<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>74037</bug_id>
          
          <creation_ts>2011-12-07 16:39:15 -0800</creation_ts>
          <short_desc>[chromium] Remove assumption that empty surface is always at end of list.</short_desc>
          <delta_ts>2011-12-12 12:53:49 -0800</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>Layout and Rendering</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>Unspecified</rep_platform>
          <op_sys>Unspecified</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords></keywords>
          <priority>P1</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Shawn Singh">shawnsingh</reporter>
          <assigned_to name="Shawn Singh">shawnsingh</assigned_to>
          <cc>cc-bugs</cc>
    
    <cc>enne</cc>
    
    <cc>jamesr</cc>
    
    <cc>webkit.review.bot</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>516992</commentid>
    <comment_count>0</comment_count>
    <who name="Shawn Singh">shawnsingh</who>
    <bug_when>2011-12-07 16:39:15 -0800</bug_when>
    <thetext>This patch (coming in just a moment) hopefully fixes some crashes associated with http://code.google.com/p/chromium/issues/detail?id=106734 . It probably does not fix all causes of similar crashes, please see issue 106734 for details.

No tests are added yet, just to get the patch uploaded.  If people want this fix to actually land, then we can take some time to add a test for this.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>516999</commentid>
    <comment_count>1</comment_count>
      <attachid>118289</attachid>
    <who name="Shawn Singh">shawnsingh</who>
    <bug_when>2011-12-07 16:56:05 -0800</bug_when>
    <thetext>Created attachment 118289
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>517000</commentid>
    <comment_count>2</comment_count>
    <who name="Shawn Singh">shawnsingh</who>
    <bug_when>2011-12-07 16:57:49 -0800</bug_when>
    <thetext>After checking on OSX, this does not fix the problem.  Please see the chromium issue 106734 for discussion.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>518001</commentid>
    <comment_count>3</comment_count>
      <attachid>118505</attachid>
    <who name="Shawn Singh">shawnsingh</who>
    <bug_when>2011-12-08 18:13:54 -0800</bug_when>
    <thetext>Created attachment 118505
Patch

Please refer to chromium issue 106734 for continued discussion, comment #14 refers to this particular patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>518134</commentid>
    <comment_count>4</comment_count>
      <attachid>118505</attachid>
    <who name="Vangelis Kokkevis">vangelis</who>
    <bug_when>2011-12-08 23:12:47 -0800</bug_when>
    <thetext>Comment on attachment 118505
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=118505&amp;action=review

&gt; Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:444
&gt; +            while (renderSurfaceLayerList.last() != layer) {

I&apos;m not sure I follow.  If layer-&gt;renderSurface() != NULL then the layer being processed has an associated RS and it was just added to the renderSurfaceLayerList so it must be the last element. How can we get here with the list having more elements?   
Also, in general, when layer A follows Layer B in the renderSurfaceLayerList, it doesn&apos;t necessarily mean than A is a descendant of B.  They could be siblings or even in unrelated parts of the tree.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>518147</commentid>
    <comment_count>5</comment_count>
      <attachid>118505</attachid>
    <who name="Shawn Singh">shawnsingh</who>
    <bug_when>2011-12-08 23:47:21 -0800</bug_when>
    <thetext>Comment on attachment 118505
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=118505&amp;action=review

&gt;&gt; Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:444
&gt;&gt; +            while (renderSurfaceLayerList.last() != layer) {
&gt; 
&gt; I&apos;m not sure I follow.  If layer-&gt;renderSurface() != NULL then the layer being processed has an associated RS and it was just added to the renderSurfaceLayerList so it must be the last element. How can we get here with the list having more elements?   
&gt; Also, in general, when layer A follows Layer B in the renderSurfaceLayerList, it doesn&apos;t necessarily mean than A is a descendant of B.  They could be siblings or even in unrelated parts of the tree.

This portion of the code happens after the recursion.  That means that additional surfaces that may get created are completely within the subtree and eventually contribute to layer-&gt;renderSurface().

Enne and I discussed offline - we agreed that in theory, additional surfaces should not be created -- if the code were correct.  We&apos;re pretty sure the root of this is https://bugs.webkit.org/show_bug.cgi?id=74147 -- by not transforming the clipRect, it makes descendant surfaces think that they are not clipped.  But we also agreed that this current proposed patch is a safer fix for merging to m17.

Does this sound reasonable to you?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>518148</commentid>
    <comment_count>6</comment_count>
    <who name="Shawn Singh">shawnsingh</who>
    <bug_when>2011-12-08 23:49:08 -0800</bug_when>
    <thetext>Correction - &quot;pretty sure&quot; sounds more confident than we actually are.  We&apos;re somewhat sure that&apos;s the root of the problem, and when we have time we&apos;ll create a reduced test case first, to verify.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>518731</commentid>
    <comment_count>7</comment_count>
    <who name="James Robinson">jamesr</who>
    <bug_when>2011-12-09 18:44:53 -0800</bug_when>
    <thetext>This is deep magick. I know this is for a crash fix but I&apos;d like to see Enne or Vangelis give unambiguous positive feedback, and ideally have a test case, before putting this one in. It&apos;s very easy to spend a lot of time running in circles with bugs like this so I&apos;d like for at least two people to have a deep understanding of what&apos;s going on here and why the fix works so we don&apos;t end up just chasing issue behind this one for weeks.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>518866</commentid>
    <comment_count>8</comment_count>
    <who name="Shawn Singh">shawnsingh</who>
    <bug_when>2011-12-10 20:44:52 -0800</bug_when>
    <thetext>(In reply to comment #7)
&gt; This is deep magick. I know this is for a crash fix but I&apos;d like to see Enne or Vangelis give unambiguous positive feedback, and ideally have a test case, before putting this one in. It&apos;s very easy to spend a lot of time running in circles with bugs like this so I&apos;d like for at least two people to have a deep understanding of what&apos;s going on here and why the fix works so we don&apos;t end up just chasing issue behind this one for weeks.

I&apos;ll definitely make new patch with a test case asap.  Looking forward to hearing Vangelis&apos;s and Enne&apos;s feedback, too.

If it helps, I can give any verbose details about the debugging investigations I did.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>519130</commentid>
    <comment_count>9</comment_count>
      <attachid>118775</attachid>
    <who name="Shawn Singh">shawnsingh</who>
    <bug_when>2011-12-12 04:19:59 -0800</bug_when>
    <thetext>Created attachment 118775
added test case that reproduces the crash</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>519133</commentid>
    <comment_count>10</comment_count>
    <who name="Shawn Singh">shawnsingh</who>
    <bug_when>2011-12-12 04:32:01 -0800</bug_when>
    <thetext>(In reply to comment #9)
&gt; Created an attachment (id=118775) [details]
&gt; added test case that reproduces the crash

Explanation of the crash:

The crash occurs somewhat indirectly from the cause.

