[{"data":1,"prerenderedAt":29272},["ShallowReactive",2],{"home-posts":3},[4,8835],{"id":5,"title":6,"body":7,"date":8825,"description":8826,"endMark":8827,"extension":8828,"illustration":8827,"meta":8829,"navigation":969,"path":8830,"seo":8831,"stem":8832,"unlisted":8833,"__hash__":8834},"blog\u002Fblog\u002Fthrough-sand-and-star.md","Through Sand and Star",{"type":8,"value":9,"toc":8810},"minimark",[10,33,36,41,50,56,62,65,68,71,74,81,84,90,93,99,103,106,109,113,116,126,139,146,152,155,160,164,167,170,176,259,264,267,272,275,282,285,288,292,298,320,323,330,334,341,344,347,406,409,412,416,419,422,433,436,439,445,448,462,8396,8399,8744,8750,8753,8756,8762,8767,8782,8786,8789,8803,8806],[11,12,13,19,20,27,28,32],"p",{},[14,15,18],"span",{"class":16,"style":17},"dropcap","--dc-w: 1.698em","W","hen researching hardware to build my next hacks, I accidentally ran into an\ninteresting ",[21,22,26],"a",{"href":23,"rel":24},"https:\u002F\u002Fblog.janestreet.com\u002Fcan-you-reverse-engineer-an-asic\u002F",[25],"nofollow","puzzle posed by Jane Street",".\nEssentially, they gave us a GDS file and we must reverse engineer it to\nunderstand what the circuit does. Technically, we only need to find an input\nthat raises ",[29,30,31],"code",{},"success",", but let's solve the more general problem.",[11,34,35],{},"First and foremost, let's plan how to solve this.",[37,38,40],"h2",{"id":39},"intuition","Intuition",[11,42,43,44,49],{},"After looking at the ",[21,45,48],{"href":46,"rel":47},"https:\u002F\u002Fgithub.com\u002Fjanestreet\u002Fasic-puzzle-2026#puzzle-gds",[25],"layout",",\nwe know the design is small. The output generator is likely some kind of\nscrambler. From what I learned in college years ago, this would likely be\nimplemented with a linear-feedback shift register (LFSR), because XORs are\ncheap.",[51,52,53],"note",{},[11,54,55],{},"This circuit looks small enough that throwing the whole thing at an LLM would\nlikely solve it. However, solving this problem is not my goal here. More than\nthe answer, I want to see if I can find an unintended solution or some\ninteresting bugs in the challenge myself.",[11,57,58,59,61],{},"If we look at the clusters near ",[29,60,31],{},", it is even smaller. The puzzle\ndesigner probably did not use a cryptographic function here. If it is not a\none-way function, we can use Z3 to solve it. If Z3 cannot handle it, then we\nneed proper reverse engineering, which I am not too worried about.",[11,63,64],{},"Symbolic execution has a path-explosion problem. However, if we know the input\nlength, we can unroll the circuit and solve it efficiently.",[11,66,67],{},"Essentially, we want to turn GDS back into Boolean gates, throw it into an SMT\nsolver, and hopefully call it a day.",[37,69,70],{"id":48},"Layout",[11,72,73],{},"The first thing we need to do is parse the GDS file. Being a true engineer, the\nfirst thing I do is refuse to read their documentation and look for a GDS\nopener online.",[11,75,76],{},[77,78],"img",{"alt":79,"src":80},"GDS layout","https:\u002F\u002Fi.imgur.com\u002FHGHSFlB.png",[11,82,83],{},"The bottom looks like Morse code. Decode it:",[85,86,87],"blockquote",{},[11,88,89],{},"PER ARENAM AD ASTRA",[11,91,92],{},"Nice, we got our first Easter egg. Still, we need to turn this into a netlist.\nIn software reverse engineering, we want our binary to have symbols. Without\nthose, looking at a stripped binary is a pain. For hardware, we want the same\nthing: annotations in the layout instead of solely physical shapes.",[51,94,96],{"label":95},"Easter Eggs",[11,97,98],{},"When openning this with TinyTapeout GDS viewer, I didn't see the morse code as\nit seems the INTERNAL layer is not rendered.",[37,100,102],{"id":101},"turn-it-into-a-netlist","Turn it into a netlist",[11,104,105],{},"Luckily, the GDS keeps the standard-cell names and pin labels. We know which\nboxes are NAND gates, flip-flops, and muxes. Public SkyWater models tell us\nwhat they do. KLayout can then recover which labeled pins are connected.",[11,107,108],{},"So anyway, I vibe-coded the extractor and simulator with Claude using warm up\nas the validator.",[37,110,112],{"id":111},"guess-the-input-size","Guess the input size",[11,114,115],{},"Openning the VCD file in emacs, the header has",[117,118,123],"pre",{"className":119,"code":121,"language":122},[120],"language-text","$date\n  Sat Dec 31 23:59:60 2016\n$end\n$version\n    Leave no stone unturned! But for this file, consider looking at it in a waveform viewer instead.\n$end\n$timescale\n    1ps\n$end\n","text",[29,124,121],{"__ignoreMap":125},"",[11,127,128,132,133,138],{},[129,130,131],"strong",{},"Sat Dec 31 23:59:60 2016"," this looks out-of-place. Why do we have 60 as second here? Is this a hint toward something? So I open Google again. It turns out ",[21,134,137],{"href":135,"rel":136},"https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FLeap_second",[25],"leap second"," is a thing. TIL.",[11,140,141,142,145],{},"Anyway, visualizing the waveforms and looking at the edges where ",[29,143,144],{},"enable"," changes (from\nC4 to C125 and from C160 to C281), we get two exact 121-cycle periods.",[11,147,148],{},[77,149],{"alt":150,"src":151},"Look at the cycle","https:\u002F\u002Fi.imgur.com\u002FkqKA3PD.png",[11,153,154],{},"This is probably the input length.",[51,156,157],{},[11,158,159],{},"I expect to find Morse code here but it didn't work. Input's hex representation is neither readable.",[37,161,163],{"id":162},"solve-it","Solve it",[11,165,166],{},"The way I think about this is circuit has states and transitions. We assign symbolic\nvariables to the states and perform 121 transitions then we would have the\nfinal Boolean formula. We find input so that success is true.",[11,168,169],{},"So anyway, I prompted LLM to write the script using Z3 to do that and we get the answer input:",[117,171,174],{"className":172,"code":173,"language":122,"meta":125},[120],"0000000101010000100000000000010101010000000000001010000001000001000000100000101000010000000100000010000010010001010000000\n",[29,175,173],{"__ignoreMap":125},[11,177,178,179,184,185,258],{},"We can simulate the circuit with this input and get the answer\n",[129,180,181],{},[29,182,183],{},"(* TWO STARS *)",". Did we reverse engineer it though? No, but the puzzle\nobviously has something to do with stars, an ",[14,186,189,218],{"className":187},[188],"katex",[14,190,193],{"className":191},[192],"katex-mathml",[194,195,197],"math",{"xmlns":196},"http:\u002F\u002Fwww.w3.org\u002F1998\u002FMath\u002FMathML",[198,199,200,213],"semantics",{},[201,202,203,207,211],"mrow",{},[204,205,206],"mn",{},"11",[208,209,210],"mo",{},"×",[204,212,206],{},[214,215,217],"annotation",{"encoding":216},"application\u002Fx-tex","11 \\times 11",[14,219,223,248],{"className":220,"ariaHidden":222},[221],"katex-html","true",[14,224,227,232,236,241,245],{"className":225},[226],"base",[14,228],{"className":229,"style":231},[230],"strut","height:0.7278em;vertical-align:-0.0833em;",[14,233,206],{"className":234},[235],"mord",[14,237],{"className":238,"style":240},[239],"mspace","margin-right:0.2222em;",[14,242,210],{"className":243},[244],"mbin",[14,246],{"className":247,"style":240},[239],[14,249,251,255],{"className":250},[226],[14,252],{"className":253,"style":254},[230],"height:0.6444em;",[14,256,206],{"className":257},[235]," grid, and “two\nstars.” Without any additional context, I asked Google:",[85,260,261],{},[11,262,263],{},"What are the things that have 11x11 grids and stars, relating to TWO STARS?",[11,265,266],{},"and got:",[85,268,269],{},[11,270,271],{},"The things you are referring to are Star Battle logic puzzles, which are\nalso widely known as Two Not Touch.",[11,273,274],{},"So this is a Star Battle checker, with solution:",[276,277],"diagram-grid",{":rows":278,"caption":279,"markGlyph":280,"marks":281},"[\".......*.*.\",\"*....*.....\",\".......*.*.\",\"*.*........\",\"....*.*....\",\"..*.....*..\",\"....*.....*\",\".*....*....\",\"...*......*\",\".....*..*..\",\".*.*.......\"]","The 121-bit input, shown as an 11×11 grid.","★","*",[11,283,284],{},"It has exactly two stars in every row, column, and hidden region, with no two\nstars touching.",[11,286,287],{},"The hidden regions are eleven irregular shapes that tile the board — the part\nZ3 has to recover later. Colored in, the solution above lands two stars in\neach:",[37,289,291],{"id":290},"what-is-the-circuit-doing","What is the circuit doing?",[11,293,294,295,297],{},"Now we trace backward from ",[29,296,31],{},". The 92 registers turn into a much smaller\nset of things:",[299,300,301,305,308,311,314,317],"ul",{},[302,303,304],"li",{},"two mod-11 counters for the column and row;",[302,306,307],{},"an 8-bit total-star counter that must equal 22;",[302,309,310],{},"a per-row counter that must equal two at the end of every row;",[302,312,313],{},"eleven counters indexed by column;",[302,315,316],{},"eleven counters indexed by a hidden region map;",[302,318,319],{},"a 12-bit shift register used for adjacency checks.",[11,321,322],{},"The shift register is read at delays 1, 10, 11, and 12. On an 11-wide grid,\nthose are left, up-right, up, and up-left. If any of them is set when a new star\narrives, the adjacency-error flag latches.",[11,324,325,326,329],{},"The region map is easy to recover once we know what to ask. Feed a grid with\none ",[29,327,328],{},"1",", see which region counter moves, and repeat for all 121 cells. Solving\nthe recovered Star Battle board gives the same grid as Z3.",[37,331,333],{"id":332},"hunting-easter-eggs","Hunting Easter eggs",[11,335,336,337,340],{},"So far we have ",[338,339,89],"em",{}," and the leap second easter egg. Are there\nmore?",[11,342,343],{},"Let's solve for potential output strings.\nSince we already have our Z3 pipeline, we can constrain\nthe verdict state, run the output generator, and ask whether any other state is\nreachable.",[11,345,346],{},"We get five messages:",[348,349,350,363],"table",{},[351,352,353],"thead",{},[354,355,356,360],"tr",{},[357,358,359],"th",{},"Message",[357,361,362],{},"Trigger",[364,365,366,374,382,390,398],"tbody",{},[354,367,368,371],{},[369,370,183],"td",{},[369,372,373],{},"the unique solution",[354,375,376,379],{},[369,377,378],{},"TWO\"NOT TOUCH",[369,380,381],{},"all counts pass, but two stars touch",[354,383,384,387],{},[369,385,386],{},"EMPTY SKY",[369,388,389],{},"all zeros",[354,391,392,395],{},[369,393,394],{},"TRY AGAIN",[369,396,397],{},"generic failure",[354,399,400,403],{},[369,401,402],{},"BIG BANG",[369,404,405],{},"all ones",[11,407,408],{},"Until this point, most of our results came from probing, Z3, simulation, and\nguessing from observable inputs and outputs. A program that behaves like a Star\nBattle checker could still have hidden states, just like malware or backdoors.\nDynamic analysis alone cannot cover this. We need static analysis—if only\nthere were a decompiler like Ghidra or IDA for hardware.",[11,410,411],{},"In the old days, my blog would end here. However, with LLMs, building a\nprototype is now cheap.",[37,413,415],{"id":414},"concept-of-a-tool","Concept of a tool",[11,417,418],{},"Before building the tool, we must know what we want to build.",[11,420,421],{},"The whole circuit is a big blob of Boolean logic. Humans cannot comprehend\nthat. An LLM, having a bigger context, can do a better job for a bigger small\nboard. But can we compress the circuit into a denser representation:\npseudocode with structural recovery?",[11,423,424,425,428,429,432],{},"So we want to know what are LFSR, counters, registers, ... The decompiler output\nmust be readable as well: lift expressions to ",[29,426,427],{},"if",", ",[29,430,431],{},"for",", or fold repetitive information\u002Fconstants.",[11,434,435],{},"If we vibe code this, we want to use open source designs as the test sets. We also\nhave Z3, which is useful for validation. The metrics we care about could be as simple\nas line counts, or simply LLM-as-judge.",[11,437,438],{},"So, after a few prompts, we have a prototype compiler that works, at least on small-scale designs:",[11,440,441],{},[77,442],{"alt":443,"src":444},"Introduce GREW - Slop hardware decompiler","https:\u002F\u002Fi.imgur.com\u002FX4DDG3S.png",[11,446,447],{},"Let's look at the decompiler output.",[299,449,450,453,456,459],{},[302,451,452],{},"ctr0 and ctr1 are mod-11 counter: this is the grid size",[302,454,455],{},"We also have a bunch of cap-3 counter: they are star count rules",[302,457,458],{},"All the long wires are look-up tables that we neither want nor need to read",[302,460,461],{},"Our initial lsfr assumption is indeed correct: look at all the XORs!",[463,464,466],"code-fold",{"label":465},"Decompiler output",[117,467,471],{"className":468,"code":469,"language":470,"meta":125,"style":125},"language-verilog shiki shiki-themes github-light github-dark","module puzzle (\n    input I,\n    input clk,\n    input enable,\n    input rst_n,\n    output [7:0] O,\n    output success);\n  \u002F\u002F ---------------- recovered state ----------\n  reg [3:0] ctr0;        \u002F\u002F mod-11 counter\n  reg [3:0] ctr1;        \u002F\u002F mod-11 counter\n  reg [7:0] lfsr0;       \u002F\u002F 4 transition rules, 256 reachable values\n  reg [11:0] sh0;        \u002F\u002F shift register\n  reg [7:0] acc0;        \u002F\u002F accumulator\n  reg [3:0] sat0;        \u002F\u002F saturating counter, cap 15\n  reg [1:0] sat1;        \u002F\u002F saturating counter, cap 3\n  reg [1:0] sat2;        \u002F\u002F saturating counter, cap 3\n  reg [1:0] sat3;        \u002F\u002F saturating counter, cap 3\n  reg [1:0] sat4;        \u002F\u002F saturating counter, cap 3\n  reg [1:0] sat5;        \u002F\u002F saturating counter, cap 3\n  reg [1:0] sat6;        \u002F\u002F saturating counter, cap 3\n  reg [1:0] sat7;        \u002F\u002F saturating counter, cap 3\n  reg [1:0] sat8;        \u002F\u002F saturating counter, cap 3\n  reg [1:0] sat9;        \u002F\u002F saturating counter, cap 3\n  reg [1:0] sat10;       \u002F\u002F saturating counter, cap 3\n  reg [1:0] sat11;       \u002F\u002F saturating counter, cap 3\n  reg [1:0] sat12;       \u002F\u002F saturating counter, cap 3\n  reg [1:0] arr0 [0:10]; \u002F\u002F saturating counters, cap 3\n  reg flag0, r0, success_q, flag1, flag2, flag3;\n  \u002F\u002F success requires !flag0   (proved)\n  \u002F\u002F success requires !flag2   (proved)\n  \u002F\u002F success requires !flag3   (proved)\n  \u002F\u002F O[0]..O[7] (all 8) requires flag0   (proved)\n  \u002F\u002F success requires flag1   (proved)\n  \u002F\u002F sh0 is read at delays [1, 10, 11, 12]; ctr0 advances with it, counts mod 11\n\n  \u002F\u002F ---- shared subexpressions\n  wire t6 = ctr1 in {7, 13};\n  wire t14 = !(ctr1[0] & ctr1[2]) & !((ctr1[0] ^ ctr1[2]) & ctr1[3]) & !(ctr1[1] ^ ctr1[3]);\n  wire t15 = !((!(ctr0[3] & (ctr1[0] ^ ctr1[2] ^ ctr1[3] ^ (ctr1[2] & ctr1[1]))) & ctr1 not in {6, 15}) | t14 | ctr1 in {9, 12} | t6);\n  wire t18 = !((ctr1 in {0:1, 8:9} | ((ctr1[0] ^ ctr1[2]) & ctr1[1])) ^ ctr0[2] ^ (ctr0[1] & (ctr1[0] ^ ctr1[1])));\n  wire t22 = (ctr0[1] & (ctr1[0] ^ ctr1[1]) & !((ctr1 in {0:1, 8:9} | ((ctr1[0] ^ ctr1[2]) & ctr1[1])) ^ ctr0[2])) | (t18 & ctr1[0] & ctr0[0] & (ctr0[1] ^ ctr1[0] ^ ctr1[1]));\n  wire t24 = !ctr0[2] | ctr1 in {0:1, 8:9} | ((ctr1[0] ^ ctr1[2]) & ctr1[1]);\n  wire t26 = t24 & ctr1 not in {3, 11};\n  wire t27 = (t22 & ((ctr1[0] ^ ctr1[2] ^ ctr1[3] ^ (ctr1[2] & ctr1[1]) ^ ctr0[3]) | !t24 | !(ctr1 not in {3, 11}))) | (!t26 & (ctr1[0] ^ ctr1[2] ^ ctr1[3] ^ (ctr1[2] & ctr1[1]) ^ ctr0[3]));\n  wire t28 = (!(ctr0[3] & (ctr1[0] ^ ctr1[2] ^ ctr1[3] ^ (ctr1[2] & ctr1[1]))) & ctr1 not in {6, 15} & (t14 | ctr1 in {9, 12} | t6)) | t15;\n  wire t29 = t15 | (t27 & !t28);\n  wire t30 = ctr1 == 12 | (ctr1 in {4:6, 9:12} & t29);\n  wire t32 = !(ctr1 >= 13 | (!(ctr1 not in [7:13]) & t30 & !(ctr1 == 13)));\n  wire t33 = ctr1 in {4:6, 9:11} ^ t29;\n  wire t34 = !(t27 ^ t28);\n  wire t35 = (ctr1 in {0:1, 8:9} | ((ctr1[0] ^ ctr1[2]) & ctr1[1])) ^ ctr0[2] ^ (ctr0[1] & (ctr1[0] ^ ctr1[1])) ^ (!(ctr1[0] & ctr0[0]) | !(ctr0[1] ^ ctr1[0] ^ ctr1[1]));\n  wire t36 = !t35;\n  wire t37 = (ctr1[0] & ctr0[0]) | (ctr0[1] ^ ctr1[0] ^ ctr1[1]);\n  wire t38 = t22 ^ ctr1[0] ^ t26 ^ ctr1[2] ^ ctr1[3] ^ (ctr1[2] & ctr1[1]) ^ ctr0[3];\n  wire t39 = !t38;\n  wire t41 = t36 & t37 & t39 & !(ctr1[0] ^ ctr0[0]) & (!(ctr1[0] & ctr0[0]) | !(ctr0[1] ^ ctr1[0] ^ ctr1[1]));\n  wire t43 = !(ctr1[0] & ctr0[0]) & (ctr1[0] | ctr0[0]) & (ctr0[1] ^ ctr1[0] ^ ctr1[1]);\n  wire t44 = t37 & (!(ctr1[0] & ctr0[0]) | !(ctr0[1] ^ ctr1[0] ^ ctr1[1]));\n  wire t45 = !((ctr1[0] ^ ctr0[0]) | t44);\n  wire t46 = !(t36 & t45);\n  wire t47 = !(t46 & t39);\n  wire t48 = !(t36 | t45);\n  wire t49 = t37 | !(ctr1[0] | ctr0[0]);\n  wire t50 = !t49;\n  wire t51 = !(t36 | t50);\n  wire t52 = t45 | t35;\n  wire t53 = !t52;\n  wire t54 = !((t51 | t53 | t39) & t34);\n  wire t55 = t39 | t45;\n  wire t56 = t37 & !(ctr1[0] ^ ctr0[0]) & (!(ctr1[0] & ctr0[0]) | !(ctr0[1] ^ ctr1[0] ^ ctr1[1]));\n  wire t57 = !t36 | (ctr1[0] ^ ctr0[0]);\n  wire t58 = !(t37 & t18 & (!(ctr1[0] & ctr0[0]) | !(ctr0[1] ^ ctr1[0] ^ ctr1[1])));\n  wire t59 = t30 ^ ctr1 not in [7:12];\n  wire t60 = !t59;\n  wire t61 = (t33 ? (t34 ? t56 | (t57 & t58 & t38) : t55 & (t43 | t47)) : (t34 | t41 | !(t36 | t43 | t39 | t45)) & (!(t47 | t48) | t54)) | t60;\n  wire t62 = !(t50 & t18);\n  wire t63 = !(t43 & t18);\n  wire t64 = !(t63 | t38);\n  wire t65 = !(t58 | t38);\n  wire t66 = t59 | (!(t34 | (t33 & (t62 | t39) & !t64)) & (t33 | t65)) | (t34 & (!(t33 | t43 | t38 | t45 | t35) | !(t46 | t39)));\n  wire t67 = (t43 | t45 | t35) & t38;\n  wire t68 = !t33;\n  wire t69 = t60 | !((t33 | ((t54 | !(t38 | t48)) & (!(t36 | t43 | (t37 & t39 & !(ctr1[0] ^ ctr0[0]) & (!(ctr1[0] & ctr0[0]) | !