Attachment #225378 for bug #129429

View Details Raw Unified Return to Bug 129429

| Differences between



2014-02-27  peavo@outlook.com  <peavo@outlook.com>

        [Win32][LLINT] Crash when running JSC stress tests.
        https://bugs.webkit.org/show_bug.cgi?id=129429

        Reviewed by NOBODY (OOPS!).

        On Windows we need to check if the stack pointer moves over the stack guard page of size 4K.
        If so, we need to read or write some data on every following guard page
        to make sure the system commits the previously uncommitted stack memory.
        Otherwise we might crash later if we access uncommitted stack memory.

        * JavaScriptCore.vcxproj/LLInt/LLIntAssembly/build-LLIntAssembly.sh: Enable LLINT.
        * jit/AssemblyHelpers.cpp:
        (JSC::AssemblyHelpers::moveStackGuardPage): Added method to move stack guard page.
        * jit/AssemblyHelpers.h:
        (JSC::AssemblyHelpers::moveStackPointer): Added method to move stack pointer.
        * jit/JIT.cpp:
        (JSC::JIT::privateCompile): Use moveStackPointer method, which will move the guard page.
        * jit/JITCall32_64.cpp:
        (JSC::JIT::compileLoadVarargs): Ditto.
        * jit/Repatch.cpp:
        (JSC::writeBarrier): Compile fix when DFG_JIT is not enabled.
        * llint/LowLevelInterpreter.asm: Added macro to move stack guard page.
        * offlineasm/x86.rb: Compile fix.

2014-02-27  Gabor Rapcsanyi  <rgabor@webkit.org>

        r164764 broke the ARM build

Lines 29-32 printf "END" > LowLevelInterpreterWin.as Source/JavaScriptCore/JavaScriptCore.vcxproj/LLInt/LLIntAssembly/build-LLIntAssembly.sh_sec1
- Source/JavaScriptCore/JavaScriptCore.vcxproj/LLInt/LLIntAssembly/build-LLIntAssembly.sh -1 / +1 lines
29		29
30	# When enabling LLINT and switching to the x86 backend, use "LowLevelInterpreterWin.asm" as output file when running asm.rb.	30	# When enabling LLINT and switching to the x86 backend, use "LowLevelInterpreterWin.asm" as output file when running asm.rb.
31		31
32	/usr/bin/env ruby "${SRCROOT}/offlineasm/asm.rb" "${SRCROOT}/llint/LowLevelInterpreter.asm" "${BUILT_PRODUCTS_DIR}/LLIntOffsetsExtractor/LLIntOffsetsExtractor${3}.exe" "LLIntAssembly.h" \|\| exit 1	32	/usr/bin/env ruby "${SRCROOT}/offlineasm/asm.rb" "${SRCROOT}/llint/LowLevelInterpreter.asm" "${BUILT_PRODUCTS_DIR}/LLIntOffsetsExtractor/LLIntOffsetsExtractor${3}.exe" "LowLevelInterpreterWin.asm" \|\| exit 1



}
#endif

#if PLATFORM(WIN)
// On Windows we need to check if the stack pointer moves over the stack guard page of size 4K.
// If so, we need to read or write some data on every following guard page
// to make sure the system commits the previously uncommitted stack memory.
// Otherwise we might crash later if we access uncommitted stack memory.
// See http ://msdn.microsoft.com/en-us/library/ms686774%28VS.85%29.aspx

void AssemblyHelpers::moveStackGuardPage(int offset, RegisterID base, RegisterID temp)
{
    const int winStackGuardPageSize = 4096;
    const TrustedImm32 delta(winStackGuardPageSize - 16);

    move(TrustedImm32(-offset), temp);
    sub32(base, temp);
    add32(stackPointerRegister, temp);

    Label moveGuardPageLoop(this);
    Jump jmp = branch32(LessThan, temp, delta);
    sub32(delta, temp);
    sub32(delta, stackPointerRegister);
    // Dummy operation to make sure the system commits memory, and moves the guard page.
    sub32(TrustedImm32(0), Address(stackPointerRegister));
    jump(moveGuardPageLoop);
    Label doneMovingGuardPage(this);
    jmp.linkTo(doneMovingGuardPage, this);
}
#endif

#if !ASSERT_DISABLED
#if USE(JSVALUE64)
void AssemblyHelpers::jitAssertIsInt32(GPRReg gpr)