1. When a layer creates its own renderSurface, that layer does not initialize its clipRect.  The clipRect remains whatever it most recently was from the previous frame.

2. Because of this, the layer may have an incorrect clipRect.  This layer and child layers will accidentally think that they should schedule themselves to be drawn, and this surface ultimately gets added to the renderSurfaceLayerList.

3. In combination with this, an ancestor surface knows that it should be clipped, and tries to remove itself from the renderSurfaceLayerList.  At this point, we had assumed this surface was the last item, but when Steps 1 and 2 occur, then this is not true, and we removed the wrong surface from the list.

4. The layer we intended to remove from renderSurfaceLayerList had already cleared its surface.  When we try to iterate over that empty list and access the size() parameter, it crashes.

This is what the unit test reproduces.

This fix is only half the solution.  I have an almost-working &quot;correct&quot; version, but I feel it is too risky to back-port that to m17.   By removing all subsequent layers (which we know are part of the subtree), I think we are keeping the intended correctness, since all those layers end up contributing to a surface that knows it should be clipped.  This seems safer to me for m17.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>519268</commentid>
    <comment_count>11</comment_count>
      <attachid>118775</attachid>
    <who name="Adrienne Walker">enne</who>
    <bug_when>2011-12-12 09:23:28 -0800</bug_when>
    <thetext>Comment on attachment 118775
added test case that reproduces the crash

View in context: https://bugs.webkit.org/attachment.cgi?id=118775&amp;action=review

Ah, we only modify the render surface layer&apos;s clip rect on line 420 after we&apos;ve processed all the children.  Oops.

Excellent detective work and test case.  :)

&gt; Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:443
&gt; +            // FIXME: Originally we asserted that this layer was already at the end of the
&gt; +            //        list, and only needed to remove that layer. For now, we remove the
&gt; +            //        entire subtree of surfaces to fix a crash bug. The root cause is
&gt; +            //        https://bugs.webkit.org/show_bug.cgi?id=74147 and we should be able
&gt; +            //        to put the original assert after fixing that.

Maybe for robustness we should just leave this in after the fact.  Maybe there&apos;s other edge cases we haven&apos;t caught or maybe somebody else will break this in the future.  I&apos;m beginning to think just removing the last layer in the list was too clever of a solution.  All the other render surfaces that are in the list after this layer have to be children, so it should always be safe to remove them.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>519309</commentid>
    <comment_count>12</comment_count>
      <attachid>118775</attachid>
    <who name="James Robinson">jamesr</who>
    <bug_when>2011-12-12 10:23:15 -0800</bug_when>
    <thetext>Comment on attachment 118775
added test case that reproduces the crash

Awesome test and explanation. R=me for this.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>519340</commentid>
    <comment_count>13</comment_count>
      <attachid>118775</attachid>
    <who name="Shawn Singh">shawnsingh</who>
    <bug_when>2011-12-12 10:49:33 -0800</bug_when>
    <thetext>Comment on attachment 118775
added test case that reproduces the crash

Cool, thanks =)</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>519389</commentid>
    <comment_count>14</comment_count>
      <attachid>118775</attachid>
    <who name="WebKit Review Bot">webkit.review.bot</who>
    <bug_when>2011-12-12 12:53:45 -0800</bug_when>
    <thetext>Comment on attachment 118775
added test case that reproduces the crash

Clearing flags on attachment: 118775

Committed r102611: &lt;http://trac.webkit.org/changeset/102611&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>519390</commentid>
    <comment_count>15</comment_count>
    <who name="WebKit Review Bot">webkit.review.bot</who>
    <bug_when>2011-12-12 12:53:49 -0800</bug_when>
    <thetext>All reviewed patches have been landed.  Closing bug.</thetext>
  </long_desc>
      
          <attachment
              isobsolete="1"
              ispatch="1"
              isprivate="0"
          >
            <attachid>118289</attachid>
            <date>2011-12-07 16:56:05 -0800</date>
            <delta_ts>2011-12-08 18:13:50 -0800</delta_ts>
            <desc>Patch</desc>
            <filename>bug-74037-20111207165604.patch</filename>
            <type>text/plain</type>
            <size>2372</size>
            <attacher name="Shawn Singh">shawnsingh</attacher>
            