(ctr0[1] ^ ctr1[0] ^ ctr1[1]))) | t45) | t34 | t41))) & (t51 | t34 | t43 | t67 | t68 | t45));\n  wire t70 = t66 & t32 & t69;\n  wire t71 = !(t44 | t38 | t35);\n  wire t72 = t44 | t35;\n  wire t73 = !(t39 | t48);\n  wire t74 = !t72;\n  wire t75 = !((t33 | (t34 ? (t52 & t39) | (t46 & t73) : t71 | ((t50 | t38) & t72))) & t60 & ((t34 & t72) | t68 | ((t56 | t74) ? t39 : t73)));\n  wire t76 = t57 & t39 & t49;\n  wire t77 = (t33 & (!(t34 | (t62 & t39) | t67) | (t34 & t64))) | t60 | (!((t76 | t73) & t34) & ((t34 & t37 & t18 & (!(ctr1[0] & ctr0[0]) | !(ctr0[1] ^ ctr1[0] ^ ctr1[1]))) | t76 | t73) & t68);\n  wire t78 = t75 & t32 & t77;\n  wire t79 = t44 | t39 | t35;\n  wire t80 = !((t38 & t48) | t34);\n  wire t81 = (((((t57 & t58) | t38) & t79) | t34) & (t51 | !(t34 & (t53 | t38))) & t68) | t59 | (t33 & ((t34 & t47 & t79) | (t80 & ((ctr1[0] ^ ctr0[0]) | t44 | t39 | t35) & (t56 | t38 | t74))));\n  wire t82 = ((t34 | t41 | !(t39 | t63)) & !((t38 ? t51 | t43 | t45 : t36 | t43 | t45) & t34) & t68) | (t33 & (!t34 | ((t43 | t38 | t35) & t63)) & (!t80 | (t36 & t55))) | t60;\n  wire t83 = !(t34 & t47);\n  wire t84 = t59 | ((t83 | t73) & (t34 | t71 | t65) & t68) | !((t83 & (t34 | t73 | ((t43 | t35) & t39 & t63))) | t68);\n  wire t85 = t32 & t82 & t84;\n  wire t87 = t32 & t61 & t81;\n  wire t88 = !t87;\n  wire t93 = acc0 == 121;\n  wire t94 = acc0 == 0;\n  wire t95 = !((!success_q & r0) | t93 | t94);\n  wire t96 = !success_q & !t93 & !t94 & r0;\n  wire t97 = !(t95 | t96);\n  wire t100 = !((!t93 & (success_q | r0)) | t94);\n  wire t101 = !(t95 | t100);\n  wire t106 = !(t96 | t100);\n  wire t107 = t95 & t106;\n  wire t108 = !(t95 | (t96 & t100));\n  wire t109 = t107 | t108;\n  wire t110 = !t109;\n  wire t111 = !(t95 | t96 | t100);\n  wire t120 = !((sat0 not in [8:11] & float0 & sat0 not in [4:7]) | sat0 in {0:2, 4:6});\n\n  always @(posedge clk or negedge rst_n)\n  if (!rst_n) begin \u003Creset> end\n  else begin\n    if (enable) begin\n      if (!flag1) begin\n        for (ctr1 = 0; ctr1 \u003C= 10; ctr1++)  for (ctr0 = 0; ctr0 \u003C= 10; ctr0++) begin\n          sh0 \u003C- {sh0[10:0], I};\n          if (I) begin\n            if (t32 & t61 & t81 & t82 & t84) sat1 \u003C- min(sat1 + 1, 3);\n            if (t75 & t61 & t81 & t77) sat2 \u003C- min(sat2 + 1, 3);\n            if (t66 & t77 & t82) sat4 \u003C- min(sat4 + 1, 3);\n            if (!(t87 | t70 | t78 | t85)) sat6 \u003C- min(sat6 + 1, 3);\n            if (t66 & t32 & !(t87 | t85) & t69 & t77) sat8 \u003C- min(sat8 + 1, 3);\n            if (t66 & t32 & t69 & t82 & !(t87 | t78)) sat9 \u003C- min(sat9 + 1, 3);\n            if (t75 & !(t87 | t70) & t77 & t82 & t84) sat11 \u003C- min(sat11 + 1, 3);\n            arr0[ctr0] \u003C- min(arr0[ctr0] + 1, 3);\n            if ((ctr0 != 0 & sh0[11]) | (sh0[9] & ctr0 != 10) | (sh0[0] & ctr0 != 0) | sh0[10])\n              flag2 \u003C- 1;\n          end\n          if (ctr0 == 10 & (sat5[1] ? sat5[0] | I : !(sat5[0] & I))) flag3 \u003C- 1;\n        end\n      end\n      if (ctr0 == 10 & ctr1 == 10) flag1 \u003C- 1;\n    end\n    acc0 \u003C- acc0 + (enable & !flag1 & I);\n    if (!flag0) sat0 \u003C- 0;\n    else sat0 \u003C- min(sat0 + 1, 15);\n    if (ctr0 == 10 & enable) sat5 \u003C- 0;\n    else if (ctr0 != 10 & enable & !flag1 & I) sat5 \u003C- min(sat5 + 1, 3);\n    if ((sat0 == 15 & flag1) | (flag1 & !flag0) | (!enable & !flag0) | (sat0 == 15 & !enable))\n      lfsr0 \u003C- lfsr0;\n    else if ((flag0 & !sat0[0] & flag1) | (flag0 & !enable & !sat0[3]) | (flag0 & !enable & !sat0[2]) | (flag0 & !sat0[1] & !enable) | (flag0 & !sat0[3] & flag1) | (flag0 & !sat0[1] & flag1) | (flag0 & !sat0[2] & flag1) | (flag0 & !enable & !sat0[0]))\n      lfsr0 \u003C- {lfsr0[1] ^ lfsr0[3] ^ lfsr0[5] ^ lfsr0[7], lfsr0[2] ^ lfsr0[4] ^ lfsr0[5], lfsr0[0] ^ lfsr0[1] ^ lfsr0[4] ^ lfsr0[5], lfsr0[2] ^ lfsr0[5] ^ lfsr0[6] ^ lfsr0[7], lfsr0[0] ^ lfsr0[3] ^ lfsr0[4] ^ lfsr0[6], lfsr0[1] ^ lfsr0[2] ^ lfsr0[3] ^ lfsr0[4], lfsr0[0] ^ lfsr0[3] ^ lfsr0[5] ^ lfsr0[6] ^ lfsr0[7], lfsr0[1] ^ lfsr0[2] ^ lfsr0[7]};\n    else if (!I & enable & !flag1)\n      lfsr0 \u003C- {lfsr0[2], lfsr0[1] ^ lfsr0[3] ^ lfsr0[5] ^ lfsr0[7], lfsr0[3], lfsr0[0], lfsr0[1], lfsr0[5], lfsr0[4], lfsr0[6]};\n    else\n      lfsr0 \u003C- {lfsr0[2], !(lfsr0[1] ^ lfsr0[3] ^ lfsr0[5] ^ lfsr0[7]), lfsr0[3], lfsr0[0], lfsr0[1], lfsr0[5], lfsr0[4], lfsr0[6]};\n\n    if (enable & !flag1 & I & !t70 & !t78 & !t88 & !t85) sat3 \u003C- min(sat3 + 1, 3);\n    if (enable & !flag1 & I & !t87 & !t78 & !t85 & t70) sat7 \u003C- min(sat7 + 1, 3);\n    if (enable & !flag1 & I & !t87 & !t70 & t78 & !t85) sat10 \u003C- min(sat10 + 1, 3);\n    if (enable & !flag1 & I & t85 & !t87 & !t70 & !t78) sat12 \u003C- min(sat12 + 1, 3);\n    if (flag1) begin\n      flag0 \u003C- 1;\n      if (!flag0) begin\n        r0 \u003C- sat1 == 2 & sat2 == 2 & sat3 == 2 & sat4 == 2 & sat6 == 2 & sat7 == 2 & sat8 == 2 & sat9 == 2 & sat10 == 2 & sat11 == 2 & sat12 == 2 & acc0 == 22 & flag2 & !flag3 & all(arr0 == 2);\n        success_q \u003C- sat1 == 2 & sat2 == 2 & sat3 == 2 & sat4 == 2 & sat6 == 2 & sat7 == 2 & sat8 == 2 & sat9 == 2 & sat10 == 2 & sat11 == 2 & sat12 == 2 & acc0 == 22 & !flag2 & !flag3 & all(arr0 == 2);\n      end\n    end\n  end\n\n  assign O[0] = flag0 & ((t97 & !sat0[3] & ((sat0[0] & !sat0[1]) | sat0 in {7, 15} | sat0 in {2, 10}) & t100) | (t101 & !(sat0 not in [9:11] & sat0 not in {1:2, 5}) & t96) | t110 | (!((sat0[0] & !sat0[1] & (sat0[2] | sat0[3])) | sat0 in {2:3, 10:15}) & t111) | (t95 & t106 & (lfsr0[6] ^ ((sat0 in {0:9, 12:13} & sat0 not in {6, 14}) | (!sat0[0] & sat0[3]))))) & (sat0 in {2, 4:7} | t107 | t108) & sat0 != 15;\n  assign O[1] = flag0 & (sat0 in {1, 5} | sat0 == 8 | t107 | t108) & ((t101 & ((sat0 not in [8:11] & float0 & sat0 not in [4:7]) | (sat0[0] & !sat0[2]) | sat0 in {0:2, 4:6}) & (sat0 in {1:2, 9:10} | t120 | sat0 in {4:5, 12:13}) & t96) | t110 | (sat0[2] & sat0[1] & !sat0[3] & t111) | (t95 & t106 & !((sat0[2] | sat0[1]) ^ lfsr0[0] ^ (!(sat0[0] | sat0[1]) | sat0 \u003C= 3 | (!sat0[0] & sat0[3])))) | (t97 & (sat0 in {7, 15} | !sat0[0]) & !sat0[3] & t100)) & sat0 != 15;\n  assign O[2] = flag0 & (sat0 == 5 | t107 | t108 | sat0 in {0, 8}) & sat0 != 15 & ((t101 & !(sat0[0] & sat0[1]) & sat0 \u003C= 11 & t96) | t110 | (t97 & sat0[1] & !sat0[3] & (sat0[2] | !sat0[0]) & t100) | (t95 & t106 & (lfsr0[4] ^ (sat0 not in {8:9, 11:12} & sat0 in {0:1, 6:14}))) | (sat0 \u003C= 3 & t111 & (sat0[0] | !sat0[1])));\n  assign O[3] = flag0 & ((t97 & t100 & sat0 in {1, 6}) | ((!(sat0[2] | (sat0[0] & sat0[3])) | !((sat0[0] & !sat0[1]) | sat0[3])) & t111 & (sat0[0] | !sat0[1]) & sat0 in {1, 4:15}) | ((lfsr0[1] ^ ((sat0 in {6, 14} | !(sat0[2] | (!(sat0[0] & sat0[1]) & (sat0[0] | sat0[1]))) | sat0 in {0:6, 15}) & sat0 in {0:2, 5:14})) & t95 & t106) | t110 | (t101 & !((sat0[1] | ((sat0[2] | !sat0[0]) & (sat0[0] | !sat0[2]))) ^ sat0 in {1:2, 5}) & t96)) & (sat0 == 7 | sat0 == 8 | sat0 == 2 | t107 | t108) & sat0 != 15;\n  assign O[4] = flag0 & ((sat0 >= 2 & t111 & !(sat0[0] & (sat0[2] | sat0[3])) & sat0 \u003C= 9) | (t95 & t106 & ((sat0 in {0:9, 12:13} & (sat0[2] | (sat0[1] & !sat0[0]) | (!sat0[0] & sat0[3]))) ^ lfsr0[3])) | t110 | (t101 & (!(t120 | (sat0[1] & (sat0[0] | !sat0[2])) | sat0 in {4:5, 12:13}) | sat0 in {8, 10}) & t96)) & (sat0 \u003C= 2 | t107 | t108) & sat0 != 15;\n  assign O[5] = flag0 & ((sat0 == 5 & ((!success_q & r0) | t93 | t94) & (success_q | t93 | t94 | !r0) & ((!t93 & (success_q | r0)) | t94)) | (t101 & t96 & sat0 in {3, 7}) | t110 | (t95 & t106 & !(((sat0 not in {2, 7:14} | ((sat0[2] | sat0[1]) & !sat0[0] & sat0[3])) & (sat0[1] | !sat0[0])) ^ lfsr0[5])) | (sat0 == 3 & ((!success_q & r0) | t93 | t94) & (success_q | t93 | t94 | !r0) & (t93 | !(success_q | r0)) & acc0 != 0)) & sat0 != 15 & (sat0 == 3 | t107 | t108);\n  assign O[6] = flag0 & (sat0 == 7 | sat0 == 8 | t107 | t108 | sat0 in {0:2, 4:6}) & (((sat0[1] | !(sat0[0] & (sat0[2] | sat0[3]))) & t111 & sat0 \u003C= 9) | (t101 & t96 & sat0 not in {3, 7} & sat0 \u003C= 12) | t110 | (t95 & t106 & !(((sat0[2] & (sat0[1] | !sat0[0])) | sat0 in {1, 3}) ^ lfsr0[2])) | (t97 & sat0 in {0:2, 4:7} & t100)) & sat0 != 15;\n  assign O[7] = flag0 & t109 & !(lfsr0[7] ^ (sat0 in [4:6] | ((!(sat0[2] | sat0[1]) | (sat0[0] & sat0[1])) & (!sat0[0] | sat0[3])))) & t95 & t106 & sat0 != 15;\n  assign success = success_q;\nendmodule\n\n  \u002F\u002F ---------------- legend ----------------\n  \u002F\u002F ctr0[3:0] = {dfrtp#39, dfrtp#38, dfrtp#41, dfrtp#40} (msb..lsb)\n  \u002F\u002F ctr1[3:0] = {dfrtp#66, dfrtp#67, dfrtp#69, dfrtp#68} (msb..lsb)\n  \u002F\u002F lfsr0[7:0] = {dfstp#4, dfstp#3, dfstp#2, dfstp#1, dfrtp#36, dfrtp#35, dfrtp#34, dfrtp#33} (msb..lsb)\n  \u002F\u002F sh0[11:0] = {dfrtp#46, dfrtp#48, dfrtp#51, dfrtp#50, dfrtp#54, dfrtp#42, dfrtp#49, dfrtp#44, dfrtp#52, dfrtp#45, dfrtp#53, dfrtp#43} (msb..lsb)\n  \u002F\u002F arr0[0:10] : 2-bit saturating\n  \u002F\u002F sat0[3:0] = {dfxtp#4, dfxtp#1, dfxtp#3, dfxtp#2} (msb..lsb)\n  \u002F\u002F sat1[1:0] = {dfrtp#25, dfrtp#28} (msb..lsb)\n  \u002F\u002F sat2[1:0] = {dfrtp#26, dfrtp#29} (msb..lsb)\n  \u002F\u002F sat3[1:0] = {dfrtp#32, dfrtp#30} (msb..lsb)\n  \u002F\u002F sat4[1:0] = {dfrtp#74, dfrtp#31} (msb..lsb)\n  \u002F\u002F sat5[1:0] = {dfrtp#55, dfrtp#57} (msb..lsb)\n  \u002F\u002F sat6[1:0] = {dfrtp#70, dfrtp#84} (msb..lsb)\n  \u002F\u002F sat7[1:0] = {dfrtp#71, dfrtp#77} (msb..lsb)\n  \u002F\u002F sat8[1:0] = {dfrtp#72, dfrtp#79} (msb..lsb)\n  \u002F\u002F sat9[1:0] = {dfrtp#73, dfrtp#78} (msb..lsb)\n  \u002F\u002F sat10[1:0] = {dfrtp#81, dfrtp#75} (msb..lsb)\n  \u002F\u002F sat11[1:0] = {dfrtp#80, dfrtp#76} (msb..lsb)\n  \u002F\u002F sat12[1:0] = {dfrtp#82, dfrtp#83} (msb..lsb)\n  \u002F\u002F acc0[7:0] = {dfrtp#62, dfrtp#65, dfrtp#63, dfrtp#64, dfrtp#58, dfrtp#59, dfrtp#60, dfrtp#61} (msb..lsb)\n  \u002F\u002F flag0    = dfrtp#1\n  \u002F\u002F r0       = dfrtp#2\n  \u002F\u002F success_q = dfrtp#3\n  \u002F\u002F flag1    = dfrtp#37\n  \u002F\u002F flag2    = dfrtp#47\n  \u002F\u002F flag3    = dfrtp#56\n  \u002F\u002F arr0 is indexed directly by ctr0:\n","verilog",[29,472,473,489,498,506,514,522,544,552,559,580,598,617,636,655,674,693,711,729,747,765,783,801,819,837,855,873,891,920,928,934,940,946,952,958,964,971,977,1002,1074,1177,1253,1368,1427,1455,1570,1661,1685,1731,1789,1818,1833,1936,1951,1991,2034,2049,2122,2180,2230,2257,2277,2297,2315,2345,2360,2379,2396,2411,2440,2457,2521,2548,2605,2630,2645,2729,2749,2768,2788,2807,2900,2925,2940,3089,3110,3134,3150,3170,3185,3261,3282,3410,3431,3451,3474,3593,3705,3724,3798,3819,3840,3855,3876,3895,3928,3961,3981,4013,4032,4051,4068,4092,4109,4124,4146,4217,4222,4246,4274,4283,4295,4310,4367,4388,4399,4443,4479,4511,4551,4597,4642,4688,4709,4779,4791,4797,4847,4853,4859,4887,4893,4920,4938,4961,4983,5028,5089,5100,5262,5400,5425,5478,5484,5544,5549,5610,5667,5722,5777,5787,5799,5812,5950,6075,6080,6085,6091,6096,6405,6741,6963,7317,7566,7860,8098,8210,8223,8229,8234,8240,8246,8252,8258,8264,8270,8276,8282,8288,8294,8300,8306,8312,8318,8324,8330,8336,8342,8348,8354,8360,8366,8372,8378,8384,8390],{"__ignoreMap":125},[14,474,477,481,485],{"class":475,"line":476},"line",1,[14,478,480],{"class":479},"szBVR","module",[14,482,484],{"class":483},"sScJk"," puzzle",[14,486,488],{"class":487},"sVt8B"," (\n",[14,490,492,495],{"class":475,"line":491},2,[14,493,494],{"class":479},"    input",[14,496,497],{"class":487}," I,\n",[14,499,501,503],{"class":475,"line":500},3,[14,502,494],{"class":479},[14,504,505],{"class":487}," clk,\n",[14,507,509,511],{"class":475,"line":508},4,[14,510,494],{"class":479},[14,512,513],{"class":487}," enable,\n",[14,515,517,519],{"class":475,"line":516},5,[14,518,494],{"class":479},[14,520,521],{"class":487}," rst_n,\n",[14,523,525,528,531,535,538,541],{"class":475,"line":524},6,[14,526,527],{"class":479},"    output",[14,529,530],{"class":487}," [",[14,532,534],{"class":533},"sj4cs","7",[14,536,537],{"class":487},":",[14,539,540],{"class":533},"0",[14,542,543],{"class":487},"] O,\n",[14,545,547,549],{"class":475,"line":546},7,[14,548,527],{"class":479},[14,550,551],{"class":487}," success);\n",[14,553,555],{"class":475,"line":554},8,[14,556,558],{"class":557},"sJ8bj","  \u002F\u002F ---------------- recovered state ----------\n",[14,560,562,565,567,570,572,574,577],{"class":475,"line":561},9,[14,563,564],{"class":479},"  reg",[14,566,530],{"class":487},[14,568,569],{"class":533},"3",[14,571,537],{"class":487},[14,573,540],{"class":533},[14,575,576],{"class":487},"] ctr0;        ",[14,578,579],{"class":557},"\u002F\u002F mod-11 counter\n",[14,581,583,585,587,589,591,593,596],{"class":475,"line":582},10,[14,584,564],{"class":479},[14,586,530],{"class":487},[14,588,569],{"class":533},[14,590,537],{"class":487},[14,592,540],{"class":533},[14,594,595],{"class":487},"] ctr1;        ",[14,597,579],{"class":557},[14,599,601,603,605,607,609,611,614],{"class":475,"line":600},11,[14,602,564],{"class":479},[14,604,530],{"class":487},[14,606,534],{"class":533},[14,608,537],{"class":487},[14,610,540],{"class":533},[14,612,613],{"class":487},"] lfsr0;       ",[14,615,616],{"class":557},"\u002F\u002F 4 transition rules, 256 reachable values\n",[14,618,620,622,624,626,628,630,633],{"class":475,"line":619},12,[14,621,564],{"class":479},[14,623,530],{"class":487},[14,625,206],{"class":533},[14,627,537],{"class":487},[14,629,540],{"class":533},[14,631,632],{"class":487},"] sh0;        ",[14,634,635],{"class":557},"\u002F\u002F shift register\n",[14,637,639,641,643,645,647,649,652],{"class":475,"line":638},13,[14,640,564],{"class":479},[14,642,530],{"class":487},[14,644,534],{"class":533},[14,646,537],{"class":487},[14,648,540],{"class":533},[14,650,651],{"class":487},"] acc0;        ",[14,653,654],{"class":557},"\u002F\u002F accumulator\n",[14,656,658,660,662,664,666,668,671],{"class":475,"line":657},14,[14,659,564],{"class":479},[14,661,530],{"class":487},[14,663,569],{"class":533},[14,665,537],{"class":487},[14,667,540],{"class":533},[14,669,670],{"class":487},"] sat0;        ",[14,672,673],{"class":557},"\u002F\u002F saturating counter, cap 15\n",[14,675,677,679,681,683,685,687,690],{"class":475,"line":676},15,[14,678,564],{"class":479},[14,680,530],{"class":487},[14,682,328],{"class":533},[14,684,537],{"class":487},[14,686,540],{"class":533},[14,688,689],{"class":487},"] sat1;        ",[14,691,692],{"class":557},"\u002F\u002F saturating counter, cap 3\n",[14,694,696,698,700,702,704,706,709],{"class":475,"line":695},16,[14,697,564],{"class":479},[14,699,530],{"class":487},[14,701,328],{"class":533},[14,703,537],{"class":487},[14,705,540],{"class":533},[14,707,708],{"class":487},"] sat2;        ",[14,710,692],{"class":557},[14,712,714,716,718,720,722,724,727],{"class":475,"line":713},17,[14,715,564],{"class":479},[14,717,530],{"class":487},[14,719,328],{"class":533},[14,721,537],{"class":487},[14,723,540],{"class":533},[14,725,726],{"class":487},"] sat3;        ",[14,728,692],{"class":557},[14,730,732,734,736,738,740,742,745],{"class":475,"line":731},18,[14,733,564],{"class":479},[14,735,530],{"class":487},[14,737,328],{"class":533},[14,739,537],{"class":487},[14,741,540],{"class":533},[14,743,744],{"class":487},"] sat4;        ",[14,746,692],{"class":557},[14,748,750,752,754,756,758,760,763],{"class":475,"line":749},19,[14,751,564],{"class":479},[14,753,530],{"class":487},[14,755,328],{"class":533},[14,757,537],{"class":487},[14,759,540],{"class":533},[14,761,762],{"class":487},"] sat5;        ",[14,764,692],{"class":557},[14,766,768,770,772,774,776,778,781],{"class":475,"line":767},20,[14,769,564],{"class":479},[14,771,530],{"class":487},[14,773,328],{"class":533},[14,775,537],{"class":487},[14,777,540],{"class":533},[14,779,780],{"class":487},"] sat6;        ",[14,782,692],{"class":557},[14,784,786,788,790,792,794,796,799],{"class":475,"line":785},21,[14,787,564],{"class":479},[14,789,530],{"class":487},[14,791,328],{"class":533},[14,793,537],{"class":487},[14,795,540],{"class":533},[14,797,798],{"class":487},"] sat7;        ",[14,800,692],{"class":557},[14,802,804,806,808,810,812,814,817],{"class":475,"line":803},22,[14,805,564],{"class":479},[14,807,530],{"class":487},[14,809,328],{"class":533},[14,811,537],{"class":487},[14,813,540],{"class":533},[14,815,816],{"class":487},"] sat8;        ",[14,818,692],{"class":557},[14,820,822,824,826,828,830,832,835],{"class":475,"line":821},23,[14,823,564],{"class":479},[14,825,530],{"class":487},[14,827,328],{"class":533},[14,829,537],{"class":487},[14,831,540],{"class":533},[14,833,834],{"class":487},"] sat9;        ",[14,836,692],{"class":557},[14,838,840,842,844,846,848,850,853],{"class":475,"line":839},24,[14,841,564],{"class":479},[14,843,530],{"class":487},[14,845,328],{"class":533},[14,847,537],{"class":487},[14,849,540],{"class":533},[14,851,852],{"class":487},"] sat10;       ",[14,854,692],{"class":557},[14,856,858,860,862,864,866,868,871],{"class":475,"line":857},25,[14,859,564],{"class":479},[14,861,530],{"class":487},[14,863,328],{"class":533},[14,865,537],{"class":487},[14,867,540],{"class":533},[14,869,870],{"class":487},"] sat11;       ",[14,872,692],{"class":557},[14,874,876,878,880,882,884,886,889],{"class":475,"line":875},26,[14,877,564],{"class":479},[14,879,530],{"class":487},[14,881,328],{"class":533},[14,883,537],{"class":487},[14,885,540],{"class":533},[14,887,888],{"class":487},"] sat12;       ",[14,890,692],{"class":557},[14,892,894,896,898,900,902,904,907,909,911,914,917],{"class":475,"line":893},27,[14,895,564],{"class":479},[14,897,530],{"class":487},[14,899,328],{"class":533},[14,901,537],{"class":487},[14,903,540],{"class":533},[14,905,906],{"class":487},"] arr0 [",[14,908,540],{"class":533},[14,910,537],{"class":487},[14,912,913],{"class":533},"10",[14,915,916],{"class":487},"]; ",[14,918,919],{"class":557},"\u002F\u002F saturating counters, cap 