Content-Type: multipart/mixed; boundary="------------VSyUaBX0fVqNSmUIeXHUA0ru"
Message-ID: <889a06dd-45fc-423b-9dd2-87d5b5dc60c6@gmail.com>
Date: Mon, 28 Sep 2026 12:54:43 +0300
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
From: Vlad Lesin <vladlesin@gmail.com>
Subject: ReplicationSlotRelease() clobbers another backend's statusFlags entry
To: PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Content-Language: en-US, ru-RU
Cc: Andrey Borodin <x4mmm@yandex-team.ru>
Archived-At: 
 <https://www.postgresql.org/message-id/889a06dd-45fc-423b-9dd2-87d5b5dc60c6%40gmail.com>
Precedence: bulk

This is a multi-part message in MIME format.
--------------VSyUaBX0fVqNSmUIeXHUA0ru
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit

Hi,

We chased a sporadic crash in our CI for a while and it turned out to be 
a live PostgreSQL bug, so here it is with a patch.

A checkpoint that invalidates an obsolete replication slot wipes the 
shared status flags of an unrelated backend. On an assert-enabled server 
that backend aborts at its next commit and the postmaster takes the 
whole cluster down with it. Without assertions nobody notices, and in 
the worst case vacuum then removes rows a standby still needs. It 
affects every branch from v14 up, and it is not primary-only: a standby 
reaches the same code during a restartpoint, and from v16 during 
ordinary replay.

The mechanism is a one-line indexing mistake. ReplicationSlotRelease() 
ends with:

	/* might not have been set when we've been a plain slot */
	LWLockAcquire(ProcArrayLock, LW_EXCLUSIVE);
	MyProc->statusFlags &= ~PROC_IN_LOGICAL_DECODING;
	ProcGlobal->statusFlags[MyProc->pgxactoff] = MyProc->statusFlags;
	LWLockRelease(ProcArrayLock);

That is correct only for a process that is in the proc array. An 
auxiliary process never enters it, so its pgxactoff is still the zero 
InitProcGlobal() left there, and the store lands on the 
ProcGlobal->statusFlags[] entry of whichever backend owns offset 0.

The two statements are not the same operation. The bit clear applies to 
the caller's own private copy, which in an auxiliary process is zero 
anyway; the store is an assignment onto a foreign entry, so the victim 
loses every flag it holds, not just PROC_IN_LOGICAL_DECODING.

Auxiliary processes do get here. InvalidatePossiblyObsoleteSlot() takes 
the doomed slot by hand, setting MyReplicationSlot and active_pid under 
the slot's spinlock, and then lets go of it through 
ReplicationSlotRelease():

	CreateCheckPoint()                      checkpointer
	CreateRestartPoint()                    startup process
	xlog_redo()                             startup process, v16+
	ResolveRecoveryConflictWithSnapshot()   startup process, v16+
	  -> InvalidateObsoleteReplicationSlots()
	     -> InvalidatePossiblyObsoleteSlot()
	        -> ReplicationSlotRelease()

The last two came in with 26669757b6a, which is why a standby can reach 
this during replay from v16 on. From v18 idle_replication_slot_timeout 
can trigger the invalidation as well, so max_slot_wal_keep_size is no 
longer needed to get there at all.

The damage surfaces later, and only sometimes. The victim has to reach 
the end of its transaction while running VACUUM or CREATE INDEX 
CONCURRENTLY. ProcArrayEndTransaction() then compares its private flags 
against ProcGlobal->statusFlags[]. In an --enable-cassert build the 
assertion there fires:

	TRAP: failed Assert("proc->statusFlags == 
ProcGlobal->statusFlags[proc->pgxactoff]")
	LOG:  client backend was terminated by signal 6: Aborted

That is how we found it: the primary died while the checkpointer was 
invalidating a slot that had fallen behind max_slot_wal_keep_size, and 
autovacuum happened to be vacuuming pg_depend at that moment.

The victim is the proc array member with the lowest PGPROC slot number, 
normally the longest-connected regular backend, or an autovacuum worker 
when no client is connected. Whether the damage is noticed depends on 
what that process happens to be doing, which is why the crash looks random.

Without assertions nothing complains, and what the corruption costs 
depends on which flag the victim lost. Losing PROC_IN_VACUUM or 
PROC_IN_SAFE_IC only makes horizons more conservative. The next commit 
rewrites the entry anyway.

PROC_AFFECTS_ALL_HORIZONS is the bad one. InitWalSender() sets it on a 
walsender that connected without a database, and nothing sets it again 
for the life of that connection. If such a walsender is the victim, 
ComputeXidHorizons() stops applying its hot standby feedback xmin to 
data_oldest_nonremovable. Vacuum can then remove rows the standby still 
needs.

