<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>85912</bug_id>
          
          <creation_ts>2012-05-08 14:10:19 -0700</creation_ts>
          <short_desc>Crash in computedCSSPadding* functions due to RenderImage::imageDimensionsChanged called during attachment</short_desc>
          <delta_ts>2012-05-24 00:57:20 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>Layout and Rendering</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>All</rep_platform>
          <op_sys>All</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>InRadar</keywords>
          <priority>P1</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Julien Chaffraix">jchaffraix</reporter>
          <assigned_to name="Julien Chaffraix">jchaffraix</assigned_to>
          <cc>eric</cc>
    
    <cc>thorton</cc>
    
    <cc>webkit-bug-importer</cc>
    
    <cc>webkit.review.bot</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>618787</commentid>
    <comment_count>0</comment_count>
      <attachid>140779</attachid>
    <who name="Julien Chaffraix">jchaffraix</who>
    <bug_when>2012-05-08 14:10:19 -0700</bug_when>
    <thetext>Created attachment 140779
Reproduction

Example stacktrace:

0:000&gt; kp
ChildEBP RetAddr  
0012ed7c 0311270d chrome_1c30000!WebCore::RenderBoxModelObject::computedCSSPaddingBottom(void)+0x5b [c:\b\build\slave\win\build\src\third_party\webkit\source\webcore\rendering\renderboxmodelobject.cpp @ 633]
0012ed8c 0310278c chrome_1c30000!WebCore::RenderBoxModelObject::paddingBottom(void)+0xd [c:\b\build\slave\win\build\src\third_party\webkit\source\webcore\rendering\renderboxmodelobject.h @ 102]
0012edcc 03355ae7 chrome_1c30000!WebCore::RenderBox::contentBoxRect(void)+0x3c [c:\b\build\slave\win\build\src\third_party\webkit\source\webcore\rendering\renderbox.h @ 138]
0012ee6c 03355c9a chrome_1c30000!WebCore::RenderImage::imageDimensionsChanged(bool imageSizeChanged = false, class WebCore::IntRect * rect = 0x00000000)+0x1a7 [c:\b\build\slave\win\build\src\third_party\webkit\source\webcore\rendering\renderimage.cpp @ 225]
0012ee90 03425a00 chrome_1c30000!WebCore::RenderImage::imageChanged(void * newImage = 0x01a71700, class WebCore::IntRect * rect = 0x00000000)+0x12a [c:\b\build\slave\win\build\src\third_party\webkit\source\webcore\rendering\renderimage.cpp @ 176]
0012eeb0 033df56e chrome_1c30000!WebCore::CachedImage::didAddClient(class WebCore::CachedResourceClient * c = 0x01a3411c)+0xa0 [c:\b\build\slave\win\build\src\third_party\webkit\source\webcore\loader\cache\cachedimage.cpp @ 117]
0012eec4 033423f2 chrome_1c30000!WebCore::CachedResource::addClient(class WebCore::CachedResourceClient * client = 0x01a3411c)+0x1e [c:\b\build\slave\win\build\src\third_party\webkit\source\webcore\loader\cache\cachedresource.cpp @ 381]
0012eed4 0335481d chrome_1c30000!WebCore::RenderImageResourceStyleImage::initialize(class WebCore::RenderObject * renderer = 0x01a3411c)+0x32 [c:\b\build\slave\win\build\src\third_party\webkit\source\webcore\rendering\renderimageresourcestyleimage.cpp @ 53]
0012eee4 032da771 chrome_1c30000!WebCore::RenderImage::setImageResource(class WTF::PassOwnPtr&lt;WebCore::RenderImageResource&gt; imageResource = class WTF::PassOwnPtr&lt;WebCore::RenderImageResource&gt;)+0x2d [c:\b\build\slave\win\build\src\third_party\webkit\source\webcore\rendering\renderimage.cpp @ 74]
0012eefc 036d4a27 chrome_1c30000!WebCore::RenderObject::createObject(class WebCore::Node * node = 0x01284200, class WebCore::RenderStyle * style = 0x01b4d010)+0x91 [c:\b\build\slave\win\build\src\third_party\webkit\source\webcore\rendering\renderobject.cpp @ 135]
0012ef10 037c3132 chrome_1c30000!WebCore::HTMLElement::createRenderer(class WebCore::RenderArena * arena = 0x019fd380, class WebCore::RenderStyle * style = 0x01b4e000)+0x47 [c:\b\build\slave\win\build\src\third_party\webkit\source\webcore\html\htmlelement.cpp @ 781]
0012ef28 037c329d chrome_1c30000!WebCore::NodeRendererFactory::createRenderer(void)+0x22 [c:\b\build\slave\win\build\src\third_party\webkit\source\webcore\dom\noderenderingcontext.cpp @ 351]
0012ef44 03788396 chrome_1c30000!WebCore::NodeRendererFactory::createRendererIfNeeded(void)+0xfd [c:\b\build\slave\win\build\src\third_party\webkit\source\webcore\dom\noderenderingcontext.cpp @ 400]
0012ef6c 03791506 chrome_1c30000!WebCore::Node::createRendererIfNeeded(void)+0x16 [c:\b\build\slave\win\build\src\third_party\webkit\source\webcore\dom\node.cpp @ 1427]
0012ef7c 03739036 chrome_1c30000!WebCore::Element::attach(void)+0x16 [c:\b\build\slave\win\build\src\third_party\webkit\source\webcore\dom\element.cpp @ 977]
0012ef80 03739b80 chrome_1c30000!WebCore::executeTask(struct WebCore::HTMLConstructionSiteTask * task = 0x01a3411c)+0x66 [c:\b\build\slave\win\build\src\third_party\webkit\source\webcore\html\parser\htmlconstructionsite.cpp @ 103]
0012efb4 0372f5f2 chrome_1c30000!WebCore::HTMLConstructionSite::executeQueuedTasks(void)+0x60 [c:\b\build\slave\win\build\src\third_party\webkit\source\webcore\html\parser\htmlconstructionsite.cpp @ 140]
0012efc4 0372f820 chrome_1c30000!WebCore::HTMLTreeBuilder::constructTreeFromAtomicToken(class WebCore::AtomicHTMLToken * token = 0x0012efd8)+0xb2 [c:\b\build\slave\win\build\src\third_party\webkit\source\webcore\html\parser\htmltreebuilder.cpp @ 482]
0012effc 03710c49 chrome_1c30000!WebCore::HTMLTreeBuilder::constructTreeFromToken(class WebCore::HTMLToken * rawToken = 0x019e805c)+0x30 [c:\b\build\slave\win\build\src\third_party\webkit\source\webcore\html\parser\htmltreebuilder.cpp @ 461]
0012f03c 03710fc9 chrome_1c30000!WebCore::HTMLDocumentParser::pumpTokenizer(WebCore::HTMLDocumentParser::SynchronousMode mode = AllowYield (0))+0x119 [c:\b\build\slave\win\build\src\third_party\webkit\source\webcore\html\parser\htmldocumentparser.cpp @ 278]