              <data encoding="base64">U3VidmVyc2lvbiBSZXZpc2lvbjogMTAyMTUxCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D
aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggOWE2ZDMyODcxYzJjZTVi
NmMzYTJkNjM3NjQ1YWJjZDJlMDNmMzAxZi4uMGJlZjU4MmQ2OGMzNzA3NjkyYjA2YjZiNGI4NzEy
Y2U4NGVmZmI2ZCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv
dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE1IEBACisyMDExLTEyLTA3ICBTaGF3
biBTaW5naCAgPHNoYXduc2luZ2hAY2hyb21pdW0ub3JnPgorCisgICAgICAgIFtjaHJvbWl1bV0g
UmVtb3ZlIGFzc3VtcHRpb24gdGhhdCBlbXB0eSBzdXJmYWNlIGlzIGFsd2F5cyBhdCB0aGUgZW5k
IG9mIGxpc3QuCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9p
ZD03NDAzNworCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAg
IE5vIG5ldyB0ZXN0cy4gKE9PUFMhKQorCisgICAgICAgICogcGxhdGZvcm0vZ3JhcGhpY3MvY2hy
b21pdW0vY2MvQ0NMYXllclRyZWVIb3N0Q29tbW9uLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OmNh
bGN1bGF0ZURyYXdUcmFuc2Zvcm1zQW5kVmlzaWJpbGl0eUludGVybmFsKToKKwogMjAxMS0xMi0w
NiAgSmFycmVkIE5pY2hvbGxzICA8amFycmVkQHNlbmNoYS5jb20+CiAKICAgICAgICAgZ2V0Q29t
cHV0ZWRTdHlsZSByZXR1cm5zIHdyb25nIHZhbHVlIGZvciBtYXJnaW4tKgpkaWZmIC0tZ2l0IGEv
U291cmNlL1dlYkNvcmUvcGxhdGZvcm0vZ3JhcGhpY3MvY2hyb21pdW0vY2MvQ0NMYXllclRyZWVI
b3N0Q29tbW9uLmNwcCBiL1NvdXJjZS9XZWJDb3JlL3BsYXRmb3JtL2dyYXBoaWNzL2Nocm9taXVt
L2NjL0NDTGF5ZXJUcmVlSG9zdENvbW1vbi5jcHAKaW5kZXggMWQwMWVkODhiMjdiZTZlZTA2YzJi
ZTA5NDhkZGE1ZmM2NjM4YTgxOC4uOGUwZDE1MzRhZGM0MzQ0NWU2YjUzMzFmY2I4ODg5Y2RiODI4
MjIyYSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvcGxhdGZvcm0vZ3JhcGhpY3MvY2hyb21p
dW0vY2MvQ0NMYXllclRyZWVIb3N0Q29tbW9uLmNwcAorKysgYi9Tb3VyY2UvV2ViQ29yZS9wbGF0
Zm9ybS9ncmFwaGljcy9jaHJvbWl1bS9jYy9DQ0xheWVyVHJlZUhvc3RDb21tb24uY3BwCkBAIC00
MzQsMTIgKzQzNCwxMyBAQCBzdGF0aWMgYm9vbCBjYWxjdWxhdGVEcmF3VHJhbnNmb3Jtc0FuZFZp
c2liaWxpdHlJbnRlcm5hbChMYXllclR5cGUqIGxheWVyLCBMYXllcgogICAgICAgICAgICAgcmVu
ZGVyU3VyZmFjZS0+c2V0UmVwbGljYURyYXdUcmFuc2Zvcm0ocmVwbGljYURyYXdUcmFuc2Zvcm0p
OwogICAgICAgICB9CiAKLSAgICAgICAgLy8gSWYgYSByZW5kZXIgc3VyZmFjZSBoYXMgbm8gbGF5
ZXIgbGlzdCwgdGhlbiBpdCBhbmQgbm9uZSBvZiBpdHMKLSAgICAgICAgLy8gY2hpbGRyZW4gbmVl
ZGVkIHRvIGdldCBkcmF3bi4gVGhlcmVmb3JlLCBpdCBzaG91bGQgYmUgdGhlIGxhc3QgbGF5ZXIK
LSAgICAgICAgLy8gaW4gdGhlIHJlbmRlciBzdXJmYWNlIGxpc3QgYW5kIHdlIGNhbiB0cml2aWFs
bHkgcmVtb3ZlIGl0LgorICAgICAgICAvLyBGSVhNRTogSW4gdGhlb3J5IHdlIGV4cGVjdGVkIHRo
YXQgdGhlIGZvbGxvd2luZyBjb25kaXRpb24gaGFwcGVucyBvbmx5IHdoZW4gdGhlCisgICAgICAg
IC8vICAgICAgICBzdXJmYWNlIGlzIHRoZSBsYXN0IGVudHJ5IG9mIHJlbmRlclN1cmZhY2VMYXll
ckxpc3QuIEhvd2V2ZXIsIGluCisgICAgICAgIC8vICAgICAgICBwcmFjdGljZSB0aGF0IHdhc24n
dCB3b3JraW5nIGFzIGV4cGVjdGVkLiBGb3Igbm93LCBpdCB3b3JrZWQgcHJvcGVybHkgdG8KKyAg
ICAgICAgLy8gICAgICAgIGZpbmQgdGhlIGVudHJ5IHdoZXJldmVyIGl0IGV4aXN0cyBpbiB0aGUg
bGlzdCwgYW5kIHRoZW4gcmVtb3ZlIGl0LgorICAgICAgICAvLyAgICAgICAgaHR0cDovL2NvZGUu
Z29vZ2xlLmNvbS9wL2Nocm9taXVtL2lzc3Vlcy9kZXRhaWw/aWQ9MTA2NzM0CiAgICAgICAgIGlm
ICghbGF5ZXItPnJlbmRlclN1cmZhY2UoKS0+bGF5ZXJMaXN0KCkuc2l6ZSgpKSB7Ci0gICAgICAg
ICAgICBBU1NFUlQocmVuZGVyU3VyZmFjZUxheWVyTGlzdC5sYXN0KCkgPT0gbGF5ZXIpOwotICAg
ICAgICAgICAgcmVuZGVyU3VyZmFjZUxheWVyTGlzdC5yZW1vdmVMYXN0KCk7CisgICAgICAgICAg
ICByZW5kZXJTdXJmYWNlTGF5ZXJMaXN0LnJlbW92ZShyZW5kZXJTdXJmYWNlTGF5ZXJMaXN0LmZp
bmQobGF5ZXIpKTsKICAgICAgICAgICAgIGxheWVyLT5jbGVhclJlbmRlclN1cmZhY2UoKTsKICAg
ICAgICAgICAgIHJldHVybiBmYWxzZTsKICAgICAgICAgfQo=
</data>

          </attachment>
          <attachment
              isobsolete="1"
              ispatch="1"
              isprivate="0"
          >
            <attachid>118505</attachid>
            <date>2011-12-08 18:13:54 -0800</date>
            <delta_ts>2011-12-12 04:19:55 -0800</delta_ts>
            <desc>Patch</desc>
            <filename>bug-74037-20111208181352.patch</filename>
            <type>text/plain</type>
            <size>2585</size>
            <attacher name="Shawn Singh">shawnsingh</attacher>
            