The attached patch adds a reproducer, 
src/test/recovery/t/057_slot_invalidation_statusflags.pl. It creates a 
physical slot nobody streams from and pushes it past 
max_slot_wal_keep_size. A conflicting ShareUpdateExclusiveLock parks a 
backend inside VACUUM. vacuum_rel() sets PROC_IN_VACUUM before it opens 
the relation, so that backend waits with the flag set. Then CHECKPOINT 
invalidates the slot.

I ran the test on REL_13_22, REL_14_24, REL_16_15, REL_17_11, REL_18_6 
and master. v13 passes, everything from v14 up fails the same way. v15 
and v19 carry the statement verbatim, so the range is v14 through master.

The patch skips the update unless PROC_IN_LOGICAL_DECODING is actually 
set. Only StartupDecodingContext() sets that flag and no auxiliary 
process reaches it, so nothing changes for a process in the proc array, 
while the checkpointer no longer executes the store at all.

With the patch applied on master I ran the core regression tests, plus 
the TAP suites in src/test/recovery and src/test/subscription. All of 
them pass.

Related, neither of them this bug:

https://postgr.es/m/tencent_CA7420C82971BC4B64F0748A7D2898A4720A%40qq.com
reports the same assertion from a different route, an exiting walsender 
whose pgxactoff was stale because ProcArrayRemove() had already 
compacted the ProcGlobal arrays. That one is v14-only, since 2f6501fa3c5 
moved the slot release to before_shmem_exit() in v15, and nothing from 
the thread was committed.

1f2e51e3c7c, and its back-branch commits, fixed ReplicationSlotRelease() 
for a caller in single user mode. Same shape as this one: the function 
assumes its caller is an ordinary backend.


-- 
Best regards,
Vlad

--------------VSyUaBX0fVqNSmUIeXHUA0ru
Content-Type: text/x-patch; charset=UTF-8;
 name="v1-0001-Fix-clobbering-of-shared-statusFlags-when-a-slot-.patch"
Content-Disposition: attachment;
 filename*0="v1-0001-Fix-clobbering-of-shared-statusFlags-when-a-slot-.pa";
 filename*1="tch"
Content-Transfer-Encoding: base64