#endif
    }

#if PLATFORM(WIN)
    void moveStackGuardPage(int offset, RegisterID base, RegisterID temp);
#endif

    ALWAYS_INLINE void moveStackPointer(int offset, RegisterID base, RegisterID temp)
    {
        temp;
#if PLATFORM(WIN)
        moveStackGuardPage(offset, base, temp);
#endif
        addPtr(TrustedImm32(offset), base, stackPointerRegister);
    }


#if CPU(X86_64) || CPU(X86)
    size_t prologueStackPointerDelta()
    {

Lines 522-528 CompilationResult JIT::privateCompile(JI Source/JavaScriptCore/jit/JIT.cpp_sec1
- Source/JavaScriptCore/jit/JIT.cpp -1 / +1 lines
522	stackOverflow = branchPtr(Above, AbsoluteAddress(m_vm->addressOfStackLimit()), regT1);	522	stackOverflow = branchPtr(Above, AbsoluteAddress(m_vm->addressOfStackLimit()), regT1);
523	}	523	}
524		524
525	addPtr(TrustedImm32(stackPointerOffsetFor(m_codeBlock) * sizeof(Register)), callFrameRegister, stackPointerRegister);	525	moveStackPointer(stackPointerOffsetFor(m_codeBlock) * sizeof(Register), callFrameRegister, regT2);
526	checkStackPointerAlignment();	526	checkStackPointerAlignment();
527		527
528	privateCompileMainPass();	528	privateCompileMainPass();

Lines 188-194 void JIT::compileLoadVarargs(Instruction Source/JavaScriptCore/jit/JITCall32_64.cpp_sec1
- Source/JavaScriptCore/jit/JITCall32_64.cpp -1 / +1 lines
188		188
189	emitLoad(arguments, regT1, regT0);	189	emitLoad(arguments, regT1, regT0);
190	callOperation(operationSizeFrameForVarargs, regT1, regT0, firstFreeRegister, firstVarArgOffset);	190	callOperation(operationSizeFrameForVarargs, regT1, regT0, firstFreeRegister, firstVarArgOffset);
191	addPtr(TrustedImm32(-sizeof(CallerFrameAndPC)), returnValueGPR, stackPointerRegister);	191	moveStackPointer(-sizeof(CallerFrameAndPC), returnValueGPR, regT4);
192	emitLoad(thisValue, regT1, regT4);	192	emitLoad(thisValue, regT1, regT4);
193	emitLoad(arguments, regT3, regT2);	193	emitLoad(arguments, regT3, regT2);
194	callOperation(operationLoadVarargs, returnValueGPR, regT1, regT4, regT3, regT2, firstVarArgOffset);	194	callOperation(operationLoadVarargs, returnValueGPR, regT1, regT4, regT3, regT2, firstVarArgOffset);



    ASSERT(owner != scratch1);
    ASSERT(owner != scratch2);

#if ENABLE(DFG_JIT)
    MacroAssembler::Jump definitelyNotMarked = DFG::SpeculativeJIT::genericWriteBarrier(jit, owner);
#endif
    MacroAssembler::Call call = storeToWriteBarrierBuffer(jit, owner, scratch1, scratch2, allocator);
#if ENABLE(DFG_JIT)
    definitelyNotMarked.link(&jit);
#endif
    return call;
}
#endif // ENABLE(GGC)



    end
end

# On Windows we need to check if the stack pointer moves over the stack guard page of size 4K.
# If so, we need to read or write some data on every following guard page
# to make sure the system commits the previously uncommitted stack memory.
# Otherwise we might crash later if we access uncommitted stack memory.
# See http://msdn.microsoft.com/en-us/library/ms686774%28VS.85%29.aspx

macro moveStackPointerAndGuardPage(reg, scratch)
    const winStackGuardPageSize = 4096
    const delta = winStackGuardPageSize - 16

    subi reg, scratch
    addi sp, scratch
.updateSpLoop:
    bilt scratch, delta, .almostDoneUpdateSp
    subi delta, scratch
    subi delta, sp
    # Dummy operation to make sure the system commits memory, and moves the guard page.
    subi 0, [sp]
    jmp .updateSpLoop
.almostDoneUpdateSp:
    subi scratch, sp
end

