<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>9787</bug_id>
          
          <creation_ts>2006-07-08 08:21:21 -0700</creation_ts>
          <short_desc>fast/frames tests failing (bad pointer to owner element) under MallocScribble</short_desc>
          <delta_ts>2006-07-18 10:59:25 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>Frames</component>
          <version>420+</version>
          <rep_platform>Mac</rep_platform>
          <op_sys>OS X 10.4</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>InRadar, Regression</keywords>
          <priority>P1</priority>
          <bug_severity>Critical</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Darin Adler">darin</reporter>
          <assigned_to name="Anders Carlsson">andersca</assigned_to>
          <cc>ddkilzer</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>48810</commentid>
    <comment_count>0</comment_count>
    <who name="Darin Adler">darin</who>
    <bug_when>2006-07-08 08:21:21 -0700</bug_when>
    <thetext>Since the recent frame changes, I&apos;ve seen an intermittent crash that I&apos;ve been able to reproduce with 1 or 2 runs when running the fast/frames tests.

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x555555cd
0x013997cc in WebCore::RenderPart::setFrame (this=0x55555555, frame=0x0) at /Safari/OpenSource/WebCore/rendering/RenderPart.cpp:66
66          if (frame == m_frame)
(gdb) bt
#0  0x013997cc in WebCore::RenderPart::setFrame (this=0x55555555, frame=0x0) at /Safari/OpenSource/WebCore/rendering/RenderPart.cpp:66
#1  0x01128f04 in WebCore::Frame::~Frame (this=0x18926660) at /Safari/OpenSource/WebCore/page/Frame.cpp:210
#2  0x0113e728 in WebCore::FrameMac::~FrameMac (this=0x18926660) at /Safari/OpenSource/WebCore/bridge/mac/FrameMac.mm:175
#3  0x0148dcec in WebCore::Shared&lt;WebCore::Frame&gt;::deref (this=0x18926664) at /Safari/OpenSource/WebCore/platform/Shared.h:32
#4  0x01127dbc in WebCore::Frame::lifeSupportTimerFired (this=0x18926660) at /Safari/OpenSource/WebCore/page/Frame.cpp:2510
#5  0x014e3070 in WebCore::Timer&lt;WebCore::Frame&gt;::fired (this=0x1498e7d0) at /Safari/OpenSource/WebCore/platform/Timer.h:94
#6  0x012d8020 in WebCore::TimerBase::fireTimers (fireTime=1152371018.6822951, firingTimers=@0xbfffe620) at /Safari/OpenSource/WebCore/platform/Timer.cpp:335
#7  0x012d80ec in WebCore::TimerBase::sharedTimerFired () at /Safari/OpenSource/WebCore/platform/Timer.cpp:352
#8  0x012d7498 in WebCore::timerFired () at /Safari/OpenSource/WebCore/platform/mac/SharedTimerMac.cpp:46
#9  0x907ef550 in __CFRunLoopDoTimer ()
#10 0x907dbec8 in __CFRunLoopRun ()
#11 0x907db47c in CFRunLoopRunSpecific ()
#12 0x92953164 in -[NSRunLoop runMode:beforeDate:] ()
#13 0x0000ae08 in dumpRenderTree (pathOrURL=0xbfffeeb8 &quot;empty-cols-attribute.html&quot;) at /Safari/OpenSource/WebKitTools/DumpRenderTree/DumpRenderTree.m:756
#14 0x00007ed8 in main (argc=2, argv=0xbffff7e4) at /Safari/OpenSource/WebKitTools/DumpRenderTree/DumpRenderTree.m:321

To reproduce, I created a file with the names of the tests:

    cd LayoutTests/fast/frames
    ls -1 *.html &gt; tests.txt
    gdb &lt;build dir&gt;/Debug/DumpRenderTree
    set env MallocScribble 1
    run - &lt; tests.txt
    &lt;then run and run over again until you see the crash&gt;

The problem is that a Frame ends up with a pointer to an element that has been deallocated. It&apos;s critical that we fix this -- this is the kind of thing that really kills us in WebKit releases.

We need to clean up the object ownership rules between the owner element and the frame. The concept is that the frame holds a pointer to the owner element that&apos;s guaranteed to get cleared if the element goes away before the frame does, and it seems this invariant has been broken.