It looks like the code already knows about the issue as we NULL-check for containingBlock() in RenderImage::imageDimensionsChanged.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>618808</commentid>
    <comment_count>1</comment_count>
      <attachid>140785</attachid>
    <who name="Julien Chaffraix">jchaffraix</who>
    <bug_when>2012-05-08 14:29:00 -0700</bug_when>
    <thetext>Created attachment 140785
Proposed fix: bail out as that&apos;s what we were already doing (but forgot the repainting logic).</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>618864</commentid>
    <comment_count>2</comment_count>
      <attachid>140785</attachid>
    <who name="Eric Seidel (no email)">eric</who>
    <bug_when>2012-05-08 15:23:08 -0700</bug_when>
    <thetext>Comment on attachment 140785
Proposed fix: bail out as that&apos;s what we were already doing (but forgot the repainting logic).

View in context: https://bugs.webkit.org/attachment.cgi?id=140785&amp;action=review

&gt; Source/WebCore/rendering/RenderImage.cpp:197
&gt; +    if (!containingBlock())

Why is it safe to leave this w/o setting setNeedsLayout(false)?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>618997</commentid>
    <comment_count>3</comment_count>
      <attachid>140785</attachid>
    <who name="Julien Chaffraix">jchaffraix</who>
    <bug_when>2012-05-08 17:21:59 -0700</bug_when>
    <thetext>Comment on attachment 140785
Proposed fix: bail out as that&apos;s what we were already doing (but forgot the repainting logic).

View in context: https://bugs.webkit.org/attachment.cgi?id=140785&amp;action=review

&gt;&gt; Source/WebCore/rendering/RenderImage.cpp:197
&gt;&gt; +    if (!containingBlock())
&gt; 
&gt; Why is it safe to leave this w/o setting setNeedsLayout(false)?

I assume you mean setNeedsLayout(true) here as there is no requirement for imageDimensionsChanged to call setNeedsLayout(false).

If you don&apos;t have a containingBlock() that means you are unrooted. The addChild machinery will take care of setting the needs layout bits later so we don&apos;t need to do that now.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>619016</commentid>
    <comment_count>4</comment_count>
      <attachid>140785</attachid>
    <who name="Eric Seidel (no email)">eric</who>
    <bug_when>2012-05-08 17:41:25 -0700</bug_when>
    <thetext>Comment on attachment 140785
Proposed fix: bail out as that&apos;s what we were already doing (but forgot the repainting logic).

View in context: https://bugs.webkit.org/attachment.cgi?id=140785&amp;action=review

&gt;&gt;&gt; Source/WebCore/rendering/RenderImage.cpp:197
&gt;&gt;&gt; +    if (!containingBlock())
&gt;&gt; 
&gt;&gt; Why is it safe to leave this w/o setting setNeedsLayout(false)?
&gt; 
&gt; I assume you mean setNeedsLayout(true) here as there is no requirement for imageDimensionsChanged to call setNeedsLayout(false).
&gt; 
&gt; If you don&apos;t have a containingBlock() that means you are unrooted. The addChild machinery will take care of setting the needs layout bits later so we don&apos;t need to do that now.