macro moveStackPointerForCodeBlock(codeBlock, scratch)
    loadi CodeBlock::m_numCalleeRegisters[codeBlock], scratch
    lshiftp 3, scratch

    if ARMv7
        subp cfr, scratch, scratch
        move scratch, sp
    elsif X86_WIN
        moveStackPointerAndGuardPage(cfr, scratch)
    else
        subp cfr, scratch, sp
    end

        if ARMv7
            subp t1, CallerFrameAndPCSize, t2
            move t2, sp
        elsif X86_WIN
            move CallerFrameAndPCSize, t2
            moveStackPointerAndGuardPage(t1, t2)
        else
            subp t1, CallerFrameAndPCSize, sp
        end

Lines 414-420 class BaseIndex Source/JavaScriptCore/offlineasm/x86.rb_sec1
- Source/JavaScriptCore/offlineasm/x86.rb -1 / +1 lines
414	end	414	end
415		415
416	def x86Operand(kind)	416	def x86Operand(kind)
417	if !isIntelSyntax \|\| kind != :double	417	if !isIntelSyntax
418	x86AddressOperand(:ptr)	418	x86AddressOperand(:ptr)
419	else	419	else
420	"#{getSizeString(kind)}[#{offset.value} + #{base.x86Operand(:ptr)} + #{index.x86Operand(:ptr)} * #{scale}]"	420	"#{getSizeString(kind)}[#{offset.value} + #{base.x86Operand(:ptr)} + #{index.x86Operand(:ptr)} * #{scale}]"



2014-02-27  peavo@outlook.com  <peavo@outlook.com>

        [Win32][LLINT] Crash when running JSC stress tests.
        https://bugs.webkit.org/show_bug.cgi?id=129429

        Reviewed by NOBODY (OOPS!).

        * wtf/Platform.h: Enable LLINT on Win32.

2014-02-26  Gavin Barraclough  <barraclough@apple.com>

        FastMalloc should use vm_page_shift intead of PAGE_SHIFT.



#if !defined(ENABLE_JIT) \
    && (CPU(X86) || CPU(X86_64) || CPU(ARM) || CPU(ARM64) || CPU(MIPS)) \
    && !OS(WINCE) \
    && !(OS(WINDOWS) && CPU(X86_64))
#define ENABLE_JIT 1
#endif


   low-level interpreter. */
#if !defined(ENABLE_LLINT) \
    && ENABLE(JIT) \
    && (OS(DARWIN) || OS(LINUX) || OS(FREEBSD) || OS(WINDOWS)) \
    && ((OS(DARWIN) && !PLATFORM(EFL)) || PLATFORM(GTK) || PLATFORM(WIN)) \
    && (CPU(X86) || CPU(X86_64) || CPU(ARM_THUMB2) || CPU(ARM_TRADITIONAL) || CPU(ARM64) || CPU(MIPS) || CPU(SH4))
#define ENABLE_LLINT 1
#endif

#endif

/* Configure the interpreter */
#if COMPILER(GCC) || COMPILER(MSVC)
#define HAVE_COMPUTED_GOTO 1
#endif




2014-02-27  peavo@outlook.com  <peavo@outlook.com>

        [Win32][LLINT] Crash when running JSC stress tests.
        https://bugs.webkit.org/show_bug.cgi?id=129429

        Reviewed by NOBODY (OOPS!).

        * platform/graphics/texmap/TextureMapperGL.cpp: Include a WinCairo compile fix.

2014-02-27  Commit Queue  <commit-queue@webkit.org>

        Unreviewed, rolling out r164783.



    return adoptRef(texture);
}

#if USE(TEXTURE_MAPPER_GL)
PassOwnPtr<TextureMapper> TextureMapper::platformCreateAccelerated()
{
    return TextureMapperGL::create();
}
#endif

