<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>56372</bug_id>
          
          <creation_ts>2011-03-15 06:48:57 -0700</creation_ts>
          <short_desc>Crash in ReplaceSelectionCommand::doApply when inserting a node under a document node</short_desc>
          <delta_ts>2011-03-15 22:16:16 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>HTML Editing</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>All</rep_platform>
          <op_sys>All</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords></keywords>
          <priority>P1</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          <blocked>56421</blocked>
          <everconfirmed>1</everconfirmed>
          <reporter name="Berend-Jan Wever">skylined</reporter>
          <assigned_to name="Ryosuke Niwa">rniwa</assigned_to>
          <cc>darin</cc>
    
    <cc>eric</cc>
    
    <cc>ojan</cc>
    
    <cc>rniwa</cc>
    
    <cc>tkent</cc>
    
    <cc>tony</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>367639</commentid>
    <comment_count>0</comment_count>
      <attachid>85800</attachid>
    <who name="Berend-Jan Wever">skylined</who>
    <bug_when>2011-03-15 06:48:57 -0700</bug_when>
    <thetext>Created attachment 85800
Repro

Chromium: http://code.google.com/p/chromium/issues/detail?id=76183

It is possible to make any HTMLElement a child of the HTMLDocument. In this case HTMLElement::parentElement returns NULL because a HTMLDocument is not an HTMLElement.

It is also possible to execute CompositeEditCommand::insertNodeAfter to insert another HTMLElement after such an HTMLElement. CompositeEditCommand::insertNodeAfter calls HTMLElement::parentElement and expects it to return an HTMLElement.

Combined, this can cause NULL pointer exceptions. I&apos;m not entirely sure where the problem is; it could be that CompositeEditCommand::insertNodeAfter should work on Nodes rather than HTMLElements. It could also be that the code should never get this far and throw a JavaScript exception if it detects this situation. I suspect the former, it makes sense considering the name of the function.

Repro:
&lt;body onload=&quot;go()&quot;&gt;&lt;script&gt;function go() {
  var sElement = [&apos;iframe&apos;, &apos;img&apos;, &apos;embed&apos;, &apos;textarea&apos;][0]; // Select which element you want to test.
  document.open();
  var oElement1 = document.appendChild(document.createElement(sElement));
  var oElement2 = oElement1.appendChild(document.createElement(sElement));
  document.designMode = &quot;on&quot;;
  oElement1.focus();
  document.execCommand(&quot;InsertHorizontalRule&quot;);
}&lt;/script&gt;&lt;/body&gt;

id:             chrome.dll!WebCore::CompositeEditCommand::insertNodeAfter ReadAV@NULL (cf23d1b576db7f88c78bb2e323691274)
description:    Attempt to read from unallocated NULL pointer+0x2C in chrome.dll!WebCore::CompositeEditCommand::insertNodeAfter
application:    Chromium 12.0.705.0
stack:          chrome.dll!WebCore::CompositeEditCommand::insertNodeAfter
                chrome.dll!WebCore::CompositeEditCommand::insertNodeAt
                chrome.dll!WebCore::ReplaceSelectionCommand::insertNodeAtAndUpdateNodesInserted
                chrome.dll!WebCore::ReplaceSelectionCommand::doApply
                chrome.dll!WebCore::EditCommand::apply
                chrome.dll!WebCore::applyCommand
                chrome.dll!WebCore::executeInsertFragment
                chrome.dll!WebCore::executeInsertNode
                chrome.dll!WebCore::executeInsertHorizontalRule
                chrome.dll!WebCore::Editor::Command::execute
                chrome.dll!WebCore::Document::execCommand
                ...</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>367866</commentid>
    <comment_count>1</comment_count>
      <attachid>85844</attachid>
    <who name="Ryosuke Niwa">rniwa</who>
    <bug_when>2011-03-15 12:49:37 -0700</bug_when>
    <thetext>Created attachment 85844
fixes the crash</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>367960</commentid>
    <comment_count>2</comment_count>
      <attachid>85844</attachid>
    <who name="Darin Adler">darin</who>
    <bug_when>2011-03-15 14:55:22 -0700</bug_when>
    <thetext>Comment on attachment 85844
fixes the crash

View in context: https://bugs.webkit.org/attachment.cgi?id=85844&amp;action=review