No, I was confused and thought I was reading a layout() method, since you&apos;re calling computedLogicalWidth/ehgith below, which are layout() subroutines. :)

&gt; Source/WebCore/rendering/RenderImage.cpp:208
&gt; +        // lets see if we need to relayout at all..
&gt; +        int oldwidth = width();
&gt; +        int oldheight = height();
&gt; +        if (!preferredLogicalWidthsDirty())
&gt; +            setPreferredLogicalWidthsDirty(true);
&gt; +        computeLogicalWidth();
&gt; +        computeLogicalHeight();

This feels really odd to do outside of layout.  I guess this is trying to avoid crawling the whole tree to layout this one image.  I really have trouble imagining that this is saving us time, since doesn&apos;t calling setPreferredLogicalWidthsDirty walk up the tree anyway?
    void setPreferredLogicalWidthsDirty(bool, MarkingBehavior = MarkContainingBlockChain);

So this is going to end up causing a layout regardless, no?  Or at least a pre-widths calc?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>619597</commentid>
    <comment_count>5</comment_count>
      <attachid>140785</attachid>
    <who name="Julien Chaffraix">jchaffraix</who>
    <bug_when>2012-05-09 09:57:32 -0700</bug_when>
    <thetext>Comment on attachment 140785
Proposed fix: bail out as that&apos;s what we were already doing (but forgot the repainting logic).

View in context: https://bugs.webkit.org/attachment.cgi?id=140785&amp;action=review

&gt;&gt; Source/WebCore/rendering/RenderImage.cpp:208
&gt;&gt; +        computeLogicalHeight();
&gt; 
&gt; This feels really odd to do outside of layout.  I guess this is trying to avoid crawling the whole tree to layout this one image.  I really have trouble imagining that this is saving us time, since doesn&apos;t calling setPreferredLogicalWidthsDirty walk up the tree anyway?
&gt;     void setPreferredLogicalWidthsDirty(bool, MarkingBehavior = MarkContainingBlockChain);
&gt; 
&gt; So this is going to end up causing a layout regardless, no?  Or at least a pre-widths calc?

I think this code is fine, though a bit twisted.

As we have changed our preferred logical size, we need to mark our ancestors as needing preferred logical widths recalculation. setPreferredLogicalWidthsDirty(true) doesn&apos;t trigger a relayout though and we only for a layout if we have actually changed our size below. Those checks are saving us a full layout if we end up not changing our logical width or height.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>620995</commentid>
    <comment_count>6</comment_count>
      <attachid>140785</attachid>
    <who name="Eric Seidel (no email)">eric</who>
    <bug_when>2012-05-10 14:36:14 -0700</bug_when>
    <thetext>Comment on attachment 140785
Proposed fix: bail out as that&apos;s what we were already doing (but forgot the repainting logic).

OK.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>621003</commentid>
    <comment_count>7</comment_count>
    <who name="Julien Chaffraix">jchaffraix</who>
    <bug_when>2012-05-10 14:40:01 -0700</bug_when>
    <thetext>Thanks Eric!</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>621041</commentid>
    <comment_count>8</comment_count>
      <attachid>140785</attachid>
    <who name="WebKit Review Bot">webkit.review.bot</who>
    <bug_when>2012-05-10 15:07:47 -0700</bug_when>
    <thetext>Comment on attachment 140785
Proposed fix: bail out as that&apos;s what we were already doing (but forgot the repainting logic).

Clearing flags on attachment: 140785

Committed r116693: &lt;http://trac.webkit.org/changeset/116693&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>621042</commentid>
    <comment_count>9</comment_count>
    <who name="WebKit Review Bot">webkit.review.bot</who>
    <bug_when>2012-05-10 15:07:56 -0700</bug_when>
    <thetext>All reviewed patches have been landed.  Closing bug.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>632491</commentid>
    <comment_count>10</comment_count>
    <who name="Radar WebKit Bug Importer">webkit-bug-importer</who>
    <bug_when>2012-05-24 00:57:20 -0700</bug_when>
    <thetext>&lt;rdar://problem/11522851&gt;</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="0"
              isprivate="0"
          >
            <attachid>140779</attachid>
            <date>2012-05-08 14:10:19 -0700</date>
            <delta_ts>2012-05-08 14:10:19 -0700</delta_ts>
            <desc>Reproduction</desc>
            <filename>link-body-content-imageDimensionChanged-crash.html</filename>
            <type>text/html</type>
            <size>528</size>
            <attacher name="Julien Chaffraix">jchaffraix</attacher>
            
              <data encoding="base64">PCFET0NUWVBFIGh0bWw+CjxodG1sPgo8aGVhZD4KPHN0eWxlPgpkaXYgewogICAgY29udGVudDog
dXJsKCJkYXRhOmltYWdlL3BuZztiYXNlNjQsaVZCT1J3MEtHZ29BQUFBTlNVaEVVZ0FBQUE4QUFB
QVBBUU1BQUFBQkdBY0pBQUFBQTFCTVZFVUFnQUNjK2FXUkFBQUFERWxFUVZSNDJtTmdJQUVBQUFB
dEFBSDdLaE1xQUFBQUFFbEZUa1N1UW1DQyIpOwogICAgcGFkZGluZy1ib3R0b206IDEwNTgxJTsK
fQogPC9zdHlsZT4KPHNjcmlwdD4KaWYgKHdpbmRvdy5sYXlvdXRUZXN0Q29udHJvbGxlcikKICAg
IGxheW91dFRlc3RDb250cm9sbGVyLmR1bXBBc1RleHQoKTsKPC9zY3JpcHQ+CjwvaGVhZD4KPHA+
IEJ1ZyBYWFggPC9wPgo8cD4gVGhpcyB0ZXN0IFBBU1NFRCBpZiBpdCBkaWQgbm90IGNyYXNoLiA8
L3A+CjxkaXY+CiAgICA8bGluayBocmVmPSJpbmV4aXN0YW50LmNzcyIgcmVsPXN0eWxlc2hlZXQ+
CiAgICA8Ym9keSBzdHlsZT0nY29udGVudDogIlBBU1NFRCwgbm8gY3Jhc2giOyAnPjwvYm9keT4K
PC9kaXY+CjwvaHRtbD4K
</data>