More importantly, this code is getting too loosely connected and fragile with the responsibilities for lifetime being split between the frame element classes, the frame class, and the renderer for the part.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>48824</commentid>
    <comment_count>1</comment_count>
    <who name="David Kilzer (:ddkilzer)">ddkilzer</who>
    <bug_when>2006-07-08 09:18:23 -0700</bug_when>
    <thetext>*** Bug 9784 has been marked as a duplicate of this bug. ***</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>48827</commentid>
    <comment_count>2</comment_count>
    <who name="David Kilzer (:ddkilzer)">ddkilzer</who>
    <bug_when>2006-07-08 09:19:15 -0700</bug_when>
    <thetext>There may be some relevant crash logs in Bug 9784.

</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>48851</commentid>
    <comment_count>3</comment_count>
      <attachid>9277</attachid>
    <who name="Anders Carlsson">andersca</who>
    <bug_when>2006-07-08 11:13:01 -0700</bug_when>
    <thetext>Created attachment 9277
Patch

I reworked things a bit so that RenderPart doesn&apos;t have to know about the frame. Instead, the elements reset the owner element in ::detach.

With this patch I can&apos;t reproduce the crash.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>48857</commentid>
    <comment_count>4</comment_count>
      <attachid>9277</attachid>
    <who name="Darin Adler">darin</who>
    <bug_when>2006-07-08 14:10:08 -0700</bug_when>
    <thetext>Comment on attachment 9277
Patch

The line of code in Frame::~Frame that says d-&gt;m_ownerElement = 0 doesn&apos;t seem necessary. We&apos;re destroying the object and we don&apos;t need to nil out fields in it.

The code should not use renderer-&gt;element() -- it should use the more efficient and more sensibly named node() function.

Are you certain there&apos;s no code path where the frame element gets destroyed without a close call? For example, what about when a whole page and frame tree goes away at once. Same question about the other elements.

It seems a little dangerous to me that the frame has a pointer to the owner element, and it&apos;s not ref&apos;d. And in the other direction, the owner element has only an indirect memory of the frame -- a frame name. Can these two ever get out of sync? Because if they do, then the Frame has a bad pointer in it.

The patch looks fine to me, but I&apos;m still concerned that the object ownership relationship is too fragile.

I&apos;m going to say review+ because this is definitely an improvement.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>48877</commentid>
    <comment_count>5</comment_count>
    <who name="Maciej Stachowiak">mjs</who>
    <bug_when>2006-07-08 21:23:31 -0700</bug_when>
    <thetext>I made the two specific tweaks Darin suggested and landed this, to get the buildbot happy again. I agree that it would be good (in a follow-on patch) to clear up the ownership policy.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>50290</commentid>
    <comment_count>6</comment_count>
    <who name="Timothy Hatcher">timothy</who>
    <bug_when>2006-07-18 10:59:25 -0700</bug_when>
    <thetext>&lt;rdar://problem/4618213&gt;</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>9277</attachid>
            <date>2006-07-08 11:13:01 -0700</date>
            <delta_ts>2006-07-08 14:10:08 -0700</delta_ts>
            <desc>Patch</desc>
            <filename>frame-ownership.txt</filename>
            <type>text/plain</type>
            <size>8730</size>
            <attacher name="Anders Carlsson">andersca</attacher>
            