};
#endif

Return to Bug 129429

Lines 824-832 static MacroAssembler::Call writeBarrier Source/JavaScriptCore/jit/Repatch.cpp_sec1
- Source/JavaScriptCore/jit/Repatch.cpp +4 lines
824	ASSERT(owner != scratch1);	824	ASSERT(owner != scratch1);
825	ASSERT(owner != scratch2);	825	ASSERT(owner != scratch2);
826		826
		827	#if ENABLE(DFG_JIT)
827	MacroAssembler::Jump definitelyNotMarked = DFG::SpeculativeJIT::genericWriteBarrier(jit, owner);	828	MacroAssembler::Jump definitelyNotMarked = DFG::SpeculativeJIT::genericWriteBarrier(jit, owner);
		829	#endif
828	MacroAssembler::Call call = storeToWriteBarrierBuffer(jit, owner, scratch1, scratch2, allocator);	830	MacroAssembler::Call call = storeToWriteBarrierBuffer(jit, owner, scratch1, scratch2, allocator);
		831	#if ENABLE(DFG_JIT)
829	definitelyNotMarked.link(&jit);	832	definitelyNotMarked.link(&jit);
		833	#endif
830	return call;	834	return call;
831	}	835	}
832	#endif // ENABLE(GGC)	836	#endif // ENABLE(GGC)

Lines 640-646 Source/WTF/wtf/Platform.h_sec1
- Source/WTF/wtf/Platform.h -4 / +4 lines
640	#if !defined(ENABLE_JIT) \	640	#if !defined(ENABLE_JIT) \
641	&& (CPU(X86) \|\| CPU(X86_64) \|\| CPU(ARM) \|\| CPU(ARM64) \|\| CPU(MIPS)) \	641	&& (CPU(X86) \|\| CPU(X86_64) \|\| CPU(ARM) \|\| CPU(ARM64) \|\| CPU(MIPS)) \
642	&& !OS(WINCE) \	642	&& !OS(WINCE) \
643	&& !OS(WINDOWS)	643	&& !(OS(WINDOWS) && CPU(X86_64))
644	#define ENABLE_JIT 1	644	#define ENABLE_JIT 1
645	#endif	645	#endif
646		646
Lines 693-700 Source/WTF/wtf/Platform.h_sec2
693	low-level interpreter. */	693	low-level interpreter. */
694	#if !defined(ENABLE_LLINT) \	694	#if !defined(ENABLE_LLINT) \
695	&& ENABLE(JIT) \	695	&& ENABLE(JIT) \
696	&& (OS(DARWIN) \|\| OS(LINUX) \|\| OS(FREEBSD)) \	696	&& (OS(DARWIN) \|\| OS(LINUX) \|\| OS(FREEBSD) \|\| OS(WINDOWS)) \
697	&& ((OS(DARWIN) && !PLATFORM(EFL)) \|\| PLATFORM(GTK)) \	697	&& ((OS(DARWIN) && !PLATFORM(EFL)) \|\| PLATFORM(GTK) \|\| PLATFORM(WIN)) \
698	&& (CPU(X86) \|\| CPU(X86_64) \|\| CPU(ARM_THUMB2) \|\| CPU(ARM_TRADITIONAL) \|\| CPU(ARM64) \|\| CPU(MIPS) \|\| CPU(SH4))	698	&& (CPU(X86) \|\| CPU(X86_64) \|\| CPU(ARM_THUMB2) \|\| CPU(ARM_TRADITIONAL) \|\| CPU(ARM64) \|\| CPU(MIPS) \|\| CPU(SH4))
699	#define ENABLE_LLINT 1	699	#define ENABLE_LLINT 1
700	#endif	700	#endif
Lines 783-789 Source/WTF/wtf/Platform.h_sec3
783	#endif	783	#endif
784		784
785	/* Configure the interpreter */	785	/* Configure the interpreter */
786	#if COMPILER(GCC)	786	#if COMPILER(GCC) \|\| COMPILER(MSVC)
787	#define HAVE_COMPUTED_GOTO 1	787	#define HAVE_COMPUTED_GOTO 1
788	#endif	788	#endif
789		789

Lines 1128-1137 PassRefPtr<BitmapTexture> TextureMapperG Source/WebCore/platform/graphics/texmap/TextureMapperGL.cpp_sec1
- Source/WebCore/platform/graphics/texmap/TextureMapperGL.cpp +2 lines
1128	return adoptRef(texture);	1128	return adoptRef(texture);
1129	}	1129	}
1130		1130
		1131	#if USE(TEXTURE_MAPPER_GL)
1131	PassOwnPtr<TextureMapper> TextureMapper::platformCreateAccelerated()	1132	PassOwnPtr<TextureMapper> TextureMapper::platformCreateAccelerated()
1132	{	1133	{
1133	return TextureMapperGL::create();	1134	return TextureMapperGL::create();
1134	}	1135	}
		1136	#endif
1135		1137
1136	};	1138	};
1137	#endif	1139	#endif