              <data encoding="base64">U3VidmVyc2lvbiBSZXZpc2lvbjogMTAyMzQxCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D
aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggMzY4ODkzNGJhNjZiMWEx
MTA1MDJkZDI4OWQ2NDZhZDhiNWNmZTk2Yi4uMzQ0YjA3YjU1OTMzMmRhNjJlMjE0MDc0NDI2Zjkw
ODkzNDRlZWE4YiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv
dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE1IEBACisyMDExLTEyLTA4ICBTaGF3
biBTaW5naCAgPHNoYXduc2luZ2hAY2hyb21pdW0ub3JnPgorCisgICAgICAgIFtjaHJvbWl1bV0g
UmVtb3ZlIGFzc3VtcHRpb24gdGhhdCBlbXB0eSBzdXJmYWNlIGlzIGFsd2F5cyBhdCB0aGUgZW5k
IG9mIGxpc3QuCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9p
ZD03NDAzNworCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAg
IE5vIG5ldyB0ZXN0cy4gKE9PUFMhKQorCisgICAgICAgICogcGxhdGZvcm0vZ3JhcGhpY3MvY2hy
b21pdW0vY2MvQ0NMYXllclRyZWVIb3N0Q29tbW9uLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OmNh
bGN1bGF0ZURyYXdUcmFuc2Zvcm1zQW5kVmlzaWJpbGl0eUludGVybmFsKToKKwogMjAxMS0xMi0w
OCAgVGFrYXNoaSBUb3lvc2hpbWEgIDx0b3lvc2hpbUBjaHJvbWl1bS5vcmc+CiAKICAgICAgICAg
UHJvdmlkZSBtb3JlIHNwZWNpZmljIGVycm9yIGRlc2NyaXB0aW9uIGZvciBTb2NrZXRTdHJlYW1F
cnJvci4KZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL3BsYXRmb3JtL2dyYXBoaWNzL2Nocm9t
aXVtL2NjL0NDTGF5ZXJUcmVlSG9zdENvbW1vbi5jcHAgYi9Tb3VyY2UvV2ViQ29yZS9wbGF0Zm9y
bS9ncmFwaGljcy9jaHJvbWl1bS9jYy9DQ0xheWVyVHJlZUhvc3RDb21tb24uY3BwCmluZGV4IDFk
MDFlZDg4YjI3YmU2ZWUwNmMyYmUwOTQ4ZGRhNWZjNjYzOGE4MTguLmM4NTZkMTg0OGE3ODBjMTRl
MTAzMmUwNzE3NTY5YWM0YzE1MWQwYWEgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL3BsYXRm
b3JtL2dyYXBoaWNzL2Nocm9taXVtL2NjL0NDTGF5ZXJUcmVlSG9zdENvbW1vbi5jcHAKKysrIGIv
U291cmNlL1dlYkNvcmUvcGxhdGZvcm0vZ3JhcGhpY3MvY2hyb21pdW0vY2MvQ0NMYXllclRyZWVI
b3N0Q29tbW9uLmNwcApAQCAtNDM0LDEwICs0MzQsMTcgQEAgc3RhdGljIGJvb2wgY2FsY3VsYXRl
RHJhd1RyYW5zZm9ybXNBbmRWaXNpYmlsaXR5SW50ZXJuYWwoTGF5ZXJUeXBlKiBsYXllciwgTGF5
ZXIKICAgICAgICAgICAgIHJlbmRlclN1cmZhY2UtPnNldFJlcGxpY2FEcmF3VHJhbnNmb3JtKHJl
cGxpY2FEcmF3VHJhbnNmb3JtKTsKICAgICAgICAgfQogCi0gICAgICAgIC8vIElmIGEgcmVuZGVy
IHN1cmZhY2UgaGFzIG5vIGxheWVyIGxpc3QsIHRoZW4gaXQgYW5kIG5vbmUgb2YgaXRzCi0gICAg
ICAgIC8vIGNoaWxkcmVuIG5lZWRlZCB0byBnZXQgZHJhd24uIFRoZXJlZm9yZSwgaXQgc2hvdWxk
IGJlIHRoZSBsYXN0IGxheWVyCi0gICAgICAgIC8vIGluIHRoZSByZW5kZXIgc3VyZmFjZSBsaXN0
IGFuZCB3ZSBjYW4gdHJpdmlhbGx5IHJlbW92ZSBpdC4KKyAgICAgICAgLy8gSWYgYSByZW5kZXIg
c3VyZmFjZSBoYXMgbm8gbGF5ZXIgbGlzdCwgdGhlbiBpdCBhbmQgbm9uZSBvZiBpdHMgY2hpbGRy
ZW4gbmVlZGVkIHRvIGdldCBkcmF3bi4KICAgICAgICAgaWYgKCFsYXllci0+cmVuZGVyU3VyZmFj
ZSgpLT5sYXllckxpc3QoKS5zaXplKCkpIHsKKyAgICAgICAgICAgIC8vIEZJWE1FOiBPcmlnaW5h
bGx5IHdlIGFzc2VydGVkIHRoYXQgdGhpcyBsYXllciB3YXMgYWxyZWFkeSBhdCB0aGUgZW5kIG9m
IHRoZQorICAgICAgICAgICAgLy8gICAgICAgIGxpc3QsIGFuZCBvbmx5IG5lZWRlZCB0byByZW1v
dmUgdGhhdCBsYXllci4gRm9yIG5vdywgd2UgcmVtb3ZlIHRoZQorICAgICAgICAgICAgLy8gICAg
ICAgIGVudGlyZSBzdWJ0cmVlIG9mIHN1cmZhY2VzIHRvIGZpeCBhIGNyYXNoIGJ1Zy4gVGhlIHJv
b3QgY2F1c2UgaXMKKyAgICAgICAgICAgIC8vICAgICAgICBtb3N0IGxpa2VseSBodHRwczovL2J1
Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9NzQxNDcgYW5kIHdlIGNhbgorICAgICAgICAg
ICAgLy8gICAgICAgIHByb2JhYmx5IHB1dCB0aGUgb3JpZ2luYWwgYXNzZXJ0IGFmdGVyIGZpeGlu
ZyB0aGF0LgorICAgICAgICAgICAgd2hpbGUgKHJlbmRlclN1cmZhY2VMYXllckxpc3QubGFzdCgp
ICE9IGxheWVyKSB7CisgICAgICAgICAgICAgICAgcmVuZGVyU3VyZmFjZUxheWVyTGlzdC5sYXN0
KCktPmNsZWFyUmVuZGVyU3VyZmFjZSgpOworICAgICAgICAgICAgICAgIHJlbmRlclN1cmZhY2VM
YXllckxpc3QucmVtb3ZlTGFzdCgpOworICAgICAgICAgICAgfQogICAgICAgICAgICAgQVNTRVJU
KHJlbmRlclN1cmZhY2VMYXllckxpc3QubGFzdCgpID09IGxheWVyKTsKICAgICAgICAgICAgIHJl
bmRlclN1cmZhY2VMYXllckxpc3QucmVtb3ZlTGFzdCgpOwogICAgICAgICAgICAgbGF5ZXItPmNs
ZWFyUmVuZGVyU3VyZmFjZSgpOwo=
</data>

          </attachment>
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>118775</attachid>
            <date>2011-12-12 04:19:59 -0800</date>
            <delta_ts>2011-12-12 12:53:44 -0800</delta_ts>
            <desc>added test case that reproduces the crash</desc>
            <filename>bug-74037-20111212041958.patch</filename>
            <type>text/plain</type>
            <size>8600</size>
            <attacher name="Shawn Singh">shawnsingh</attacher>
            