RnJvbSBiNjAwYTI1NzYxZjUxZmFkOTM4ZWZhMDNmMjg2MTY1ZDIxNWMzNjZhIE1vbiBTZXAg
MTcgMDA6MDA6MDAgMjAwMQpGcm9tOiBWbGFkIExlc2luIDx2bGFkX2xlc2luQG1haWwucnU+
CkRhdGU6IFdlZCwgMjMgU2VwIDIwMjYgMTA6MzM6NDkgLTA3MDAKU3ViamVjdDogW1BBVENI
IHYxXSBGaXggY2xvYmJlcmluZyBvZiBzaGFyZWQgc3RhdHVzRmxhZ3Mgd2hlbiBhIHNsb3Qg
aXMKIGludmFsaWRhdGVkCgpSZXBsaWNhdGlvblNsb3RSZWxlYXNlKCkgZW5kZWQgd2l0aDoK
CiAgICBNeVByb2MtPnN0YXR1c0ZsYWdzICY9IH5QUk9DX0lOX0xPR0lDQUxfREVDT0RJTkc7
CiAgICBQcm9jR2xvYmFsLT5zdGF0dXNGbGFnc1tNeVByb2MtPnBneGFjdG9mZl0gPSBNeVBy
b2MtPnN0YXR1c0ZsYWdzOwoKVGhhdCBpcyBvbmx5IGNvcnJlY3QgZm9yIGEgcHJvY2VzcyBp
biB0aGUgcHJvYyBhcnJheS4gIEF1eGlsaWFyeQpwcm9jZXNzZXMgbmV2ZXIgam9pbiBpdCwg
c28gdGhlaXIgcGd4YWN0b2ZmIGlzIHN0aWxsIHRoZSB6ZXJvIGl0IHdhcwppbml0aWFsaXpl
ZCB0bywgYW5kIHRoZSBzdG9yZSBvdmVyd3JpdGVzIHRoZSBlbnRyeSBvZiB3aGljaGV2ZXIg
YmFja2VuZApvd25zIG9mZnNldCAwLgoKVGhlIGNoZWNrcG9pbnRlciBhbmQgdGhlIHN0YXJ0
dXAgcHJvY2VzcyBib3RoIGdldCB0aGVyZS4KSW52YWxpZGF0ZVBvc3NpYmx5T2Jzb2xldGVT
bG90KCkgYWNxdWlyZXMgYSBzbG90IHRoYXQgaGFzIGZhbGxlbiBiZWhpbmQKbWF4X3Nsb3Rf
d2FsX2tlZXBfc2l6ZSBhbmQgcmVsZWFzZXMgaXQgdGhyb3VnaCBSZXBsaWNhdGlvblNsb3RS
ZWxlYXNlKCk7CnRoZSBzdGFydHVwIHByb2Nlc3MgZG9lcyBzbyBkdXJpbmcgYSByZXN0YXJ0
cG9pbnQsIGFuZCB3aGVuIHJlcGxheQppbnZhbGlkYXRlcyBhIHNsb3QgdGhhdCBjb25mbGlj
dHMgd2l0aCByZWNvdmVyeS4KClRoZSB0d28gc3RhdGVtZW50cyBhY3Qgb24gZGlmZmVyZW50
IHByb2Nlc3Nlcy4gIFRoZSBiaXQgY2xlYXIgYXBwbGllcyB0bwp0aGUgY2FsbGVyJ3Mgb3du
IHByaXZhdGUgY29weSwgd2hpY2ggaW4gYW4gYXV4aWxpYXJ5IHByb2Nlc3MgaXMgemVybwph
bHJlYWR5OyB0aGUgc3RvcmUgaXMgYW4gYXNzaWdubWVudCByYXRoZXIgdGhhbiBhIGJpdCBj
bGVhciwgYW5kIGl0CmxhbmRzIG9uIGFub3RoZXIgYmFja2VuZCdzIGVudHJ5LiAgVGhlIGJh
Y2tlbmQgYXQgb2Zmc2V0IDAgdGhlcmVmb3JlCmxvc2VzIG5vdCBqdXN0IFBST0NfSU5fTE9H
SUNBTF9ERUNPRElORyBidXQgZXZlcnkgZmxhZyBpdCBob2xkcy4KClNraXAgdGhlIHVwZGF0
ZSB1bmxlc3MgUFJPQ19JTl9MT0dJQ0FMX0RFQ09ESU5HIGlzIHNldC4gIE5vdGhpbmcgYnV0
ClN0YXJ0dXBEZWNvZGluZ0NvbnRleHQoKSBzZXRzIHRoYXQgZmxhZywgYW5kIG5vIGF1eGls
aWFyeSBwcm9jZXNzCnJlYWNoZXMgaXQsIHNvIG5vdGhpbmcgY2hhbmdlcyBmb3IgYSBwcm9j
ZXNzIGluIHRoZSBwcm9jIGFycmF5LiAgQXNzZXJ0CmFzIG11Y2ggYXQgYm90aCBwbGFjZXMs
IGFkZGluZyBBbUF1eGlsaWFyeVByb2Nlc3MoKTsgdGhlIGF1eGlsaWFyeQpiYWNrZW5kIHR5
cGVzIGFyZSBhbHJlYWR5IGNvbnRpZ3VvdXMgaW4gQmFja2VuZFR5cGUuCgpCYWNrLXBhdGNo