&gt; Source/WebCore/dom/Document.cpp:4134
&gt; +bool Document::isContentEditable() const
&gt; +{
&gt; +    if (document()-&gt;inDesignMode())
&gt; +        return true;
&gt; +
&gt; +    return renderer() &amp;&amp; (renderer()-&gt;style()-&gt;userModify() == READ_WRITE || renderer()-&gt;style()-&gt;userModify() == READ_WRITE_PLAINTEXT_ONLY);
&gt; +}
&gt; +
&gt; +bool Document::isContentRichlyEditable() const
&gt; +{
&gt; +    if (document()-&gt;inDesignMode())
&gt; +        return true;
&gt; +
&gt; +    return renderer() &amp;&amp; renderer()-&gt;style()-&gt;userModify() == READ_WRITE;
&gt; +}

Is there a way we can share code with the HTMLElement functions? It’s not good to have a near exact copy of those functions in the document class.

Also, it’s strange to call document() in a function on Document.

&gt; Source/WebCore/dom/Document.h:898
&gt; +    virtual bool isContentEditable() const;
&gt; +    virtual bool isContentRichlyEditable() const;

We often make this sort of function private, because if it’s going to be called in performance-critical code and you have a Document*, then it would be better to have a non-virtual version of the function. I think that makes sense in this case. Nobody needs to call isContentEditable on a Document* yet. If they did we could provide something slightly faster.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>367962</commentid>
    <comment_count>3</comment_count>
      <attachid>85844</attachid>
    <who name="Darin Adler">darin</who>
    <bug_when>2011-03-15 14:55:52 -0700</bug_when>
    <thetext>Comment on attachment 85844
fixes the crash

The review tool changed this back to review? But I don’t want to change it to review+ because then it will look like I reviewed it. Can someone help me fix this?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>367964</commentid>
    <comment_count>4</comment_count>
    <who name="Darin Adler">darin</who>
    <bug_when>2011-03-15 14:56:34 -0700</bug_when>
    <thetext>(In reply to comment #3)
&gt; The review tool changed this back to review? But I don’t want to change it to review+ because then it will look like I reviewed it. Can someone help me fix this?

I didn’t intentionally remove the review flag.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>367965</commentid>
    <comment_count>5</comment_count>
    <who name="Darin Adler">darin</who>
    <bug_when>2011-03-15 14:58:24 -0700</bug_when>
    <thetext>Tony, you could resolve this by setting review+ again.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>367971</commentid>
    <comment_count>6</comment_count>
    <who name="Ryosuke Niwa">rniwa</who>
    <bug_when>2011-03-15 15:04:31 -0700</bug_when>
    <thetext>Thanks for the review, Tony.

(In reply to comment #2)
&gt; Is there a way we can share code with the HTMLElement functions? It’s not good to have a near exact copy of those functions in the document class.

I thought about it too but isContentEditable is in a really hot path, and I can&apos;t increase any latency there.

&gt; Also, it’s strange to call document() in a function on Document.

Oops, will fix.

&gt; We often make this sort of function private, because if it’s going to be called in performance-critical code and you have a Document*, then it would be better to have a non-virtual version of the function. I think that makes sense in this case. Nobody needs to call isContentEditable on a Document* yet. If they did we could provide something slightly faster.

We could make them non-virtual function of Node.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>367974</commentid>
    <comment_count>7</comment_count>
    <who name="Ryosuke Niwa">rniwa</who>
    <bug_when>2011-03-15 15:06:59 -0700</bug_when>
    <thetext>Okay, let&apos;s land this patch as is (Reviewed by Tony) and then refactor these functions in a separate patch.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>368000</commentid>
    <comment_count>8</comment_count>
    <who name="Ryosuke Niwa">rniwa</who>
    <bug_when>2011-03-15 15:38:03 -0700</bug_when>
    <thetext>Committed r81185: &lt;http://trac.webkit.org/changeset/81185&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>368184</commentid>
    <comment_count>9</comment_count>
      <attachid>85844</attachid>
    <who name="David Levin">levin</who>
    <bug_when>2011-03-15 22:16:16 -0700</bug_when>
    <thetext>Comment on attachment 85844
fixes the crash

Clearing r? from landed patch. (It was given a r+ also.)</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="0"
              isprivate="0"
          >
            <attachid>85800</attachid>
            <date>2011-03-15 06:48:57 -0700</date>
            <delta_ts>2011-03-15 06:48:57 -0700</delta_ts>
            <desc>Repro</desc>
            <filename>repro.html</filename>
            <type>text/html</type>
            <size>430</size>
            <attacher name="Berend-Jan Wever">skylined</attacher>
            