3\n",[14,921,923,925],{"class":475,"line":922},28,[14,924,564],{"class":479},[14,926,927],{"class":487}," flag0, r0, success_q, flag1, flag2, flag3;\n",[14,929,931],{"class":475,"line":930},29,[14,932,933],{"class":557},"  \u002F\u002F success requires !flag0   (proved)\n",[14,935,937],{"class":475,"line":936},30,[14,938,939],{"class":557},"  \u002F\u002F success requires !flag2   (proved)\n",[14,941,943],{"class":475,"line":942},31,[14,944,945],{"class":557},"  \u002F\u002F success requires !flag3   (proved)\n",[14,947,949],{"class":475,"line":948},32,[14,950,951],{"class":557},"  \u002F\u002F O[0]..O[7] (all 8) requires flag0   (proved)\n",[14,953,955],{"class":475,"line":954},33,[14,956,957],{"class":557},"  \u002F\u002F success requires flag1   (proved)\n",[14,959,961],{"class":475,"line":960},34,[14,962,963],{"class":557},"  \u002F\u002F sh0 is read at delays [1, 10, 11, 12]; ctr0 advances with it, counts mod 11\n",[14,965,967],{"class":475,"line":966},35,[14,968,970],{"emptyLinePlaceholder":969},true,"\n",[14,972,974],{"class":475,"line":973},36,[14,975,976],{"class":557},"  \u002F\u002F ---- shared subexpressions\n",[14,978,980,983,986,989,992,994,996,999],{"class":475,"line":979},37,[14,981,982],{"class":479},"  wire",[14,984,985],{"class":487}," t6 ",[14,987,988],{"class":479},"=",[14,990,991],{"class":487}," ctr1 in {",[14,993,534],{"class":533},[14,995,428],{"class":487},[14,997,998],{"class":533},"13",[14,1000,1001],{"class":487},"};\n",[14,1003,1005,1007,1010,1012,1015,1018,1020,1023,1026,1029,1032,1035,1037,1039,1042,1044,1047,1049,1051,1053,1055,1057,1059,1061,1063,1065,1067,1069,1071],{"class":475,"line":1004},38,[14,1006,982],{"class":479},[14,1008,1009],{"class":487}," t14 ",[14,1011,988],{"class":479},[14,1013,1014],{"class":479}," !",[14,1016,1017],{"class":487},"(ctr1[",[14,1019,540],{"class":533},[14,1021,1022],{"class":487},"] ",[14,1024,1025],{"class":479},"&",[14,1027,1028],{"class":487}," ctr1[",[14,1030,1031],{"class":533},"2",[14,1033,1034],{"class":487},"]) ",[14,1036,1025],{"class":479},[14,1038,1014],{"class":479},[14,1040,1041],{"class":487},"((ctr1[",[14,1043,540],{"class":533},[14,1045,1046],{"class":487},"] ^ ctr1[",[14,1048,1031],{"class":533},[14,1050,1034],{"class":487},[14,1052,1025],{"class":479},[14,1054,1028],{"class":487},[14,1056,569],{"class":533},[14,1058,1034],{"class":487},[14,1060,1025],{"class":479},[14,1062,1014],{"class":479},[14,1064,1017],{"class":487},[14,1066,328],{"class":533},[14,1068,1046],{"class":487},[14,1070,569],{"class":533},[14,1072,1073],{"class":487},"]);\n",[14,1075,1077,1079,1082,1084,1086,1089,1092,1095,1097,1099,1101,1104,1106,1108,1110,1112,1114,1117,1119,1121,1123,1125,1127,1130,1132,1135,1138,1141,1144,1146,1149,1152,1155,1157,1159,1161,1164,1166,1169,1172,1174],{"class":475,"line":1076},39,[14,1078,982],{"class":479},[14,1080,1081],{"class":487}," t15 ",[14,1083,988],{"class":479},[14,1085,1014],{"class":479},[14,1087,1088],{"class":487},"((",[14,1090,1091],{"class":479},"!",[14,1093,1094],{"class":487},"(ctr0[",[14,1096,569],{"class":533},[14,1098,1022],{"class":487},[14,1100,1025],{"class":479},[14,1102,1103],{"class":487}," (ctr1[",[14,1105,540],{"class":533},[14,1107,1046],{"class":487},[14,1109,1031],{"class":533},[14,1111,1046],{"class":487},[14,1113,569],{"class":533},[14,1115,1116],{"class":487},"] ^ (ctr1[",[14,1118,1031],{"class":533},[14,1120,1022],{"class":487},[14,1122,1025],{"class":479},[14,1124,1028],{"class":487},[14,1126,328],{"class":533},[14,1128,1129],{"class":487},"]))) ",[14,1131,1025],{"class":479},[14,1133,1134],{"class":487}," ctr1 ",[14,1136,1137],{"class":479},"not",[14,1139,1140],{"class":487}," in {",[14,1142,1143],{"class":533},"6",[14,1145,428],{"class":487},[14,1147,1148],{"class":533},"15",[14,1150,1151],{"class":487},"}) ",[14,1153,1154],{"class":479},"|",[14,1156,1009],{"class":487},[14,1158,1154],{"class":479},[14,1160,991],{"class":487},[14,1162,1163],{"class":533},"9",[14,1165,428],{"class":487},[14,1167,1168],{"class":533},"12",[14,1170,1171],{"class":487},"} ",[14,1173,1154],{"class":479},[14,1175,1176],{"class":487}," t6);\n",[14,1178,1180,1182,1185,1187,1189,1192,1194,1196,1198,1200,1203,1205,1207,1209,1211,1214,1216,1218,1220,1222,1224,1226,1228,1231,1233,1236,1238,1240,1242,1244,1246,1248,1250],{"class":475,"line":1179},40,[14,1181,982],{"class":479},[14,1183,1184],{"class":487}," t18 ",[14,1186,988],{"class":479},[14,1188,1014],{"class":479},[14,1190,1191],{"class":487},"((ctr1 in {",[14,1193,540],{"class":533},[14,1195,537],{"class":487},[14,1197,328],{"class":533},[14,1199,428],{"class":487},[14,1201,1202],{"class":533},"8",[14,1204,537],{"class":487},[14,1206,1163],{"class":533},[14,1208,1171],{"class":487},[14,1210,1154],{"class":479},[14,1212,1213],{"class":487}," ((ctr1[",[14,1215,540],{"class":533},[14,1217,1046],{"class":487},[14,1219,1031],{"class":533},[14,1221,1034],{"class":487},[14,1223,1025],{"class":479},[14,1225,1028],{"class":487},[14,1227,328],{"class":533},[14,1229,1230],{"class":487},"])) ^ ctr0[",[14,1232,1031],{"class":533},[14,1234,1235],{"class":487},"] ^ (ctr0[",[14,1237,328],{"class":533},[14,1239,1022],{"class":487},[14,1241,1025],{"class":479},[14,1243,1103],{"class":487},[14,1245,540],{"class":533},[14,1247,1046],{"class":487},[14,1249,328],{"class":533},[14,1251,1252],{"class":487},"])));\n",[14,1254,1256,1258,1261,1263,1266,1268,1270,1272,1274,1276,1278,1280,1282,1284,1286,1288,1290,1292,1294,1296,1298,1300,1302,1304,1306,1308,1310,1312,1314,1316,1318,1320,1322,1324,1326,1329,1331,1334,1336,1338,1340,1342,1344,1347,1349,1351,1353,1355,1357,1359,1361,1363,1365],{"class":475,"line":1255},41,[14,1257,982],{"class":479},[14,1259,1260],{"class":487}," t22 ",[14,1262,988],{"class":479},[14,1264,1265],{"class":487}," (ctr0[",[14,1267,328],{"class":533},[14,1269,1022],{"class":487},[14,1271,1025],{"class":479},[14,1273,1103],{"class":487},[14,1275,540],{"class":533},[14,1277,1046],{"class":487},[14,1279,328],{"class":533},[14,1281,1034],{"class":487},[14,1283,1025],{"class":479},[14,1285,1014],{"class":479},[14,1287,1191],{"class":487},[14,1289,540],{"class":533},[14,1291,537],{"class":487},[14,1293,328],{"class":533},[14,1295,428],{"class":487},[14,1297,1202],{"class":533},[14,1299,537],{"class":487},[14,1301,1163],{"class":533},[14,1303,1171],{"class":487},[14,1305,1154],{"class":479},[14,1307,1213],{"class":487},[14,1309,540],{"class":533},[14,1311,1046],{"class":487},[14,1313,1031],{"class":533},[14,1315,1034],{"class":487},[14,1317,1025],{"class":479},[14,1319,1028],{"class":487},[14,1321,328],{"class":533},[14,1323,1230],{"class":487},[14,1325,1031],{"class":533},[14,1327,1328],{"class":487},"])) ",[14,1330,1154],{"class":479},[14,1332,1333],{"class":487}," (t18 ",[14,1335,1025],{"class":479},[14,1337,1028],{"class":487},[14,1339,540],{"class":533},[14,1341,1022],{"class":487},[14,1343,1025],{"class":479},[14,1345,1346],{"class":487}," ctr0[",[14,1348,540],{"class":533},[14,1350,1022],{"class":487},[14,1352,1025],{"class":479},[14,1354,1265],{"class":487},[14,1356,328],{"class":533},[14,1358,1046],{"class":487},[14,1360,540],{"class":533},[14,1362,1046],{"class":487},[14,1364,328],{"class":533},[14,1366,1367],{"class":487},"]));\n",[14,1369,1371,1373,1376,1378,1380,1383,1385,1387,1389,1391,1393,1395,1397,1399,1401,1403,1405,1407,1409,1411,1413,1415,1417,1419,1421,1423,1425],{"class":475,"line":1370},42,[14,1372,982],{"class":479},[14,1374,1375],{"class":487}," t24 ",[14,1377,988],{"class":479},[14,1379,1014],{"class":479},[14,1381,1382],{"class":487},"ctr0[",[14,1384,1031],{"class":533},[14,1386,1022],{"class":487},[14,1388,1154],{"class":479},[14,1390,991],{"class":487},[14,1392,540],{"class":533},[14,1394,537],{"class":487},[14,1396,328],{"class":533},[14,1398,428],{"class":487},[14,1400,1202],{"class":533},[14,1402,537],{"class":487},[14,1404,1163],{"class":533},[14,1406,1171],{"class":487},[14,1408,1154],{"class":479},[14,1410,1213],{"class":487},[14,1412,540],{"class":533},[14,1414,1046],{"class":487},[14,1416,1031],{"class":533},[14,1418,1034],{"class":487},[14,1420,1025],{"class":479},[14,1422,1028],{"class":487},[14,1424,328],{"class":533},[14,1426,1073],{"class":487},[14,1428,1430,1432,1435,1437,1439,1441,1443,1445,1447,1449,1451,1453],{"class":475,"line":1429},43,[14,1431,982],{"class":479},[14,1433,1434],{"class":487}," t26 ",[14,1436,988],{"class":479},[14,1438,1375],{"class":487},[14,1440,1025],{"class":479},[14,1442,1134],{"class":487},[14,1444,1137],{"class":479},[14,1446,1140],{"class":487},[14,1448,569],{"class":533},[14,1450,428],{"class":487},[14,1452,206],{"class":533},[14,1454,1001],{"class":487},[14,1456,1458,1460,1463,1465,1468,1470,1472,1474,1476,1478,1480,1482,1484,1486,1488,1490,1492,1494,1497,1499,1501,1503,1505,1508,1510,1512,1515,1517,1519,1521,1523,1525,1528,1530,1533,1535,1538,1540,1542,1544,1546,1548,1550,1552,1554,1556,1558,1560,1562,1564,1566,1568],{"class":475,"line":1457},44,[14,1459,982],{"class":479},[14,1461,1462],{"class":487}," t27 ",[14,1464,988],{"class":479},[14,1466,1467],{"class":487}," (t22 ",[14,1469,1025],{"class":479},[14,1471,1213],{"class":487},[14,1473,540],{"class":533},[14,1475,1046],{"class":487},[14,1477,1031],{"class":533},[14,1479,1046],{"class":487},[14,1481,569],{"class":533},[14,1483,1116],{"class":487},[14,1485,1031],{"class":533},[14,1487,1022],{"class":487},[14,1489,1025],{"class":479},[14,1491,1028],{"class":487},[14,1493,328],{"class":533},[14,1495,1496],{"class":487},"]) ^ ctr0[",[14,1498,569],{"class":533},[14,1500,1034],{"class":487},[14,1502,1154],{"class":479},[14,1504,1014],{"class":479},[14,1506,1507],{"class":487},"t24 ",[14,1509,1154],{"class":479},[14,1511,1014],{"class":479},[14,1513,1514],{"class":487},"(ctr1 ",[14,1516,1137],{"class":479},[14,1518,1140],{"class":487},[14,1520,569],{"class":533},[14,1522,428],{"class":487},[14,1524,206],{"class":533},[14,1526,1527],{"class":487},"}))) ",[14,1529,1154],{"class":479},[14,1531,1532],{"class":487}," (",[14,1534,1091],{"class":479},[14,1536,1537],{"class":487},"t26 ",[14,1539,1025],{"class":479},[14,1541,1103],{"class":487},[14,1543,540],{"class":533},[14,1545,1046],{"class":487},[14,1547,1031],{"class":533},[14,1549,1046],{"class":487},[14,1551,569],{"class":533},[14,1553,1116],{"class":487},[14,1555,1031],{"class":533},[14,1557,1022],{"class":487},[14,1559,1025],{"class":479},[14,1561,1028],{"class":487},[14,1563,328],{"class":533},[14,1565,1496],{"class":487},[14,1567,569],{"class":533},[14,1569,1367],{"class":487},[14,1571,1573,1575,1578,1580,1582,1584,1586,1588,1590,1592,1594,1596,1598,1600,1602,1604,1606,1608,1610,1612,1614,1616,1618,1620,1622,1624,1626,1628,1630,1632,1634,1636,1639,1641,1643,1645,1647,1649,1651,1653,1656,1658],{"class":475,"line":1572},45,[14,1574,982],{"class":479},[14,1576,1577],{"class":487}," t28 ",[14,1579,988],{"class":479},[14,1581,1532],{"class":487},[14,1583,1091],{"class":479},[14,1585,1094],{"class":487},[14,1587,569],{"class":533},[14,1589,1022],{"class":487},[14,1591,1025],{"class":479},[14,1593,1103],{"class":487},[14,1595,540],{"class":533},[14,1597,1046],{"class":487},[14,1599,1031],{"class":533},[14,1601,1046],{"class":487},[14,1603,569],{"class":533},[14,1605,1116],{"class":487},[14,1607,1031],{"class":533},[14,1609,1022],{"class":487},[14,1611,1025],{"class":479},[14,1613,1028],{"class":487},[14,1615,328],{"class":533},[14,1617,1129],{"class":487},[14,1619,1025],{"class":479},[14,1621,1134],{"class":487},[14,1623,1137],{"class":479},[14,1625,1140],{"class":487},[14,1627,1143],{"class":533},[14,1629,428],{"class":487},[14,1631,1148],{"class":533},[14,1633,1171],{"class":487},[14,1635,1025],{"class":479},[14,1637,1638],{"class":487}," (t14 ",[14,1640,1154],{"class":479},[14,1642,991],{"class":487},[14,1644,1163],{"class":533},[14,1646,428],{"class":487},[14,1648,1168],{"class":533},[14,1650,1171],{"class":487},[14,1652,1154],{"class":479},[14,1654,1655],{"class":487}," t6)) ",[14,1657,1154],{"class":479},[14,1659,1660],{"class":487}," t15;\n",[14,1662,1664,1666,1669,1671,1673,1675,1678,1680,1682],{"class":475,"line":1663},46,[14,1665,982],{"class":479},[14,1667,1668],{"class":487}," t29 ",[14,1670,988],{"class":479},[14,1672,1081],{"class":487},[14,1674,1154],{"class":479},[14,1676,1677],{"class":487}," (t27 ",[14,1679,1025],{"class":479},[14,1681,1014],{"class":479},[14,1683,1684],{"class":487},"t28);\n",[14,1686,1688,1690,1693,1695,1697,1700,1703,1706,1709,1712,1714,1716,1718,1720,1722,1724,1726,1728],{"class":475,"line":1687},47,[14,1689,982],{"class":479},[14,1691,1692],{"class":487}," t30 ",[14,1694,988],{"class":479},[14,1696,1134],{"class":487},[14,1698,1699],{"class":479},"==",[14,1701,1702],{"class":533}," 12",[14,1704,1705],{"class":479}," |",[14,1707,1708],{"class":487}," (ctr1 in {",[14,1710,1711],{"class":533},"4",[14,1713,537],{"class":487},[14,1715,1143],{"class":533},[14,1717,428],{"class":487},[14,1719,1163],{"class":533},[14,1721,537],{"class":487},[14,1723,1168],{"class":533},[14,1725,1171],{"class":487},[14,1727,1025],{"class":479},[14,1729,1730],{"class":487}," t29);\n",[14,1732,1734,1736,1739,1741,1743,1745,1748,1751,1753,1755,1757,1759,1761,1764,1766,1768,1770,1772,1774,1776,1778,1780,1782,1784,1786],{"class":475,"line":1733},48,[14,1735,982],{"class":479},[14,1737,1738],{"class":487}," t32 ",[14,1740,988],{"class":479},[14,1742,1014],{"class":479},[14,1744,1514],{"class":487},[14,1746,1747],{"class":479},">=",[14,1749,1750],{"class":533}," 13",[14,1752,1705],{"class":479},[14,1754,1532],{"class":487},[14,1756,1091],{"class":479},[14,1758,1514],{"class":487},[14,1760,1137],{"class":479},[14,1762,1763],{"class":487}," in [",[14,1765,534],{"class":533},[14,1767,537],{"class":487},[14,1769,998],{"class":533},[14,1771,1034],{"class":487},[14,1773,1025],{"class":479},[14,1775,1692],{"class":487},[14,1777,1025],{"class":479},[14,1779,1014],{"class":479},[14,1781,1514],{"class":487},[14,1783,1699],{"class":479},[14,1785,1750],{"class":533},[14,1787,1788],{"class":487},")));\n",[14,1790,1792,1794,1797,1799,1801,1803,1805,1807,1809,1811,1813,1815],{"class":475,"line":1791},49,[14,1793,982],{"class":479},[14,1795,1796],{"class":487}," t33 ",[14,1798,988],{"class":479},[14,1800,991],{"class":487},[14,1802,1711],{"class":533},[14,1804,537],{"class":487},[14,1806,1143],{"class":533},[14,1808,428],{"class":487},[14,1810,1163],{"class":533},[14,1812,537],{"class":487},[14,1814,206],{"class":533},[14,1816,1817],{"class":487},"} ^ t29;\n",[14,1819,1821,1823,1826,1828,1830],{"class":475,"line":1820},50,[14,1822,982],{"class":479},[14,1824,1825],{"class":487}," t34 ",[14,1827,988],{"class":479},[14,1829,1014],{"class":479},[14,1831,1832],{"class":487},"(t27 ^ t28);\n",[14,1834,1836,1838,1841,1843,1845,1847,1849,1851,1853,1855,1857,1859,1861,1863,1865,1867,1869,1871,1873,1875,1877,1879,1881,1883,1885,1887,1889,1891,1893,1895,1897,1899,1902,1904,1906,1908,1910,1912,1914,1916,1918,1920,1922,1924,1926,1928,1930,1932,1934],{"class":475,"line":1835},51,[14,1837,982],{"class":479},[14,1839,1840],{"class":487}," t35 ",[14,1842,988],{"class":479},[14,1844,1708],{"class":487},[14,1846,540],{"class":533},[14,1848,537],{"class":487},[14,1850,328],{"class":533},[14,1852,428],{"class":487},[14,1854,1202],{"class":533},[14,1856,537],{"class":487},[14,1858,1163],{"class":533},[14,1860,1171],{"class":487},[14,1862,1154],{"class":479},[14,1864,1213],{"class":487},[14,1866,540],{"class":533},[14,1868,1046],{"class":487},[14,1870,1031],{"class":533},[14,1872,1034],{"class":487},[14,1874,1025],{"class":479},[14,1876,1028],{"class":487},[14,1878,328],{"class":533},[14,1880,1230],{"class":487},[14,1882,1031],{"class":533},[14,1884,1235],{"class":487},[14,1886,328],{"class":533},[14,1888,1022],{"class":487},[14,1890,1025],{"class":479},[14,1892,1103],{"class":487},[14,1894,540],{"class":533},[14,1896,1046],{"class":487},[14,1898,328],{"class":533},[14,1900,1901],{"class":487},"])) ^ (",[14,1903,1091],{"class":479},[14,1905,1017],{"class":487},[14,1907,540],{"class":533},[14,1909,1022],{"class":487},[14,1911,1025],{"class":479},[14,1913,1346],{"class":487},[14,1915,540],{"class":533},[14,1917,1034],{"class":487},[14,1919,1154],{"class":479},[14,1921,1014],{"class":479},[14,1923,1094],{"class":487},[14,1925,328],{"class":533},[14,1927,1046],{"class":487},[14,1929,540],{"class":533},[14,1931,1046],{"class":487},[14,1933,328],{"class":533},[14,1935,1367],{"class":487},[14,1937,1939,1941,1944,1946,1948],{"class":475,"line":1938},52,[14,1940,982],{"class":479},[14,1942,1943],{"class":487}," t36 ",[14,1945,988],{"class":479},[14,1947,1014],{"class":479},[14,1949,1950],{"class":487},"t35;\n",[14,1952,1954,1956,1959,1961,1963,1965,1967,1969,1971,1973,1975,1977,1979,1981,1983,1985,1987,1989],{"class":475,"line":1953},53,[14,1955,982],{"class":479},[14,1957,1958],{"class":487}," t37 ",[14,1960,988],{"class":479},[14,1962,1103],{"class":487},[14,1964,540],{"class":533},[14,1966,1022],{"class":487},[14,1968,1025],{"class":479},[14,1970,1346],{"class":487},[14,1972,540],{"class":533},[14,1974,1034],{"class":487},[14,1976,1154],{"class":479},[14,1978,1265],{"class":487},[14,1980,328],{"class":533},[14,1982,1046],{"class":487},[14,1984,540],{"class":533},[14,1986,1046],{"class":487},[14,1988,328],{"class":533},[14,1990,1073],{"class":487},[14,1992,1994,1996,1999,2001,2004,2006,2009,2011,2013,2015,2017,2019,2021,2023,2025,2027,2029,2031],{"class":475,"line":1993},54,[14,1995,982],{"class":479},[14,1997,1998],{"class":487}," t38 ",[14,2000,988],{"class":479},[14,2002,2003],{"class":487}," t22 ^ ctr1[",[14,2005,540],{"class":533},[14,2007,2008],{"class":487},"] ^ t26 ^ ctr1[",[14,2010,1031],{"class":533},[14,2012,1046],{"class":487},[14,2014,569],{"class":533},[14,2016,1116],{"class":487},[14,2018,1031],{"class":533},[14,2020,1022],{"class":487},[14,2022,1025],{"class":479},[14,2024,1028],{"class":487},[14,2026,328],{"class":533},[14,2028,1496],{"class":487},[14,2030,569],{"class":533},[14,2032,2033],{"class":487},"];\n",[14,2035,2037,2039,2042,2044,2046],{"class":475,"line":2036},55,[14,2038,982],{"class":479},[14,2040,2041],{"class":487}," t39 ",[14,2043,988],{"class":479},[14,2045,1014],{"class":479},[14,2047,2048],{"class":487},"t38;\n",[14,2050,2052,2054,2057,2059,2061,2063,2065,2067,2069,2071,2073,2075,2077,2080,2082,2084,2086,2088,2090,2092,2094,2096,2098,2100,2102,2104,2106,2108,2110,2112,2114,2116,2118,2120],{"class":475,"line":2051},56,[14,2053,982],{"class":479},[14,2055,2056],{"class":487}," t41 ",[14,2058,988],{"class":479},[14,2060,1943],{"class":487},[14,2062,1025],{"class":479},[14,2064,1958],{"class":487},[14,2066,1025],{"class":479},[14,2068,2041],{"class":487},[14,2070,1025],{"class":479},[14,2072,1014],{"class":479},[14,2074,1017],{"class":487},[14,2076,540],{"class":533},[14,2078,2079],{"class":487},"] ^ ctr0[",[14,2081,540],{"class":533},[14,2083,1034],{"class":487},[14,2085,1025],{"class":479},[14,2087,1532],{"class":487},[14,2089,1091],{"class":479},[14,2091,1017],{"class":487},[14,2093,540],{"class":533},[14,2095,1022],{"class":487},[14,2097,1025],{"class":479},[14,2099,1346],{"class":487},[14,2101,540],{"class":533},[14,2103,1034],{"class":487},[14,2105,1154],{"class":479},[14,2107,1014],{"class":479},[14,2109,1094],{"class":487},[14,2111,328],{"class":533},[14,2113,1046],{"class":487},[14,2115,540],{"class":533},[14,2117,1046],{"class":487},[14,2119,328],{"class":533},[14,2121,1367],{"class":487},[14,2123,2125,2127,2130,2132,2134,2136,2138,2140,2142,2144,2146,2148,2150,2152,2154,2156,2158,2160,2162,2164,2166,2168,2170,2172,2174,2176,2178],{"class":475,"line":2124},57,[14,2126,982],{"class":479},[14,2128,2129],{"class":487}," t43 ",[14,2131,988],{"class":479},[14,2133,1014],{"class":479},[14,2135,1017],{"class":487},[14,2137,540],{"class":533},[14,2139,1022],{"class":487},[14,2141,1025],{"class":479},[14,2143,1346],{"class":487},[14,2145,540],{"class":533},[14,2147,1034],{"class":487},[14,2149,1025],{"class":479},[14,2151,1103],{"class":487},[14,2153,540],{"class":533},[14,2155,1022],{"class":487},[14,2157,1154],{"class":479},[14,2159,1346],{"class":487},[14,2161,540],{"class":533},[14,2163,1034],{"class":487},[14,2165,1025],{"class":479},[14,2167,1265],{"class":487},[14,2169,328],{"class":533},[14,2171,1046],{"class":487},[14,2173,540],{"class":533},[14,2175,1046],{"class":487},[14,2177,328],{"class":533},[14,2179,1073],{"class":487},[14,2181,2183,2185,2188,2190,2192,2194,2196,2198,2200,2202,2204,2206,2208,2210,2212,2214,2216,2218,2220,2222,2224,2226,2228],{"class":475,"line":2182},58,[14,2184,982],{"class":479},[14,2186,2187],{"class":487}," t44 ",[14,2189,988],{"class":479},[14,2191,1958],{"class":487},[14,2193,1025],{"class":479},[14,2195,1532],{"class":487},[14,2197,1091],{"class":479},[14,2199,1017],{"class":487},[14,2201,540],{"class":533},[14,2203,1022],{"class":487},[14,2205,1025],{"class":479},[14,2207,1346],{"class":487},[14,2209,540],{"class":533},[14,2211,1034],{"class":487},[14,2213,1154],{"class":479},[14,2215,1014],{"class":479},[14,2217,1094],{"class":487},[14,2219,328],{"class":533},[14,2221,1046],{"class":487},[14,2223,540],{"class":533},[14,2225,1046],{"class":487},[14,2227,328],{"class":533},[14,2229,1367],{"class":487},[14,2231,2233,2235,2238,2240,2242,2244,2246,2248,2250,2252,2254],{"class":475,"line":2232},59,[14,2234,982],{"class":479},[14,2236,2237],{"class":487}," t45 ",[14,2239,988],{"class":479},[14,2241,1014],{"class":479},[14,2243,1041],{"class":487},[14,2245,540],{"class":533},[14,2247,2079],{"class":487},[14,2249,540],{"class":533},[14,2251,1034],{"class":487},[14,2253,1154],{"class":479},[14,2255,2256],{"class":487}," t44);\n",[14,2258,2260,2262,2265,2267,2269,2272,2274],{"class":475,"line":2259},60,[14,2261,982],{"class":479},[14,2263,2264],{"class":487}," t46 ",[14,2266,988],{"class":479},[14,2268,1014],{"class":479},[14,2270,2271],{"class":487},"(t36 ",[14,2273,1025],{"class":479},[14,2275,2276],{"class":487}," t45);\n",[14,2278,2280,2282,2285,2287,2289,2292,2294],{"class":475,"line":2279},61,[14,2281,982],{"class":479},[14,2283,2284],{"class":487}," t47 ",[14,2286,988],{"class":479},[14,2288,1014],{"class":479},[14,2290,2291],{"class":487},"(t46 ",[14,2293,1025],{"class":479},[14,2295,2296],{"class":487}," t39);\n",[14,2298,2300,2302,2305,2307,2309,2311,2313],{"class":475,"line":2299},62,[14,2301,982],{"class":479},[14,2303,2304],{"class":487}," t48 ",[14,2306,988],{"class":479},[14,2308,1014],{"class":479},[14,2310,2271],{"class":487},[14,2312,1154],{"class":479},[14,2314,2276],{"class":487},[14,2316,2318,2320,2323,2325,2327,2329,2331,2333,2335,2337,2339,2341,2343],{"class":475,"line":2317},63,[14,2319,982],{"class":479},[14,2321,2322],{"class":487}," t49 ",[14,2324,988],{"class":479},[14,2326,1958],{"class":487},[14,2328,1154],{"class":479},[14,2330,1014],{"class":479},[14,2332,1017],{"class":487},[14,2334,540],{"class":533},[14,2336,1022],{"class":487},[14,2338,1154],{"class":479},[14,2340,1346],{"class":487},[14,2342,540],{"class":533},[14,2344,1073],{"class":487},[14,2346,2348,2350,2353,2355,2357],{"class":475,"line":2347},64,[14,2349,982],{"class":479},[14,2351,2352],{"class":487}," t50 ",[14,2354,988],{"class":479},[14,2356,1014],{"class":479},[14,2358,2359],{"class":487},"t49;\n",[14,2361,2363,2365,2368,2370,2372,2374,2376],{"class":475,"line":2362},65,[14,2364,982],{"class":479},[14,2366,2367],{"class":487}," t51 ",[14,2369,988],{"class":479},[14,2371,1014],{"class":479},[14,2373,2271],{"class":487},[14,2375,1154],{"class":479},[14,2377,2378],{"class":487}," t50);\n",[14,2380,2382,2384,2387,2389,2391,2393],{"class":475,"line":2381},66,[14,2383,982],{"class":479},[14,2385,2386],{"class":487}," t52 ",[14,2388,988],{"class":479},[14,2390,2237],{"class":487},[14,2392,1154],{"class":479},[14,2394,2395],{"class":487}," t35;\n",[14,2397,2399,2401,2404,2406,2408],{"class":475,"line":2398},67,[14,2400,982],{"class":479},[14,2402,2403],{"class":487}," t53 ",[14,2405,988],{"class":479},[14,2407,1014],{"class":479},[14,2409,2410],{"class":487},"t52;\n",[14,2412,2414,2416,2419,2421,2423,2426,2428,2430,2432,2435,2437],{"class":475,"line":2413},68,[14,2415,982],{"class":479},[14,2417,2418],{"class":487}," t54 ",[14,2420,988],{"class":479},[14,2422,1014],{"class":479},[14,2424,2425],{"class":487},"((t51 ",[14,2427,1154],{"class":479},[14,2429,2403],{"class":487},[14,2431,1154],{"class":479},[14,2433,2434],{"class":487}," t39) ",[14,2436,1025],{"class":479},[14,2438,2439],{"class":487}," t34);\n",[14,2441,2443,2445,2448,2450,2452,2454],{"class":475,"line":2442},69,[14,2444,982],{"class":479},[14,2446,2447],{"class":487}," t55 ",[14,2449,988],{"class":479},[14,2451,2041],{"class":487},[14,2453,1154],{"class":479},[14,2455,2456],{"class":487}," t45;\n",[14,2458,2460,2462,2465,2467,2469,2471,2473,2475,2477,2479,2481,2483,2485,2487,2489,2491,2493,2495,2497,2499,2501,2503,2505,2507,2509,2511,2513,2515,2517,2519],{"class":475,"line":2459},70,[14,2461,982],{"class":479},[14,2463,2464],{"class":487}," t56 ",[14,2466,988],{"class":479},[14,2468,1958],{"class":487},[14,2470,1025],{"class":479},[14,2472,1014],{"class":479},[14,2474,1017],{"class":487},[14,2476,540],{"class":533},[14,2478,2079],{"class":487},[14,2480,540],{"class":533},[14,2482,1034],{"class":487},[14,2484,1025],{"class":479},[14,2486,1532],{"class":487},[14,2488,1091],{"class":479},[14,2490,1017],{"class":487},[14,2492,540],{"class":533},[14,2494,1022],{"class":487},[14,2496,1025],{"class":479},[14,2498,1346],{"class":487},[14,2500,540],{"class":533},[14,2502,1034],{"class":487},[14,2504,1154],{"class":479},[14,2506,1014],{"class":479},[14,2508,1094],{"class":487},[14,2510,328],{"class":533},[14,2512,1046],{"class":487},[14,2514,540],{"class":533},[14,2516,1046],{"class":487},[14,2518,328],{"class":533},[14,2520,1367],{"class":487},[14,2522,2524,2526,2529,2531,2533,2536,2538,2540,2542,2544,2546],{"class":475,"line":2523},71,[14,2525,982],{"class":479},[14,2527,2528],{"class":487}," t57 ",[14,2530,988],{"class":479},[14,2532,1014],{"class":479},[14,2534,2535],{"class":487},"t36 ",[14,2537,1154],{"class":479},[14,2539,1103],{"class":487},[14,2541,540],{"class":533},[14,2543,2079],{"class":487},[14,2545,540],{"class":533},[14,2547,1073],{"class":487},[14,2549,2551,2553,2556,2558,2560,2563,2565,2567,2569,2571,2573,2575,2577,2579,2581,2583,2585,2587,2589,2591,2593,2595,2597,2599,2601,2603],{"class":475,"line":2550},72,[14,2552,982],{"class":479},[14,2554,2555],{"class":487}," t58 ",[14,2557,988],{"class":479},[14,2559,1014],{"class":479},[14,2561,2562],{"class":487},"(t37 ",[14,2564,1025],{"class":479},[14,2566,1184],{"class":487},[14,2568,1025],{"class":479},[14,2570,1532],{"class":487},[14,2572,1091],{"class":479},[14,2574,1017],{"class":487},[14,2576,540],{"class":533},[14,2578,1022],{"class":487},[14,2580,1025],{"class":479},[14,2582,1346],{"class":487},[14,2584,540],{"class":533},[14,2586,1034],{"class":487},[14,2588,1154],{"class":479},[14,2590,1014],{"class":479},[14,2592,1094],{"class":487},[14,2594,328],{"class":533},[14,2596,1046],{"class":487},[14,2598,540],{"class":533},[14,2600,1046],{"class":487},[14,2602,328],{"class":533},[14,2604,1252],{"class":487},[14,2606,2608,2610,2613,2615,2618,2620,2622,2624,2626,2628],{"class":475,"line":2607},73,[14,2609,982],{"class":479},[14,2611,2612],{"class":487}," t59 ",[14,2614,988],{"class":479},[14,2616,2617],{"class":487}," t30 ^ ctr1 ",[14,2619,1137],{"class":479},[14,2621,1763],{"class":487},[14,2623,534],{"class":533},[14,2625,537],{"class":487},[14,2627,1168],{"class":533},[14,2629,2033],{"class":487},[14,2631,2633,2635,2638,2640,2642],{"class":475,"line":2632},74,[14,2634,982],{"class":479},[14,2636,2637],{"class":487}," t60 ",[14,2639,988],{"class":479},[14,2641,1014],{"class":479},[14,2643,2644],{"class":487},"t59;\n",[14,2646,2648,2650,2653,2655,2658,2660,2663,2665,2667,2669,2672,2674,2677,2679,2682,2684,2686,2688,2690,2692,2694,2696,2698,2700,2702,2705,2707,2709,2711,2714,2716,2719,2721,2724,2726],{"class":475,"line":2647},75,[14,2649,982],{"class":479},[14,2651,2652],{"class":487}," t61 ",[14,2654,988],{"class":479},[14,2656,2657],{"class":487}," (t33 ? (t34 ? t56 ",[14,2659,1154],{"class":479},[14,2661,2662],{"class":487}," (t57 ",[14,2664,1025],{"class":479},[14,2666,2555],{"class":487},[14,2668,1025],{"class":479},[14,2670,2671],{"class":487}," t38) : t55 ",[14,2673,1025],{"class":479},[14,2675,2676],{"class":487}," (t43 ",[14,2678,1154],{"class":479},[14,2680,2681],{"class":487}," t47)) : (t34 ",[14,2683,1154],{"class":479},[14,2685,2056],{"class":487},[14,2687,1154],{"class":479},[14,2689,1014],{"class":479},[14,2691,2271],{"class":487},[14,2693,1154],{"class":479},[14,2695,2129],{"class":487},[14,2697,1154],{"class":479},[14,2699,2041],{"class":487},[14,2701,1154],{"class":479},[14,2703,2704],{"class":487}," t45)) ",[14,2706,1025],{"class":479},[14,2708,1532],{"class":487},[14,2710,1091],{"class":479},[14,2712,2713],{"class":487},"(t47 ",[14,2715,1154],{"class":479},[14,2717,2718],{"class":487}," t48) ",[14,2720,1154],{"class":479},[14,2722,2723],{"class":487}," t54)) ",[14,2725,1154],{"class":479},[14,2727,2728],{"class":487}," t60;\n",[14,2730,2732,2734,2737,2739,2741,2744,2746],{"class":475,"line":2731},76,[14,2733,982],{"class":479},[14,2735,2736],{"class":487}," t62 ",[14,2738,988],{"class":479},[14,2740,1014],{"class":479},[14,2742,2743],{"class":487},"(t50 ",[14,2745,1025],{"class":479},[14,2747,2748],{"class":487}," t18);\n",[14,2750,2752,2754,2757,2759,2761,2764,2766],{"class":475,"line":2751},77,[14,2753,982],{"class":479},[14,2755,2756],{"class":487}," t63 ",[14,2758,988],{"class":479},[14,2760,1014],{"class":479},[14,2762,2763],{"class":487},"(t43 ",[14,2765,1025],{"class":479},[14,2767,2748],{"class":487},[14,2769,2771,2773,2776,2778,2780,2783,2785],{"class":475,"line":2770},78,[14,2772,982],{"class":479},[14,2774,2775],{"class":487}," t64 ",[14,2777,988],{"class":479},[14,2779,1014],{"class":479},[14,2781,2782],{"class":487},"(t63 ",[14,2784,1154],{"class":479},[14,2786,2787],{"class":487}," t38);\n",[14,2789,2791,2793,2796,2798,2800,2803,2805],{"class":475,"line":2790},79,[14,2792,982],{"class":479},[14,2794,2795],{"class":487}," t65 ",[14,2797,988],{"class":479},[14,2799,1014],{"class":479},[14,2801,2802],{"class":487},"(t58 ",[14,2804,1154],{"class":479},[14,2806,2787],{"class":487},[14,2808,2810,2812,2815,2817,2819,2821,2823,2825,2828,2830,2833,2835,2838,2840,2842,2844,2846,2849,2851,2853,2855,2858,2860,2863,2865,2867,2869,2872,2874,2876,2878,2880,2882,2884,2886,2889,2891,2893,2895,2897],{"class":475,"line":2809},80,[14,2811,982],{"class":479},[14,2813,2814],{"class":487}," t66 ",[14,2816,988],{"class":479},[14,2818,2612],{"class":487},[14,2820,1154],{"class":479},[14,2822,1532],{"class":487},[14,2824,1091],{"class":479},[14,2826,2827],{"class":487},"(t34 ",[14,2829,1154],{"class":479},[14,2831,2832],{"class":487}," (t33 ",[14,2834,1025],{"class":479},[14,2836,2837],{"class":487}," (t62 ",[14,2839,1154],{"class":479},[14,2841,2434],{"class":487},[14,2843,1025],{"class":479},[14,2845,1014],{"class":479},[14,2847,2848],{"class":487},"t64)) ",[14,2850,1025],{"class":479},[14,2852,2832],{"class":487},[14,2854,1154],{"class":479},[14,2856,2857],{"class":487}," t65)) ",[14,2859,1154],{"class":479},[14,2861,2862],{"class":487}," (t34 ",[14,2864,1025],{"class":479},[14,2866,1532],{"class":487},[14,2868,1091],{"class":479},[14,2870,2871],{"class":487},"(t33 ",[14,2873,1154],{"class":479},[14,2875,2129],{"class":487},[14,2877,1154],{"class":479},[14,2879,1998],{"class":487},[14,2881,1154],{"class":479},[14,2883,2237],{"class":487},[14,2885,1154],{"class":479},[14,2887,2888],{"class":487}," t35) ",[14,2890,1154],{"class":479},[14,2892,1014],{"class":479},[14,2894,2291],{"class":487},[14,2896,1154],{"class":479},[14,2898,2899],{"class":487}," t39)));\n",[14,2901,2903,2905,2908,2910,2912,2914,2916,2918,2920,2922],{"class":475,"line":2902},81,[14,2904,982],{"class":479},[14,2906,2907],{"class":487}," t67 ",[14,2909,988],{"class":479},[14,2911,2676],{"class":487},[14,2913,1154],{"class":479},[14,2915,2237],{"class":487},[14,2917,1154],{"class":479},[14,2919,2888],{"class":487},[14,2921,1025],{"class":479},[14,2923,2924],{"class":487}," t38;\n",[14,2926,2928,2930,2933,2935,2937],{"class":475,"line":2927},82,[14,2929,982],{"class":479},[14,2931,2932],{"class":487}," t68 ",[14,2934,988],{"class":479},[14,2936,1014],{"class":479},[14,2938,2939],{"class":487},"t33;\n",[14,2941,2943,2945,2948,2950,2952,2954,2956,2959,2961,2964,2966,2968,2971,2973,2976,2978,2980,2982,2984,2986,2988,2990,2993,2995,2997,2999,3001,3003,3005,3007,3009,3011,3013,3015,3017,3019,3021,3023,3025,3027,3029,3031,3033,3035,3037,3039,3041,3043,3045,3047,3049,3051,3054,3056,3058,3060,3063,3065,3068,3070,3072,3074,3076,3078,3080,3082,3084,3086],{"class":475,"line":2942},83,[14,2944,982],{"class":479},[14,2946,2947],{"class":487}," t69 ",[14,2949,988],{"class":479},[14,2951,2637],{"class":487},[14,2953,1154],{"class":479},[14,2955,1014],{"class":479},[14,2957,2958],{"class":487},"((t33 ",[14,2960,1154],{"class":479},[14,2962,2963],{"class":487}," ((t54 ",[14,2965,1154],{"class":479},[14,2967,1014],{"class":479},[14,2969,2970],{"class":487},"(t38 ",[14,2972,1154],{"class":479},[14,2974,2975],{"class":487}," t48)) ",[14,2977,1025],{"class":479},[14,2979,1532],{"class":487},[14,2981,1091],{"class":479},[14,2983,2271],{"class":487},[14,2985,1154],{"class":479},[14,2987,2129],{"class":487},[14,2989,1154],{"class":479},[14,2991,2992],{"class":487}," (t37 ",[14,2994,1025],{"class":479},[14,2996,2041],{"class":487},[14,2998,1025],{"class":479},[14,3000,1014],{"class":479},[14,3002,1017],{"class":487},[14,3004,540],{"class":533},[14,3006,2079],{"class":487},[14,3008,540],{"class":533},[14,3010,1034],{"class":487},[14,3012,1025],{"class":479},[14,3014,1532],{"class":487},[14,3016,1091],{"class":479},[14,3018,1017],{"class":487},[14,3020,540],{"class":533},[14,3022,1022],{"class":487},[14,3024,1025],{"class":479},[14,3026,1346],{"class":487},[14,3028,540],{"class":533},[14,3030,1034],{"class":487},[14,3032,1154],{"class":479},[14,3034,1014],{"class":479},[14,3036,1094],{"class":487},[14,3038,328],{"class":533},[14,3040,1046],{"class":487},[14,3042,540],{"class":533},[14,3044,1046],{"class":487},[14,3046,328],{"class":533},[14,3048,1129],{"class":487},[14,3050,1154],{"class":479},[14,3052,3053],{"class":487}," t45) ",[14,3055,1154],{"class":479},[14,3057,1825],{"class":487},[14,3059,1154],{"class":479},[14,3061,3062],{"class":487}," t41))) ",[14,3064,1025],{"class":479},[14,3066,3067],{"class":487}," (t51 ",[14,3069,1154],{"class":479},[14,3071,1825],{"class":487},[14,3073,1154],{"class":479},[14,3075,2129],{"class":487},[14,3077,1154],{"class":479},[14,3079,2907],{"class":487},[14,3081,1154],{"class":479},[14,3083,2932],{"class":487},[14,3085,1154],{"class":479},[14,3087,3088],{"class":487}," t45));\n",[14,3090,3092,3094,3097,3099,3101,3103,3105,3107],{"class":475,"line":3091},84,[14,3093,982],{"class":479},[14,3095,3096],{"class":487}," t70 ",[14,3098,988],{"class":479},[14,3100,2814],{"class":487},[14,3102,1025],{"class":479},[14,3104,1738],{"class":487},[14,3106,1025],{"class":479},[14,3108,3109],{"class":487}," t69;\n",[14,3111,3113,3115,3118,3120,3122,3125,3127,3129,3131],{"class":475,"line":3112},85,[14,3114,982],{"class":479},[14,3116,3117],{"class":487}," t71 ",[14,3119,988],{"class":479},[14,3121,1014],{"class":479},[14,3123,3124],{"class":487},"(t44 ",[14,3126,1154],{"class":479},[14,3128,1998],{"class":487},[14,3130,1154],{"class":479},[14,3132,3133],{"class":487}," t35);\n",[14,3135,3137,3139,3142,3144,3146,3148],{"class":475,"line":3136},86,[14,3138,982],{"class":479},[14,3140,3141],{"class":487}," t72 ",[14,3143,988],{"class":479},[14,3145,2187],{"class":487},[14,3147,1154],{"class":479},[14,3149,2395],{"class":487},[14,3151,3153,3155,3158,3160,3162,3165,3167],{"class":475,"line":3152},87,[14,3154,982],{"class":479},[14,3156,3157],{"class":487}," t73 ",[14,3159,988],{"class":479},[14,3161,1014],{"class":479},[14,3163,3164],{"class":487},"(t39 ",[14,3166,1154],{"class":479},[14,3168,3169],{"class":487}," t48);\n",[14,3171,3173,3175,3178,3180,3182],{"class":475,"line":3172},88,[14,3174,982],{"class":479},[14,3176,3177],{"class":487}," t74 ",[14,3179,988],{"class":479},[14,3181,1014],{"class":479},[14,3183,3184],{"class":487},"t72;\n",[14,3186,3188,3190,3193,3195,3197,3199,3201,3204,3206,3208,3210,3213,3215,3218,3220,3223,3225,3228,3230,3233,3235,3237,3239,3242,3244,3247,3249,3251,3253,3256,3258],{"class":475,"line":3187},89,[14,3189,982],{"class":479},[14,3191,3192],{"class":487}," t75 ",[14,3194,988],{"class":479},[14,3196,1014],{"class":479},[14,3198,2958],{"class":487},[14,3200,1154],{"class":479},[14,3202,3203],{"class":487}," (t34 ? (t52 ",[14,3205,1025],{"class":479},[14,3207,2434],{"class":487},[14,3209,1154],{"class":479},[14,3211,3212],{"class":487}," (t46 ",[14,3214,1025],{"class":479},[14,3216,3217],{"class":487}," t73) : t71 ",[14,3219,1154],{"class":479},[14,3221,3222],{"class":487}," ((t50 ",[14,3224,1154],{"class":479},[14,3226,3227],{"class":487}," t38) ",[14,3229,1025],{"class":479},[14,3231,3232],{"class":487}," t72))) ",[14,3234,1025],{"class":479},[14,3236,2637],{"class":487},[14,3238,1025],{"class":479},[14,3240,3241],{"class":487}," ((t34 ",[14,3243,1025],{"class":479},[14,3245,3246],{"class":487}," t72) ",[14,3248,1154],{"class":479},[14,3250,2932],{"class":487},[14,3252,1154],{"class":479},[14,3254,3255],{"class":487}," ((t56 ",[14,3257,1154],{"class":479},[14,3259,3260],{"class":487}," t74) ? t39 : t73)));\n",[14,3262,3264,3266,3269,3271,3273,3275,3277,3279],{"class":475,"line":3263},90,[14,3265,982],{"class":479},[14,3267,3268],{"class":487}," t76 ",[14,3270,988],{"class":479},[14,3272,2528],{"class":487},[14,3274,1025],{"class":479},[14,3276,2041],{"class":487},[14,3278,1025],{"class":479},[14,3280,3281],{"class":487}," t49;\n",[14,3283,3285,3287,3290,3292,3294,3296,3298,3300,3302,3304,3306,3308,3310,3312,3315,3317,3319,3321,3324,3326,3328,3330,3332,3334,3337,3339,3342,3344,3347,3349,3351,3353,3355,3357,3359,3361,3363,3365,3367,3369,3371,3373,3375,3377,3379,3381,3383,3385,3387,3389,3391,3393,3395,3397,3399,3401,3403,3405,3407],{"class":475,"line":3284},91,[14,3286,982],{"class":479},[14,3288,3289],{"class":487}," t77 ",[14,3291,988],{"class":479},[14,3293,2832],{"class":487},[14,3295,1025],{"class":479},[14,3297,1532],{"class":487},[14,3299,1091],{"class":479},[14,3301,2827],{"class":487},[14,3303,1154],{"class":479},[14,3305,2837],{"class":487},[14,3307,1025],{"class":479},[14,3309,2434],{"class":487},[14,3311,1154],{"class":479},[14,3313,3314],{"class":487}," t67) ",[14,3316,1154],{"class":479},[14,3318,2862],{"class":487},[14,3320,1025],{"class":479},[14,3322,3323],{"class":487}," t64))) ",[14,3325,1154],{"class":479},[14,3327,2637],{"class":487},[14,3329,1154],{"class":479},[14,3331,1532],{"class":487},[14,3333,1091],{"class":479},[14,3335,3336],{"class":487},"((t76 ",[14,3338,1154],{"class":479},[14,3340,3341],{"class":487}," t73) ",[14,3343,1025],{"class":479},[14,3345,3346],{"class":487}," t34) ",[14,3348,1025],{"class":479},[14,3350,3241],{"class":487},[14,3352,1025],{"class":479},[14,3354,1958],{"class":487},[14,3356,1025],{"class":479},[14,3358,1184],{"class":487},[14,3360,1025],{"class":479},[14,3362,1532],{"class":487},[14,3364,1091],{"class":479},[14,3366,1017],{"class":487},[14,3368,540],{"class":533},[14,3370,1022],{"class":487},[14,3372,1025],{"class":479},[14,3374,1346],{"class":487},[14,3376,540],{"class":533},[14,3378,1034],{"class":487},[14,3380,1154],{"class":479},[14,3382,1014],{"class":479},[14,3384,1094],{"class":487},[14,3386,328],{"class":533},[14,3388,1046],{"class":487},[14,3390,540],{"class":533},[14,3392,1046],{"class":487},[14,3394,328],{"class":533},[14,3396,1129],{"class":487},[14,3398,1154],{"class":479},[14,3400,3268],{"class":487},[14,3402,1154],{"class":479},[14,3404,3341],{"class":487},[14,3406,1025],{"class":479},[14,3408,3409],{"class":487}," t68);\n",[14,3411,3413,3415,3418,3420,3422,3424,3426,3428],{"class":475,"line":3412},92,[14,3414,982],{"class":479},[14,3416,3417],{"class":487}," t78 ",[14,3419,988],{"class":479},[14,3421,3192],{"class":487},[14,3423,1025],{"class":479},[14,3425,1738],{"class":487},[14,3427,1025],{"class":479},[14,3429,3430],{"class":487}," t77;\n",[14,3432,3434,3436,3439,3441,3443,3445,3447,3449],{"class":475,"line":3433},93,[14,3435,982],{"class":479},[14,3437,3438],{"class":487}," t79 ",[14,3440,988],{"class":479},[14,3442,2187],{"class":487},[14,3444,1154],{"class":479},[14,3446,2041],{"class":487},[14,3448,1154],{"class":479},[14,3450,2395],{"class":487},[14,3452,3454,3456,3459,3461,3463,3466,3468,3470,3472],{"class":475,"line":3453},94,[14,3455,982],{"class":479},[14,3457,3458],{"class":487}," t80 ",[14,3460,988],{"class":479},[14,3462,1014],{"class":479},[14,3464,3465],{"class":487},"((t38 ",[14,3467,1025],{"class":479},[14,3469,2718],{"class":487},[14,3471,1154],{"class":479},[14,3473,2439],{"class":487},[14,3475,3477,3479,3482,3484,3487,3489,3492,3494,3496,3498,3501,3503,3505,3507,3509,3511,3513,3515,3517,3520,3522,3525,3527,3530,3532,3534,3536,3538,3540,3542,3544,3546,3548,3550,3552,3555,3557,3559,3561,3563,3565,3567,3569,3571,3573,3575,3577,3579,3581,3584,3586,3588,3590],{"class":475,"line":3476},95,[14,3478,982],{"class":479},[14,3480,3481],{"class":487}," t81 ",[14,3483,988],{"class":479},[14,3485,3486],{"class":487}," (((((t57 ",[14,3488,1025],{"class":479},[14,3490,3491],{"class":487}," t58) ",[14,3493,1154],{"class":479},[14,3495,3227],{"class":487},[14,3497,1025],{"class":479},[14,3499,3500],{"class":487}," t79) ",[14,3502,1154],{"class":479},[14,3504,3346],{"class":487},[14,3506,1025],{"class":479},[14,3508,3067],{"class":487},[14,3510,1154],{"class":479},[14,3512,1014],{"class":479},[14,3514,2827],{"class":487},[14,3516,1025],{"class":479},[14,3518,3519],{"class":487}," (t53 ",[14,3521,1154],{"class":479},[14,3523,3524],{"class":487}," t38))) ",[14,3526,1025],{"class":479},[14,3528,3529],{"class":487}," t68) ",[14,3531,1154],{"class":479},[14,3533,2612],{"class":487},[14,3535,1154],{"class":479},[14,3537,2832],{"class":487},[14,3539,1025],{"class":479},[14,3541,3241],{"class":487},[14,3543,1025],{"class":479},[14,3545,2284],{"class":487},[14,3547,1025],{"class":479},[14,3549,3500],{"class":487},[14,3551,1154],{"class":479},[14,3553,3554],{"class":487}," (t80 ",[14,3556,1025],{"class":479},[14,3558,1213],{"class":487},[14,3560,540],{"class":533},[14,3562,2079],{"class":487},[14,3564,540],{"class":533},[14,3566,1034],{"class":487},[14,3568,1154],{"class":479},[14,3570,2187],{"class":487},[14,3572,1154],{"class":479},[14,3574,2041],{"class":487},[14,3576,1154],{"class":479},[14,3578,2888],{"class":487},[14,3580,1025],{"class":479},[14,3582,3583],{"class":487}," (t56 ",[14,3585,1154],{"class":479},[14,3587,1998],{"class":487},[14,3589,1154],{"class":479},[14,3591,3592],{"class":487}," t74))));\n",[14,3594,3596,3598,3601,3603,3605,3607,3609,3611,3613,3615,3617,3620,3622,3624,3627,3629,3631,3633,3636,3638,3640,3642,3644,3646,3648,3650,3652,3654,3656,3658,3660,3662,3665,3667,3670,3672,3674,3676,3678,3680,3682,3684,3686,3688,3691,3693,3696,3698,3701,3703],{"class":475,"line":3595},96,[14,3597,982],{"class":479},[14,3599,3600],{"class":487}," t82 ",[14,3602,988],{"class":479},[14,3604,3241],{"class":487},[14,3606,1154],{"class":479},[14,3608,2056],{"class":487},[14,3610,1154],{"class":479},[14,3612,1014],{"class":479},[14,3614,3164],{"class":487},[14,3616,1154],{"class":479},[14,3618,3619],{"class":487}," t63)) ",[14,3621,1025],{"class":479},[14,3623,1014],{"class":479},[14,3625,3626],{"class":487},"((t38 ? t51 ",[14,3628,1154],{"class":479},[14,3630,2129],{"class":487},[14,3632,1154],{"class":479},[14,3634,3635],{"class":487}," t45 : t36 ",[14,3637,1154],{"class":479},[14,3639,2129],{"class":487},[14,3641,1154],{"class":479},[14,3643,3053],{"class":487},[14,3645,1025],{"class":479},[14,3647,3346],{"class":487},[14,3649,1025],{"class":479},[14,3651,3529],{"class":487},[14,3653,1154],{"class":479},[14,3655,2832],{"class":487},[14,3657,1025],{"class":479},[14,3659,1532],{"class":487},[14,3661,1091],{"class":479},[14,3663,3664],{"class":487},"t34 ",[14,3666,1154],{"class":479},[14,3668,3669],{"class":487}," ((t43 ",[14,3671,1154],{"class":479},[14,3673,1998],{"class":487},[14,3675,1154],{"class":479},[14,3677,2888],{"class":487},[14,3679,1025],{"class":479},[14,3681,3619],{"class":487},[14,3683,1025],{"class":479},[14,3685,1532],{"class":487},[14,3687,1091],{"class":479},[14,3689,3690],{"class":487},"t80 ",[14,3692,1154],{"class":479},[14,3694,3695],{"class":487}," (t36 ",[14,3697,1025],{"class":479},[14,3699,3700],{"class":487}," t55))) ",[14,3702,1154],{"class":479},[14,3704,2728],{"class":487},[14,3706,3708,3710,3713,3715,3717,3719,3721],{"class":475,"line":3707},97,[14,3709,982],{"class":479},[14,3711,3712],{"class":487}," t83 ",[14,3714,988],{"class":479},[14,3716,1014],{"class":479},[14,3718,2827],{"class":487},[14,3720,1025],{"class":479},[14,3722,3723],{"class":487}," t47);\n",[14,3725,3727,3729,3732,3734,3736,3738,3741,3743,3745,3747,3749,3751,3753,3755,3758,3760,3762,3764,3766,3769,3771,3773,3775,3777,3779,3781,3783,3785,3787,3789,3791,3794,3796],{"class":475,"line":3726},98,[14,3728,982],{"class":479},[14,3730,3731],{"class":487}," t84 ",[14,3733,988],{"class":479},[14,3735,2612],{"class":487},[14,3737,1154],{"class":479},[14,3739,3740],{"class":487}," ((t83 ",[14,3742,1154],{"class":479},[14,3744,3341],{"class":487},[14,3746,1025],{"class":479},[14,3748,2862],{"class":487},[14,3750,1154],{"class":479},[14,3752,3117],{"class":487},[14,3754,1154],{"class":479},[14,3756,3757],{"class":487}," t65) ",[14,3759,1025],{"class":479},[14,3761,3529],{"class":487},[14,3763,1154],{"class":479},[14,3765,1014],{"class":479},[14,3767,3768],{"class":487},"((t83 ",[14,3770,1025],{"class":479},[14,3772,2862],{"class":487},[14,3774,1154],{"class":479},[14,3776,3157],{"class":487},[14,3778,1154],{"class":479},[14,3780,3669],{"class":487},[14,3782,1154],{"class":479},[14,3784,2888],{"class":487},[14,3786,1025],{"class":479},[14,3788,2041],{"class":487},[14,3790,1025],{"class":479},[14,3792,3793],{"class":487}," t63))) ",[14,3795,1154],{"class":479},[14,3797,3409],{"class":487},[14,3799,3801,3803,3806,3808,3810,3812,3814,3816],{"class":475,"line":3800},99,[14,3802,982],{"class":479},[14,3804,3805],{"class":487}," t85 ",[14,3807,988],{"class":479},[14,3809,1738],{"class":487},[14,3811,1025],{"class":479},[14,3813,3600],{"class":487},[14,3815,1025],{"class":479},[14,3817,3818],{"class":487}," t84;\n",[14,3820,3822,3824,3827,3829,3831,3833,3835,3837],{"class":475,"line":3821},100,[14,3823,982],{"class":479},[14,3825,3826],{"class":487}," t87 ",[14,3828,988],{"class":479},[14,3830,1738],{"class":487},[14,3832,1025],{"class":479},[14,3834,2652],{"class":487},[14,3836,1025],{"class":479},[14,3838,3839],{"class":487}," t81;\n",[14,3841,3843,3845,3848,3850,3852],{"class":475,"line":3842},101,[14,3844,982],{"class":479},[14,3846,3847],{"class":487}," t88 ",[14,3849,988],{"class":479},[14,3851,1014],{"class":479},[14,3853,3854],{"class":487},"t87;\n",[14,3856,3858,3860,3863,3865,3868,3870,3873],{"class":475,"line":3857},102,[14,3859,982],{"class":479},[14,3861,3862],{"class":487}," t93 ",[14,3864,988],{"class":479},[14,3866,3867],{"class":487}," acc0 ",[14,3869,1699],{"class":479},[14,3871,3872],{"class":533}," 121",[14,3874,3875],{"class":487},";\n",[14,3877,3879,3881,3884,3886,3888,3890,3893],{"class":475,"line":3878},103,[14,3880,982],{"class":479},[14,3882,3883],{"class":487}," t94 ",[14,3885,988],{"class":479},[14,3887,3867],{"class":487},[14,3889,1699],{"class":479},[14,3891,3892],{"class":533}," 0",[14,3894,3875],{"class":487},[14,3896,3898,3900,3903,3905,3907,3909,3911,3914,3916,3919,3921,3923,3925],{"class":475,"line":3897},104,[14,3899,982],{"class":479},[14,3901,3902],{"class":487}," t95 ",[14,3904,988],{"class":479},[14,3906,1014],{"class":479},[14,3908,1088],{"class":487},[14,3910,1091],{"class":479},[14,3912,3913],{"class":487},"success_q ",[14,3915,1025],{"class":479},[14,3917,3918],{"class":487}," r0) ",[14,3920,1154],{"class":479},[14,3922,3862],{"class":487},[14,3924,1154],{"class":479},[14,3926,3927],{"class":487}," t94);\n",[14,3929,3931,3933,3936,3938,3940,3942,3944,3946,3949,3951,3953,3956,3958],{"class":475,"line":3930},105,[14,3932,982],{"class":479},[14,3934,3935],{"class":487}," t96 ",[14,3937,988],{"class":479},[14,3939,1014],{"class":479},[14,3941,3913],{"class":487},[14,3943,1025],{"class":479},[14,3945,1014],{"class":479},[14,3947,3948],{"class":487},"t93 ",[14,3950,1025],{"class":479},[14,3952,1014],{"class":479},[14,3954,3955],{"class":487},"t94 ",[14,3957,1025],{"class":479},[14,3959,3960],{"class":487}," r0;\n",[14,3962,3964,3966,3969,3971,3973,3976,3978],{"class":475,"line":3963},106,[14,3965,982],{"class":479},[14,3967,3968],{"class":487}," t97 ",[14,3970,988],{"class":479},[14,3972,1014],{"class":479},[14,3974,3975],{"class":487},"(t95 ",[14,3977,1154],{"class":479},[14,3979,3980],{"class":487}," t96);\n",[14,3982,3984,3986,3989,3991,3993,3995,3997,3999,4001,4004,4006,4009,4011],{"class":475,"line":3983},107,[14,3985,982],{"class":479},[14,3987,3988],{"class":487}," t100 ",[14,3990,988],{"class":479},[14,3992,1014],{"class":479},[14,3994,1088],{"class":487},[14,3996,1091],{"class":479},[14,3998,3948],{"class":487},[14,4000,1025],{"class":479},[14,4002,4003],{"class":487}," (success_q ",[14,4005,1154],{"class":479},[14,4007,4008],{"class":487}," r0)) ",[14,4010,1154],{"class":479},[14,4012,3927],{"class":487},[14,4014,4016,4018,4021,4023,4025,4027,4029],{"class":475,"line":4015},108,[14,4017,982],{"class":479},[14,4019,4020],{"class":487}," t101 ",[14,4022,988],{"class":479},[14,4024,1014],{"class":479},[14,4026,3975],{"class":487},[14,4028,1154],{"class":479},[14,4030,4031],{"class":487}," t100);\n",[14,4033,4035,4037,4040,4042,4044,4047,4049],{"class":475,"line":4034},109,[14,4036,982],{"class":479},[14,4038,4039],{"class":487}," t106 ",[14,4041,988],{"class":479},[14,4043,1014],{"class":479},[14,4045,4046],{"class":487},"(t96 ",[14,4048,1154],{"class":479},[14,4050,4031],{"class":487},[14,4052,4054,4056,4059,4061,4063,4065],{"class":475,"line":4053},110,[14,4055,982],{"class":479},[14,4057,4058],{"class":487}," t107 ",[14,4060,988],{"class":479},[14,4062,3902],{"class":487},[14,4064,1025],{"class":479},[14,4066,4067],{"class":487}," t106;\n",[14,4069,4071,4073,4076,4078,4080,4082,4084,4087,4089],{"class":475,"line":4070},111,[14,4072,982],{"class":479},[14,4074,4075],{"class":487}," t108 ",[14,4077,988],{"class":479},[14,4079,1014],{"class":479},[14,4081,3975],{"class":487},[14,4083,1154],{"class":479},[14,4085,4086],{"class":487}," (t96 ",[14,4088,1025],{"class":479},[14,4090,4091],{"class":487}," t100));\n",[14,4093,4095,4097,4100,4102,4104,4106],{"class":475,"line":4094},112,[14,4096,982],{"class":479},[14,4098,4099],{"class":487}," t109 ",[14,4101,988],{"class":479},[14,4103,4058],{"class":487},[14,4105,1154],{"class":479},[14,4107,4108],{"class":487}," t108;\n",[14,4110,4112,4114,4117,4119,4121],{"class":475,"line":4111},113,[14,4113,982],{"class":479},[14,4115,4116],{"class":487}," t110 ",[14,4118,988],{"class":479},[14,4120,1014],{"class":479},[14,4122,4123],{"class":487},"t109;\n",[14,4125,4127,4129,4132,4134,4136,4138,4140,4142,4144],{"class":475,"line":4126},114,[14,4128,982],{"class":479},[14,4130,4131],{"class":487}," t111 ",[14,4133,988],{"class":479},[14,4135,1014],{"class":479},[14,4137,3975],{"class":487},[14,4139,1154],{"class":479},[14,4141,3935],{"class":487},[14,4143,1154],{"class":479},[14,4145,4031],{"class":487},[14,4147,4149,4151,4154,4156,4158,4161,4163,4165,4167,4169,4171,4173,4175,4178,4180,4183,4185,4187,4189,4191,4193,4195,4197,4200,4202,4204,4206,4208,4210,4212,4214],{"class":475,"line":4148},115,[14,4150,982],{"class":479},[14,4152,4153],{"class":487}," t120 ",[14,4155,988],{"class":479},[14,4157,1014],{"class":479},[14,4159,4160],{"class":487},"((sat0 ",[14,4162,1137],{"class":479},[14,4164,1763],{"class":487},[14,4166,1202],{"class":533},[14,4168,537],{"class":487},[14,4170,206],{"class":533},[14,4172,1022],{"class":487},[14,4174,1025],{"class":479},[14,4176,4177],{"class":487}," float0 ",[14,4179,1025],{"class":479},[14,4181,4182],{"class":487}," sat0 ",[14,4184,1137],{"class":479},[14,4186,1763],{"class":487},[14,4188,1711],{"class":533},[14,4190,537],{"class":487},[14,4192,534],{"class":533},[14,4194,1034],{"class":487},[14,4196,1154],{"class":479},[14,4198,4199],{"class":487}," sat0 in {",[14,4201,540],{"class":533},[14,4203,537],{"class":487},[14,4205,1031],{"class":533},[14,4207,428],{"class":487},[14,4209,1711],{"class":533},[14,4211,537],{"class":487},[14,4213,1143],{"class":533},[14,4215,4216],{"class":487},"});\n",[14,4218,4220],{"class":475,"line":4219},116,[14,4221,970],{"emptyLinePlaceholder":969},[14,4223,4225,4228,4231,4234,4237,4240,4243],{"class":475,"line":4224},117,[14,4226,4227],{"class":479},"  always",[14,4229,4230],{"class":487}," @(",[14,4232,4233],{"class":479},"posedge",[14,4235,4236],{"class":487}," clk ",[14,4238,4239],{"class":479},"or",[14,4241,4242],{"class":479}," negedge",[14,4244,4245],{"class":487}," rst_n)\n",[14,4247,4249,4252,4254,4256,4259,4262,4265,4268,4271],{"class":475,"line":4248},118,[14,4250,4251],{"class":479},"  if",[14,4253,1532],{"class":487},[14,4255,1091],{"class":479},[14,4257,4258],{"class":487},"rst_n) ",[14,4260,4261],{"class":479},"begin",[14,4263,4264],{"class":479}," \u003C",[14,4266,4267],{"class":487},"reset",[14,4269,4270],{"class":479},">",[14,4272,4273],{"class":479}," end\n",[14,4275,4277,4280],{"class":475,"line":4276},119,[14,4278,4279],{"class":479},"  