IHRvIHYxNCwgd2hlcmUgNTc4OGUyNThiYjIgaW50cm9kdWNlZCB0aGUgYXJyYXkgaW5kZXhl
ZCBieQpwZ3hhY3RvZmYuCgpCYWNrcGF0Y2gtdGhyb3VnaDogMTQKLS0tCiBzcmMvYmFja2Vu
ZC9yZXBsaWNhdGlvbi9sb2dpY2FsL2xvZ2ljYWwuYyAgICAgfCAgIDMgKwogc3JjL2JhY2tl
bmQvcmVwbGljYXRpb24vc2xvdC5jICAgICAgICAgICAgICAgIHwgIDIzICsrKy0KIHNyYy9p
bmNsdWRlL21pc2NhZG1pbi5oICAgICAgICAgICAgICAgICAgICAgICB8ICAgMyArCiBzcmMv
dGVzdC9yZWNvdmVyeS9tZXNvbi5idWlsZCAgICAgICAgICAgICAgICAgfCAgIDEgKwogLi4u
L3QvMDU3X3Nsb3RfaW52YWxpZGF0aW9uX3N0YXR1c2ZsYWdzLnBsICAgIHwgMTI5ICsrKysr
KysrKysrKysrKysrKwogNSBmaWxlcyBjaGFuZ2VkLCAxNTQgaW5zZXJ0aW9ucygrKSwgNSBk
ZWxldGlvbnMoLSkKIGNyZWF0ZSBtb2RlIDEwMDY0NCBzcmMvdGVzdC9yZWNvdmVyeS90LzA1
N19zbG90X2ludmFsaWRhdGlvbl9zdGF0dXNmbGFncy5wbAoKZGlmZiAtLWdpdCBhL3NyYy9i
YWNrZW5kL3JlcGxpY2F0aW9uL2xvZ2ljYWwvbG9naWNhbC5jIGIvc3JjL2JhY2tlbmQvcmVw
bGljYXRpb24vbG9naWNhbC9sb2dpY2FsLmMKaW5kZXggOThlNWYxZGQ4ZjkuLjRkODMzNWI0
YTdkIDEwMDY0NAotLS0gYS9zcmMvYmFja2VuZC9yZXBsaWNhdGlvbi9sb2dpY2FsL2xvZ2lj
YWwuYworKysgYi9zcmMvYmFja2VuZC9yZXBsaWNhdGlvbi9sb2dpY2FsL2xvZ2ljYWwuYwpA
QCAtMjcyLDYgKzI3Miw5IEBAIFN0YXJ0dXBEZWNvZGluZ0NvbnRleHQoTGlzdCAqb3V0cHV0
X3BsdWdpbl9vcHRpb25zLAogCSAqLwogCWlmICghSXNUcmFuc2FjdGlvbk9yVHJhbnNhY3Rp
b25CbG9jaygpKQogCXsKKwkJLyogT25seSBhIHByb2MgYXJyYXkgbWVtYmVyIGhhcyBhIHBn
eGFjdG9mZiBvZiBpdHMgb3duLiAqLworCQlBc3NlcnQoIUFtQXV4aWxpYXJ5UHJvY2Vzcygp
KTsKKwogCQlMV0xvY2tBY3F1aXJlKFByb2NBcnJheUxvY2ssIExXX0VYQ0xVU0lWRSk7CiAJ
CU15UHJvYy0+c3RhdHVzRmxhZ3MgfD0gUFJPQ19JTl9MT0dJQ0FMX0RFQ09ESU5HOwogCQlQ
cm9jR2xvYmFsLT5zdGF0dXNGbGFnc1tNeVByb2MtPnBneGFjdG9mZl0gPSBNeVByb2MtPnN0
YXR1c0ZsYWdzOwpkaWZmIC0tZ2l0IGEvc3JjL2JhY2tlbmQvcmVwbGljYXRpb24vc2xvdC5j
IGIvc3JjL2JhY2tlbmQvcmVwbGljYXRpb24vc2xvdC5jCmluZGV4IDYzY2U2ZDI3ODg1Li42
NjNlNDRiMjEyMyAxMDA2NDQKLS0tIGEvc3JjL2JhY2tlbmQvcmVwbGljYXRpb24vc2xvdC5j
CisrKyBiL3NyYy9iYWNrZW5kL3JlcGxpY2F0aW9uL3Nsb3QuYwpAQCAtODMxLDExICs4MzEs
MjQgQEAgUmVwbGljYXRpb25TbG90UmVsZWFzZSh2b2lkKQogCQlNeVJlcGxpY2F0aW9uU2xv
dCA9IE5VTEw7CiAJfQogCi0JLyogbWlnaHQgbm90IGhhdmUgYmVlbiBzZXQgd2hlbiB3ZSd2
ZSBiZWVuIGEgcGxhaW4gc2xvdCAqLwotCUxXTG9ja0FjcXVpcmUoUHJvY0FycmF5TG9jaywg
TFdfRVhDTFVTSVZFKTsKLQlNeVByb2MtPnN0YXR1c0ZsYWdzICY9IH5QUk9DX0lOX0xPR0lD
QUxfREVDT0RJTkc7Ci0JUHJvY0dsb2JhbC0+c3RhdHVzRmxhZ3NbTXlQcm9jLT5wZ3hhY3Rv
ZmZdID0gTXlQcm9jLT5zdGF0dXNGbGFnczsKLQlMV0xvY2tSZWxlYXNlKFByb2NBcnJheUxv