              <data encoding="base64">U3VidmVyc2lvbiBSZXZpc2lvbjogMTAyNDcyCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D
aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggNzUwYzRlMDkyNzM3NzM0
OWJlZTg5MmM4YTBkZjc1MTNkN2JhMmE2Mi4uZjZjNmZlZmI4ZjEwOGFhNTEwYjQ5NmNhZDgyZjM0
MjRhNDMwYjU4MSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv
dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDIwIEBACisyMDExLTEyLTEyICBTaGF3
biBTaW5naCAgPHNoYXduc2luZ2hAY2hyb21pdW0ub3JnPgorCisgICAgICAgIFtjaHJvbWl1bV0g
UmVtb3ZlIGFzc3VtcHRpb24gdGhhdCBlbXB0eSBzdXJmYWNlIGlzIGFsd2F5cyBhdCBlbmQgb2Yg
bGlzdAorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9NzQw
MzcKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBUZXN0
IGNhc2UgYWRkZWQgdG8gQ0NMYXllclRyZWVIb3N0Q29tbW9uVGVzdC5jcHAsIHdoaWNoIHJlcHJv
ZHVjZXMKKyAgICAgICAgYSBjcmFzaCByZXBvcnRlZCBpbiBodHRwOi8vY29kZS5nb29nbGUuY29t
L3AvY2hyb21pdW0vaXNzdWVzL2RldGFpbD9pZD0xMDY3MzQKKworICAgICAgICBUaGlzIHBhdGNo
IGZpeGVzIHRoZSBjcmFzaCBpbiBhIGxlc3Mgcmlza3kgd2F5IHRvIGJlIG1lcmdlZCBpbnRvCisg
ICAgICAgIG0xNywgYnV0IHRoZSByb290IG9mIHRoZSBpc3N1ZSBuZWVkcyB0byBiZSBhZGRyZXNz
ZWQgaW4gYQorICAgICAgICBmb2xsb3ctdXAgcGF0Y2guCisKKyAgICAgICAgKiBwbGF0Zm9ybS9n
cmFwaGljcy9jaHJvbWl1bS9jYy9DQ0xheWVyVHJlZUhvc3RDb21tb24uY3BwOgorICAgICAgICAo
V2ViQ29yZTo6Y2FsY3VsYXRlRHJhd1RyYW5zZm9ybXNBbmRWaXNpYmlsaXR5SW50ZXJuYWwpOgor
CiAyMDExLTEyLTA5ICBUb255IENoYW5nICA8dG9ueUBjaHJvbWl1bS5vcmc+CiAKICAgICAgICAg
VW5yZXZpZXdlZCwgcm9sbGluZyBvdXQgcjEwMjQxNi4KZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJL
aXQvY2hyb21pdW0vQ2hhbmdlTG9nIGIvU291cmNlL1dlYktpdC9jaHJvbWl1bS9DaGFuZ2VMb2cK
aW5kZXggZWQ1ZWM2NmMwMzdjM2E1MjA5OWJlMTMzYzE3NTEwMDg1YTM5NDg3Zi4uY2Y4NjJiNGJj
OWUyZjlmNTU1ZjRlZmUyMGJmNWE5YWFmZThkZjVhMiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYktp
dC9jaHJvbWl1bS9DaGFuZ2VMb2cKKysrIGIvU291cmNlL1dlYktpdC9jaHJvbWl1bS9DaGFuZ2VM
b2cKQEAgLTEsMyArMSwxMyBAQAorMjAxMS0xMi0xMiAgU2hhd24gU2luZ2ggIDxzaGF3bnNpbmdo
QGNocm9taXVtLm9yZz4KKworICAgICAgICBbY2hyb21pdW1dIFJlbW92ZSBhc3N1bXB0aW9uIHRo
YXQgZW1wdHkgc3VyZmFjZSBpcyBhbHdheXMgYXQgZW5kIG9mIGxpc3QKKyAgICAgICAgaHR0cHM6
Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTc0MDM3CisKKyAgICAgICAgUmV2aWV3
ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgKiB0ZXN0cy9DQ0xheWVyVHJlZUhvc3RD
b21tb25UZXN0LmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OlRFU1QpOgorCiAyMDExLTEyLTA5ICBD
YXJ5IENsYXJrICA8Y2FyeWNsYXJrQGdvb2dsZS5jb20+CiAKICAgICAgICAgQ2hyb21pdW0gREVQ
UyByb2xsIHRvIHBpY2sgdXAgbmV3IHVzZV9za2lhPTEgZGVmYXVsdCBvbiBDaHJvbWl1bS1NYWMK
ZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL3BsYXRmb3JtL2dyYXBoaWNzL2Nocm9taXVtL2Nj
L0NDTGF5ZXJUcmVlSG9zdENvbW1vbi5jcHAgYi9Tb3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9ncmFw
aGljcy9jaHJvbWl1bS9jYy9DQ0xheWVyVHJlZUhvc3RDb21tb24uY3BwCmluZGV4IDFkMDFlZDg4
YjI3YmU2ZWUwNmMyYmUwOTQ4ZGRhNWZjNjYzOGE4MTguLjU2NTA5YmNlYzNjNjFlMmRmZTE2NjRh
YjQxNjVmNDI5MzczOTNlMWIgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL3BsYXRmb3JtL2dy