              <data encoding="base64">PGJvZHkgb25sb2FkPSJnbygpIj48c2NyaXB0PmZ1bmN0aW9uIGdvKCkgewogIHZhciBzRWxlbWVu
dCA9IFsnaWZyYW1lJywgJ2ltZycsICdlbWJlZCcsICd0ZXh0YXJlYSddWzBdOyAvLyBTZWxlY3Qg
d2hpY2ggZWxlbWVudCB5b3Ugd2FudCB0byB0ZXN0LgogIGRvY3VtZW50Lm9wZW4oKTsKICB2YXIg
b0VsZW1lbnQxID0gZG9jdW1lbnQuYXBwZW5kQ2hpbGQoZG9jdW1lbnQuY3JlYXRlRWxlbWVudChz
RWxlbWVudCkpOwogIHZhciBvRWxlbWVudDIgPSBvRWxlbWVudDEuYXBwZW5kQ2hpbGQoZG9jdW1l
bnQuY3JlYXRlRWxlbWVudChzRWxlbWVudCkpOwogIGRvY3VtZW50LmRlc2lnbk1vZGUgPSAib24i
OwogIG9FbGVtZW50MS5mb2N1cygpOwogIGRvY3VtZW50LmV4ZWNDb21tYW5kKCJJbnNlcnRIb3Jp
em9udGFsUnVsZSIpOwp9PC9zY3JpcHQ+PC9ib2R5Pg==
</data>

          </attachment>
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>85844</attachid>
            <date>2011-03-15 12:49:37 -0700</date>
            <delta_ts>2011-03-15 22:16:16 -0700</delta_ts>
            <desc>fixes the crash</desc>
            <filename>bug-56372-20110315124935.patch</filename>
            <type>text/plain</type>
            <size>8615</size>
            <attacher name="Ryosuke Niwa">rniwa</attacher>
            