          </attachment>
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>140785</attachid>
            <date>2012-05-08 14:29:00 -0700</date>
            <delta_ts>2012-05-10 15:07:46 -0700</delta_ts>
            <desc>Proposed fix: bail out as that&apos;s what we were already doing (but forgot the repainting logic).</desc>
            <filename>bug-85912-20120508142859.patch</filename>
            <type>text/plain</type>
            <size>8382</size>
            <attacher name="Julien Chaffraix">jchaffraix</attacher>
            
              <data encoding="base64">U3VidmVyc2lvbiBSZXZpc2lvbjogMTE2Mzc0CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D
aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggZDdiOTFjZDU3ZjY1NWJm
Y2JjYTllOGI2YzE0YzFkYTM2NmU1Y2VkZi4uNTFhNmNiMTgyNmFlZTZiYzIwYjU0YzczY2QwNzhi
NzZjOWU4YWE0YyAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv
dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDIzIEBACisyMDEyLTA1LTA4ICBKdWxp
ZW4gQ2hhZmZyYWl4ICA8amNoYWZmcmFpeEB3ZWJraXQub3JnPgorCisgICAgICAgIENyYXNoIGlu
IGNvbXB1dGVkQ1NTUGFkZGluZyogZnVuY3Rpb25zIGR1ZSB0byBSZW5kZXJJbWFnZTo6aW1hZ2VE
aW1lbnNpb25zQ2hhbmdlZCBjYWxsZWQgZHVyaW5nIGF0dGFjaG1lbnQKKyAgICAgICAgaHR0cHM6
Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTg1OTEyCisKKyAgICAgICAgUmV2aWV3
ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgVGVzdHM6IGZhc3QvaW1hZ2VzL2xpbmst
Ym9keS1jb250ZW50LWltYWdlRGltZW5zaW9uQ2hhbmdlZC1jcmFzaC5odG1sCisgICAgICAgICAg
ICAgICBmYXN0L2ltYWdlcy9zY3JpcHQtY291bnRlci1pbWFnZURpbWVuc2lvbkNoYW5nZWQtY3Jh
c2guaHRtbAorCisgICAgICAgIFRoZSBidWcgY29tZXMgZnJvbSBDU1MgZ2VuZXJhdGVkIGltYWdl
cyB0aGF0IGNvdWxkIGVuZCB1cCBjYWxsaW5nIGltYWdlRGltZW5zaW9uc0NoYW5nZWQgZHVyaW5n
IGF0dGFjaG1lbnQuIEFzIHRoZQorICAgICAgICByZXN0IG9mIHRoZSBjb2RlIChlLmcuIGNvbXB1
dGVkQ1NTUGFkZGluZyopIHdvdWxkIGFzc3VtZXMgdGhhdCB3ZSBhcmUgYWxyZWFkeSBpbnNlcnRl
ZCBpbiB0aGUgdHJlZSwgd2Ugd291bGQgY3Jhc2guCisKKyAgICAgICAgVGhlIHNvbHV0aW9uIGlz
IHRvIGJhaWwgb3V0IGluIHRoaXMgY2FzZSBhcyBuZXdseSBpbnNlcnRlZCBSZW5kZXJPYmplY3Qg
d2lsbCB0cmlnZ2VyIGxheW91dCBsYXRlciBvbiBhbmQgcHJvcGVybHkKKyAgICAgICAgaGFuZGxl
IHdoYXQgd2Ugd291bGQgYmUgZG9pbmcgYXMgcGFydCBvZiBpbWFnZURpbWVuc2lvbkNoYW5nZWQg
KHRoZSBvbmx5IGV4Y2VwdGlvbiBiZWluZyB1cGRhdGluZyBvdXIgaW50cmluc2ljCisgICAgICAg
IHNpemUgd2hpY2ggc2hvdWxkIGJlIGRvbmUgYXMgcGFydCBvZiBpbWFnZURpbWVuc2lvbnNDaGFu
Z2VkKS4KKworICAgICAgICAqIHJlbmRlcmluZy9SZW5kZXJJbWFnZS5jcHA6CisgICAgICAgIChX
ZWJDb3JlOjpSZW5kZXJJbWFnZTo6aW1hZ2VEaW1lbnNpb25zQ2hhbmdlZCk6CisKIDIwMTItMDUt