else",[14,4281,4282],{"class":479}," begin\n",[14,4284,4286,4289,4292],{"class":475,"line":4285},120,[14,4287,4288],{"class":479},"    if",[14,4290,4291],{"class":487}," (enable) ",[14,4293,4294],{"class":479},"begin\n",[14,4296,4298,4301,4303,4305,4308],{"class":475,"line":4297},121,[14,4299,4300],{"class":479},"      if",[14,4302,1532],{"class":487},[14,4304,1091],{"class":479},[14,4306,4307],{"class":487},"flag1) ",[14,4309,4294],{"class":479},[14,4311,4313,4316,4319,4321,4323,4326,4329,4332,4335,4338,4341,4343,4346,4348,4350,4353,4355,4357,4360,4362,4365],{"class":475,"line":4312},122,[14,4314,4315],{"class":479},"        for",[14,4317,4318],{"class":487}," (ctr1 ",[14,4320,988],{"class":479},[14,4322,3892],{"class":533},[14,4324,4325],{"class":487},"; ctr1 ",[14,4327,4328],{"class":479},"\u003C=",[14,4330,4331],{"class":533}," 10",[14,4333,4334],{"class":487},"; ctr1",[14,4336,4337],{"class":479},"++",[14,4339,4340],{"class":487},")  ",[14,4342,431],{"class":479},[14,4344,4345],{"class":487}," (ctr0 ",[14,4347,988],{"class":479},[14,4349,3892],{"class":533},[14,4351,4352],{"class":487},"; ctr0 ",[14,4354,4328],{"class":479},[14,4356,4331],{"class":533},[14,4358,4359],{"class":487},"; ctr0",[14,4361,4337],{"class":479},[14,4363,4364],{"class":487},") ",[14,4366,4294],{"class":479},[14,4368,4370,4373,4376,4379,4381,4383,4385],{"class":475,"line":4369},123,[14,4371,4372],{"class":487},"          sh0 ",[14,4374,4375],{"class":479},"\u003C-",[14,4377,4378],{"class":487}," {sh0[",[14,4380,913],{"class":533},[14,4382,537],{"class":487},[14,4384,540],{"class":533},[14,4386,4387],{"class":487},"], I};\n",[14,4389,4391,4394,4397],{"class":475,"line":4390},124,[14,4392,4393],{"class":479},"          if",[14,4395,4396],{"class":487}," (I) ",[14,4398,4294],{"class":479},[14,4400,4402,4405,4408,4410,4412,4414,4416,4418,4420,4422,4425,4427,4430,4433,4436,4438,4440],{"class":475,"line":4401},125,[14,4403,4404],{"class":479},"            if",[14,4406,4407],{"class":487}," (t32 ",[14,4409,1025],{"class":479},[14,4411,2652],{"class":487},[14,4413,1025],{"class":479},[14,4415,3481],{"class":487},[14,4417,1025],{"class":479},[14,4419,3600],{"class":487},[14,4421,1025],{"class":479},[14,4423,4424],{"class":487}," t84) sat1 ",[14,4426,4375],{"class":479},[14,4428,4429],{"class":487}," min(sat1 ",[14,4431,4432],{"class":479},"+",[14,4434,4435],{"class":533}," 1",[14,4437,428],{"class":487},[14,4439,569],{"class":533},[14,4441,4442],{"class":487},");\n",[14,4444,4446,4448,4451,4453,4455,4457,4459,4461,4464,4466,4469,4471,4473,4475,4477],{"class":475,"line":4445},126,[14,4447,4404],{"class":479},[14,4449,4450],{"class":487}," (t75 ",[14,4452,1025],{"class":479},[14,4454,2652],{"class":487},[14,4456,1025],{"class":479},[14,4458,3481],{"class":487},[14,4460,1025],{"class":479},[14,4462,4463],{"class":487}," t77) sat2 ",[14,4465,4375],{"class":479},[14,4467,4468],{"class":487}," min(sat2 ",[14,4470,4432],{"class":479},[14,4472,4435],{"class":533},[14,4474,428],{"class":487},[14,4476,569],{"class":533},[14,4478,4442],{"class":487},[14,4480,4482,4484,4487,4489,4491,4493,4496,4498,4501,4503,4505,4507,4509],{"class":475,"line":4481},127,[14,4483,4404],{"class":479},[14,4485,4486],{"class":487}," (t66 ",[14,4488,1025],{"class":479},[14,4490,3289],{"class":487},[14,4492,1025],{"class":479},[14,4494,4495],{"class":487}," t82) sat4 ",[14,4497,4375],{"class":479},[14,4499,4500],{"class":487}," min(sat4 ",[14,4502,4432],{"class":479},[14,4504,4435],{"class":533},[14,4506,428],{"class":487},[14,4508,569],{"class":533},[14,4510,4442],{"class":487},[14,4512,4514,4516,4518,4520,4523,4525,4527,4529,4531,4533,4536,4538,4541,4543,4545,4547,4549],{"class":475,"line":4513},128,[14,4515,4404],{"class":479},[14,4517,1532],{"class":487},[14,4519,1091],{"class":479},[14,4521,4522],{"class":487},"(t87 ",[14,4524,1154],{"class":479},[14,4526,3096],{"class":487},[14,4528,1154],{"class":479},[14,4530,3417],{"class":487},[14,4532,1154],{"class":479},[14,4534,4535],{"class":487}," t85)) sat6 ",[14,4537,4375],{"class":479},[14,4539,4540],{"class":487}," min(sat6 ",[14,4542,4432],{"class":479},[14,4544,4435],{"class":533},[14,4546,428],{"class":487},[14,4548,569],{"class":533},[14,4550,4442],{"class":487},[14,4552,4554,4556,4558,4560,4562,4564,4566,4568,4570,4573,4575,4577,4579,4582,4584,4587,4589,4591,4593,4595],{"class":475,"line":4553},129,[14,4555,4404],{"class":479},[14,4557,4486],{"class":487},[14,4559,1025],{"class":479},[14,4561,1738],{"class":487},[14,4563,1025],{"class":479},[14,4565,1014],{"class":479},[14,4567,4522],{"class":487},[14,4569,1154],{"class":479},[14,4571,4572],{"class":487}," t85) ",[14,4574,1025],{"class":479},[14,4576,2947],{"class":487},[14,4578,1025],{"class":479},[14,4580,4581],{"class":487}," t77) sat8 ",[14,4583,4375],{"class":479},[14,4585,4586],{"class":487}," min(sat8 ",[14,4588,4432],{"class":479},[14,4590,4435],{"class":533},[14,4592,428],{"class":487},[14,4594,569],{"class":533},[14,4596,4442],{"class":487},[14,4598,4600,4602,4604,4606,4608,4610,4612,4614,4616,4618,4620,4622,4624,4627,4629,4632,4634,4636,4638,4640],{"class":475,"line":4599},130,[14,4601,4404],{"class":479},[14,4603,4486],{"class":487},[14,4605,1025],{"class":479},[14,4607,1738],{"class":487},[14,4609,1025],{"class":479},[14,4611,2947],{"class":487},[14,4613,1025],{"class":479},[14,4615,3600],{"class":487},[14,4617,1025],{"class":479},[14,4619,1014],{"class":479},[14,4621,4522],{"class":487},[14,4623,1154],{"class":479},[14,4625,4626],{"class":487}," t78)) sat9 ",[14,4628,4375],{"class":479},[14,4630,4631],{"class":487}," min(sat9 ",[14,4633,4432],{"class":479},[14,4635,4435],{"class":533},[14,4637,428],{"class":487},[14,4639,569],{"class":533},[14,4641,4442],{"class":487},[14,4643,4645,4647,4649,4651,4653,4655,4657,4660,4662,4664,4666,4668,4670,4673,4675,4678,4680,4682,4684,4686],{"class":475,"line":4644},131,[14,4646,4404],{"class":479},[14,4648,4450],{"class":487},[14,4650,1025],{"class":479},[14,4652,1014],{"class":479},[14,4654,4522],{"class":487},[14,4656,1154],{"class":479},[14,4658,4659],{"class":487}," t70) ",[14,4661,1025],{"class":479},[14,4663,3289],{"class":487},[14,4665,1025],{"class":479},[14,4667,3600],{"class":487},[14,4669,1025],{"class":479},[14,4671,4672],{"class":487}," t84) sat11 ",[14,4674,4375],{"class":479},[14,4676,4677],{"class":487}," min(sat11 ",[14,4679,4432],{"class":479},[14,4681,4435],{"class":533},[14,4683,428],{"class":487},[14,4685,569],{"class":533},[14,4687,4442],{"class":487},[14,4689,4691,4694,4696,4699,4701,4703,4705,4707],{"class":475,"line":4690},132,[14,4692,4693],{"class":487},"            arr0[ctr0] ",[14,4695,4375],{"class":479},[14,4697,4698],{"class":487}," min(arr0[ctr0] ",[14,4700,4432],{"class":479},[14,4702,4435],{"class":533},[14,4704,428],{"class":487},[14,4706,569],{"class":533},[14,4708,4442],{"class":487},[14,4710,4712,4714,4717,4720,4722,4725,4728,4730,4732,4734,4737,4739,4741,4743,4746,4748,4750,4752,4754,4756,4758,4760,4762,4764,4766,4768,4770,4772,4774,4776],{"class":475,"line":4711},133,[14,4713,4404],{"class":479},[14,4715,4716],{"class":487}," ((ctr0 ",[14,4718,4719],{"class":479},"!=",[14,4721,3892],{"class":533},[14,4723,4724],{"class":479}," &",[14,4726,4727],{"class":487}," sh0[",[14,4729,206],{"class":533},[14,4731,1034],{"class":487},[14,4733,1154],{"class":479},[14,4735,4736],{"class":487}," (sh0[",[14,4738,1163],{"class":533},[14,4740,1022],{"class":487},[14,4742,1025],{"class":479},[14,4744,4745],{"class":487}," ctr0 ",[14,4747,4719],{"class":479},[14,4749,4331],{"class":533},[14,4751,4364],{"class":487},[14,4753,1154],{"class":479},[14,4755,4736],{"class":487},[14,4757,540],{"class":533},[14,4759,1022],{"class":487},[14,4761,1025],{"class":479},[14,4763,4745],{"class":487},[14,4765,4719],{"class":479},[14,4767,3892],{"class":533},[14,4769,4364],{"class":487},[14,4771,1154],{"class":479},[14,4773,4727],{"class":487},[14,4775,913],{"class":533},[14,4777,4778],{"class":487},"])\n",[14,4780,4782,4785,4787,4789],{"class":475,"line":4781},134,[14,4783,4784],{"class":487},"              flag2 ",[14,4786,4375],{"class":479},[14,4788,4435],{"class":533},[14,4790,3875],{"class":487},[14,4792,4794],{"class":475,"line":4793},135,[14,4795,4796],{"class":479},"          end\n",[14,4798,4800,4802,4804,4806,4808,4810,4813,4815,4818,4820,4822,4824,4827,4829,4832,4834,4836,4838,4841,4843,4845],{"class":475,"line":4799},136,[14,4801,4393],{"class":479},[14,4803,4345],{"class":487},[14,4805,1699],{"class":479},[14,4807,4331],{"class":533},[14,4809,4724],{"class":479},[14,4811,4812],{"class":487}," (sat5[",[14,4814,328],{"class":533},[14,4816,4817],{"class":487},"] ? sat5[",[14,4819,540],{"class":533},[14,4821,1022],{"class":487},[14,4823,1154],{"class":479},[14,4825,4826],{"class":487}," I : ",[14,4828,1091],{"class":479},[14,4830,4831],{"class":487},"(sat5[",[14,4833,540],{"class":533},[14,4835,1022],{"class":487},[14,4837,1025],{"class":479},[14,4839,4840],{"class":487}," I))) flag3 ",[14,4842,4375],{"class":479},[14,4844,4435],{"class":533},[14,4846,3875],{"class":487},[14,4848,4850],{"class":475,"line":4849},137,[14,4851,4852],{"class":479},"        end\n",[14,4854,4856],{"class":475,"line":4855},138,[14,4857,4858],{"class":479},"      end\n",[14,4860,4862,4864,4866,4868,4870,4872,4874,4876,4878,4881,4883,4885],{"class":475,"line":4861},139,[14,4863,4300],{"class":479},[14,4865,4345],{"class":487},[14,4867,1699],{"class":479},[14,4869,4331],{"class":533},[14,4871,4724],{"class":479},[14,4873,1134],{"class":487},[14,4875,1699],{"class":479},[14,4877,4331],{"class":533},[14,4879,4880],{"class":487},") flag1 ",[14,4882,4375],{"class":479},[14,4884,4435],{"class":533},[14,4886,3875],{"class":487},[14,4888,4890],{"class":475,"line":4889},140,[14,4891,4892],{"class":479},"    end\n",[14,4894,4896,4899,4901,4903,4905,4908,4910,4912,4915,4917],{"class":475,"line":4895},141,[14,4897,4898],{"class":487},"    acc0 ",[14,4900,4375],{"class":479},[14,4902,3867],{"class":487},[14,4904,4432],{"class":479},[14,4906,4907],{"class":487}," (enable ",[14,4909,1025],{"class":479},[14,4911,1014],{"class":479},[14,4913,4914],{"class":487},"flag1 ",[14,4916,1025],{"class":479},[14,4918,4919],{"class":487}," I);\n",[14,4921,4923,4925,4927,4929,4932,4934,4936],{"class":475,"line":4922},142,[14,4924,4288],{"class":479},[14,4926,1532],{"class":487},[14,4928,1091],{"class":479},[14,4930,4931],{"class":487},"flag0) sat0 ",[14,4933,4375],{"class":479},[14,4935,3892],{"class":533},[14,4937,3875],{"class":487},[14,4939,4941,4944,4946,4948,4951,4953,4955,4957,4959],{"class":475,"line":4940},143,[14,4942,4943],{"class":479},"    else",[14,4945,4182],{"class":487},[14,4947,4375],{"class":479},[14,4949,4950],{"class":487}," min(sat0 ",[14,4952,4432],{"class":479},[14,4954,4435],{"class":533},[14,4956,428],{"class":487},[14,4958,1148],{"class":533},[14,4960,4442],{"class":487},[14,4962,4964,4966,4968,4970,4972,4974,4977,4979,4981],{"class":475,"line":4963},144,[14,4965,4288],{"class":479},[14,4967,4345],{"class":487},[14,4969,1699],{"class":479},[14,4971,4331],{"class":533},[14,4973,4724],{"class":479},[14,4975,4976],{"class":487}," enable) sat5 ",[14,4978,4375],{"class":479},[14,4980,3892],{"class":533},[14,4982,3875],{"class":487},[14,4984,4986,4988,4991,4993,4995,4997,4999,5002,5004,5006,5008,5010,5013,5015,5018,5020,5022,5024,5026],{"class":475,"line":4985},145,[14,4987,4943],{"class":479},[14,4989,4990],{"class":479}," if",[14,4992,4345],{"class":487},[14,4994,4719],{"class":479},[14,4996,4331],{"class":533},[14,4998,4724],{"class":479},[14,5000,5001],{"class":487}," enable ",[14,5003,1025],{"class":479},[14,5005,1014],{"class":479},[14,5007,4914],{"class":487},[14,5009,1025],{"class":479},[14,5011,5012],{"class":487}," I) sat5 ",[14,5014,4375],{"class":479},[14,5016,5017],{"class":487}," min(sat5 ",[14,5019,4432],{"class":479},[14,5021,4435],{"class":533},[14,5023,428],{"class":487},[14,5025,569],{"class":533},[14,5027,4442],{"class":487},[14,5029,5031,5033,5036,5038,5041,5043,5046,5048,5051,5053,5055,5058,5060,5062,5064,5067,5069,5071,5073,5075,5078,5080,5082,5084,5086],{"class":475,"line":5030},146,[14,5032,4288],{"class":479},[14,5034,5035],{"class":487}," ((sat0 ",[14,5037,1699],{"class":479},[14,5039,5040],{"class":533}," 15",[14,5042,4724],{"class":479},[14,5044,5045],{"class":487}," flag1) ",[14,5047,1154],{"class":479},[14,5049,5050],{"class":487}," (flag1 ",[14,5052,1025],{"class":479},[14,5054,1014],{"class":479},[14,5056,5057],{"class":487},"flag0) ",[14,5059,1154],{"class":479},[14,5061,1532],{"class":487},[14,5063,1091],{"class":479},[14,5065,5066],{"class":487},"enable ",[14,5068,1025],{"class":479},[14,5070,1014],{"class":479},[14,5072,5057],{"class":487},[14,5074,1154],{"class":479},[14,5076,5077],{"class":487}," (sat0 ",[14,5079,1699],{"class":479},[14,5081,5040],{"class":533},[14,5083,4724],{"class":479},[14,5085,1014],{"class":479},[14,5087,5088],{"class":487},"enable))\n",[14,5090,5092,5095,5097],{"class":475,"line":5091},147,[14,5093,5094],{"class":487},"      lfsr0 ",[14,5096,4375],{"class":479},[14,5098,5099],{"class":487}," lfsr0;\n",[14,5101,5103,5105,5107,5110,5112,5114,5117,5119,5121,5123,5125,5127,5130,5132,5134,5136,5138,5140,5142,5144,5146,5148,5150,5152,5154,5156,5158,5160,5162,5164,5166,5168,5170,5172,5174,5176,5178,5180,5182,5184,5187,5189,5191,5193,5195,5197,5199,5201,5203,5205,5207,5209,5211,5213,5215,5217,5219,5221,5223,5225,5227,5229,5231,5233,5235,5237,5239,5241,5243,5245,5247,5249,5251,5253,5255,5257,5259],{"class":475,"line":5102},148,[14,5104,4943],{"class":479},[14,5106,4990],{"class":479},[14,5108,5109],{"class":487}," ((flag0 ",[14,5111,1025],{"class":479},[14,5113,1014],{"class":479},[14,5115,5116],{"class":487},"sat0[",[14,5118,540],{"class":533},[14,5120,1022],{"class":487},[14,5122,1025],{"class":479},[14,5124,5045],{"class":487},[14,5126,1154],{"class":479},[14,5128,5129],{"class":487}," (flag0 ",[14,5131,1025],{"class":479},[14,5133,1014],{"class":479},[14,5135,5066],{"class":487},[14,5137,1025],{"class":479},[14,5139,1014],{"class":479},[14,5141,5116],{"class":487},[14,5143,569],{"class":533},[14,5145,1034],{"class":487},[14,5147,1154],{"class":479},[14,5149,5129],{"class":487},[14,5151,1025],{"class":479},[14,5153,1014],{"class":479},[14,5155,5066],{"class":487},[14,5157,1025],{"class":479},[14,5159,1014],{"class":479},[14,5161,5116],{"class":487},[14,5163,1031],{"class":533},[14,5165,1034],{"class":487},[14,5167,1154],{"class":479},[14,5169,5129],{"class":487},[14,5171,1025],{"class":479},[14,5173,1014],{"class":479},[14,5175,5116],{"class":487},[14,5177,328],{"class":533},[14,5179,1022],{"class":487},[14,5181,1025],{"class":479},[14,5183,1014],{"class":479},[14,5185,5186],{"class":487},"enable) ",[14,5188,1154],{"class":479},[14,5190,5129],{"class":487},[14,5192,1025],{"class":479},[14,5194,1014],{"class":479},[14,5196,5116],{"class":487},[14,5198,569],{"class":533},[14,5200,1022],{"class":487},[14,5202,1025],{"class":479},[14,5204,5045],{"class":487},[14,5206,1154],{"class":479},[14,5208,5129],{"class":487},[14,5210,1025],{"class":479},[14,5212,1014],{"class":479},[14,5214,5116],{"class":487},[14,5216,328],{"class":533},[14,5218,1022],{"class":487},[14,5220,1025],{"class":479},[14,5222,5045],{"class":487},[14,5224,1154],{"class":479},[14,5226,5129],{"class":487},[14,5228,1025],{"class":479},[14,5230,1014],{"class":479},[14,5232,5116],{"class":487},[14,5234,1031],{"class":533},[14,5236,1022],{"class":487},[14,5238,1025],{"class":479},[14,5240,5045],{"class":487},[14,5242,1154],{"class":479},[14,5244,5129],{"class":487},[14,5246,1025],{"class":479},[14,5248,1014],{"class":479},[14,5250,5066],{"class":487},[14,5252,1025],{"class":479},[14,5254,1014],{"class":479},[14,5256,5116],{"class":487},[14,5258,540],{"class":533},[14,5260,5261],{"class":487},"]))\n",[14,5263,5265,5267,5269,5272,5274,5277,5279,5281,5284,5286,5288,5291,5293,5295,5297,5299,5301,5303,5305,5307,5309,5311,5313,5315,5317,5319,5321,5323,5325,5327,5329,5331,5333,5335,5337,5339,5341,5343,5345,5347,5349,5351,5353,5355,5357,5359,5361,5363,5365,5367,5369,5371,5373,5375,5377,5379,5381,5383,5385,5387,5389,5391,5393,5395,5397],{"class":475,"line":5264},149,[14,5266,5094],{"class":487},[14,5268,4375],{"class":479},[14,5270,5271],{"class":487}," {lfsr0[",[14,5273,328],{"class":533},[14,5275,5276],{"class":487},"] ^ lfsr0[",[14,5278,569],{"class":533},[14,5280,5276],{"class":487},[14,5282,5283],{"class":533},"5",[14,5285,5276],{"class":487},[14,5287,534],{"class":533},[14,5289,5290],{"class":487},"], lfsr0[",[14,5292,1031],{"class":533},[14,5294,5276],{"class":487},[14,5296,1711],{"class":533},[14,5298,5276],{"class":487},[14,5300,5283],{"class":533},[14,5302,5290],{"class":487},[14,5304,540],{"class":533},[14,5306,5276],{"class":487},[14,5308,328],{"class":533},[14,5310,5276],{"class":487},[14,5312,1711],{"class":533},[14,5314,5276],{"class":487},[14,5316,5283],{"class":533},[14,5318,5290],{"class":487},[14,5320,1031],{"class":533},[14,5322,5276],{"class":487},[14,5324,5283],{"class":533},[14,5326,5276],{"class":487},[14,5328,1143],{"class":533},[14,5330,5276],{"class":487},[14,5332,534],{"class":533},[14,5334,5290],{"class":487},[14,5336,540],{"class":533},[14,5338,5276],{"class":487},[14,5340,569],{"class":533},[14,5342,5276],{"class":487},[14,5344,1711],{"class":533},[14,5346,5276],{"class":487},[14,5348,1143],{"class":533},[14,5350,5290],{"class":487},[14,5352,328],{"class":533},[14,5354,5276],{"class":487},[14,5356,1031],{"class":533},[14,5358,5276],{"class":487},[14,5360,569],{"class":533},[14,5362,5276],{"class":487},[14,5364,1711],{"class":533},[14,5366,5290],{"class":487},[14,5368,540],{"class":533},[14,5370,5276],{"class":487},[14,5372,569],{"class":533},[14,5374,5276],{"class":487},[14,5376,5283],{"class":533},[14,5378,5276],{"class":487},[14,5380,1143],{"class":533},[14,5382,5276],{"class":487},[14,5384,534],{"class":533},[14,5386,5290],{"class":487},[14,5388,328],{"class":533},[14,5390,5276],{"class":487},[14,5392,1031],{"class":533},[14,5394,5276],{"class":487},[14,5396,534],{"class":533},[14,5398,5399],{"class":487},"]};\n",[14,5401,5403,5405,5407,5409,5411,5414,5416,5418,5420,5422],{"class":475,"line":5402},150,[14,5404,4943],{"class":479},[14,5406,4990],{"class":479},[14,5408,1532],{"class":487},[14,5410,1091],{"class":479},[14,5412,5413],{"class":487},"I ",[14,5415,1025],{"class":479},[14,5417,5001],{"class":487},[14,5419,1025],{"class":479},[14,5421,1014],{"class":479},[14,5423,5424],{"class":487},"flag1)\n",[14,5426,5428,5430,5432,5434,5436,5438,5440,5442,5444,5446,5448,5450,5452,5454,5456,5458,5460,5462,5464,5466,5468,5470,5472,5474,5476],{"class":475,"line":5427},151,[14,5429,5094],{"class":487},[14,5431,4375],{"class":479},[14,5433,5271],{"class":487},[14,5435,1031],{"class":533},[14,5437,5290],{"class":487},[14,5439,328],{"class":533},[14,5441,5276],{"class":487},[14,5443,569],{"class":533},[14,5445,5276],{"class":487},[14,5447,5283],{"class":533},[14,5449,5276],{"class":487},[14,5451,534],{"class":533},[14,5453,5290],{"class":487},[14,5455,569],{"class":533},[14,5457,5290],{"class":487},[14,5459,540],{"class":533},[14,5461,5290],{"class":487},[14,5463,328],{"class":533},[14,5465,5290],{"class":487},[14,5467,5283],{"class":533},[14,5469,5290],{"class":487},[14,5471,1711],{"class":533},[14,5473,5290],{"class":487},[14,5475,1143],{"class":533},[14,5477,5399],{"class":487},[14,5479,5481],{"class":475,"line":5480},152,[14,5482,5483],{"class":479},"    else\n",[14,5485,5487,5489,5491,5493,5495,5498,5500,5503,5505,5507,5509,5511,5513,5515,5517,5520,5522,5524,5526,5528,5530,5532,5534,5536,5538,5540,5542],{"class":475,"line":5486},153,[14,5488,5094],{"class":487},[14,5490,4375],{"class":479},[14,5492,5271],{"class":487},[14,5494,1031],{"class":533},[14,5496,5497],{"class":487},"], ",[14,5499,1091],{"class":479},[14,5501,5502],{"class":487},"(lfsr0[",[14,5504,328],{"class":533},[14,5506,5276],{"class":487},[14,5508,569],{"class":533},[14,5510,5276],{"class":487},[14,5512,5283],{"class":533},[14,5514,5276],{"class":487},[14,5516,534],{"class":533},[14,5518,5519],{"class":487},"]), lfsr0[",[14,5521,569],{"class":533},[14,5523,5290],{"class":487},[14,5525,540],{"class":533},[14,5527,5290],{"class":487},[14,5529,328],{"class":533},[14,5531,5290],{"class":487},[14,5533,5283],{"class":533},[14,5535,5290],{"class":487},[14,5537,1711],{"class":533},[14,5539,5290],{"class":487},[14,5541,1143],{"class":533},[14,5543,5399],{"class":487},[14,5545,5547],{"class":475,"line":5546},154,[14,5548,970],{"emptyLinePlaceholder":969},[14,5550,5552,5554,5556,5558,5560,5562,5564,5567,5569,5571,5574,5576,5578,5581,5583,5585,5588,5590,5592,5595,5597,5600,5602,5604,5606,5608],{"class":475,"line":5551},155,[14,5553,4288],{"class":479},[14,5555,4907],{"class":487},[14,5557,1025],{"class":479},[14,5559,1014],{"class":479},[14,5561,4914],{"class":487},[14,5563,1025],{"class":479},[14,5565,5566],{"class":487}," I ",[14,5568,1025],{"class":479},[14,5570,1014],{"class":479},[14,5572,5573],{"class":487},"t70 ",[14,5575,1025],{"class":479},[14,5577,1014],{"class":479},[14,5579,5580],{"class":487},"t78 ",[14,5582,1025],{"class":479},[14,5584,1014],{"class":479},[14,5586,5587],{"class":487},"t88 ",[14,5589,1025],{"class":479},[14,5591,1014],{"class":479},[14,5593,5594],{"class":487},"t85) sat3 ",[14,5596,4375],{"class":479},[14,5598,5599],{"class":487}," min(sat3 ",[14,5601,4432],{"class":479},[14,5603,4435],{"class":533},[14,5605,428],{"class":487},[14,5607,569],{"class":533},[14,5609,4442],{"class":487},[14,5611,5613,5615,5617,5619,5621,5623,5625,5627,5629,5631,5634,5636,5638,5640,5642,5644,5647,5649,5652,5654,5657,5659,5661,5663,5665],{"class":475,"line":5612},156,[14,5614,4288],{"class":479},[14,5616,4907],{"class":487},[14,5618,1025],{"class":479},[14,5620,1014],{"class":479},[14,5622,4914],{"class":487},[14,5624,1025],{"class":479},[14,5626,5566],{"class":487},[14,5628,1025],{"class":479},[14,5630,1014],{"class":479},[14,5632,5633],{"class":487},"t87 ",[14,5635,1025],{"class":479},[14,5637,1014],{"class":479},[14,5639,5580],{"class":487},[14,5641,1025],{"class":479},[14,5643,1014],{"class":479},[14,5645,5646],{"class":487},"t85 ",[14,5648,1025],{"class":479},[14,5650,5651],{"class":487}," t70) sat7 ",[14,5653,4375],{"class":479},[14,5655,5656],{"class":487}," min(sat7 ",[14,5658,4432],{"class":479},[14,5660,4435],{"class":533},[14,5662,428],{"class":487},[14,5664,569],{"class":533},[14,5666,4442],{"class":487},[14,5668,5670,5672,5674,5676,5678,5680,5682,5684,5686,5688,5690,5692,5694,5696,5698,5700,5702,5704,5707,5709,5712,5714,5716,5718,5720],{"class":475,"line":5669},157,[14,5671,4288],{"class":479},[14,5673,4907],{"class":487},[14,5675,1025],{"class":479},[14,5677,1014],{"class":479},[14,5679,4914],{"class":487},[14,5681,1025],{"class":479},[14,5683,5566],{"class":487},[14,5685,1025],{"class":479},[14,5687,1014],{"class":479},[14,5689,5633],{"class":487},[14,5691,1025],{"class":479},[14,5693,1014],{"class":479},[14,5695,5573],{"class":487},[14,5697,1025],{"class":479},[14,5699,3417],{"class":487},[14,5701,1025],{"class":479},[14,5703,1014],{"class":479},[14,5705,5706],{"class":487},"t85) sat10 ",[14,5708,4375],{"class":479},[14,5710,5711],{"class":487}," min(sat10 ",[14,5713,4432],{"class":479},[14,5715,4435],{"class":533},[14,5717,428],{"class":487},[14,5719,569],{"class":533},[14,5721,4442],{"class":487},[14,5723,5725,5727,5729,5731,5733,5735,5737,5739,5741,5743,5745,5747,5749,5751,5753,5755,5757,5759,5762,5764,5767,5769,5771,5773,5775],{"class":475,"line":5724},158,[14,5726,4288],{"class":479},[14,5728,4907],{"class":487},[14,5730,1025],{"class":479},[14,5732,1014],{"class":479},[14,5734,4914],{"class":487},[14,5736,1025],{"class":479},[14,5738,5566],{"class":487},[14,5740,1025],{"class":479},[14,5742,3805],{"class":487},[14,5744,1025],{"class":479},[14,5746,1014],{"class":479},[14,5748,5633],{"class":487},[14,5750,1025],{"class":479},[14,5752,1014],{"class":479},[14,5754,5573],{"class":487},[14,5756,1025],{"class":479},[14,5758,1014],{"class":479},[14,5760,5761],{"class":487},"t78) sat12 ",[14,5763,4375],{"class":479},[14,5765,5766],{"class":487}," min(sat12 ",[14,5768,4432],{"class":479},[14,5770,4435],{"class":533},[14,5772,428],{"class":487},[14,5774,569],{"class":533},[14,5776,4442],{"class":487},[14,5778,5780,5782,5785],{"class":475,"line":5779},159,[14,5781,4288],{"class":479},[14,5783,5784],{"class":487}," (flag1) ",[14,5786,4294],{"class":479},[14,5788,5790,5793,5795,5797],{"class":475,"line":5789},160,[14,5791,5792],{"class":487},"      flag0 ",[14,5794,4375],{"class":479},[14,5796,4435],{"class":533},[14,5798,3875],{"class":487},[14,5800,5802,5804,5806,5808,5810],{"class":475,"line":5801},161,[14,5803,4300],{"class":479},[14,5805,1532],{"class":487},[14,5807,1091],{"class":479},[14,5809,5057],{"class":487},[14,5811,4294],{"class":479},[14,5813,5815,5818,5820,5823,5825,5828,5830,5833,5835,5837,5839,5842,5844,5846,5848,5851,5853,5855,5857,5860,5862,5864,5866,5869,5871,5873,5875,5878,5880,5882,5884,5887,5889,5891,5893,5896,5898,5900,5902,5905,5907,5909,5911,5914,5916,5918,5920,5922,5924,5927,5929,5932,5934,5936,5939,5941,5944,5946,5948],{"class":475,"line":5814},162,[14,5816,5817],{"class":487},"        r0 ",[14,5819,4375],{"class":479},[14,5821,5822],{"class":487}," sat1 ",[14,5824,1699],{"class":479},[14,5826,5827],{"class":533}," 2",[14,5829,4724],{"class":479},[14,5831,5832],{"class":487}," sat2 ",[14,5834,1699],{"class":479},[14,5836,5827],{"class":533},[14,5838,4724],{"class":479},[14,5840,5841],{"class":487}," sat3 ",[14,5843,1699],{"class":479},[14,5845,5827],{"class":533},[14,5847,4724],{"class":479},[14,5849,5850],{"class":487}," sat4 ",[14,5852,1699],{"class":479},[14,5854,5827],{"class":533},[14,5856,4724],{"class":479},[14,5858,5859],{"class":487}," sat6 ",[14,5861,1699],{"class":479},[14,5863,5827],{"class":533},[14,5865,4724],{"class":479},[14,5867,5868],{"class":487}," sat7 ",[14,5870,1699],{"class":479},[14,5872,5827],{"class":533},[14,5874,4724],{"class":479},[14,5876,5877],{"class":487}," sat8 ",[14,5879,1699],{"class":479},[14,5881,5827],{"class":533},[14,5883,4724],{"class":479},[14,5885,5886],{"class":487}," sat9 ",[14,5888,1699],{"class":479},[14,5890,5827],{"class":533},[14,5892,4724],{"class":479},[14,5894,5895],{"class":487}," sat10 ",[14,5897,1699],{"class":479},[14,5899,5827],{"class":533},[14,5901,4724],{"class":479},[14,5903,5904],{"class":487}," sat11 ",[14,5906,1699],{"class":479},[14,5908,5827],{"class":533},[14,5910,4724],{"class":479},[14,5912,5913],{"class":487}," sat12 ",[14,5915,1699],{"class":479},[14,5917,5827],{"class":533},[14,5919,4724],{"class":479},[14,5921,3867],{"class":487},[14,5923,1699],{"class":479},[14,5925,5926],{"class":533}," 22",[14,5928,4724],{"class":479},[14,5930,5931],{"class":487}," flag2 ",[14,5933,1025],{"class":479},[14,5935,1014],{"class":479},[14,5937,5938],{"class":487},"flag3 ",[14,5940,1025],{"class":479},[14,5942,5943],{"class":487}," all(arr0 ",[14,5945,1699],{"class":479},[14,5947,5827],{"class":533},[14,5949,4442],{"class":487},[14,5951,5953,5956,5958,5960,5962,5964,5966,5968,5970,5972,5974,5976,5978,5980,5982,5984,5986,5988,5990,5992,5994,5996,5998,6000,6002,6004,6006,6008,6010,6012,6014,6016,6018,6020,6022,6024,6026,6028,6030,6032,6034,6036,6038,6040,6042,6044,6046,6048,6050,6052,6054,6056,6059,6061,6063,6065,6067,6069,6071,6073],{"class":475,"line":5952},163,[14,5954,5955],{"class":487},"        success_q ",[14,5957,4375],{"class":479},[14,5959,5822],{"class":487},[14,5961,1699],{"class":479},[14,5963,5827],{"class":533},[14,5965,4724],{"class":479},[14,5967,5832],{"class":487},[14,5969,1699],{"class":479},[14,5971,5827],{"class":533},[14,5973,4724],{"class":479},[14,5975,5841],{"class":487},[14,5977,1699],{"class":479},[14,5979,5827],{"class":533},[14,5981,4724],{"class":479},[14,5983,5850],{"class":487},[14,5985,1699],{"class":479},[14,5987,5827],{"class":533},[14,5989,4724],{"class":479},[14,5991,5859],{"class":487},[14,5993,1699],{"class":479},[14,5995,5827],{"class":533},[14,5997,4724],{"class":479},[14,5999,5868],{"class":487},[14,6001,1699],{"class":479},[14,6003,5827],{"class":533},[14,6005,4724],{"class":479},[14,6007,5877],{"class":487},[14,6009,1699],{"class":479},[14,6011,5827],{"class":533},[14,6013,4724],{"class":479},[14,6015,5886],{"class":487},[14,6017,1699],{"class":479},[14,6019,5827],{"class":533},[14,6021,4724],{"class":479},[14,6023,5895],{"class":487},[14,6025,1699],{"class":479},[14,6027,5827],{"class":533},[14,6029,4724],{"class":479},[14,6031,5904],{"class":487},[14,6033,1699],{"class":479},[14,6035,5827],{"class":533},[14,6037,4724],{"class":479},[14,6039,5913],{"class":487},[14,6041,1699],{"class":479},[14,6043,5827],{"class":533},[14,6045,4724],{"class":479},[14,6047,3867],{"class":487},[14,6049,1699],{"class":479},[14,6051,5926],{"class":533},[14,6053,4724],{"class":479},[14,6055,1014],{"class":479},[14,6057,6058],{"class":487},"flag2 ",[14,6060,1025],{"class":479},[14,6062,1014],{"class":479},[14,6064,5938],{"class":487},[14,6066,1025],{"class":479},[14,6068,5943],{"class":487},[14,6070,1699],{"class":479},[14,6072,5827],{"class":533},[14,6074,4442],{"class":487},[14,6076,6078],{"class":475,"line":6077},164,[14,6079,4858],{"class":479},[14,6081,6083],{"class":475,"line":6082},165,[14,6084,4892],{"class":479},[14,6086,6088],{"class":475,"line":6087},166,[14,6089,6090],{"class":479},"  end\n",[14,6092,6094],{"class":475,"line":6093},167,[14,6095,970],{"emptyLinePlaceholder":969},[14,6097,6099,6102,6105,6107,6109,6111,6114,6116,6119,6121,6123,6125,6127,6129,6131,6134,6136,6138,6140,6142,6144,6146,6148,6150,6152,6154,6156,6158,6160,6162,6164,6166,6168,6170,6172,6174,6177,6179,6182,6184,6186,6189,6191,6193,6195,6197,6199,6201,6203,6205,6207,6209,6211,6213,6215,6217,6219,6221,6223,6226,6228,6230,6232,6234,6236,6239,6241,6243,6245,6247,6249,6251,6253,6255,6258,6260,6262,6264,6267,6269,6271,6273,6275,6277,6279,6281,6283,6285,6287,6289,6291,6293,6296,6298,6301,6303,6305,6307,6310,6312,6315,6317,6319,6321,6323,6325,6327,6329,6331,6333,6335,6337,6339,6341,6343,6346,6348,6350,6352,6354,6356,6358,6360,6362,6364,6366,6369,6371,6374,6376,6378,6380,6382,6384,6386,6388,6390,6392,6395,6397,6399,6401,6403],{"class":475,"line":6098},168,[14,6100,6101],{"class":479},"  assign",[14,6103,6104],{"class":487}," O[",[14,6106,540],{"class":533},[14,6108,1022],{"class":487},[14,6110,988],{"class":479},[14,6112,6113],{"class":487}," flag0 ",[14,6115,1025],{"class":479},[14,6117,6118],{"class":487}," ((t97 ",[14,6120,1025],{"class":479},[14,6122,1014],{"class":479},[14,6124,5116],{"class":487},[14,6126,569],{"class":533},[14,6128,1022],{"class":487},[14,6130,1025],{"class":479},[14,6132,6133],{"class":487}," ((sat0[",[14,6135,540],{"class":533},[14,6137,1022],{"class":487},[14,6139,1025],{"class":479},[14,6141,1014],{"class":479},[14,6143,5116],{"class":487},[14,6145,328],{"class":533},[14,6147,1034],{"class":487},[14,6149,1154],{"class":479},[14,6151,4199],{"class":487},[14,6153,534],{"class":533},[14,6155,428],{"class":487},[14,6157,1148],{"class":533},[14,6159,1171],{"class":487},[14,6161,1154],{"class":479},[14,6163,4199],{"class":487},[14,6165,1031],{"class":533},[14,6167,428],{"class":487},[14,6169,913],{"class":533},[14,6171,1151],{"class":487},[14,6173,1025],{"class":479},[14,6175,6176],{"class":487}," t100) ",[14,6178,1154],{"class":479},[14,6180,6181],{"class":487}," (t101 ",[14,6183,1025],{"class":479},[14,6185,1014],{"class":479},[14,6187,6188],{"class":487},"(sat0 ",[14,6190,1137],{"class":479},[14,6192,1763],{"class":487},[14,6194,1163],{"class":533},[14,6196,537],{"class":487},[14,6198,206],{"class":533},[14,6200,1022],{"class":487},[14,6202,1025],{"class":479},[14,6204,4182],{"class":487},[14,6206,1137],{"class":479},[14,6208,1140],{"class":487},[14,6210,328],{"class":533},[14,6212,537],{"class":487},[14,6214,1031],{"class":533},[14,6216,428],{"class":487},[14,6218,5283],{"class":533},[14,6220,1151],{"class":487},[14,6222,1025],{"class":479},[14,6224,6225],{"class":487}," t96) ",[14,6227,1154],{"class":479},[14,6229,4116],{"class":487},[14,6231,1154],{"class":479},[14,6233,1532],{"class":487},[14,6235,1091],{"class":479},[14,6237,6238],{"class":487},"((sat0[",[14,6240,540],{"class":533},[14,6242,1022],{"class":487},[14,6244,1025],{"class":479},[14,6246,1014],{"class":479},[14,6248,5116],{"class":487},[14,6250,328],{"class":533},[14,6252,1022],{"class":487},[14,6254,1025],{"class":479},[14,6256,6257],{"class":487}," (sat0[",[14,6259,1031],{"class":533},[14,6261,1022],{"class":487},[14,6263,1154],{"class":479},[14,6265,6266],{"class":487}," sat0[",[14,6268,569],{"class":533},[14,6270,1328],{"class":487},[14,6272,1154],{"class":479},[14,6274,4199],{"class":487},[14,6276,1031],{"class":533},[14,6278,537],{"class":487},[14,6280,569],{"class":533},[14,6282,428],{"class":487},[14,6284,913],{"class":533},[14,6286,537],{"class":487},[14,6288,1148],{"class":533},[14,6290,1151],{"class":487},[14,6292,1025],{"class":479},[14,6294,6295],{"class":487}," t111) ",[14,6297,1154],{"class":479},[14,6299,6300],{"class":487}," (t95 ",[14,6302,1025],{"class":479},[14,6304,4039],{"class":487},[14,6306,1025],{"class":479},[14,6308,6309],{"class":487}," (lfsr0[",[14,6311,1143],{"class":533},[14,6313,6314],{"class":487},"] ^ ((sat0 in {",[14,6316,540],{"class":533},[14,6318,537],{"class":487},[14,6320,1163],{"class":533},[14,6322,428],{"class":487},[14,6324,1168],{"class":533},[14,6326,537],{"class":487},[14,6328,998],{"class":533},[14,6330,1171],{"class":487},[14,6332,1025],{"class":479},[14,6334,4182],{"class":487},[14,6336,1137],{"class":479},[14,6338,1140],{"class":487},[14,6340,1143],{"class":533},[14,6342,428],{"class":487},[14,6344,6345],{"class":533},"14",[14,6347,1151],{"class":487},[14,6349,1154],{"class":479},[14,6351,1532],{"class":487},[14,6353,1091],{"class":479},[14,6355,5116],{"class":487},[14,6357,540],{"class":533},[14,6359,1022],{"class":487},[14,6361,1025],{"class":479},[14,6363,6266],{"class":487},[14,6365,569],{"class":533},[14,6367,6368],{"class":487},"]))))) ",[14,6370,1025],{"class":479},[14,6372,6373],{"class":487}," (sat0 in {",[14,6375,1031],{"class":533},[14,6377,428],{"class":487},[14,6379,1711],{"class":533},[14,6381,537],{"class":487},[14,6383,534],{"class":533},[14,6385,1171],{"class":487},[14,6387,1154],{"class":479},[14,6389,4058],{"class":487},[14,6391,1154],{"class":479},[14,6393,6394],{"class":487}," t108) ",[14,6396,1025],{"class":479},[14,6398,4182],{"class":487},[14,6400,4719],{"class":479},[14,6402,5040],{"class":533},[14,6404,3875],{"class":487},[14,6406,6408,6410,6412,6414,6416,6418,6420,6422,6424,6426,6428,6430,6432,6434,6436,6438,6441,6443,6445,6447,6449,6451,6454,6456,6458,6460,6462,6464,6466,6468,6470,6472,6474,6476,6478,6480,6482,6484,6486,6488,6490,6492,6494,6496,6498,6500,6502,6504,6506,6508,6510,6512,6514,6516,6518,6520,6522,6524,6526,6528,6530,6532,6534,6536,6538,6540,6542,6544,6546,6548,6550,6552,6554,6556,6558,6560,6562,6564,6566,6568,6570,6572,6574,6576,6578,6580,6582,6584,6586,6588,6590,6592,6594,6596,6598,6600,6602,6604,6606,6608,6610,6612,6614,6616,6618,6620,6622,6624,6626,6628,6630,6632,6634,6637,6639,6642,6644,6647,6649,6651,6653,6655,6657,6659,6661,6663,6665,6668,6670,6672,6674,6676,6678,6680,6682,6684,6686,6689,6691,6694,6696,6698,6700,6702,6704,6706,6708,6710,6712,6714,6716,6718,6720,6722,6724,6726,6728,6731,6733,6735,6737,6739],{"class":475,"line":6407},169,[14,6409,6101],{"class":479},[14,6411,6104],{"class":487},[14,6413,328],{"class":533},[14,6415,1022],{"class":487},[14,6417,988],{"class":479},[14,6419,6113],{"class":487},[14,6421,1025],{"class":479},[14,6423,6373],{"class":487},[14,6425,328],{"class":533},[14,6427,428],{"class":487},[14,6429,5283],{"class":533},[14,6431,1171],{"class":487},[14,6433,1154],{"class":479},[14,6435,4182],{"class":487},[14,6437,1699],{"class":479},[14,6439,6440],{"class":533}," 