Y2spOworCS8qCisJICogVGhpcyBmdW5jdGlvbiBpcyBhbHNvIHJlYWNoZWQgZnJvbSBhbiBh
dXhpbGlhcnkgcHJvY2VzczoKKwkgKiBJbnZhbGlkYXRlUG9zc2libHlPYnNvbGV0ZVNsb3Qo
KSBhY3F1aXJlcyB0aGUgZG9vbWVkIHNsb3Qgb24gYmVoYWxmIG9mCisJICogdGhlIGNoZWNr
cG9pbnRlciwgb3Igb2YgdGhlIHN0YXJ0dXAgcHJvY2VzcyBkdXJpbmcgYSByZXN0YXJ0cG9p
bnQsIGFuZAorCSAqIHJlbGVhc2VzIGl0IGhlcmUuICBBbiBhdXhpbGlhcnkgcHJvY2VzcyBp
cyBuZXZlciBlbnRlcmVkIGludG8gdGhlIHByb2MKKwkgKiBhcnJheSwgc28gaXRzIHBneGFj
dG9mZiBpcyBzdGlsbCB0aGUgemVybyBpdCB3YXMgaW5pdGlhbGl6ZWQgdG8sIGFuZAorCSAq
IHRoZSBzdG9yZSBiZWxvdyB3b3VsZCBsYW5kIG9uIHRoZSBQcm9jR2xvYmFsLT5zdGF0dXNG
bGFnc1tdIGFycmF5IGVudHJ5CisJICogb2Ygd2hpY2hldmVyIGJhY2tlbmQgb3ducyBvZmZz
ZXQgMC4KKwkgKi8KKwlpZiAoTXlQcm9jLT5zdGF0dXNGbGFncyAmIFBST0NfSU5fTE9HSUNB
TF9ERUNPRElORykKKwl7CisJCUFzc2VydCghQW1BdXhpbGlhcnlQcm9jZXNzKCkpOworCisJ
CUxXTG9ja0FjcXVpcmUoUHJvY0FycmF5TG9jaywgTFdfRVhDTFVTSVZFKTsKKwkJTXlQcm9j
LT5zdGF0dXNGbGFncyAmPSB+UFJPQ19JTl9MT0dJQ0FMX0RFQ09ESU5HOworCQlQcm9jR2xv
YmFsLT5zdGF0dXNGbGFnc1tNeVByb2MtPnBneGFjdG9mZl0gPSBNeVByb2MtPnN0YXR1c0Zs
YWdzOworCQlMV0xvY2tSZWxlYXNlKFByb2NBcnJheUxvY2spOworCX0KIAogCWlmIChhbV93
YWxzZW5kZXIpCiAJewpkaWZmIC0tZ2l0IGEvc3JjL2luY2x1ZGUvbWlzY2FkbWluLmggYi9z
cmMvaW5jbHVkZS9taXNjYWRtaW4uaAppbmRleCAwZmM1OWFmMDJiOS4uYzM1YzU4YTYwNGYg
MTAwNjQ0Ci0tLSBhL3NyYy9pbmNsdWRlL21pc2NhZG1pbi5oCisrKyBiL3NyYy9pbmNsdWRl
L21pc2NhZG1pbi5oCkBAIC00MTAsNiArNDEwLDkgQEAgZXh0ZXJuIFBHRExMSU1QT1JUIEJh
Y2tlbmRUeXBlIE15QmFja2VuZFR5cGU7CiAJKEFtQXV0b1ZhY3V1bUxhdW5jaGVyUHJvY2Vz
cygpIHx8IFwKIAkgQW1Mb2dpY2FsU2xvdFN5bmNXb3JrZXJQcm9jZXNzKCkpCiAKKyNkZWZp
bmUgQW1BdXhpbGlhcnlQcm9jZXNzKCkgXAorCShNeUJhY2tlbmRUeXBlID49IEJfQVJDSElW
RVIgJiYgTXlCYWNrZW5kVHlwZSA8PSBCX1dBTF9XUklURVIpCisKIC8qCiAgKiBCYWNrZW5k
IHR5cGVzIHRoYXQgYXJlIHNwYXduZWQgYnkgdGhlIHBvc3RtYXN0ZXIgdG8gc2VydmUgYSBj
bGllbnQgb3IKICAqIHJlcGxpY2F0aW9uIGNvbm5lY3Rpb24uIFRoZXNlIGJhY2tlbmQgdHlw
ZXMgaGF2ZSBpbiBjb21tb24gdGhhdCB0aGV5IGFyZQpkaWZmIC0tZ2l0IGEvc3JjL3Rlc3Qv
cmVjb3ZlcnkvbWVzb24uYnVpbGQgYi9zcmMvdGVzdC9yZWNvdmVyeS9tZXNvbi5idWlsZApp
bmRleCA3MjExM2M1YWM2ZS4uZTgzODdjYTcxNTYgMTAwNjQ0Ci0tLSBhL3NyYy90ZXN0L3Jl
Y292ZXJ5L21lc29uLmJ1aWxkCisrKyBiL3NyYy90ZXN0L3JlY292ZXJ5L21lc29uLmJ1aWxk
CkBAIC02NSw2ICs2NSw3IEBAIHRlc3RzICs9IHsKICAgICAgICd0LzA1NF91bmxvZ2dlZF9z