Lines 1-3 Source/JavaScriptCore/ChangeLog_sec1
- Source/JavaScriptCore/ChangeLog +26 lines
		1	2014-02-27 peavo@outlook.com <peavo@outlook.com>
		2
		3	[Win32][LLINT] Crash when running JSC stress tests.
		4	https://bugs.webkit.org/show_bug.cgi?id=129429
		5
		6	Reviewed by NOBODY (OOPS!).
		7
		8	On Windows we need to check if the stack pointer moves over the stack guard page of size 4K.
		9	If so, we need to read or write some data on every following guard page
		10	to make sure the system commits the previously uncommitted stack memory.
		11	Otherwise we might crash later if we access uncommitted stack memory.
		12
		13	* JavaScriptCore.vcxproj/LLInt/LLIntAssembly/build-LLIntAssembly.sh: Enable LLINT.
		14	* jit/AssemblyHelpers.cpp:
		15	(JSC::AssemblyHelpers::moveStackGuardPage): Added method to move stack guard page.
		16	* jit/AssemblyHelpers.h:
		17	(JSC::AssemblyHelpers::moveStackPointer): Added method to move stack pointer.
		18	* jit/JIT.cpp:
		19	(JSC::JIT::privateCompile): Use moveStackPointer method, which will move the guard page.
		20	* jit/JITCall32_64.cpp:
		21	(JSC::JIT::compileLoadVarargs): Ditto.
		22	* jit/Repatch.cpp:
		23	(JSC::writeBarrier): Compile fix when DFG_JIT is not enabled.
		24	* llint/LowLevelInterpreter.asm: Added macro to move stack guard page.
		25	* offlineasm/x86.rb: Compile fix.
		26
1	2014-02-27 Gabor Rapcsanyi <rgabor@webkit.org>	27	2014-02-27 Gabor Rapcsanyi <rgabor@webkit.org>
2		28
3	r164764 broke the ARM build	29	r164764 broke the ARM build

Lines 70-75 void AssemblyHelpers::clearSamplingFlag( Source/JavaScriptCore/jit/AssemblyHelpers.cpp_sec1
- Source/JavaScriptCore/jit/AssemblyHelpers.cpp +28 lines
70	}	70	}
71	#endif	71	#endif
72		72
		73	#if PLATFORM(WIN)
		74	// On Windows we need to check if the stack pointer moves over the stack guard page of size 4K.
		75	// If so, we need to read or write some data on every following guard page
		76	// to make sure the system commits the previously uncommitted stack memory.
		77	// Otherwise we might crash later if we access uncommitted stack memory.
		78	// See http ://msdn.microsoft.com/en-us/library/ms686774%28VS.85%29.aspx
		79
		80	void AssemblyHelpers::moveStackGuardPage(int offset, RegisterID base, RegisterID temp)
		81	{
		82	const int winStackGuardPageSize = 4096;
		83	const TrustedImm32 delta(winStackGuardPageSize - 16);
		84
		85	move(TrustedImm32(-offset), temp);
		86	sub32(base, temp);
		87	add32(stackPointerRegister, temp);
		88
		89	Label moveGuardPageLoop(this);
		90	Jump jmp = branch32(LessThan, temp, delta);
		91	sub32(delta, temp);
		92	sub32(delta, stackPointerRegister);
		93	// Dummy operation to make sure the system commits memory, and moves the guard page.
		94	sub32(TrustedImm32(0), Address(stackPointerRegister));
		95	jump(moveGuardPageLoop);
		96	Label doneMovingGuardPage(this);
		97	jmp.linkTo(doneMovingGuardPage, this);
		98	}
		99	#endif
		100
73	#if !ASSERT_DISABLED	101	#if !ASSERT_DISABLED
74	#if USE(JSVALUE64)	102	#if USE(JSVALUE64)
75	void AssemblyHelpers::jitAssertIsInt32(GPRReg gpr)	103	void AssemblyHelpers::jitAssertIsInt32(GPRReg gpr)