              <data encoding="base64">SW5kZXg6IENoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBDaGFuZ2VMb2cJKHJldmlzaW9uIDE1MjM1
KQorKysgQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsNDMgQEAKKzIwMDYtMDct
MDggIEFuZGVycyBDYXJsc3NvbiAgPGFjYXJsc3NvbkBhcHBsZS5jb20+CisKKyAgICAgICAgUmV2
aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgaHR0cDovL2J1Z3ppbGxhLm9wZW5k
YXJ3aW4ub3JnL3Nob3dfYnVnLmNnaT9pZD05Nzg3CisgICAgICAgIGZhc3QvZnJhbWVzIHRlc3Rz
IGZhaWxpbmcgKGJhZCBwb2ludGVyIHRvIG93bmVyIGVsZW1lbnQpIHVuZGVyIE1hbGxvY1Njcmli
YmxlCisgICAgICAgIAorICAgICAgICAqIGh0bWwvSFRNTEZyYW1lRWxlbWVudC5jcHA6CisgICAg
ICAgIChXZWJDb3JlOjpIVE1MRnJhbWVFbGVtZW50OjpjbG9zZSk6CisgICAgICAgIERpc2Nvbm5l
Y3QgdGhlIG93bmVyIGVsZW1lbnQgb2Ygb3VyIGZyYW1lLgorICAgICAgICAKKyAgICAgICAgKiBo
dG1sL0hUTUxJRnJhbWVFbGVtZW50LmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OkhUTUxJRnJhbWVF
bGVtZW50OjphdHRhY2gpOgorICAgICAgICBEb24ndCBjYWxsIHNldEZyYW1lIGhlcmUuCisgICAg
ICAgIAorICAgICAgICAqIGh0bWwvSFRNTFBsdWdJbkVsZW1lbnQuY3BwOgorICAgICAgICAoV2Vi
Q29yZTo6SFRNTFBsdWdJbkVsZW1lbnQ6OmRldGFjaCk6CisgICAgICAgIERpc2Nvbm5lY3QgdGhl
IG93bmVyIGVsZW1lbnQgb2Ygb3VyIGZyYW1lLgorCisgICAgICAgICogaHRtbC9IVE1MUGx1Z0lu
RWxlbWVudC5oOgorICAgICAgICAoV2ViQ29yZTo6SFRNTFBsdWdJbkVsZW1lbnQ6OnNldEZyYW1l
TmFtZSk6ICAgICAgICAKKyAgICAgICAgTmV3IGZ1bmN0aW9uLgorICAgICAgICAKKyAgICAgICAg
KiBwYWdlL0ZyYW1lLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OkZyYW1lOjpGcmFtZSk6CisgICAg
ICAgIERvbid0IGNhbGwgc2V0RnJhbWUuCisgICAgICAgIAorICAgICAgICAoV2ViQ29yZTo6RnJh
bWU6On5GcmFtZSk6CisgICAgICAgIE51bGwgb3V0IHRoZSBvd25lciBlbGVtZW50LgorICAgICAg
ICAKKyAgICAgICAgKFdlYkNvcmU6OkZyYW1lOjpyZXF1ZXN0T2JqZWN0KToKKyAgICAgICAgV2hl
biBhbiBvYmplY3QgY3JlYXRlcyBhIGNoaWxkIGZyYW1lLCBhc3NpZ24gaXQgYSBuYW1lIHNvIGl0
IGNhbiBiZQorICAgICAgICBhY2Nlc3NlZCBmcm9tIEhUTUxQbHVnSW5FbGVtZW50LgorICAgICAg
ICAKKyAgICAgICAgKiByZW5kZXJpbmcvUmVuZGVyUGFydC5jcHA6CisgICAgICAgIChXZWJDb3Jl
OjpSZW5kZXJQYXJ0OjpSZW5kZXJQYXJ0KToKKyAgICAgICAgKFdlYkNvcmU6OlJlbmRlclBhcnQ6