ZXF1ZW5jZV9wcm9tb3Rpb24ucGwnLAogICAgICAgJ3QvMDU1X2Nhc2NhZGVfcmVjb25uZWN0
LnBsJywKICAgICAgICd0LzA1Nl9zdGFuZGJ5X3NuYXBzaG90X2V4cG9ydC5wbCcsCisgICAg
ICAndC8wNTdfc2xvdF9pbnZhbGlkYXRpb25fc3RhdHVzZmxhZ3MucGwnLAogICAgIF0sCiAg
IH0sCiB9CmRpZmYgLS1naXQgYS9zcmMvdGVzdC9yZWNvdmVyeS90LzA1N19zbG90X2ludmFs
aWRhdGlvbl9zdGF0dXNmbGFncy5wbCBiL3NyYy90ZXN0L3JlY292ZXJ5L3QvMDU3X3Nsb3Rf
aW52YWxpZGF0aW9uX3N0YXR1c2ZsYWdzLnBsCm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4
IDAwMDAwMDAwMDAwLi4wZmNiNTg3NjFhZQotLS0gL2Rldi9udWxsCisrKyBiL3NyYy90ZXN0
L3JlY292ZXJ5L3QvMDU3X3Nsb3RfaW52YWxpZGF0aW9uX3N0YXR1c2ZsYWdzLnBsCkBAIC0w
LDAgKzEsMTI5IEBACisjIENvcHlyaWdodCAoYykgMjAyNiwgUG9zdGdyZVNRTCBHbG9iYWwg
RGV2ZWxvcG1lbnQgR3JvdXAKKyMKKyMgQSBjaGVja3BvaW50IHRoYXQgaW52YWxpZGF0ZXMg
YW4gb2Jzb2xldGUgcmVwbGljYXRpb24gc2xvdCBtdXN0IG5vdCBjb3JydXB0CisjIHRoZSBz
aGFyZWQgUHJvY0dsb2JhbC0+c3RhdHVzRmxhZ3MgYXJyYXkuCit1c2Ugc3RyaWN0OwordXNl
IHdhcm5pbmdzIEZBVEFMID0+ICdhbGwnOworCit1c2UgUG9zdGdyZVNRTDo6VGVzdDo6Q2x1
c3RlcjsKK3VzZSBQb3N0Z3JlU1FMOjpUZXN0OjpVdGlsczsKK3VzZSBUZXN0OjpNb3JlOwor
dXNlIFRpbWU6OkhpUmVzIHF3KHVzbGVlcCk7CisKK215ICRub2RlID0gUG9zdGdyZVNRTDo6
VGVzdDo6Q2x1c3Rlci0+bmV3KCdwcmltYXJ5Jyk7Ciskbm9kZS0+aW5pdChhbGxvd3Nfc3Ry
ZWFtaW5nID0+IDEsIGV4dHJhID0+IFsnLS13YWwtc2Vnc2l6ZT0xJ10pOworCisjIE5vIGNo
ZWNrcG9pbnQgbWF5IGhhcHBlbiBvbiBpdHMgb3duOiB0aGUgc2luZ2xlIENIRUNLUE9JTlQg
dGhpcyB0ZXN0IGlzc3VlcworIyBoYXMgdG8gYmUgdGhlIG9uZSB0aGF0IGludmFsaWRhdGVz
IHRoZSBzbG90LCBhbmQgaXQgaGFzIHRvIHJ1biB3aGlsZSB0aGUKKyMgdmljdGltIGJhY2tl
bmQgaXMgcGFya2VkIGluc2lkZSBWQUNVVU0uCiskbm9kZS0+YXBwZW5kX2NvbmYoCisJJ3Bv
c3RncmVzcWwuY29uZicsIHFxKAorYXV0b3ZhY3V1bSA9IG9mZgorY2hlY2twb2ludF90aW1l
b3V0ID0gMWgKK21pbl93YWxfc2l6ZSA9IDJNQgorbWF4X3dhbF9zaXplID0gMUdCCittYXhf
c2xvdF93YWxfa2VlcF9zaXplID0gMU1CCitsb2dfY2hlY2twb2ludHMgPSBvbgorCisjIENs
dXN0ZXI6OmluaXQoKSB0dXJucyB0aGlzIG9mZiwgYnV0IGEgc2VydmVyIHRoYXQgc3RheXMg
ZG93biB3b3VsZCBtYWtlCisjIHRlYXJkb3duIGJhaWwgb3V0IGJlZm9yZSB0aGUgZmFpbHVy
ZSBpcyByZXBvcnRlZC4gIExldCBpdCBjb21lIGJhY2sgaW5zdGVhZCwKKyMgYW5kIHJlcG9y
dCB0aGUgY3Jhc2ggZnJvbSB0aGUgbG9nLgorcmVzdGFydF9hZnRlcl9jcmFzaCA9IG9uCisp
KTsKKyRub2RlLT5zdGFydDsKKworJG5vZGUtPnNhZmVfcHNxbCgncG9zdGdyZXMnLAorCSdD
UkVBVEUgVEFCTEUgdmFjdGJsIEFTIFNFTEVDVCBnZW5lcmF0ZV9zZXJpZXMoMSwgMTAwMCkg