              <data encoding="base64">SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi
Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDgxMTY1KQorKysgU291cmNlL1dlYkNvcmUvQ2hhbmdl
TG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMzIgQEAKKzIwMTEtMDMtMTUgIFJ5b3N1a2Ug
Tml3YSAgPHJuaXdhQHdlYmtpdC5vcmc+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChP
T1BTISkuCisKKyAgICAgICAgQ3Jhc2ggaW4gUmVwbGFjZVNlbGVjdGlvbkNvbW1hbmQ6OmRvQXBw
bHkgd2hlbiBpbnNlcnRpbmcgYSBub2RlIHVuZGVyIGEgZG9jdW1lbnQgbm9kZQorICAgICAgICBo
dHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9NTYzNzIKKworICAgICAgICBU
aGUgYnVnIHdhcyBjYXVzZWQgYnkgaW5zZXJ0Tm9kZUFmdGVyJ3MgY2FsbGluZyBwYXJlbnRFbGVt
ZW50IG9uIGRvY3VtZW50J3MgY2hpbGQuCisgICAgICAgIEZpeGVkIHRoaXMgYnkgY2hhbmdpbmcg
dGhlIG5vZGUgdGhhdCBBcHBlbmROb2RlQ29tbWFuZCB0YWtlcy4KKworICAgICAgICBUaGVyZSB3
YXMgYWxzbyBhIGJ1ZyB0aGF0IGRvY3VtZW50IG5vZGUgYWx3YXlzIHJldHVybmVkIGZhbHNlIGZv
ciBpc0NvbnRlbnRFZGl0YWJsZQorICAgICAgICBhbmQgaXNDb250ZW50UmljaGx5RWRpdGFibGUg
YmVjYXVzZSB0aGV5IG5ldmVyIG92ZXJyb2RlIE5vZGUncyBkZWZhdWx0IGltcGxlbWVudGF0aW9u
LgorICAgICAgICBGaXhlZCB0aGlzIGJ5IG92ZXJyaWRpbmcgdGhlbSBpbiBEb2N1bWVudC4KKwor
ICAgICAgICBUZXN0OiBlZGl0aW5nL2V4ZWNDb21tYW5kL2FwcGVuZC1ub2RlLXVuZGVyLWRvY3Vt
ZW50Lmh0bWwKKworICAgICAgICAqIGRvbS9Eb2N1bWVudC5jcHA6CisgICAgICAgIChXZWJDb3Jl
OjpEb2N1bWVudDo6aXNDb250ZW50RWRpdGFibGUpOiBBZGRlZC4KKyAgICAgICAgKFdlYkNvcmU6
OkRvY3VtZW50Ojppc0NvbnRlbnRSaWNobHlFZGl0YWJsZSk6IEFkZGVkLgorICAgICAgICAqIGRv
bS9Eb2N1bWVudC5oOgorICAgICAgICAqIGVkaXRpbmcvQXBwZW5kTm9kZUNvbW1hbmQuY3BwOgor
ICAgICAgICAoV2ViQ29yZTo6QXBwZW5kTm9kZUNvbW1hbmQ6OkFwcGVuZE5vZGVDb21tYW5kKTog
VGFrZXMgQ29udGFpbmVyTm9kZSBpbnN0ZWFkIG9mIEVsZW1lbnQuCisgICAgICAgICogZWRpdGlu
Zy9BcHBlbmROb2RlQ29tbWFuZC5oOgorICAgICAgICAoV2ViQ29yZTo6QXBwZW5kTm9kZUNvbW1h
bmQ6OmNyZWF0ZSk6IERpdHRvLgorICAgICAgICAqIGVkaXRpbmcvQ29tcG9zaXRlRWRpdENvbW1h
bmQuY3BwOgorICAgICAgICAoV2ViQ29yZTo6Q29tcG9zaXRlRWRpdENvbW1hbmQ6OmFwcGVuZE5v
ZGUpOiBEaXR0by4KKyAgICAgICAgKFdlYkNvcmU6OkNvbXBvc2l0ZUVkaXRDb21tYW5kOjppbnNl
cnROb2RlQWZ0ZXIpOiBDYWxscyBwYXJlbnROb2RlIGluc3RlYWQgb2YgcGFyZW50RWxlbWVudC4K
KyAgICAgICAgKiBlZGl0aW5nL0NvbXBvc2l0ZUVkaXRDb21tYW5kLmg6CisKIDIwMTEtMDMtMDgg
IExldmkgV2VpbnRyYXViICA8bGV2aXdAY2hyb21pdW0ub3JnPgogCiAgICAgICAgIFJldmlld2Vk