Lines 383-388 macro callToJavaScriptEpilogue() Source/JavaScriptCore/llint/LowLevelInterpreter.asm_sec1
- Source/JavaScriptCore/llint/LowLevelInterpreter.asm +28 lines
383	end	383	end
384	end	384	end
385		385
		386	# On Windows we need to check if the stack pointer moves over the stack guard page of size 4K.
		387	# If so, we need to read or write some data on every following guard page
		388	# to make sure the system commits the previously uncommitted stack memory.
		389	# Otherwise we might crash later if we access uncommitted stack memory.
		390	# See http://msdn.microsoft.com/en-us/library/ms686774%28VS.85%29.aspx
		391
		392	macro moveStackPointerAndGuardPage(reg, scratch)
		393	const winStackGuardPageSize = 4096
		394	const delta = winStackGuardPageSize - 16
		395
		396	subi reg, scratch
		397	addi sp, scratch
		398	.updateSpLoop:
		399	bilt scratch, delta, .almostDoneUpdateSp
		400	subi delta, scratch
		401	subi delta, sp
		402	# Dummy operation to make sure the system commits memory, and moves the guard page.
		403	subi 0, [sp]
		404	jmp .updateSpLoop
		405	.almostDoneUpdateSp:
		406	subi scratch, sp
		407	end
		408
386	macro moveStackPointerForCodeBlock(codeBlock, scratch)	409	macro moveStackPointerForCodeBlock(codeBlock, scratch)
387	loadi CodeBlock::m_numCalleeRegisters[codeBlock], scratch	410	loadi CodeBlock::m_numCalleeRegisters[codeBlock], scratch
388	lshiftp 3, scratch	411	lshiftp 3, scratch
Lines 390-395 macro moveStackPointerForCodeBlock(codeB Source/JavaScriptCore/llint/LowLevelInterpreter.asm_sec2
390	if ARMv7	413	if ARMv7
391	subp cfr, scratch, scratch	414	subp cfr, scratch, scratch
392	move scratch, sp	415	move scratch, sp
		416	elsif X86_WIN
		417	moveStackPointerAndGuardPage(cfr, scratch)
393	else	418	else
394	subp cfr, scratch, sp	419	subp cfr, scratch, sp
395	end	420	end
Lines 991-996 _llint_op_call_varargs: Source/JavaScriptCore/llint/LowLevelInterpreter.asm_sec3
991	if ARMv7	1016	if ARMv7
992	subp t1, CallerFrameAndPCSize, t2	1017	subp t1, CallerFrameAndPCSize, t2
993	move t2, sp	1018	move t2, sp
		1019	elsif X86_WIN
		1020	move CallerFrameAndPCSize, t2
		1021	moveStackPointerAndGuardPage(t1, t2)
994	else	1022	else
995	subp t1, CallerFrameAndPCSize, sp	1023	subp t1, CallerFrameAndPCSize, sp
996	end	1024	end

Lines 1-3 Source/WTF/ChangeLog_sec1
- Source/WTF/ChangeLog +9 lines
		1	2014-02-27 peavo@outlook.com <peavo@outlook.com>
		2
		3	[Win32][LLINT] Crash when running JSC stress tests.
		4	https://bugs.webkit.org/show_bug.cgi?id=129429
		5
		6	Reviewed by NOBODY (OOPS!).
		7
		8	* wtf/Platform.h: Enable LLINT on Win32.
		9
1	2014-02-26 Gavin Barraclough <barraclough@apple.com>	10	2014-02-26 Gavin Barraclough <barraclough@apple.com>
2		11
3	FastMalloc should use vm_page_shift intead of PAGE_SHIFT.	12	FastMalloc should use vm_page_shift intead of PAGE_SHIFT.

Lines 1-3 Source/WebCore/ChangeLog_sec1
- Source/WebCore/ChangeLog +9 lines
		1	2014-02-27 peavo@outlook.com <peavo@outlook.com>
		2
		3	[Win32][LLINT] Crash when running JSC stress tests.
		4	https://bugs.webkit.org/show_bug.cgi?id=129429
		5
		6	Reviewed by NOBODY (OOPS!).
		7
		8	* platform/graphics/texmap/TextureMapperGL.cpp: Include a WinCairo compile fix.
		9
1	2014-02-27 Commit Queue <commit-queue@webkit.org>	10	2014-02-27 Commit Queue <commit-queue@webkit.org>
2		11
3	Unreviewed, rolling out r164783.	12	Unreviewed, rolling out r164783.