKKyAgICB9CiAg
ICAgcmV0dXJuIFJlbmRlckJsb2NrOjpzY3JvbGxMZWZ0KCk7CiB9CiAKIGludCBSZW5kZXJUZXh0
Q29udHJvbFNpbmdsZUxpbmU6OnNjcm9sbFRvcCgpIGNvbnN0CiB7Ci0gICAgaWYgKGlubmVyVGV4
dEVsZW1lbnQoKSkKLSAgICAgICAgcmV0dXJuIGlubmVyVGV4dEVsZW1lbnQoKS0+c2Nyb2xsVG9w
KCk7CisgICAgaWYgKGlubmVyVGV4dEVsZW1lbnQoKSAmJiBpbm5lclRleHRFbGVtZW50KCktPnJl
bmRlckJveCgpKSB7CisgICAgICAgIFJlbmRlckJveCogYm94ID0gaW5uZXJUZXh0RWxlbWVudCgp
LT5yZW5kZXJCb3goKTsKKyAgICAgICAgcmV0dXJuIGFkanVzdEZvckFic29sdXRlWm9vbShib3gt
PnNjcm9sbFRvcCgpLCBib3gpOworICAgIH0KICAgICByZXR1cm4gUmVuZGVyQmxvY2s6OnNjcm9s
bFRvcCgpOwogfQogCiB2b2lkIFJlbmRlclRleHRDb250cm9sU2luZ2xlTGluZTo6c2V0U2Nyb2xs
TGVmdChpbnQgbmV3TGVmdCkKIHsKLSAgICBpZiAoaW5uZXJUZXh0RWxlbWVudCgpKQotICAgICAg
ICBpbm5lclRleHRFbGVtZW50KCktPnNldFNjcm9sbExlZnQobmV3TGVmdCk7CisgICAgaWYgKGlu
bmVyVGV4dEVsZW1lbnQoKSAmJiBpbm5lclRleHRFbGVtZW50KCktPnJlbmRlckJveCgpKSB7Cisg
ICAgICAgIFJlbmRlckJveCogYm94ID0gaW5uZXJUZXh0RWxlbWVudCgpLT5yZW5kZXJCb3goKTsK
KyAgICAgICAgYm94LT5zZXRTY3JvbGxMZWZ0KHN0YXRpY19jYXN0PGludD4obmV3TGVmdCAqIGJv
eC0+c3R5bGUoKS0+ZWZmZWN0aXZlWm9vbSgpKSk7CisgICAgfQogfQogCiB2b2lkIFJlbmRlclRl
eHRDb250cm9sU2luZ2xlTGluZTo6c2V0U2Nyb2xsVG9wKGludCBuZXdUb3ApCiB7Ci0gICAgaWYg
KGlubmVyVGV4dEVsZW1lbnQoKSkKLSAgICAgICAgaW5uZXJUZXh0RWxlbWVudCgpLT5zZXRTY3Jv
bGxUb3AobmV3VG9wKTsKKyAgICBpZiAoaW5uZXJUZXh0RWxlbWVudCgpICYmIGlubmVyVGV4dEVs
ZW1lbnQoKS0+cmVuZGVyQm94KCkpIHsKKyAgICAgICAgUmVuZGVyQm94KiBib3ggPSBpbm5lclRl
eHRFbGVtZW50KCktPnJlbmRlckJveCgpOworICAgICAgICBib3gtPnNldFNjcm9sbFRvcChzdGF0
aWNfY2FzdDxpbnQ+KG5ld1RvcCAqIGJveC0+c3R5bGUoKS0+ZWZmZWN0aXZlWm9vbSgpKSk7Cisg
ICAgfQogfQogCiBib29sIFJlbmRlclRleHRDb250cm9sU2luZ2xlTGluZTo6c2Nyb2xsKFNjcm9s
bERpcmVjdGlvbiBkaXJlY3Rpb24sIFNjcm9sbEdyYW51bGFyaXR5IGdyYW51bGFyaXR5LCBmbG9h
dCBtdWx0aXBsaWVyLCBOb2RlKiogc3RvcE5vZGUpCg==
</data>
<flag name="review"
          id="142482"
          type_id="1"
          status="-"
          setter="rniwa"
    />
          </attachment>
      

    </bug>

</bugzilla>