IGJ5IFJ5b3N1a2UgTml3YS4KSW5kZXg6IFNvdXJjZS9XZWJDb3JlL2RvbS9Eb2N1bWVudC5jcHAK
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PQotLS0gU291cmNlL1dlYkNvcmUvZG9tL0RvY3VtZW50LmNwcAkocmV2aXNpb24g
ODExNTcpCisrKyBTb3VyY2UvV2ViQ29yZS9kb20vRG9jdW1lbnQuY3BwCSh3b3JraW5nIGNvcHkp
CkBAIC00MTE3LDYgKzQxMTcsMjIgQEAgYm9vbCBEb2N1bWVudDo6aW5EZXNpZ25Nb2RlKCkgY29u
c3QKICAgICByZXR1cm4gZmFsc2U7CiB9CiAKK2Jvb2wgRG9jdW1lbnQ6OmlzQ29udGVudEVkaXRh
YmxlKCkgY29uc3QKK3sKKyAgICBpZiAoZG9jdW1lbnQoKS0+aW5EZXNpZ25Nb2RlKCkpCisgICAg
ICAgIHJldHVybiB0cnVlOworCisgICAgcmV0dXJuIHJlbmRlcmVyKCkgJiYgKHJlbmRlcmVyKCkt
PnN0eWxlKCktPnVzZXJNb2RpZnkoKSA9PSBSRUFEX1dSSVRFIHx8IHJlbmRlcmVyKCktPnN0eWxl
KCktPnVzZXJNb2RpZnkoKSA9PSBSRUFEX1dSSVRFX1BMQUlOVEVYVF9PTkxZKTsKK30KKworYm9v
bCBEb2N1bWVudDo6aXNDb250ZW50UmljaGx5RWRpdGFibGUoKSBjb25zdAoreworICAgIGlmIChk
b2N1bWVudCgpLT5pbkRlc2lnbk1vZGUoKSkKKyAgICAgICAgcmV0dXJuIHRydWU7CisKKyAgICBy
ZXR1cm4gcmVuZGVyZXIoKSAmJiByZW5kZXJlcigpLT5zdHlsZSgpLT51c2VyTW9kaWZ5KCkgPT0g
UkVBRF9XUklURTsKK30KKwogRG9jdW1lbnQqIERvY3VtZW50OjpwYXJlbnREb2N1bWVudCgpIGNv
bnN0CiB7CiAgICAgaWYgKCFtX2ZyYW1lKQpJbmRleDogU291cmNlL1dlYkNvcmUvZG9tL0RvY3Vt
ZW50LmgKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PQotLS0gU291cmNlL1dlYkNvcmUvZG9tL0RvY3VtZW50LmgJKHJldmlz
aW9uIDgxMTU3KQorKysgU291cmNlL1dlYkNvcmUvZG9tL0RvY3VtZW50LmgJKHdvcmtpbmcgY29w
eSkKQEAgLTg5NCw2ICs4OTQsOCBAQCBwdWJsaWM6CiAgICAgdm9pZCBzZXREZXNpZ25Nb2RlKElu
aGVyaXRlZEJvb2wgdmFsdWUpOwogICAgIEluaGVyaXRlZEJvb2wgZ2V0RGVzaWduTW9kZSgpIGNv
bnN0OwogICAgIGJvb2wgaW5EZXNpZ25Nb2RlKCkgY29uc3Q7CisgICAgdmlydHVhbCBib29sIGlz
Q29udGVudEVkaXRhYmxlKCkgY29uc3Q7CisgICAgdmlydHVhbCBib29sIGlzQ29udGVudFJpY2hs
eUVkaXRhYmxlKCkgY29uc3Q7CiAKICAgICBEb2N1bWVudCogcGFyZW50RG9jdW1lbnQoKSBjb25z
dDsKICAgICBEb2N1bWVudCogdG9wRG9jdW1lbnQoKSBjb25zdDsKSW5kZXg6IFNvdXJjZS9XZWJD
b3JlL2VkaXRpbmcvQXBwZW5kTm9kZUNvbW1hbmQuY3BwCj09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9X
ZWJDb3JlL2VkaXRpbmcvQXBwZW5kTm9kZUNvbW1hbmQuY3BwCShyZXZpc2lvbiA4MTE1NykKKysr
IFNvdXJjZS9XZWJDb3JlL2VkaXRpbmcvQXBwZW5kTm9kZUNvbW1hbmQuY3BwCSh3b3JraW5nIGNv
cHkpCkBAIC0zMSw3ICszMSw3IEBACiAKIG5hbWVzcGFjZSBXZWJDb3JlIHsKIAotQXBwZW5kTm9k
ZUNvbW1hbmQ6OkFwcGVuZE5vZGVDb21tYW5kKFBhc3NSZWZQdHI8RWxlbWVudD4gcGFyZW50LCBQ
YXNzUmVmUHRyPE5vZGU+IG5vZGUpCitBcHBlbmROb2RlQ29tbWFuZDo6QXBwZW5kTm9kZUNvbW1h