YXBoaWNzL2Nocm9taXVtL2NjL0NDTGF5ZXJUcmVlSG9zdENvbW1vbi5jcHAKKysrIGIvU291cmNl
L1dlYkNvcmUvcGxhdGZvcm0vZ3JhcGhpY3MvY2hyb21pdW0vY2MvQ0NMYXllclRyZWVIb3N0Q29t
bW9uLmNwcApAQCAtNDM0LDEwICs0MzQsMTcgQEAgc3RhdGljIGJvb2wgY2FsY3VsYXRlRHJhd1Ry
YW5zZm9ybXNBbmRWaXNpYmlsaXR5SW50ZXJuYWwoTGF5ZXJUeXBlKiBsYXllciwgTGF5ZXIKICAg
ICAgICAgICAgIHJlbmRlclN1cmZhY2UtPnNldFJlcGxpY2FEcmF3VHJhbnNmb3JtKHJlcGxpY2FE
cmF3VHJhbnNmb3JtKTsKICAgICAgICAgfQogCi0gICAgICAgIC8vIElmIGEgcmVuZGVyIHN1cmZh
Y2UgaGFzIG5vIGxheWVyIGxpc3QsIHRoZW4gaXQgYW5kIG5vbmUgb2YgaXRzCi0gICAgICAgIC8v
IGNoaWxkcmVuIG5lZWRlZCB0byBnZXQgZHJhd24uIFRoZXJlZm9yZSwgaXQgc2hvdWxkIGJlIHRo
ZSBsYXN0IGxheWVyCi0gICAgICAgIC8vIGluIHRoZSByZW5kZXIgc3VyZmFjZSBsaXN0IGFuZCB3
ZSBjYW4gdHJpdmlhbGx5IHJlbW92ZSBpdC4KKyAgICAgICAgLy8gSWYgYSByZW5kZXIgc3VyZmFj
ZSBoYXMgbm8gbGF5ZXIgbGlzdCwgdGhlbiBpdCBhbmQgbm9uZSBvZiBpdHMgY2hpbGRyZW4gbmVl
ZGVkIHRvIGdldCBkcmF3bi4KICAgICAgICAgaWYgKCFsYXllci0+cmVuZGVyU3VyZmFjZSgpLT5s
YXllckxpc3QoKS5zaXplKCkpIHsKKyAgICAgICAgICAgIC8vIEZJWE1FOiBPcmlnaW5hbGx5IHdl
IGFzc2VydGVkIHRoYXQgdGhpcyBsYXllciB3YXMgYWxyZWFkeSBhdCB0aGUgZW5kIG9mIHRoZQor
ICAgICAgICAgICAgLy8gICAgICAgIGxpc3QsIGFuZCBvbmx5IG5lZWRlZCB0byByZW1vdmUgdGhh
dCBsYXllci4gRm9yIG5vdywgd2UgcmVtb3ZlIHRoZQorICAgICAgICAgICAgLy8gICAgICAgIGVu
dGlyZSBzdWJ0cmVlIG9mIHN1cmZhY2VzIHRvIGZpeCBhIGNyYXNoIGJ1Zy4gVGhlIHJvb3QgY2F1
c2UgaXMKKyAgICAgICAgICAgIC8vICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93
X2J1Zy5jZ2k/aWQ9NzQxNDcgYW5kIHdlIHNob3VsZCBiZSBhYmxlCisgICAgICAgICAgICAvLyAg
ICAgICAgdG8gcHV0IHRoZSBvcmlnaW5hbCBhc3NlcnQgYWZ0ZXIgZml4aW5nIHRoYXQuCisgICAg
ICAgICAgICB3aGlsZSAocmVuZGVyU3VyZmFjZUxheWVyTGlzdC5sYXN0KCkgIT0gbGF5ZXIpIHsK
KyAgICAgICAgICAgICAgICByZW5kZXJTdXJmYWNlTGF5ZXJMaXN0Lmxhc3QoKS0+Y2xlYXJSZW5k
ZXJTdXJmYWNlKCk7CisgICAgICAgICAgICAgICAgcmVuZGVyU3VyZmFjZUxheWVyTGlzdC5yZW1v
dmVMYXN0KCk7CisgICAgICAgICAgICB9CiAgICAgICAgICAgICBBU1NFUlQocmVuZGVyU3VyZmFj
ZUxheWVyTGlzdC5sYXN0KCkgPT0gbGF5ZXIpOwogICAgICAgICAgICAgcmVuZGVyU3VyZmFjZUxh
eWVyTGlzdC5yZW1vdmVMYXN0KCk7CiAgICAgICAgICAgICBsYXllci0+Y2xlYXJSZW5kZXJTdXJm
YWNlKCk7CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0L2Nocm9taXVtL3Rlc3RzL0NDTGF5ZXJU
cmVlSG9zdENvbW1vblRlc3QuY3BwIGIvU291cmNlL1dlYktpdC9jaHJvbWl1bS90ZXN0cy9DQ0xh
eWVyVHJlZUhvc3RDb21tb25UZXN0LmNwcAppbmRleCA0ZDU5MjE0OTc4ZTYzYWY3MDI5OWJmM2Q3
ZjgwNzkxY2IxNGM3ZWQ2Li5hMzVkOTY1MjI0ZmJlNmRmNzk5NDY4NzI1ZjdkYjYwMjYwNDUwNDQ4
IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViS2l0L2Nocm9taXVtL3Rlc3RzL0NDTGF5ZXJUcmVlSG9z
dENvbW1vblRlc3QuY3BwCisrKyBiL1NvdXJjZS9XZWJLaXQvY2hyb21pdW0vdGVzdHMvQ0NMYXll
clRyZWVIb3N0Q29tbW9uVGVzdC5jcHAKQEAgLTUwOSw2ICs1MDksNzkgQEAgVEVTVChDQ0xheWVy
VHJlZUhvc3RDb21tb25UZXN0LCB2ZXJpZnlSZW5kZXJTdXJmYWNlTGlzdEZvclRyYW5zcGFyZW50
Q2hpbGQpCiAgICAgRVhQRUNUX0VRKHBhcmVudC0+ZHJhd2FibGVDb250ZW50UmVjdCgpLCBJbnRS
ZWN0KCkpOwogfQogCitURVNUKENDTGF5ZXJUcmVlSG9zdENvbW1vblRlc3QsIHZlcmlmeUNsaXBS
ZWN0Q3VsbHNSZW5kZXJTdXJmYWNlcykKK3sKKyAgICAvLyBUaGUgZW50aXJlIHN1YnRyZWUgb2Yg
bGF5ZXJzIHRoYXQgYXJlIG91dHNpZGUgdGhlIGNsaXBSZWN0IHNob3VsZCBiZSBjdWxsZWQgYXdh