On5SZW5kZXJQYXJ0KToKKyAgICAgICAgKiByZW5kZXJpbmcvUmVuZGVyUGFydC5oOgorICAgICAg
ICBHZXQgcmlkIG9mIHNldEZyYW1lLgorCiAyMDA2LTA3LTA4ICBEYXJpbiBBZGxlciAgPGRhcmlu
QGFwcGxlLmNvbT4KIAogICAgICAgICAtIHRyeSB0byBmaXggV2luZG93cyBidWlsZApJbmRleDog
V2ViQ29yZS54Y29kZXByb2ovcHJvamVjdC5wYnhwcm9qCj09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUu
eGNvZGVwcm9qL3Byb2plY3QucGJ4cHJvagkocmV2aXNpb24gMTUyMjkpCisrKyBXZWJDb3JlLnhj
b2RlcHJvai9wcm9qZWN0LnBieHByb2oJKHdvcmtpbmcgY29weSkKQEAgLTE1ODYsMjMgKzE1ODYs
NiBAQAogCQlGQUUwNDE5MDA5NzU5NkM5MDAwNTQwQkUgLyogU1ZHSW1hZ2VMb2FkZXIuaCBpbiBI
ZWFkZXJzICovID0ge2lzYSA9IFBCWEJ1aWxkRmlsZTsgZmlsZVJlZiA9IEZBRTA0MThFMDk3NTk2
QzkwMDA1NDBCRSAvKiBTVkdJbWFnZUxvYWRlci5oICovOyB9OwogLyogRW5kIFBCWEJ1aWxkRmls
ZSBzZWN0aW9uICovCiAKLS8qIEJlZ2luIFBCWEJ1aWxkU3R5bGUgc2VjdGlvbiAqLwotCQlEMDQx
RkMyNTBBNUUwNEE3MDA4NDFGN0YgLyogRGV2ZWxvcG1lbnQgKi8gPSB7Ci0JCQlpc2EgPSBQQlhC
dWlsZFN0eWxlOwotCQkJYnVpbGRTZXR0aW5ncyA9IHsKLQkJCQlDT1BZX1BIQVNFX1NUUklQID0g
Tk87Ci0JCQl9OwotCQkJbmFtZSA9IERldmVsb3BtZW50OwotCQl9OwotCQlEMDQxRkMyNjBBNUUw
NEE3MDA4NDFGN0YgLyogRGVwbG95bWVudCAqLyA9IHsKLQkJCWlzYSA9IFBCWEJ1aWxkU3R5bGU7
Ci0JCQlidWlsZFNldHRpbmdzID0gewotCQkJCUNPUFlfUEhBU0VfU1RSSVAgPSBZRVM7Ci0JCQl9
OwotCQkJbmFtZSA9IERlcGxveW1lbnQ7Ci0JCX07Ci0vKiBFbmQgUEJYQnVpbGRTdHlsZSBzZWN0
aW9uICovCi0KIC8qIEJlZ2luIFBCWENvbnRhaW5lckl0ZW1Qcm94eSBzZWN0aW9uICovCiAJCURE
MDQxRkYwMDlEOUUzMjUwMDEwQUYyQSAvKiBQQlhDb250YWluZXJJdGVtUHJveHkgKi8gPSB7CiAJ
CQlpc2EgPSBQQlhDb250YWluZXJJdGVtUHJveHk7CkBAIC02NDU4LDEyICs2NDQxLDYgQEAKIAkJ
MDg2N0Q2OTBGRTg0MDI4RkMwMkFBQzA3IC8qIFByb2plY3Qgb2JqZWN0ICovID0gewogCQkJaXNh
ID0gUEJYUHJvamVjdDsKIAkJCWJ1aWxkQ29uZmlndXJhdGlvbkxpc3QgPSAxNDlDMjg0MzA4OTAy
QjExMDA4QTlFRkMgLyogQnVpbGQgY29uZmlndXJhdGlvbiBsaXN0IGZvciBQQlhQcm9qZWN0ICJX
ZWJDb3JlIiAqLzsKLQkJCWJ1aWxkU2V0dGluZ3MgPSB7Ci0JCQl9OwotCQkJYnVpbGRTdHlsZXMg
PSAoCi0JCQkJRDA0MUZDMjUwQTVFMDRBNzAwODQxRjdGIC8qIERldmVsb3BtZW50ICovLAotCQkJ
CUQwNDFGQzI2MEE1RTA0QTcwMDg0MUY3RiAvKiBEZXBsb3ltZW50ICovLAotCQkJKTsKIAkJCWhh