bmQoUGFzc1JlZlB0cjxDb250YWluZXJOb2RlPiBwYXJlbnQsIFBhc3NSZWZQdHI8Tm9kZT4gbm9k
ZSkKICAgICA6IFNpbXBsZUVkaXRDb21tYW5kKHBhcmVudC0+ZG9jdW1lbnQoKSkKICAgICAsIG1f
cGFyZW50KHBhcmVudCkKICAgICAsIG1fbm9kZShub2RlKQpJbmRleDogU291cmNlL1dlYkNvcmUv
ZWRpdGluZy9BcHBlbmROb2RlQ29tbWFuZC5oCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9XZWJDb3Jl
L2VkaXRpbmcvQXBwZW5kTm9kZUNvbW1hbmQuaAkocmV2aXNpb24gODExNTcpCisrKyBTb3VyY2Uv
V2ViQ29yZS9lZGl0aW5nL0FwcGVuZE5vZGVDb21tYW5kLmgJKHdvcmtpbmcgY29weSkKQEAgLTMy
LDE4ICszMiwxOCBAQCBuYW1lc3BhY2UgV2ViQ29yZSB7CiAKIGNsYXNzIEFwcGVuZE5vZGVDb21t
YW5kIDogcHVibGljIFNpbXBsZUVkaXRDb21tYW5kIHsKIHB1YmxpYzoKLSAgICBzdGF0aWMgUGFz
c1JlZlB0cjxBcHBlbmROb2RlQ29tbWFuZD4gY3JlYXRlKFBhc3NSZWZQdHI8RWxlbWVudD4gcGFy
ZW50LCBQYXNzUmVmUHRyPE5vZGU+IG5vZGUpCisgICAgc3RhdGljIFBhc3NSZWZQdHI8QXBwZW5k
Tm9kZUNvbW1hbmQ+IGNyZWF0ZShQYXNzUmVmUHRyPENvbnRhaW5lck5vZGU+IHBhcmVudCwgUGFz
c1JlZlB0cjxOb2RlPiBub2RlKQogICAgIHsKICAgICAgICAgcmV0dXJuIGFkb3B0UmVmKG5ldyBB
cHBlbmROb2RlQ29tbWFuZChwYXJlbnQsIG5vZGUpKTsKICAgICB9CiAKIHByaXZhdGU6Ci0gICAg
QXBwZW5kTm9kZUNvbW1hbmQoUGFzc1JlZlB0cjxFbGVtZW50PiBwYXJlbnQsIFBhc3NSZWZQdHI8
Tm9kZT4gbm9kZSk7CisgICAgQXBwZW5kTm9kZUNvbW1hbmQoUGFzc1JlZlB0cjxDb250YWluZXJO
b2RlPiBwYXJlbnQsIFBhc3NSZWZQdHI8Tm9kZT4pOwogCiAgICAgdmlydHVhbCB2b2lkIGRvQXBw
bHkoKTsKICAgICB2aXJ0dWFsIHZvaWQgZG9VbmFwcGx5KCk7CiAKLSAgICBSZWZQdHI8RWxlbWVu
dD4gbV9wYXJlbnQ7CisgICAgUmVmUHRyPENvbnRhaW5lck5vZGU+IG1fcGFyZW50OwogICAgIFJl
ZlB0cjxOb2RlPiBtX25vZGU7CiB9OwogCkluZGV4OiBTb3VyY2UvV2ViQ29yZS9lZGl0aW5nL0Nv
bXBvc2l0ZUVkaXRDb21tYW5kLmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2ViQ29yZS9lZGl0
aW5nL0NvbXBvc2l0ZUVkaXRDb21tYW5kLmNwcAkocmV2aXNpb24gODExNTcpCisrKyBTb3VyY2Uv
V2ViQ29yZS9lZGl0aW5nL0NvbXBvc2l0ZUVkaXRDb21tYW5kLmNwcAkod29ya2luZyBjb3B5KQpA
QCAtMTQ0LDcgKzE0NCw3IEBAIHZvaWQgQ29tcG9zaXRlRWRpdENvbW1hbmQ6Omluc2VydE5vZGVB
ZnQKICAgICBBU1NFUlQoaW5zZXJ0Q2hpbGQpOwogICAgIEFTU0VSVChyZWZDaGlsZCk7CiAgICAg
QVNTRVJUKCFyZWZDaGlsZC0+aGFzVGFnTmFtZShib2R5VGFnKSk7Ci0gICAgRWxlbWVudCogcGFy
ZW50ID0gcmVmQ2hpbGQtPnBhcmVudEVsZW1lbnQoKTsKKyAgICBDb250YWluZXJOb2RlKiBwYXJl
bnQgPSByZWZDaGlsZC0+cGFyZW50Tm9kZSgpOwogICAgIEFTU0VSVChwYXJlbnQpOwogICAgIGlm
IChwYXJlbnQtPmxhc3RDaGlsZCgpID09IHJlZkNoaWxkKQogICAgICAgICBhcHBlbmROb2RlKGlu
c2VydENoaWxkLCBwYXJlbnQpOwpAQCAtMTg0LDcgKzE4NCw3IEBAIHZvaWQgQ29tcG9zaXRlRWRp