MDQgIFpoZW55YW8gTW8gIDx6bW9AZ29vZ2xlLmNvbT4KIAogICAgICAgICB2ZXJ0ZXhBdHRyaWJQ
b2ludGVyIG5lZWRzIHRvIHJlamVjdCBsYXJnZSBuZWdhdGl2ZSBvZmZzZXRzCmRpZmYgLS1naXQg
YS9Tb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVySW1hZ2UuY3BwIGIvU291cmNlL1dlYkNv
cmUvcmVuZGVyaW5nL1JlbmRlckltYWdlLmNwcAppbmRleCAzNWNhYWZmMjljNGFhNmI0YzgyOWY0
OTI4YjM5NmUzYzE4ZWIxYjgzLi4wOWQ0ZTBkMzEyYTdhNWMzOTUyYTRhY2UyMzNiYTQ0MmZmNzcw
ZjE5IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVySW1hZ2UuY3Bw
CisrKyBiL1NvdXJjZS9XZWJDb3JlL3JlbmRlcmluZy9SZW5kZXJJbWFnZS5jcHAKQEAgLTE4OCwy
OSArMTg4LDMzIEBAIGJvb2wgUmVuZGVySW1hZ2U6OnVwZGF0ZUludHJpbnNpY1NpemVJZk5lZWRl
ZChjb25zdCBJbnRTaXplJiBuZXdTaXplLCBib29sIGltYWdlCiAKIHZvaWQgUmVuZGVySW1hZ2U6
OmltYWdlRGltZW5zaW9uc0NoYW5nZWQoYm9vbCBpbWFnZVNpemVDaGFuZ2VkLCBjb25zdCBJbnRS
ZWN0KiByZWN0KQogewotICAgIGJvb2wgc2hvdWxkUmVwYWludCA9IHRydWU7Ci0gICAgaWYgKHVw
ZGF0ZUludHJpbnNpY1NpemVJZk5lZWRlZChtX2ltYWdlUmVzb3VyY2UtPmltYWdlU2l6ZShzdHls
ZSgpLT5lZmZlY3RpdmVab29tKCkpLCBpbWFnZVNpemVDaGFuZ2VkKSkgewotICAgICAgICAvLyBJ
biB0aGUgY2FzZSBvZiBnZW5lcmF0ZWQgaW1hZ2UgY29udGVudCB1c2luZyA6YmVmb3JlLzphZnRl
ciwgd2UgbWlnaHQgbm90IGJlIGluIHRoZQotICAgICAgICAvLyByZW5kZXIgdHJlZSB5ZXQuICBJ
biB0aGF0IGNhc2UsIHdlIGRvbid0IG5lZWQgdG8gd29ycnkgYWJvdXQgY2hlY2sgZm9yIGxheW91
dCwgc2luY2Ugd2UnbGwgZ2V0IGEKLSAgICAgICAgLy8gbGF5b3V0IHdoZW4gd2UgZ2V0IGFkZGVk
IGluIHRvIHRoZSByZW5kZXIgdHJlZSBoaWVyYXJjaHkgbGF0ZXIuCi0gICAgICAgIGlmIChjb250
YWluaW5nQmxvY2soKSkgewotICAgICAgICAgICAgLy8gbGV0cyBzZWUgaWYgd2UgbmVlZCB0byBy
ZWxheW91dCBhdCBhbGwuLgotICAgICAgICAgICAgaW50IG9sZHdpZHRoID0gd2lkdGgoKTsKLSAg
ICAgICAgICAgIGludCBvbGRoZWlnaHQgPSBoZWlnaHQoKTsKLSAgICAgICAgICAgIGlmICghcHJl
ZmVycmVkTG9naWNhbFdpZHRoc0RpcnR5KCkpCi0gICAgICAgICAgICAgICAgc2V0UHJlZmVycmVk
TG9naWNhbFdpZHRoc0RpcnR5KHRydWUpOwotICAgICAgICAgICAgY29tcHV0ZUxvZ2ljYWxXaWR0
aCgpOwotICAgICAgICAgICAgY29tcHV0ZUxvZ2ljYWxIZWlnaHQoKTsKLQotICAgICAgICAgICAg
aWYgKGltYWdlU2l6ZUNoYW5nZWQgfHwgd2lkdGgoKSAhPSBvbGR3aWR0aCB8fCBoZWlnaHQoKSAh
PSBvbGRoZWlnaHQpIHsKLSAgICAgICAgICAgICAgICBzaG91bGRSZXBhaW50ID0gZmFsc2U7Ci0g
ICAgICAgICAgICAgICAgaWYgKCFzZWxmTmVlZHNMYXlvdXQoKSkKLSAgICAgICAgICAgICAgICAg
ICAgc2V0TmVlZHNMYXlvdXQodHJ1ZSk7Ci0gICAgICAgICAgICB9CisgICAgYm9vbCBpbnRyaW5z
aWNTaXplQ2hhbmdlZCA9IHVwZGF0ZUludHJpbnNpY1NpemVJZk5lZWRlZChtX2ltYWdlUmVzb3Vy
Y2UtPmltYWdlU2l6ZShzdHlsZSgpLT5lZmZlY3RpdmVab29tKCkpLCBpbWFnZVNpemVDaGFuZ2Vk
KTsKKworICAgIC8vIEluIHRoZSBjYXNlIG9mIGdlbmVyYXRlZCBpbWFnZSBjb250ZW50IHVzaW5n