c1NjYW5uZWRGb3JFbmNvZGluZ3MgPSAxOwogCQkJa25vd25SZWdpb25zID0gKAogCQkJCUVuZ2xp
c2gsCkluZGV4OiBodG1sL0hUTUxGcmFtZUVsZW1lbnQuY3BwCj09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIGh0bWwv
SFRNTEZyYW1lRWxlbWVudC5jcHAJKHJldmlzaW9uIDE1MjI5KQorKysgaHRtbC9IVE1MRnJhbWVF
bGVtZW50LmNwcAkod29ya2luZyBjb3B5KQpAQCAtMjMwLDYgKzIzMCw3IEBAIHZvaWQgSFRNTEZy
YW1lRWxlbWVudDo6Y2xvc2UoKQogewogICAgIEZyYW1lKiBmcmFtZSA9IGRvY3VtZW50KCktPmZy
YW1lKCk7CiAgICAgaWYgKHJlbmRlcmVyKCkgJiYgZnJhbWUpIHsKKyAgICAgICAgZnJhbWUtPmRp
c2Nvbm5lY3RPd25lckVsZW1lbnQoKTsKICAgICAgICAgZnJhbWUtPnBhZ2UoKS0+ZGVjcmVtZW50
RnJhbWVDb3VudCgpOwogICAgICAgICBpZiAoRnJhbWUqIGNoaWxkRnJhbWUgPSBmcmFtZS0+dHJl
ZSgpLT5jaGlsZChtX25hbWUpKQogICAgICAgICAgICAgY2hpbGRGcmFtZS0+ZnJhbWVEZXRhY2hl
ZCgpOwpJbmRleDogaHRtbC9IVE1MSUZyYW1lRWxlbWVudC5jcHAKPT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gaHRt
bC9IVE1MSUZyYW1lRWxlbWVudC5jcHAJKHJldmlzaW9uIDE1MjI5KQorKysgaHRtbC9IVE1MSUZy
YW1lRWxlbWVudC5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTE1MSw3ICsxNTEsNiBAQCB2b2lkIEhU
TUxJRnJhbWVFbGVtZW50OjphdHRhY2goKQogICAgICAgICBpZiAoIWNvbnRlbnRGcmFtZSgpKQog
ICAgICAgICAgICAgb3BlblVSTCgpOwogICAgICAgICAKLSAgICAgICAgcmVuZGVyUGFydC0+c2V0
RnJhbWUoY29udGVudEZyYW1lKCkpOwogICAgICAgICByZW5kZXJQYXJ0LT5zZXRXaWRnZXQoY29u
dGVudEZyYW1lKCktPnZpZXcoKSk7CiAgICAgICAgIHJlbmRlclBhcnQtPnVwZGF0ZVdpZGdldCgp
OwogICAgICAgICBuZWVkV2lkZ2V0VXBkYXRlID0gZmFsc2U7CkluZGV4OiBodG1sL0hUTUxQbHVn
SW5FbGVtZW50LmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBodG1sL0hUTUxQbHVnSW5FbGVtZW50LmNwcAko
cmV2aXNpb24gMTUyMjkpCisrKyBodG1sL0hUTUxQbHVnSW5FbGVtZW50LmNwcAkod29ya2luZyBj
b3B5KQpAQCAtMjUsNiArMjUsOSBAQAogI2luY2x1ZGUgIkhUTUxQbHVnSW5FbGVtZW50LmgiCiAK
ICNpbmNsdWRlICJDU1NQcm9wZXJ0eU5hbWVzLmgiCisjaW5jbHVkZSAiRG9jdW1lbnQuaCIKKyNp
bmNsdWRlICJGcmFtZS5oIgorI2luY2x1ZGUgIkZyYW1lVHJlZS5oIgogI2luY2x1ZGUgIkhUTUxO
YW1lcy5oIgogCiBuYW1lc3BhY2UgV2ViQ29yZSB7CkBAIC0xMTcsNCArMTIwLDE1IEBAIGJvb2wg