dENvbW1hbmQ6Omluc2VydE5vZGVBdCgKICAgICAgICAgaW5zZXJ0Tm9kZUFmdGVyKGluc2VydENo
aWxkLCByZWZDaGlsZCk7CiB9CiAKLXZvaWQgQ29tcG9zaXRlRWRpdENvbW1hbmQ6OmFwcGVuZE5v
ZGUoUGFzc1JlZlB0cjxOb2RlPiBub2RlLCBQYXNzUmVmUHRyPEVsZW1lbnQ+IHBhcmVudCkKK3Zv
aWQgQ29tcG9zaXRlRWRpdENvbW1hbmQ6OmFwcGVuZE5vZGUoUGFzc1JlZlB0cjxOb2RlPiBub2Rl
LCBQYXNzUmVmUHRyPENvbnRhaW5lck5vZGU+IHBhcmVudCkKIHsKICAgICBBU1NFUlQoY2FuSGF2
ZUNoaWxkcmVuRm9yRWRpdGluZyhwYXJlbnQuZ2V0KCkpKTsKICAgICBhcHBseUNvbW1hbmRUb0Nv
bXBvc2l0ZShBcHBlbmROb2RlQ29tbWFuZDo6Y3JlYXRlKHBhcmVudCwgbm9kZSkpOwpJbmRleDog
U291cmNlL1dlYkNvcmUvZWRpdGluZy9Db21wb3NpdGVFZGl0Q29tbWFuZC5oCj09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0K
LS0tIFNvdXJjZS9XZWJDb3JlL2VkaXRpbmcvQ29tcG9zaXRlRWRpdENvbW1hbmQuaAkocmV2aXNp
b24gODExNTcpCisrKyBTb3VyY2UvV2ViQ29yZS9lZGl0aW5nL0NvbXBvc2l0ZUVkaXRDb21tYW5k
LmgJKHdvcmtpbmcgY29weSkKQEAgLTQ5LDcgKzQ5LDcgQEAgcHJvdGVjdGVkOgogICAgIC8vCiAg
ICAgLy8gc3VnYXJ5LXN3ZWV0IGNvbnZlbmllbmNlIGZ1bmN0aW9ucyB0byBoZWxwIGNyZWF0ZSBh
bmQgYXBwbHkgZWRpdCBjb21tYW5kcyBpbiBjb21wb3NpdGUgY29tbWFuZHMKICAgICAvLwotICAg
IHZvaWQgYXBwZW5kTm9kZShQYXNzUmVmUHRyPE5vZGU+LCBQYXNzUmVmUHRyPEVsZW1lbnQ+IHBh
cmVudCk7CisgICAgdm9pZCBhcHBlbmROb2RlKFBhc3NSZWZQdHI8Tm9kZT4sIFBhc3NSZWZQdHI8
Q29udGFpbmVyTm9kZT4gcGFyZW50KTsKICAgICB2b2lkIGFwcGx5Q29tbWFuZFRvQ29tcG9zaXRl
KFBhc3NSZWZQdHI8RWRpdENvbW1hbmQ+KTsKICAgICB2b2lkIGFwcGx5U3R5bGUoY29uc3QgRWRp
dGluZ1N0eWxlKiwgRWRpdEFjdGlvbiA9IEVkaXRBY3Rpb25DaGFuZ2VBdHRyaWJ1dGVzKTsKICAg
ICB2b2lkIGFwcGx5U3R5bGUoY29uc3QgRWRpdGluZ1N0eWxlKiwgY29uc3QgUG9zaXRpb24mIHN0
YXJ0LCBjb25zdCBQb3NpdGlvbiYgZW5kLCBFZGl0QWN0aW9uID0gRWRpdEFjdGlvbkNoYW5nZUF0
dHJpYnV0ZXMpOwpJbmRleDogTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExh
eW91dFRlc3RzL0NoYW5nZUxvZwkocmV2aXNpb24gODExNjUpCisrKyBMYXlvdXRUZXN0cy9DaGFu
Z2VMb2cJKHdvcmtpbmcgY29weSkKQEAgLTEsMyArMSwxNiBAQAorMjAxMS0wMy0xNSAgUnlvc3Vr
ZSBOaXdhICA8cm5pd2FAd2Via2l0Lm9yZz4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkg
KE9PUFMhKS4KKworICAgICAgICBDcmFzaCBpbiBSZXBsYWNlU2VsZWN0aW9uQ29tbWFuZDo6ZG9B
cHBseSB3aGVuIGluc2VydGluZyBhIG5vZGUgdW5kZXIgYSBkb2N1bWVudCBub2RlCisgICAgICAg
IGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD01NjM3MgorCisgICAgICAg
IEFkZGVkIGEgdGVzdCB0byBlbnN1cmUgV2ViS2l0IGRvZXMgbm90IGNyYXNoIHdoZW4gYXBwZW5k
aW5nIGEgbm9kZSB0byBhIGRvY3VtZW50CisgICAgICAgIHRoYXQgaGFzIG9ubHkgdHdvIG5lc3Rl