IDpiZWZvcmUvOmFmdGVyL2NvbnRlbnQsIHdlIG1pZ2h0IG5vdCBiZQorICAgIC8vIGluIHRoZSBy
ZW5kZXIgdHJlZSB5ZXQuIEluIHRoYXQgY2FzZSwgd2UganVzdCBuZWVkIHRvIHVwZGF0ZSBvdXIg
aW50cmluc2ljIHNpemUuCisgICAgLy8gbGF5b3V0KCkgd2lsbCBiZSBjYWxsZWQgYWZ0ZXIgd2Ug
YXJlIGluc2VydGVkIGluIHRoZSB0cmVlIHdoaWNoIHdpbGwgdGFrZSBjYXJlIG9mCisgICAgLy8g
d2hhdCB3ZSBhcmUgZG9pbmcgaGVyZS4KKyAgICBpZiAoIWNvbnRhaW5pbmdCbG9jaygpKQorICAg
ICAgICByZXR1cm47CiAKLSAgICAgICAgICAgIHNldFdpZHRoKG9sZHdpZHRoKTsKLSAgICAgICAg
ICAgIHNldEhlaWdodChvbGRoZWlnaHQpOworICAgIGJvb2wgc2hvdWxkUmVwYWludCA9IHRydWU7
CisgICAgaWYgKGludHJpbnNpY1NpemVDaGFuZ2VkKSB7CisgICAgICAgIC8vIGxldHMgc2VlIGlm
IHdlIG5lZWQgdG8gcmVsYXlvdXQgYXQgYWxsLi4KKyAgICAgICAgaW50IG9sZHdpZHRoID0gd2lk
dGgoKTsKKyAgICAgICAgaW50IG9sZGhlaWdodCA9IGhlaWdodCgpOworICAgICAgICBpZiAoIXBy
ZWZlcnJlZExvZ2ljYWxXaWR0aHNEaXJ0eSgpKQorICAgICAgICAgICAgc2V0UHJlZmVycmVkTG9n
aWNhbFdpZHRoc0RpcnR5KHRydWUpOworICAgICAgICBjb21wdXRlTG9naWNhbFdpZHRoKCk7Cisg
ICAgICAgIGNvbXB1dGVMb2dpY2FsSGVpZ2h0KCk7CisKKyAgICAgICAgaWYgKGltYWdlU2l6ZUNo
YW5nZWQgfHwgd2lkdGgoKSAhPSBvbGR3aWR0aCB8fCBoZWlnaHQoKSAhPSBvbGRoZWlnaHQpIHsK
KyAgICAgICAgICAgIHNob3VsZFJlcGFpbnQgPSBmYWxzZTsKKyAgICAgICAgICAgIGlmICghc2Vs
Zk5lZWRzTGF5b3V0KCkpCisgICAgICAgICAgICAgICAgc2V0TmVlZHNMYXlvdXQodHJ1ZSk7CiAg
ICAgICAgIH0KKworICAgICAgICBzZXRXaWR0aChvbGR3aWR0aCk7CisgICAgICAgIHNldEhlaWdo
dChvbGRoZWlnaHQpOwogICAgIH0KIAogICAgIGlmIChzaG91bGRSZXBhaW50KSB7CmRpZmYgLS1n
aXQgYS9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cgYi9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKaW5kZXgg
ZDBlZjYxYzUzM2FhYjA0NjFlMDI4YzdlZDZjM2I0ZmM2ZDMyZWRkMy4uOGFmMmNjYzc3ODhiNzI2
Y2ExNjBiNmQyYmNiYThlYWVhM2JhNjNmNyAxMDA2NDQKLS0tIGEvTGF5b3V0VGVzdHMvQ2hhbmdl
TG9nCisrKyBiL0xheW91dFRlc3RzL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE1IEBACisyMDEyLTA1
LTA4ICBKdWxpZW4gQ2hhZmZyYWl4ICA8amNoYWZmcmFpeEB3ZWJraXQub3JnPgorCisgICAgICAg
IENyYXNoIGluIGNvbXB1dGVkQ1NTUGFkZGluZyogZnVuY3Rpb25zIGR1ZSB0byBSZW5kZXJJbWFn
ZTo6aW1hZ2VEaW1lbnNpb25zQ2hhbmdlZCBjYWxsZWQgZHVyaW5nIGF0dGFjaG1lbnQKKyAgICAg
ICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTg1OTEyCisKKyAgICAg
ICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgKiBmYXN0L2ltYWdlcy9s
aW5rLWJvZHktY29udGVudC1pbWFnZURpbWVuc2lvbkNoYW5nZWQtY3Jhc2gtZXhwZWN0ZWQudHh0
OiBBZGRlZC4KKyAgICAgICAgKiBmYXN0L2ltYWdlcy9saW5rLWJvZHktY29udGVudC1pbWFnZURp
bWVuc2lvbkNoYW5nZWQtY3Jhc2guaHRtbDogQWRkZWQuCisgICAgICAgICogZmFzdC9pbWFnZXMv
c2NyaXB0LWNvdW50ZXItaW1hZ2VEaW1lbnNpb25DaGFuZ2VkLWNyYXNoLWV4cGVjdGVkLnR4dDog