QVMgaScpOworJG5vZGUtPnNhZmVfcHNxbCgncG9zdGdyZXMnLAorCSJTRUxFQ1QgcGdfY3Jl
YXRlX3BoeXNpY2FsX3JlcGxpY2F0aW9uX3Nsb3QoJ2Rvb21lZCcsIHRydWUpIik7CisKKyMg
TGVhdmUgdGhlIHNsb3QgLS0gd2hpY2ggbm9ib2R5IGlzIHN0cmVhbWluZyBmcm9tLCBzbyB0
aGUgY2hlY2twb2ludGVyIGdldHMgdG8KKyMgYWNxdWlyZSBpdCBpdHNlbGYgLS0gZmFyIGVu
b3VnaCBiZWhpbmQgdGhhdCB0aGUgbmV4dCBjaGVja3BvaW50IGhhcyB0bworIyBpbnZhbGlk
YXRlIGl0LgorYWR2YW5jZV93YWwoJG5vZGUsIDIpOworCisjIFRoZSBjb250cm9sIHNlc3Np
b24gcnVucyBvdmVyIGEgd2Fsc2VuZGVyIGNvbm5lY3Rpb24gb24gcHVycG9zZTogaXRzIFBH
UFJPQworIyBjb21lcyBmcm9tIHRoZSB3YWxzZW5kZXIgZnJlZSBsaXN0LCBzbyBpdCBjYW5u
b3QgdGFrZSB0aGUgZGVuc2UtYXJyYXkgc2xvdAorIyB0aGF0IHRoZSB2YWN1dW1pbmcgYmFj
a2VuZCBiZWxvdyBoYXMgdG8gb3duLgorbXkgJGN0bCA9ICRub2RlLT5iYWNrZ3JvdW5kX3Bz
cWwoJ3Bvc3RncmVzJywgcmVwbGljYXRpb24gPT4gJ2RhdGFiYXNlJyk7CisKKyMgdmFjdXVt
X3JlbCgpIHNldHMgUFJPQ19JTl9WQUNVVU0gYmVmb3JlIGl0IG9wZW5zIHRoZSByZWxhdGlv
biwgc28gYQorIyBjb25mbGljdGluZyBTaGFyZVVwZGF0ZUV4Y2x1c2l2ZUxvY2sgcGFya3Mg
dGhlIHZpY3RpbSBpbiBleGFjdGx5IHRoZSBzdGF0ZQorIyB0aGUgYXNzZXJ0aW9uIGF0IGNv
bW1pdCBjaGVja3MuCiskY3RsLT5xdWVyeV9zYWZlKCdCRUdJTicpOworJGN0bC0+cXVlcnlf
c2FmZSgnTE9DSyBUQUJMRSB2YWN0YmwgSU4gU0hBUkUgVVBEQVRFIEVYQ0xVU0lWRSBNT0RF
Jyk7CisKK215ICR2YWMgPSAkbm9kZS0+YmFja2dyb3VuZF9wc3FsKCdwb3N0Z3JlcycsIG9u
X2Vycm9yX3N0b3AgPT4gMCk7CiskdmFjLT5xdWVyeV91bnRpbChxci8vLCAiVkFDVVVNIHZh
Y3RibDtcbiIpOworCisjIFdhaXQgZm9yIGl0IHRocm91Z2ggdGhlIGNvbnRyb2wgc2Vzc2lv
bi4gIEFuIG9yZGluYXJ5IHBvbGxfcXVlcnlfdW50aWwoKQorIyB3b3VsZCBjb25uZWN0IGEg
c2Vjb25kIHJlZ3VsYXIgYmFja2VuZCwgYW5kIHRoYXQgb25lIC0tIG5vdCB0aGUgdmFjdXVt
IC0tCisjIGNvdWxkIGVuZCB1cCBvd25pbmcgZGVuc2Ugc2xvdCAwLgorbXkgJGJsb2NrZWQg
PSAnJzsKK2ZvcmVhY2ggbXkgJGkgKDEgLi4gMzAwKQoreworCSRibG9ja2VkID0gJGN0bC0+
cXVlcnlfc2FmZSgKKwkJcXtTRUxFQ1QgY291bnQoKikgRlJPTSBwZ19sb2NrcworCQkgICBX
SEVSRSByZWxhdGlvbiA9ICd2YWN0YmwnOjpyZWdjbGFzcyBBTkQgTk9UIGdyYW50ZWR9KTsK
KwlsYXN0IGlmICRibG9ja2VkIGVxICcxJzsKKwl1c2xlZXAoMTAwXzAwMCk7Cit9Citpcygk
YmxvY2tlZCwgJzEnLCAnVkFDVVVNIGlzIHBhcmtlZCB3YWl0aW5nIGZvciB0aGUgdGFibGUg
bG9jaycpOworaXMoICRjdGwtPnF1ZXJ5X3NhZmUoCisJCXF7U0VMRUNUIGNvdW50KCopIEZS
T00gcGdfc3RhdF9hY3Rpdml0eQorCQkgICBXSEVSRSBiYWNrZW5kX3R5cGUgPSAnY2xpZW50
IGJhY2tlbmQnfSksCisJJzEnLAorCSd0aGUgdmFjdXVtaW5nIGJhY2tlbmQgaXMgdGhlIG9u
bHkgcmVndWxhciBiYWNrZW5kIGNvbm5lY3RlZCcpOworCitpc250KAorCSRjdGwtPnF1ZXJ5