SFRNTFBsdWdJbkVsZW1lbnQ6OmNoZWNrRFREKGNvbnN0IE4KICAgICByZXR1cm4gbmV3Q2hpbGQt
Pmhhc1RhZ05hbWUocGFyYW1UYWcpIHx8IEhUTUxFbGVtZW50OjpjaGVja0RURChuZXdDaGlsZCk7
CiB9CiAKK3ZvaWQgSFRNTFBsdWdJbkVsZW1lbnQ6OmRldGFjaCgpCit7CisgICAgaWYgKEZyYW1l
KiBwYXJlbnRGcmFtZSA9IGRvY3VtZW50KCktPmZyYW1lKCkpIHsKKyAgICAgICAgRnJhbWUqIGNv
bnRlbnRGcmFtZSA9IHBhcmVudEZyYW1lLT50cmVlKCktPmNoaWxkKG1fZnJhbWVOYW1lKTsKKyAg
ICAgICAgaWYgKGNvbnRlbnRGcmFtZSkKKyAgICAgICAgICAgIGNvbnRlbnRGcmFtZS0+ZGlzY29u
bmVjdE93bmVyRWxlbWVudCgpOworICAgIH0KKyAgICAKKyAgICBIVE1MRWxlbWVudDo6ZGV0YWNo
KCk7Cit9CisKIH0KSW5kZXg6IGh0bWwvSFRNTFBsdWdJbkVsZW1lbnQuaAo9PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0t
LSBodG1sL0hUTUxQbHVnSW5FbGVtZW50LmgJKHJldmlzaW9uIDE1MjI5KQorKysgaHRtbC9IVE1M
UGx1Z0luRWxlbWVudC5oCSh3b3JraW5nIGNvcHkpCkBAIC00Myw2ICs0Myw4IEBAIHB1YmxpYzoK
ICAgICB2aXJ0dWFsIGJvb2wgbWFwVG9FbnRyeShjb25zdCBRdWFsaWZpZWROYW1lJiBhdHRyTmFt
ZSwgTWFwcGVkQXR0cmlidXRlRW50cnkmIHJlc3VsdCkgY29uc3Q7CiAgICAgdmlydHVhbCB2b2lk
IHBhcnNlTWFwcGVkQXR0cmlidXRlKE1hcHBlZEF0dHJpYnV0ZSopOwogCisgICAgdmlydHVhbCB2
b2lkIGRldGFjaCgpOworICAgIAogICAgIHZpcnR1YWwgSFRNTFRhZ1N0YXR1cyBlbmRUYWdSZXF1
aXJlbWVudCgpIGNvbnN0IHsgcmV0dXJuIFRhZ1N0YXR1c1JlcXVpcmVkOyB9CiAgICAgdmlydHVh
bCBib29sIGNoZWNrRFREKGNvbnN0IE5vZGUqIG5ld0NoaWxkKTsKIApAQCAtNjEsMTMgKzYzLDE1
IEBAIHB1YmxpYzoKICNpZiBfX0FQUExFX18KICAgICB2aXJ0dWFsIEtKUzo6QmluZGluZ3M6Oklu
c3RhbmNlKiBnZXRJbnN0YW5jZSgpIGNvbnN0ID0gMDsKICNlbmRpZgotICAgIAorCisgICAgdm9p
ZCBzZXRGcmFtZU5hbWUoY29uc3QgQXRvbWljU3RyaW5nJiBmcmFtZU5hbWUpIHsgbV9mcmFtZU5h
bWUgPSBmcmFtZU5hbWU7IH0KIHByb3RlY3RlZDoKICAgICBTdHJpbmcgb2xkTmFtZUF0dHI7Ci0K
ICNpZiBfX0FQUExFX18KICAgICBtdXRhYmxlIFJlZlB0cjxLSlM6OkJpbmRpbmdzOjpJbnN0YW5j
ZT4gbV9pbnN0YW5jZTsKICNlbmRpZgorcHJpdmF0ZToKKyAgICBBdG9taWNTdHJpbmcgbV9mcmFt
ZU5hbWU7CiB9OwogCiB9CkluZGV4OiBwYWdlL0ZyYW1lLmNwcAo9PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBwYWdl
L0ZyYW1lLmNwcAkocmV2aXNpb24gMTUyMjkpCisrKyBwYWdlL0ZyYW1lLmNwcAkod29ya2luZyBj
b3B5KQpAQCAtMTY4LDkgKzE2OCw2IEBAIEZyYW1lOjpGcmFtZShQYWdlKiBwYWdlLCBFbGVtZW50