QWRkZWQuCisgICAgICAgICogZmFzdC9pbWFnZXMvc2NyaXB0LWNvdW50ZXItaW1hZ2VEaW1lbnNp
b25DaGFuZ2VkLWNyYXNoLmh0bWw6IEFkZGVkLgorCiAyMDEyLTA1LTA0ICBaaGVueWFvIE1vICA8
em1vQGdvb2dsZS5jb20+CiAKICAgICAgICAgdmVydGV4QXR0cmliUG9pbnRlciBuZWVkcyB0byBy
ZWplY3QgbGFyZ2UgbmVnYXRpdmUgb2Zmc2V0cwpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvZmFz
dC9pbWFnZXMvbGluay1ib2R5LWNvbnRlbnQtaW1hZ2VEaW1lbnNpb25DaGFuZ2VkLWNyYXNoLWV4
cGVjdGVkLnR4dCBiL0xheW91dFRlc3RzL2Zhc3QvaW1hZ2VzL2xpbmstYm9keS1jb250ZW50LWlt
YWdlRGltZW5zaW9uQ2hhbmdlZC1jcmFzaC1leHBlY3RlZC50eHQKbmV3IGZpbGUgbW9kZSAxMDA2
NDQKaW5kZXggMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMC4uZTY2YmJm
MjQ0OWZjMzI4NDZkZTBjNzk3YjM4MDBiMjQ3OWE3NDQ3NQotLS0gL2Rldi9udWxsCisrKyBiL0xh
eW91dFRlc3RzL2Zhc3QvaW1hZ2VzL2xpbmstYm9keS1jb250ZW50LWltYWdlRGltZW5zaW9uQ2hh
bmdlZC1jcmFzaC1leHBlY3RlZC50eHQKQEAgLTAsMCArMSw1IEBACitCdWcgODU5MTI6IENyYXNo
IGluIGNvbXB1dGVkQ1NTUGFkZGluZyogZnVuY3Rpb25zIGR1ZSB0byBSZW5kZXJJbWFnZTo6aW1h
Z2VEaW1lbnNpb25zQ2hhbmdlZCBjYWxsZWQgZHVyaW5nIGF0dGFjaG1lbnQKKworVGhpcyB0ZXN0
IFBBU1NFRCBpZiBpdCBkaWQgbm90IGNyYXNoLgorCisKZGlmZiAtLWdpdCBhL0xheW91dFRlc3Rz
L2Zhc3QvaW1hZ2VzL2xpbmstYm9keS1jb250ZW50LWltYWdlRGltZW5zaW9uQ2hhbmdlZC1jcmFz
aC5odG1sIGIvTGF5b3V0VGVzdHMvZmFzdC9pbWFnZXMvbGluay1ib2R5LWNvbnRlbnQtaW1hZ2VE
aW1lbnNpb25DaGFuZ2VkLWNyYXNoLmh0bWwKbmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAw
MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMC4uMmNkOTcwMzc2MWQ1ZTg3NGQ3
N2UyN2YyMTY1NmZmY2NiNzlkZjk1OAotLS0gL2Rldi9udWxsCisrKyBiL0xheW91dFRlc3RzL2Zh
c3QvaW1hZ2VzL2xpbmstYm9keS1jb250ZW50LWltYWdlRGltZW5zaW9uQ2hhbmdlZC1jcmFzaC5o
dG1sCkBAIC0wLDAgKzEsMjEgQEAKKzwhRE9DVFlQRSBodG1sPgorPGh0bWw+Cis8aGVhZD4KKzxz
dHlsZT4KK2RpdiB7CisgICAgY29udGVudDogdXJsKCJkYXRhOmltYWdlL3BuZztiYXNlNjQsaVZC
T1J3MEtHZ29BQUFBTlNVaEVVZ0FBQUE4QUFBQVBBUU1BQUFBQkdBY0pBQUFBQTFCTVZFVUFnQUNj
K2FXUkFBQUFERWxFUVZSNDJtTmdJQUVBQUFBdEFBSDdLaE1xQUFBQUFFbEZUa1N1UW1DQyIpOwor
ICAgIHBhZGRpbmctYm90dG9tOiAxMDU4MSU7Cit9CisgPC9zdHlsZT4KKzxzY3JpcHQ+CitpZiAo
d2luZG93LmxheW91dFRlc3RDb250cm9sbGVyKQorICAgIGxheW91dFRlc3RDb250cm9sbGVyLmR1
bXBBc1RleHQoKTsKKzwvc2NyaXB0PgorPC9oZWFkPgorPHA+IEJ1ZyA8YSBocmVmPSJodHRwOi8v
d2Via2l0Lm9yZy9iLzg1OTEyIj44NTkxMjwvYT46IENyYXNoIGluIGNvbXB1dGVkQ1NTUGFkZGlu
ZyogZnVuY3Rpb25zIGR1ZSB0byBSZW5kZXJJbWFnZTo6aW1hZ2VEaW1lbnNpb25zQ2hhbmdlZCBj
YWxsZWQgZHVyaW5nIGF0dGFjaG1lbnQ8L3A+Cis8cD4gVGhpcyB0ZXN0IFBBU1NFRCBpZiBpdCBk
aWQgbm90IGNyYXNoLiA8L3A+Cis8ZGl2PgorICAgIDxsaW5rIGhyZWY9ImluZXhpc3RhbnQuY3Nz