X3NhZmUoCisJCXF7U0VMRUNUIHdhbF9zdGF0dXMgRlJPTSBwZ19yZXBsaWNhdGlvbl9zbG90
cworCQkgICBXSEVSRSBzbG90X25hbWUgPSAnZG9vbWVkJ30pLAorCSdsb3N0JywKKwknc2xv
dCBoYXMgbm90IGJlZW4gaW52YWxpZGF0ZWQgeWV0Jyk7CisKK215ICRsb2dfb2Zmc2V0ID0g
LXMgJG5vZGUtPmxvZ2ZpbGU7CisKKyRjdGwtPnF1ZXJ5X3NhZmUoJ0NIRUNLUE9JTlQnKTsK
KworaXMoICRjdGwtPnF1ZXJ5X3NhZmUoCisJCXF7U0VMRUNUIHdhbF9zdGF0dXMgRlJPTSBw
Z19yZXBsaWNhdGlvbl9zbG90cworCQkgICBXSEVSRSBzbG90X25hbWUgPSAnZG9vbWVkJ30p
LAorCSdsb3N0JywKKwknY2hlY2twb2ludCBpbnZhbGlkYXRlZCB0aGUgb2Jzb2xldGUgc2xv
dCcpOworCisjIFJlbGVhc2UgdGhlIGxvY2suICBUaGUgVkFDVVVNIG5vdyBydW5zIHRvIGNv
bXBsZXRpb24gYW5kIGNvbW1pdHMsIHdoaWNoIGlzCisjIHdoZXJlIHRoZSBjbG9iYmVyZWQg
ZmxhZ3MgYXJlIG5vdGljZWQuCiskY3RsLT5xdWVyeV9zYWZlKCdDT01NSVQnKTsKKworIyBB
IHNlcnZlciB0aGF0IGhhcyBqdXN0IGFib3J0ZWQgdGFrZXMgdGhpcyBzZXNzaW9uIGRvd24g
d2l0aCBpdCwgc28gdGhlIHF1ZXJ5CisjIGhhcyB0byBiZSBhbGxvd2VkIHRvIGZhaWwuCitt
eSAkdmFjdXVtZWQgPSBldmFsIHsgJHZhYy0+cXVlcnlfc2FmZSgnU0VMRUNUIDEnKSB9Owor
CisjIE9sZGVyIGJyYW5jaGVzIHNwZWxsIHRoaXMgIlRSQVA6IEZhaWxlZEFzc2VydGlvbigi
LCBuZXdlciBvbmVzCisjICJUUkFQOiBmYWlsZWQgQXNzZXJ0KCIuCitvayghJG5vZGUtPmxv
Z19jb250YWlucyhxci9UUkFQOiBmYWlsL2ksICRsb2dfb2Zmc2V0KSwKKwknbm8gYXNzZXJ0
aW9uIGZhaWx1cmUgd2hpbGUgaW52YWxpZGF0aW5nIHRoZSBzbG90Jyk7CitvayghJG5vZGUt
PmxvZ19jb250YWlucyhxci93YXMgdGVybWluYXRlZCBieSBzaWduYWwvLCAkbG9nX29mZnNl
dCksCisJJ25vIGJhY2tlbmQgd2FzIGtpbGxlZCB3aGlsZSBpbnZhbGlkYXRpbmcgdGhlIHNs
b3QnKTsKK2lzKCR2YWN1dW1lZCwgJzEnLCAndGhlIHBhcmtlZCBWQUNVVU0gY29tbWl0dGVk
IGFuZCBpdHMgc2Vzc2lvbiBzdXJ2aXZlZCcpOworCisjIEJvdGggc2Vzc2lvbnMgYXJlIGdv
bmUgaWYgdGhlIHNlcnZlciB3ZW50IGRvd24gdW5kZXIgdGhlbSwgc28gbmVpdGhlciBtYXkg
YmUKKyMgYWxsb3dlZCB0byB0YWtlIHRoZSB0ZXN0IHdpdGggaXQuCitldmFsIHsgJHZhYy0+
cXVpdDsgfTsKK2V2YWwgeyAkY3RsLT5xdWl0OyB9OworCitkb25lX3Rlc3RpbmcoKTsKKwor
IyBCdXJuIHRocm91Z2ggJG4gV0FMIHNlZ21lbnRzLgorc3ViIGFkdmFuY2Vfd2FsCit7CisJ
bXkgKCRub2RlLCAkbikgPSBAXzsKKworCWZvciAobXkgJGkgPSAwOyAkaSA8ICRuOyAkaSsr
KQorCXsKKwkJJG5vZGUtPnNhZmVfcHNxbCgncG9zdGdyZXMnLAorCQkJJ0NSRUFURSBUQUJM
RSB0ICgpOyBEUk9QIFRBQkxFIHQ7IFNFTEVDVCBwZ19zd2l0Y2hfd2FsKCk7Jyk7CisJfQor
CXJldHVybjsKK30KCmJhc2UtY29tbWl0OiAzNzQ1MjJhYTYzYWYxMTg3YzE1ZGQyMWRiMGIy
Yzk4OGI1NWM5YTNhCi0tIAoyLjUyLjAKCg==

--------------VSyUaBX0fVqNSmUIeXHUA0ru--