KiBvd25lckUKICNpZm5kZWYgTkRFQlVHCiAgICAgKytGcmFtZUNvdW50ZXI6OmNvdW50OwogI2Vu
ZGlmCi0KLSAgICBpZiAob3duZXJSZW5kZXJlcigpKQotICAgICAgICBvd25lclJlbmRlcmVyKCkt
PnNldEZyYW1lKHRoaXMpOwogfQogCiBGcmFtZTo6fkZyYW1lKCkKQEAgLTIwNiwxMSArMjAzLDgg
QEAgRnJhbWU6On5GcmFtZSgpCiAgICAgZm9yIChIYXNoU2V0PEZyYW1lKj46Oml0ZXJhdG9yIGl0
ID0gb3BlbmVkQnkuYmVnaW4oKTsgaXQgIT0gZW5kOyArK2l0KQogICAgICAgICAoKml0KS0+c2V0
T3BlbmVyKDApOwogICAgIAotICAgIGlmIChvd25lclJlbmRlcmVyKCkpIHsKLSAgICAgICAgb3du
ZXJSZW5kZXJlcigpLT5zZXRGcmFtZSgwKTsKLSAgICAgICAgQVNTRVJUKCFkLT5tX293bmVyRWxl
bWVudCk7Ci0gICAgfQotICAgIAorICAgIGQtPm1fb3duZXJFbGVtZW50ID0gMDsKKwogICAgIGlm
IChkLT5tX3ZpZXcpIHsKICAgICAgICAgZC0+bV92aWV3LT5oaWRlKCk7CiAgICAgICAgIGQtPm1f
dmlldy0+bV9mcmFtZSA9IDA7CkBAIC0xNDI1LDggKzE0MTksMTIgQEAgYm9vbCBGcmFtZTo6cmVx
dWVzdE9iamVjdChSZW5kZXJQYXJ0KiByZQogICAgIGlmIChzaG91bGRVc2VQbHVnaW4ocmVuZGVy
ZXItPmVsZW1lbnQoKSwgY29tcGxldGVkVVJMLCBtaW1lVHlwZSwgcmVuZGVyZXItPmhhc0ZhbGxi
YWNrQ29udGVudCgpLCB1c2VGYWxsYmFjaykpCiAgICAgICAgIHJldHVybiBsb2FkUGx1Z2luKHJl
bmRlcmVyLCBjb21wbGV0ZWRVUkwsIG1pbWVUeXBlLCBwYXJhbU5hbWVzLCBwYXJhbVZhbHVlcywg
dXNlRmFsbGJhY2spOwogCisgICAgQVNTRVJUKHJlbmRlcmVyLT5lbGVtZW50KCktPmhhc1RhZ05h
bWUob2JqZWN0VGFnKSB8fCByZW5kZXJlci0+ZWxlbWVudCgpLT5oYXNUYWdOYW1lKGVtYmVkVGFn
KSk7CisgICAgQXRvbWljU3RyaW5nIHVuaXF1ZUZyYW1lTmFtZSA9IHRyZWUoKS0+dW5pcXVlQ2hp
bGROYW1lKGZyYW1lTmFtZSk7CisgICAgc3RhdGljX2Nhc3Q8SFRNTFBsdWdJbkVsZW1lbnQqPihy
ZW5kZXJlci0+ZWxlbWVudCgpKS0+c2V0RnJhbWVOYW1lKHVuaXF1ZUZyYW1lTmFtZSk7CisgICAg
CiAgICAgLy8gRklYTUU6IG9rIHRvIGFsd2F5cyBtYWtlIGEgbmV3IG9uZT8gd2hlbiBkb2VzIHRo
ZSBvbGQgZnJhbWUgZ2V0IHJlbW92ZWQ/Ci0gICAgcmV0dXJuIGxvYWRTdWJmcmFtZShzdGF0aWNf
Y2FzdDxFbGVtZW50Kj4ocmVuZGVyZXItPmVsZW1lbnQoKSksIGNvbXBsZXRlZFVSTCwgZnJhbWVO
YW1lLCBkLT5tX3JlZmVycmVyKTsKKyAgICByZXR1cm4gbG9hZFN1YmZyYW1lKHN0YXRpY19jYXN0
PEVsZW1lbnQqPihyZW5kZXJlci0+ZWxlbWVudCgpKSwgY29tcGxldGVkVVJMLCB1bmlxdWVGcmFt
ZU5hbWUsIGQtPm1fcmVmZXJyZXIpOwogfQogCiBib29sIEZyYW1lOjpzaG91bGRVc2VQbHVnaW4o