ZCBpZnJhbWVzLgorCisgICAgICAgICogZWRpdGluZy9leGVjQ29tbWFuZC9hcHBlbmQtbm9kZS11
bmRlci1kb2N1bWVudC1leHBlY3RlZC50eHQ6IEFkZGVkLgorICAgICAgICAqIGVkaXRpbmcvZXhl
Y0NvbW1hbmQvYXBwZW5kLW5vZGUtdW5kZXItZG9jdW1lbnQuaHRtbDogQWRkZWQuCisKIDIwMTEt
MDMtMTUgIEFuZGVycyBDYXJsc3NvbiAgPGFuZGVyc2NhQGFwcGxlLmNvbT4KIAogICAgICAgICBS
ZXZpZXdlZCBieSBTYW0gV2VpbmlnLgpJbmRleDogTGF5b3V0VGVzdHMvZWRpdGluZy9leGVjQ29t
bWFuZC9hcHBlbmQtbm9kZS11bmRlci1kb2N1bWVudC1leHBlY3RlZC50eHQKPT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQot
LS0gTGF5b3V0VGVzdHMvZWRpdGluZy9leGVjQ29tbWFuZC9hcHBlbmQtbm9kZS11bmRlci1kb2N1
bWVudC1leHBlY3RlZC50eHQJKHJldmlzaW9uIDApCisrKyBMYXlvdXRUZXN0cy9lZGl0aW5nL2V4
ZWNDb21tYW5kL2FwcGVuZC1ub2RlLXVuZGVyLWRvY3VtZW50LWV4cGVjdGVkLnR4dAkocmV2aXNp
b24gMCkKQEAgLTAsMCArMSwyIEBACitUaGlzIHRlc3QgZW5zdXJlcyBXZWJLaXQgZG9lcyBub3Qg
Y3Jhc2ggd2hlbiByZXBsYWNpbmcgY29udGVudHMgaW4gYSBkb2N1bWVudCB3aG9zZSB0aGUgb25s
eSBjb250ZW50IGlzIGEgbmVzdGVkIGlmcmFtZXMuCitQQVNTLgpJbmRleDogTGF5b3V0VGVzdHMv
ZWRpdGluZy9leGVjQ29tbWFuZC9hcHBlbmQtbm9kZS11bmRlci1kb2N1bWVudC5odG1sCj09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT0KLS0tIExheW91dFRlc3RzL2VkaXRpbmcvZXhlY0NvbW1hbmQvYXBwZW5kLW5vZGUtdW5k
ZXItZG9jdW1lbnQuaHRtbAkocmV2aXNpb24gMCkKKysrIExheW91dFRlc3RzL2VkaXRpbmcvZXhl
Y0NvbW1hbmQvYXBwZW5kLW5vZGUtdW5kZXItZG9jdW1lbnQuaHRtbAkocmV2aXNpb24gMCkKQEAg
LTAsMCArMSwyMyBAQAorPCFET0NUWVBFIGh0bWw+Cis8aHRtbD4KKzxib2R5IG9ubG9hZD0icnVu
VGVzdCgpIj4KKzxzY3JpcHQ+CisKK2lmICh3aW5kb3cubGF5b3V0VGVzdENvbnRyb2xsZXIpCisg
ICAgbGF5b3V0VGVzdENvbnRyb2xsZXIuZHVtcEFzVGV4dCgpOworCitmdW5jdGlvbiBydW5UZXN0
KCkgeworICBkb2N1bWVudC5kZXNpZ25Nb2RlID0gIm9uIjsKKyAgZG9jdW1lbnQub3BlbigpOwor
ICB2YXIgcGFyZW50ID0gZG9jdW1lbnQuYXBwZW5kQ2hpbGQoZG9jdW1lbnQuY3JlYXRlRWxlbWVu
dCgnaWZyYW1lJykpOworICBwYXJlbnQuYXBwZW5kQ2hpbGQoZG9jdW1lbnQuY3JlYXRlRWxlbWVu
dCgnaWZyYW1lJykpOworICBwYXJlbnQuZm9jdXMoKTsKKyAgZG9jdW1lbnQuZXhlY0NvbW1hbmQo
Ikluc2VydEhvcml6b250YWxSdWxlIik7CisKKyAgZG9jdW1lbnQub3BlbigpOworICBkb2N1bWVu
dC53cml0ZWxuKCdUaGlzIHRlc3QgZW5zdXJlcyBXZWJLaXQgZG9lcyBub3QgY3Jhc2ggd2hlbiBy
ZXBsYWNpbmcgY29udGVudHMgaW4gYSBkb2N1bWVudCB3aG9zZSB0aGUgb25seSBjb250ZW50IGlz
IGEgbmVzdGVkIGlmcmFtZXMuPGJyPlBBU1MuJyk7Cit9CisKKzwvc2NyaXB0PgorPC9ib2R5Pgor
PC9odG1sPgo=
</data>

          </attachment>
      

    </bug>

</bugzilla>