eSwKKyAgICAvLyBhbmQgc2hvdWxkIG5vdCBhZmZlY3QgdGhlIHJlbmRlclN1cmZhY2VMYXllckxp
c3QuCisgICAgLy8KKyAgICAvLyBUaGUgdGVzdCB0cmVlIGlzIHNldCB1cCBhcyBmb2xsb3dzOgor
ICAgIC8vICAtIGFsbCBsYXllcnMgZXhjZXB0IHRoZSBsZWFmTm9kZXMgYXJlIGZvcmNlZCB0byBi
ZSBhIG5ldyByZW5kZXJTdXJmYWNlIHRoYXQgaGF2ZSBzb21ldGhpbmcgdG8gZHJhdy4KKyAgICAv
LyAgLSBwYXJlbnQgaXMgYSBsYXJnZSBjb250YWluZXIgbGF5ZXIuCisgICAgLy8gIC0gY2hpbGQg
aGFzIG1hc2tzVG9Cb3VuZHM9dHJ1ZSB0byBjYXVzZSBjbGlwcGluZy4KKyAgICAvLyAgLSBncmFu
ZENoaWxkIGlzIHBvc2l0aW9uZWQgb3V0c2lkZSBvZiB0aGUgY2hpbGQncyBib3VuZHMKKyAgICAv
LyAgLSBncmVhdEdyYW5kQ2hpbGQgaXMgYWxzbyBrZXB0IG91dHNpZGUgY2hpbGQncyBib3VuZHMu
CisgICAgLy8KKyAgICAvLyBJbiB0aGlzIGNvbmZpZ3VyYXRpb24sIGdyYW5kQ2hpbGQgYW5kIGdy
ZWF0R3JhbmRDaGlsZCBhcmUgY29tcGxldGVseSBvdXRzaWRlIHRoZQorICAgIC8vIGNsaXBSZWN0
LCBhbmQgdGhleSBzaG91bGQgbmV2ZXIgZ2V0IHNjaGVkdWxlZCBvbiB0aGUgbGlzdCBvZiByZW5k
ZXJTdXJmYWNlcy4KKyAgICAvLworCisgICAgY29uc3QgVHJhbnNmb3JtYXRpb25NYXRyaXggaWRl
bnRpdHlNYXRyaXg7CisgICAgUmVmUHRyPExheWVyQ2hyb21pdW0+IHBhcmVudCA9IExheWVyQ2hy
b21pdW06OmNyZWF0ZSgwKTsKKyAgICBSZWZQdHI8TGF5ZXJDaHJvbWl1bT4gY2hpbGQgPSBMYXll
ckNocm9taXVtOjpjcmVhdGUoMCk7CisgICAgUmVmUHRyPExheWVyQ2hyb21pdW0+IGdyYW5kQ2hp
bGQgPSBMYXllckNocm9taXVtOjpjcmVhdGUoMCk7CisgICAgUmVmUHRyPExheWVyQ2hyb21pdW0+
IGdyZWF0R3JhbmRDaGlsZCA9IExheWVyQ2hyb21pdW06OmNyZWF0ZSgwKTsKKyAgICBSZWZQdHI8
TGF5ZXJDaHJvbWl1bVdpdGhGb3JjZWREcmF3c0NvbnRlbnQ+IGxlYWZOb2RlMSA9IGFkb3B0UmVm
KG5ldyBMYXllckNocm9taXVtV2l0aEZvcmNlZERyYXdzQ29udGVudCgwKSk7CisgICAgUmVmUHRy
PExheWVyQ2hyb21pdW1XaXRoRm9yY2VkRHJhd3NDb250ZW50PiBsZWFmTm9kZTIgPSBhZG9wdFJl
ZihuZXcgTGF5ZXJDaHJvbWl1bVdpdGhGb3JjZWREcmF3c0NvbnRlbnQoMCkpOworICAgIHBhcmVu
dC0+Y3JlYXRlUmVuZGVyU3VyZmFjZSgpOworICAgIHBhcmVudC0+YWRkQ2hpbGQoY2hpbGQpOwor
ICAgIGNoaWxkLT5hZGRDaGlsZChncmFuZENoaWxkKTsKKyAgICBncmFuZENoaWxkLT5hZGRDaGls
ZChncmVhdEdyYW5kQ2hpbGQpOworCisgICAgLy8gbGVhZk5vZGUxIGVuc3VyZXMgdGhhdCBwYXJl
bnQgYW5kIGNoaWxkIGFyZSBrZXB0IG9uIHRoZSByZW5kZXJTdXJmYWNlTGF5ZXJMaXN0LAorICAg
IC8vIGV2ZW4gdGhvdWdoIGdyYW5kQ2hpbGQgYW5kIGdyZWF0R3JhbmRDaGlsZCBzaG91bGQgYmUg
Y2xpcHBlZC4KKyAgICBjaGlsZC0+YWRkQ2hpbGQobGVhZk5vZGUxKTsKKyAgICBncmVhdEdyYW5k
Q2hpbGQtPmFkZENoaWxkKGxlYWZOb2RlMik7CisKKyAgICBzZXRMYXllclByb3BlcnRpZXNGb3JU
ZXN0aW5nKHBhcmVudC5nZXQoKSwgaWRlbnRpdHlNYXRyaXgsIGlkZW50aXR5TWF0cml4LCBGbG9h
dFBvaW50KDAsIDApLCBGbG9hdFBvaW50KDAsIDApLCBJbnRTaXplKDUwMCwgNTAwKSwgZmFsc2Up
OworICAgIHNldExheWVyUHJvcGVydGllc0ZvclRlc3RpbmcoY2hpbGQuZ2V0KCksIGlkZW50aXR5
TWF0cml4LCBpZGVudGl0eU1hdHJpeCwgRmxvYXRQb2ludCgwLCAwKSwgRmxvYXRQb2ludCgwLCAw
KSwgSW50U2l6ZSgyMCwgMjApLCBmYWxzZSk7CisgICAgc2V0TGF5ZXJQcm9wZXJ0aWVzRm9yVGVz
dGluZyhncmFuZENoaWxkLmdldCgpLCBpZGVudGl0eU1hdHJpeCwgaWRlbnRpdHlNYXRyaXgsIEZs
b2F0UG9pbnQoMCwgMCksIEZsb2F0UG9pbnQoNDUsIDQ1KSwgSW50U2l6ZSgxMCwgMTApLCBmYWxz
ZSk7CisgICAgc2V0TGF5ZXJQcm9wZXJ0aWVzRm9yVGVzdGluZyhncmVhdEdyYW5kQ2hpbGQuZ2V0
KCksIGlkZW50aXR5TWF0cml4LCBpZGVudGl0eU1hdHJpeCwgRmxvYXRQb2ludCgwLCAwKSwgRmxv
YXRQb2ludCgwLCAwKSwgSW50U2l6ZSgxMCwgMTApLCBmYWxzZSk7CisgICAgc2V0TGF5ZXJQcm9w
ZXJ0aWVzRm9yVGVzdGluZyhsZWFmTm9kZTEuZ2V0KCksIGlkZW50aXR5TWF0cml4LCBpZGVudGl0