Tm9kZSogZWxlbWVudCwgY29uc3QgS1VSTCYgdXJsLCBjb25zdCBTdHJpbmcmIG1pbWVUeXBlLCBi
b29sIGhhc0ZhbGxiYWNrLCBib29sJiB1c2VGYWxsYmFjaykKSW5kZXg6IHJlbmRlcmluZy9SZW5k
ZXJQYXJ0LmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09Ci0tLSByZW5kZXJpbmcvUmVuZGVyUGFydC5jcHAJKHJldmlz
aW9uIDE1MjI5KQorKysgcmVuZGVyaW5nL1JlbmRlclBhcnQuY3BwCSh3b3JraW5nIGNvcHkpCkBA
IC0zOSw4ICszOSw2IEBAIHVzaW5nIG5hbWVzcGFjZSBIVE1MTmFtZXM7CiAKIFJlbmRlclBhcnQ6
OlJlbmRlclBhcnQoSFRNTEVsZW1lbnQqIG5vZGUpCiAgICAgOiBSZW5kZXJXaWRnZXQobm9kZSkK
LSAgICAsIG1fZnJhbWUoMCkKLSAgICAsIG1fZGlzY29ubmVjdE93bmVyRWxlbWVudFdoZW5EZXN0
cm95ZWQoIW5vZGUtPmhhc1RhZ05hbWUoaWZyYW1lVGFnKSkKIHsKICAgICAvLyBpbml0IFJlbmRl
ck9iamVjdCBhdHRyaWJ1dGVzCiAgICAgc2V0SW5saW5lKGZhbHNlKTsKQEAgLTU2LDE5ICs1NCw2
IEBAIFJlbmRlclBhcnQ6On5SZW5kZXJQYXJ0KCkKICAgICAgICAgc3RhdGljX2Nhc3Q8RnJhbWVW
aWV3Kj4od2lkZ2V0KS0+ZGVyZWYoKTsKICAgICBlbHNlCiAgICAgICAgIGRlbGV0ZSB3aWRnZXQ7
Ci0KLSAgICBpZiAobV9kaXNjb25uZWN0T3duZXJFbGVtZW50V2hlbkRlc3Ryb3llZCkKLSAgICAg
ICAgc2V0RnJhbWUoMCk7Ci19Ci0KLXZvaWQgUmVuZGVyUGFydDo6c2V0RnJhbWUoRnJhbWUqIGZy
YW1lKQotewotICAgIGlmIChmcmFtZSA9PSBtX2ZyYW1lKQotICAgICAgICByZXR1cm47Ci0KLSAg
ICBpZiAobV9mcmFtZSkKLSAgICAgICAgbV9mcmFtZS0+ZGlzY29ubmVjdE93bmVyRWxlbWVudCgp
OwotICAgIG1fZnJhbWUgPSBmcmFtZTsKIH0KIAogdm9pZCBSZW5kZXJQYXJ0OjpzZXRXaWRnZXQo
V2lkZ2V0KiB3aWRnZXQpCkluZGV4OiByZW5kZXJpbmcvUmVuZGVyUGFydC5oCj09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0K
LS0tIHJlbmRlcmluZy9SZW5kZXJQYXJ0LmgJKHJldmlzaW9uIDE1MjI5KQorKysgcmVuZGVyaW5n
L1JlbmRlclBhcnQuaAkod29ya2luZyBjb3B5KQpAQCAtMzksNyArMzksNiBAQCBwdWJsaWM6CiAg
ICAgCiAgICAgdmlydHVhbCBjb25zdCBjaGFyKiByZW5kZXJOYW1lKCkgY29uc3QgeyByZXR1cm4g
IlJlbmRlclBhcnQiOyB9CiAKLSAgICB2b2lkIHNldEZyYW1lKEZyYW1lKik7CiAgICAgdm9pZCBz
ZXRXaWRnZXQoV2lkZ2V0Kik7CiAKICAgICAvLyBGSVhNRTogVGhpcyBzaG91bGQgbm90IGJlIG5l
Y2Vzc2FyeS4K
</data>
<flag name="review"
          id="2796"
          type_id="1"
          status="+"
          setter="darin"
    />
          </attachment>
      

    </bug>

</bugzilla>