IiByZWw9c3R5bGVzaGVldD4KKyAgICA8Ym9keSBzdHlsZT0nY29udGVudDogIlBBU1NFRCwgbm8g
Y3Jhc2giOyAnPjwvYm9keT4KKzwvZGl2PgorPC9odG1sPgpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVz
dHMvZmFzdC9pbWFnZXMvc2NyaXB0LWNvdW50ZXItaW1hZ2VEaW1lbnNpb25DaGFuZ2VkLWNyYXNo
LWV4cGVjdGVkLnR4dCBiL0xheW91dFRlc3RzL2Zhc3QvaW1hZ2VzL3NjcmlwdC1jb3VudGVyLWlt
YWdlRGltZW5zaW9uQ2hhbmdlZC1jcmFzaC1leHBlY3RlZC50eHQKbmV3IGZpbGUgbW9kZSAxMDA2
NDQKaW5kZXggMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMC4uZTY2YmJm
MjQ0OWZjMzI4NDZkZTBjNzk3YjM4MDBiMjQ3OWE3NDQ3NQotLS0gL2Rldi9udWxsCisrKyBiL0xh
eW91dFRlc3RzL2Zhc3QvaW1hZ2VzL3NjcmlwdC1jb3VudGVyLWltYWdlRGltZW5zaW9uQ2hhbmdl
ZC1jcmFzaC1leHBlY3RlZC50eHQKQEAgLTAsMCArMSw1IEBACitCdWcgODU5MTI6IENyYXNoIGlu
IGNvbXB1dGVkQ1NTUGFkZGluZyogZnVuY3Rpb25zIGR1ZSB0byBSZW5kZXJJbWFnZTo6aW1hZ2VE
aW1lbnNpb25zQ2hhbmdlZCBjYWxsZWQgZHVyaW5nIGF0dGFjaG1lbnQKKworVGhpcyB0ZXN0IFBB
U1NFRCBpZiBpdCBkaWQgbm90IGNyYXNoLgorCisKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL2Zh
c3QvaW1hZ2VzL3NjcmlwdC1jb3VudGVyLWltYWdlRGltZW5zaW9uQ2hhbmdlZC1jcmFzaC5odG1s
IGIvTGF5b3V0VGVzdHMvZmFzdC9pbWFnZXMvc2NyaXB0LWNvdW50ZXItaW1hZ2VEaW1lbnNpb25D
aGFuZ2VkLWNyYXNoLmh0bWwKbmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMDAwMDAw
MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMC4uYTU4MjBjMmIyM2U1ZmRmZjIzOTE5MjZkOWFm
MThiYmUyNjNjMGFjNQotLS0gL2Rldi9udWxsCisrKyBiL0xheW91dFRlc3RzL2Zhc3QvaW1hZ2Vz
L3NjcmlwdC1jb3VudGVyLWltYWdlRGltZW5zaW9uQ2hhbmdlZC1jcmFzaC5odG1sCkBAIC0wLDAg
KzEsMjUgQEAKKzwhRE9DVFlQRSBodG1sPgorPGh0bWw+Cis8aGVhZD4KKzxzdHlsZT4KK2RpdiB7
CisgICAgY29udGVudDogdXJsKCJkYXRhOmltYWdlL3BuZztiYXNlNjQsaVZCT1J3MEtHZ29BQUFB
TlNVaEVVZ0FBQUE4QUFBQVBBUU1BQUFBQkdBY0pBQUFBQTFCTVZFVUFnQUNjK2FXUkFBQUFERWxF
UVZSNDJtTmdJQUVBQUFBdEFBSDdLaE1xQUFBQUFFbEZUa1N1UW1DQyIpOworICAgIHBhZGRpbmct
dG9wOiAxMDAlOworfQorCitib2R5IHsKKyAgICBjb250ZW50OiBjb3VudGVyKGZvb2Jhcik7Cit9
Cis8L3N0eWxlPgorPHNjcmlwdD4KK2lmICh3aW5kb3cubGF5b3V0VGVzdENvbnRyb2xsZXIpCisg
ICAgbGF5b3V0VGVzdENvbnRyb2xsZXIuZHVtcEFzVGV4dCgpOworPC9zY3JpcHQ+Cis8L2hlYWQ+
Cis8cD4gQnVnIDxhIGhyZWY9Imh0dHA6Ly93ZWJraXQub3JnL2IvODU5MTIiPjg1OTEyPC9hPjog
Q3Jhc2ggaW4gY29tcHV0ZWRDU1NQYWRkaW5nKiBmdW5jdGlvbnMgZHVlIHRvIFJlbmRlckltYWdl
OjppbWFnZURpbWVuc2lvbnNDaGFuZ2VkIGNhbGxlZCBkdXJpbmcgYXR0YWNobWVudDwvcD4KKzxw
PiBUaGlzIHRlc3QgUEFTU0VEIGlmIGl0IGRpZCBub3QgY3Jhc2guIDwvcD4KKzxkaXY+Cis8c2Ny
aXB0IHNyYz0iaW5leGlzdGFudC5qcyI+PC9zY3JpcHQ+Cis8Ym9keT4KKzwvYm9keT4KKzwvaHRt
bD4K
</data>

          </attachment>
      

    </bug>

</bugzilla>