eU1hdHJpeCwgRmxvYXRQb2ludCgwLCAwKSwgRmxvYXRQb2ludCgwLCAwKSwgSW50U2l6ZSg1MDAs
IDUwMCksIGZhbHNlKTsKKyAgICBzZXRMYXllclByb3BlcnRpZXNGb3JUZXN0aW5nKGxlYWZOb2Rl
Mi5nZXQoKSwgaWRlbnRpdHlNYXRyaXgsIGlkZW50aXR5TWF0cml4LCBGbG9hdFBvaW50KDAsIDAp
LCBGbG9hdFBvaW50KDAsIDApLCBJbnRTaXplKDIwLCAyMCksIGZhbHNlKTsKKworICAgIGNoaWxk
LT5zZXRNYXNrc1RvQm91bmRzKHRydWUpOworICAgIGNoaWxkLT5zZXRPcGFjaXR5KDAuNCk7Cisg
ICAgZ3JhbmRDaGlsZC0+c2V0T3BhY2l0eSgwLjUpOworICAgIGdyZWF0R3JhbmRDaGlsZC0+c2V0
T3BhY2l0eSgwLjQpOworCisgICAgLy8gQ29udGFtaW5hdGUgdGhlIGdyYW5kQ2hpbGQgYW5kIGdy
ZWF0R3JhbmRDaGlsZCdzIGNsaXBSZWN0IHRvIHJlcHJvZHVjZSB0aGUgY3Jhc2gKKyAgICAvLyBi
dWcgZm91bmQgaW4gaHR0cDovL2NvZGUuZ29vZ2xlLmNvbS9wL2Nocm9taXVtL2lzc3Vlcy9kZXRh
aWw/aWQ9MTA2NzM0LiBJbiB0aGlzCisgICAgLy8gYnVnLCB0aGUgY2xpcFJlY3Qgd2FzIG5vdCBy
ZS1jb21wdXRlZCBmb3IgbGF5ZXJzIHRoYXQgY3JlYXRlIFJlbmRlclN1cmZhY2VzLCBhbmQKKyAg
ICAvLyB0aGVyZWZvcmUgbGVhZk5vZGUyIHRoaW5rcyBpdCBzaG91bGQgZHJhdyBpdHNlbGYuIEFz
IGEgcmVzdWx0LCBhbiBleHRyYQorICAgIC8vIHJlbmRlclN1cmZhY2UgcmVtYWlucyBvbiB0aGUg
cmVuZGVyU3VyZmFjZUxheWVyTGlzdCwgd2hpY2ggdmlvbGF0ZXMgdGhlIGFzc3VtcHRpb24KKyAg
ICAvLyB0aGF0IGFuIGVtcHR5IHJlbmRlclN1cmZhY2Ugd2lsbCBhbHdheXMgYmUgdGhlIGxhc3Qg
aXRlbSBvbiB0aGUgbGlzdCwgd2hpY2gKKyAgICAvLyB1bHRpbWF0ZWx5IGNhdXNlZCB0aGUgY3Jh
c2guCisgICAgLy8KKyAgICAvLyBGSVhNRTogaXQgaXMgYWxzbyB1c2VmdWwgdG8gdGVzdCB3aXRo
IHRoaXMgY29tbWVudGVkIG91dC4gRXZlbnR1YWxseSB3ZSBzaG91bGQKKyAgICAvLyBjcmVhdGUg
c2V2ZXJhbCB0ZXN0IGNhc2VzIHRoYXQgdGVzdCBjbGlwUmVjdC9kcmF3YWJsZUNvbnRlbnRSZWN0
IGNvbXB1dGF0aW9uLgorICAgIGNoaWxkLT5zZXRDbGlwUmVjdChJbnRSZWN0KEludFBvaW50Ojp6
ZXJvKCksIEludFNpemUoMjAsIDIwKSkpOworICAgIGdyZWF0R3JhbmRDaGlsZC0+c2V0Q2xpcFJl
Y3QoSW50UmVjdChJbnRQb2ludDo6emVybygpLCBJbnRTaXplKDEyMzQsIDEyMzQpKSk7CisKKyAg
ICBWZWN0b3I8UmVmUHRyPExheWVyQ2hyb21pdW0+ID4gcmVuZGVyU3VyZmFjZUxheWVyTGlzdDsK
KyAgICBWZWN0b3I8UmVmUHRyPExheWVyQ2hyb21pdW0+ID4gZHVtbXlMYXllckxpc3Q7CisgICAg
aW50IGR1bW15TWF4VGV4dHVyZVNpemUgPSA1MTI7CisKKyAgICAvLyBGSVhNRTogd2hlbiB3ZSBm
aXggdGhpcyAicm9vdC1sYXllciBzcGVjaWFsIGNhc2UiIGJlaGF2aW9yIGluIENDTGF5ZXJUcmVl
SG9zdCwgd2Ugd2lsbCBoYXZlIHRvIGZpeCBpdCBoZXJlLCB0b28uCisgICAgcGFyZW50LT5zZXRD
bGlwUmVjdChJbnRSZWN0KEludFBvaW50Ojp6ZXJvKCksIHBhcmVudC0+Ym91bmRzKCkpKTsKKyAg
ICByZW5kZXJTdXJmYWNlTGF5ZXJMaXN0LmFwcGVuZChwYXJlbnQpOworCisgICAgQ0NMYXllclRy
ZWVIb3N0Q29tbW9uOjpjYWxjdWxhdGVEcmF3VHJhbnNmb3Jtc0FuZFZpc2liaWxpdHkocGFyZW50
LmdldCgpLCBwYXJlbnQuZ2V0KCksIGlkZW50aXR5TWF0cml4LCBpZGVudGl0eU1hdHJpeCwgcmVu
ZGVyU3VyZmFjZUxheWVyTGlzdCwgZHVtbXlMYXllckxpc3QsIGR1bW15TWF4VGV4dHVyZVNpemUp
OworCisgICAgQVNTRVJUX0VRKDJVLCByZW5kZXJTdXJmYWNlTGF5ZXJMaXN0LnNpemUoKSk7Cisg
ICAgRVhQRUNUX0VRKHBhcmVudC0+aWQoKSwgcmVuZGVyU3VyZmFjZUxheWVyTGlzdFswXS0+aWQo
KSk7CisgICAgRVhQRUNUX0VRKGNoaWxkLT5pZCgpLCByZW5kZXJTdXJmYWNlTGF5ZXJMaXN0WzFd
LT5pZCgpKTsKK30KKwogLy8gRklYTUU6CiAvLyBjb250aW51ZSB3b3JraW5nIG9uIGh0dHBzOi8v
YnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD02ODk0MgogLy8gIC0gYWRkIGEgdGVzdCB0
byB2ZXJpZnkgY2xpcHBpbmcgdGhhdCBjaGFuZ2VzIHRoZSAiY2VudGVyIHBvaW50Igo=
</data>

          </attachment>
      

    </bug>

</bugzilla>