8",[14,6442,1705],{"class":479},[14,6444,4058],{"class":487},[14,6446,1154],{"class":479},[14,6448,6394],{"class":487},[14,6450,1025],{"class":479},[14,6452,6453],{"class":487}," ((t101 ",[14,6455,1025],{"class":479},[14,6457,5035],{"class":487},[14,6459,1137],{"class":479},[14,6461,1763],{"class":487},[14,6463,1202],{"class":533},[14,6465,537],{"class":487},[14,6467,206],{"class":533},[14,6469,1022],{"class":487},[14,6471,1025],{"class":479},[14,6473,4177],{"class":487},[14,6475,1025],{"class":479},[14,6477,4182],{"class":487},[14,6479,1137],{"class":479},[14,6481,1763],{"class":487},[14,6483,1711],{"class":533},[14,6485,537],{"class":487},[14,6487,534],{"class":533},[14,6489,1034],{"class":487},[14,6491,1154],{"class":479},[14,6493,6257],{"class":487},[14,6495,540],{"class":533},[14,6497,1022],{"class":487},[14,6499,1025],{"class":479},[14,6501,1014],{"class":479},[14,6503,5116],{"class":487},[14,6505,1031],{"class":533},[14,6507,1034],{"class":487},[14,6509,1154],{"class":479},[14,6511,4199],{"class":487},[14,6513,540],{"class":533},[14,6515,537],{"class":487},[14,6517,1031],{"class":533},[14,6519,428],{"class":487},[14,6521,1711],{"class":533},[14,6523,537],{"class":487},[14,6525,1143],{"class":533},[14,6527,1151],{"class":487},[14,6529,1025],{"class":479},[14,6531,6373],{"class":487},[14,6533,328],{"class":533},[14,6535,537],{"class":487},[14,6537,1031],{"class":533},[14,6539,428],{"class":487},[14,6541,1163],{"class":533},[14,6543,537],{"class":487},[14,6545,913],{"class":533},[14,6547,1171],{"class":487},[14,6549,1154],{"class":479},[14,6551,4153],{"class":487},[14,6553,1154],{"class":479},[14,6555,4199],{"class":487},[14,6557,1711],{"class":533},[14,6559,537],{"class":487},[14,6561,5283],{"class":533},[14,6563,428],{"class":487},[14,6565,1168],{"class":533},[14,6567,537],{"class":487},[14,6569,998],{"class":533},[14,6571,1151],{"class":487},[14,6573,1025],{"class":479},[14,6575,6225],{"class":487},[14,6577,1154],{"class":479},[14,6579,4116],{"class":487},[14,6581,1154],{"class":479},[14,6583,6257],{"class":487},[14,6585,1031],{"class":533},[14,6587,1022],{"class":487},[14,6589,1025],{"class":479},[14,6591,6266],{"class":487},[14,6593,328],{"class":533},[14,6595,1022],{"class":487},[14,6597,1025],{"class":479},[14,6599,1014],{"class":479},[14,6601,5116],{"class":487},[14,6603,569],{"class":533},[14,6605,1022],{"class":487},[14,6607,1025],{"class":479},[14,6609,6295],{"class":487},[14,6611,1154],{"class":479},[14,6613,6300],{"class":487},[14,6615,1025],{"class":479},[14,6617,4039],{"class":487},[14,6619,1025],{"class":479},[14,6621,1014],{"class":479},[14,6623,6238],{"class":487},[14,6625,1031],{"class":533},[14,6627,1022],{"class":487},[14,6629,1154],{"class":479},[14,6631,6266],{"class":487},[14,6633,328],{"class":533},[14,6635,6636],{"class":487},"]) ^ lfsr0[",[14,6638,540],{"class":533},[14,6640,6641],{"class":487},"] ^ (",[14,6643,1091],{"class":479},[14,6645,6646],{"class":487},"(sat0[",[14,6648,540],{"class":533},[14,6650,1022],{"class":487},[14,6652,1154],{"class":479},[14,6654,6266],{"class":487},[14,6656,328],{"class":533},[14,6658,1034],{"class":487},[14,6660,1154],{"class":479},[14,6662,4182],{"class":487},[14,6664,4328],{"class":479},[14,6666,6667],{"class":533}," 3",[14,6669,1705],{"class":479},[14,6671,1532],{"class":487},[14,6673,1091],{"class":479},[14,6675,5116],{"class":487},[14,6677,540],{"class":533},[14,6679,1022],{"class":487},[14,6681,1025],{"class":479},[14,6683,6266],{"class":487},[14,6685,569],{"class":533},[14,6687,6688],{"class":487},"])))) ",[14,6690,1154],{"class":479},[14,6692,6693],{"class":487}," (t97 ",[14,6695,1025],{"class":479},[14,6697,6373],{"class":487},[14,6699,534],{"class":533},[14,6701,428],{"class":487},[14,6703,1148],{"class":533},[14,6705,1171],{"class":487},[14,6707,1154],{"class":479},[14,6709,1014],{"class":479},[14,6711,5116],{"class":487},[14,6713,540],{"class":533},[14,6715,1034],{"class":487},[14,6717,1025],{"class":479},[14,6719,1014],{"class":479},[14,6721,5116],{"class":487},[14,6723,569],{"class":533},[14,6725,1022],{"class":487},[14,6727,1025],{"class":479},[14,6729,6730],{"class":487}," t100)) ",[14,6732,1025],{"class":479},[14,6734,4182],{"class":487},[14,6736,4719],{"class":479},[14,6738,5040],{"class":533},[14,6740,3875],{"class":487},[14,6742,6744,6746,6748,6750,6752,6754,6756,6758,6760,6762,6765,6767,6769,6771,6773,6775,6777,6779,6781,6783,6785,6787,6789,6791,6793,6795,6797,6799,6801,6803,6805,6807,6809,6811,6813,6815,6817,6819,6821,6824,6826,6828,6830,6832,6834,6836,6838,6840,6842,6844,6846,6848,6850,6852,6854,6856,6858,6860,6862,6864,6866,6868,6870,6872,6874,6876,6878,6880,6882,6884,6886,6888,6890,6893,6895,6897,6899,6901,6903,6905,6907,6909,6911,6913,6915,6917,6919,6921,6923,6925,6927,6929,6931,6933,6935,6937,6939,6941,6943,6945,6947,6949,6951,6953,6955,6957,6959,6961],{"class":475,"line":6743},170,[14,6745,6101],{"class":479},[14,6747,6104],{"class":487},[14,6749,1031],{"class":533},[14,6751,1022],{"class":487},[14,6753,988],{"class":479},[14,6755,6113],{"class":487},[14,6757,1025],{"class":479},[14,6759,5077],{"class":487},[14,6761,1699],{"class":479},[14,6763,6764],{"class":533}," 5",[14,6766,1705],{"class":479},[14,6768,4058],{"class":487},[14,6770,1154],{"class":479},[14,6772,4075],{"class":487},[14,6774,1154],{"class":479},[14,6776,4199],{"class":487},[14,6778,540],{"class":533},[14,6780,428],{"class":487},[14,6782,1202],{"class":533},[14,6784,1151],{"class":487},[14,6786,1025],{"class":479},[14,6788,4182],{"class":487},[14,6790,4719],{"class":479},[14,6792,5040],{"class":533},[14,6794,4724],{"class":479},[14,6796,6453],{"class":487},[14,6798,1025],{"class":479},[14,6800,1014],{"class":479},[14,6802,6646],{"class":487},[14,6804,540],{"class":533},[14,6806,1022],{"class":487},[14,6808,1025],{"class":479},[14,6810,6266],{"class":487},[14,6812,328],{"class":533},[14,6814,1034],{"class":487},[14,6816,1025],{"class":479},[14,6818,4182],{"class":487},[14,6820,4328],{"class":479},[14,6822,6823],{"class":533}," 11",[14,6825,4724],{"class":479},[14,6827,6225],{"class":487},[14,6829,1154],{"class":479},[14,6831,4116],{"class":487},[14,6833,1154],{"class":479},[14,6835,6693],{"class":487},[14,6837,1025],{"class":479},[14,6839,6266],{"class":487},[14,6841,328],{"class":533},[14,6843,1022],{"class":487},[14,6845,1025],{"class":479},[14,6847,1014],{"class":479},[14,6849,5116],{"class":487},[14,6851,569],{"class":533},[14,6853,1022],{"class":487},[14,6855,1025],{"class":479},[14,6857,6257],{"class":487},[14,6859,1031],{"class":533},[14,6861,1022],{"class":487},[14,6863,1154],{"class":479},[14,6865,1014],{"class":479},[14,6867,5116],{"class":487},[14,6869,540],{"class":533},[14,6871,1034],{"class":487},[14,6873,1025],{"class":479},[14,6875,6176],{"class":487},[14,6877,1154],{"class":479},[14,6879,6300],{"class":487},[14,6881,1025],{"class":479},[14,6883,4039],{"class":487},[14,6885,1025],{"class":479},[14,6887,6309],{"class":487},[14,6889,1711],{"class":533},[14,6891,6892],{"class":487},"] ^ (sat0 ",[14,6894,1137],{"class":479},[14,6896,1140],{"class":487},[14,6898,1202],{"class":533},[14,6900,537],{"class":487},[14,6902,1163],{"class":533},[14,6904,428],{"class":487},[14,6906,206],{"class":533},[14,6908,537],{"class":487},[14,6910,1168],{"class":533},[14,6912,1171],{"class":487},[14,6914,1025],{"class":479},[14,6916,4199],{"class":487},[14,6918,540],{"class":533},[14,6920,537],{"class":487},[14,6922,328],{"class":533},[14,6924,428],{"class":487},[14,6926,1143],{"class":533},[14,6928,537],{"class":487},[14,6930,6345],{"class":533},[14,6932,1527],{"class":487},[14,6934,1154],{"class":479},[14,6936,5077],{"class":487},[14,6938,4328],{"class":479},[14,6940,6667],{"class":533},[14,6942,4724],{"class":479},[14,6944,4131],{"class":487},[14,6946,1025],{"class":479},[14,6948,6257],{"class":487},[14,6950,540],{"class":533},[14,6952,1022],{"class":487},[14,6954,1154],{"class":479},[14,6956,1014],{"class":479},[14,6958,5116],{"class":487},[14,6960,328],{"class":533},[14,6962,1252],{"class":487},[14,6964,6966,6968,6970,6972,6974,6976,6978,6980,6982,6984,6986,6988,6990,6992,6994,6996,6998,7000,7003,7005,7007,7009,7011,7013,7015,7017,7019,7021,7023,7025,7027,7029,7031,7033,7035,7037,7039,7041,7043,7045,7047,7049,7051,7053,7055,7057,7059,7061,7063,7065,7067,7069,7071,7073,7075,7077,7079,7081,7083,7085,7087,7089,7091,7093,7095,7098,7100,7102,7104,7106,7108,7110,7112,7114,7116,7118,7120,7122,7124,7126,7128,7130,7132,7134,7136,7138,7140,7142,7144,7146,7148,7150,7152,7154,7156,7158,7160,7162,7164,7166,7168,7170,7172,7174,7176,7178,7180,7182,7184,7186,7188,7190,7193,7195,7197,7199,7202,7204,7206,7208,7210,7212,7214,7216,7218,7220,7222,7224,7226,7228,7230,7232,7234,7236,7238,7240,7242,7244,7246,7248,7250,7252,7254,7257,7259,7261,7263,7265,7267,7269,7271,7274,7276,7278,7280,7283,7285,7287,7289,7291,7293,7295,7297,7299,7301,7303,7305,7307,7309,7311,7313,7315],{"class":475,"line":6965},171,[14,6967,6101],{"class":479},[14,6969,6104],{"class":487},[14,6971,569],{"class":533},[14,6973,1022],{"class":487},[14,6975,988],{"class":479},[14,6977,6113],{"class":487},[14,6979,1025],{"class":479},[14,6981,6118],{"class":487},[14,6983,1025],{"class":479},[14,6985,3988],{"class":487},[14,6987,1025],{"class":479},[14,6989,4199],{"class":487},[14,6991,328],{"class":533},[14,6993,428],{"class":487},[14,6995,1143],{"class":533},[14,6997,1151],{"class":487},[14,6999,1154],{"class":479},[14,7001,7002],{"class":487}," ((",[14,7004,1091],{"class":479},[14,7006,6646],{"class":487},[14,7008,1031],{"class":533},[14,7010,1022],{"class":487},[14,7012,1154],{"class":479},[14,7014,6257],{"class":487},[14,7016,540],{"class":533},[14,7018,1022],{"class":487},[14,7020,1025],{"class":479},[14,7022,6266],{"class":487},[14,7024,569],{"class":533},[14,7026,1328],{"class":487},[14,7028,1154],{"class":479},[14,7030,1014],{"class":479},[14,7032,6238],{"class":487},[14,7034,540],{"class":533},[14,7036,1022],{"class":487},[14,7038,1025],{"class":479},[14,7040,1014],{"class":479},[14,7042,5116],{"class":487},[14,7044,328],{"class":533},[14,7046,1034],{"class":487},[14,7048,1154],{"class":479},[14,7050,6266],{"class":487},[14,7052,569],{"class":533},[14,7054,1328],{"class":487},[14,7056,1025],{"class":479},[14,7058,4131],{"class":487},[14,7060,1025],{"class":479},[14,7062,6257],{"class":487},[14,7064,540],{"class":533},[14,7066,1022],{"class":487},[14,7068,1154],{"class":479},[14,7070,1014],{"class":479},[14,7072,5116],{"class":487},[14,7074,328],{"class":533},[14,7076,1034],{"class":487},[14,7078,1025],{"class":479},[14,7080,4199],{"class":487},[14,7082,328],{"class":533},[14,7084,428],{"class":487},[14,7086,1711],{"class":533},[14,7088,537],{"class":487},[14,7090,1148],{"class":533},[14,7092,1151],{"class":487},[14,7094,1154],{"class":479},[14,7096,7097],{"class":487}," ((lfsr0[",[14,7099,328],{"class":533},[14,7101,6314],{"class":487},[14,7103,1143],{"class":533},[14,7105,428],{"class":487},[14,7107,6345],{"class":533},[14,7109,1171],{"class":487},[14,7111,1154],{"class":479},[14,7113,1014],{"class":479},[14,7115,6646],{"class":487},[14,7117,1031],{"class":533},[14,7119,1022],{"class":487},[14,7121,1154],{"class":479},[14,7123,1532],{"class":487},[14,7125,1091],{"class":479},[14,7127,6646],{"class":487},[14,7129,540],{"class":533},[14,7131,1022],{"class":487},[14,7133,1025],{"class":479},[14,7135,6266],{"class":487},[14,7137,328],{"class":533},[14,7139,1034],{"class":487},[14,7141,1025],{"class":479},[14,7143,6257],{"class":487},[14,7145,540],{"class":533},[14,7147,1022],{"class":487},[14,7149,1154],{"class":479},[14,7151,6266],{"class":487},[14,7153,328],{"class":533},[14,7155,1129],{"class":487},[14,7157,1154],{"class":479},[14,7159,4199],{"class":487},[14,7161,540],{"class":533},[14,7163,537],{"class":487},[14,7165,1143],{"class":533},[14,7167,428],{"class":487},[14,7169,1148],{"class":533},[14,7171,1151],{"class":487},[14,7173,1025],{"class":479},[14,7175,4199],{"class":487},[14,7177,540],{"class":533},[14,7179,537],{"class":487},[14,7181,1031],{"class":533},[14,7183,428],{"class":487},[14,7185,5283],{"class":533},[14,7187,537],{"class":487},[14,7189,6345],{"class":533},[14,7191,7192],{"class":487},"})) ",[14,7194,1025],{"class":479},[14,7196,3902],{"class":487},[14,7198,1025],{"class":479},[14,7200,7201],{"class":487}," t106) ",[14,7203,1154],{"class":479},[14,7205,4116],{"class":487},[14,7207,1154],{"class":479},[14,7209,6181],{"class":487},[14,7211,1025],{"class":479},[14,7213,1014],{"class":479},[14,7215,6238],{"class":487},[14,7217,328],{"class":533},[14,7219,1022],{"class":487},[14,7221,1154],{"class":479},[14,7223,6133],{"class":487},[14,7225,1031],{"class":533},[14,7227,1022],{"class":487},[14,7229,1154],{"class":479},[14,7231,1014],{"class":479},[14,7233,5116],{"class":487},[14,7235,540],{"class":533},[14,7237,1034],{"class":487},[14,7239,1025],{"class":479},[14,7241,6257],{"class":487},[14,7243,540],{"class":533},[14,7245,1022],{"class":487},[14,7247,1154],{"class":479},[14,7249,1014],{"class":479},[14,7251,5116],{"class":487},[14,7253,1031],{"class":533},[14,7255,7256],{"class":487},"]))) ^ sat0 in {",[14,7258,328],{"class":533},[14,7260,537],{"class":487},[14,7262,1031],{"class":533},[14,7264,428],{"class":487},[14,7266,5283],{"class":533},[14,7268,1151],{"class":487},[14,7270,1025],{"class":479},[14,7272,7273],{"class":487}," t96)) ",[14,7275,1025],{"class":479},[14,7277,5077],{"class":487},[14,7279,1699],{"class":479},[14,7281,7282],{"class":533}," 7",[14,7284,1705],{"class":479},[14,7286,4182],{"class":487},[14,7288,1699],{"class":479},[14,7290,6440],{"class":533},[14,7292,1705],{"class":479},[14,7294,4182],{"class":487},[14,7296,1699],{"class":479},[14,7298,5827],{"class":533},[14,7300,1705],{"class":479},[14,7302,4058],{"class":487},[14,7304,1154],{"class":479},[14,7306,6394],{"class":487},[14,7308,1025],{"class":479},[14,7310,4182],{"class":487},[14,7312,4719],{"class":479},[14,7314,5040],{"class":533},[14,7316,3875],{"class":487},[14,7318,7320,7322,7324,7326,7328,7330,7332,7334,7336,7338,7340,7342,7344,7346,7348,7350,7352,7354,7356,7358,7360,7362,7364,7366,7368,7370,7372,7374,7376,7379,7381,7383,7385,7387,7389,7391,7394,7396,7398,7400,7402,7404,7406,7408,7410,7412,7414,7416,7418,7420,7422,7424,7426,7428,7430,7432,7434,7436,7438,7440,7442,7444,7446,7448,7450,7452,7454,7457,7459,7461,7463,7465,7467,7469,7471,7473,7475,7478,7480,7482,7484,7486,7488,7490,7492,7494,7496,7498,7500,7502,7504,7506,7508,7510,7512,7514,7516,7518,7520,7522,7524,7526,7528,7530,7532,7534,7536,7538,7540,7542,7544,7546,7548,7550,7552,7554,7556,7558,7560,7562,7564],{"class":475,"line":7319},172,[14,7321,6101],{"class":479},[14,7323,6104],{"class":487},[14,7325,1711],{"class":533},[14,7327,1022],{"class":487},[14,7329,988],{"class":479},[14,7331,6113],{"class":487},[14,7333,1025],{"class":479},[14,7335,5035],{"class":487},[14,7337,1747],{"class":479},[14,7339,5827],{"class":533},[14,7341,4724],{"class":479},[14,7343,4131],{"class":487},[14,7345,1025],{"class":479},[14,7347,1014],{"class":479},[14,7349,6646],{"class":487},[14,7351,540],{"class":533},[14,7353,1022],{"class":487},[14,7355,1025],{"class":479},[14,7357,6257],{"class":487},[14,7359,1031],{"class":533},[14,7361,1022],{"class":487},[14,7363,1154],{"class":479},[14,7365,6266],{"class":487},[14,7367,569],{"class":533},[14,7369,1328],{"class":487},[14,7371,1025],{"class":479},[14,7373,4182],{"class":487},[14,7375,4328],{"class":479},[14,7377,7378],{"class":533}," 9",[14,7380,4364],{"class":487},[14,7382,1154],{"class":479},[14,7384,6300],{"class":487},[14,7386,1025],{"class":479},[14,7388,4039],{"class":487},[14,7390,1025],{"class":479},[14,7392,7393],{"class":487}," ((sat0 in {",[14,7395,540],{"class":533},[14,7397,537],{"class":487},[14,7399,1163],{"class":533},[14,7401,428],{"class":487},[14,7403,1168],{"class":533},[14,7405,537],{"class":487},[14,7407,998],{"class":533},[14,7409,1171],{"class":487},[14,7411,1025],{"class":479},[14,7413,6257],{"class":487},[14,7415,1031],{"class":533},[14,7417,1022],{"class":487},[14,7419,1154],{"class":479},[14,7421,6257],{"class":487},[14,7423,328],{"class":533},[14,7425,1022],{"class":487},[14,7427,1025],{"class":479},[14,7429,1014],{"class":479},[14,7431,5116],{"class":487},[14,7433,540],{"class":533},[14,7435,1034],{"class":487},[14,7437,1154],{"class":479},[14,7439,1532],{"class":487},[14,7441,1091],{"class":479},[14,7443,5116],{"class":487},[14,7445,540],{"class":533},[14,7447,1022],{"class":487},[14,7449,1025],{"class":479},[14,7451,6266],{"class":487},[14,7453,569],{"class":533},[14,7455,7456],{"class":487},"]))) ^ lfsr0[",[14,7458,569],{"class":533},[14,7460,1328],{"class":487},[14,7462,1154],{"class":479},[14,7464,4116],{"class":487},[14,7466,1154],{"class":479},[14,7468,6181],{"class":487},[14,7470,1025],{"class":479},[14,7472,1532],{"class":487},[14,7474,1091],{"class":479},[14,7476,7477],{"class":487},"(t120 ",[14,7479,1154],{"class":479},[14,7481,6257],{"class":487},[14,7483,328],{"class":533},[14,7485,1022],{"class":487},[14,7487,1025],{"class":479},[14,7489,6257],{"class":487},[14,7491,540],{"class":533},[14,7493,1022],{"class":487},[14,7495,1154],{"class":479},[14,7497,1014],{"class":479},[14,7499,5116],{"class":487},[14,7501,1031],{"class":533},[14,7503,1328],{"class":487},[14,7505,1154],{"class":479},[14,7507,4199],{"class":487},[14,7509,1711],{"class":533},[14,7511,537],{"class":487},[14,7513,5283],{"class":533},[14,7515,428],{"class":487},[14,7517,1168],{"class":533},[14,7519,537],{"class":487},[14,7521,998],{"class":533},[14,7523,1151],{"class":487},[14,7525,1154],{"class":479},[14,7527,4199],{"class":487},[14,7529,1202],{"class":533},[14,7531,428],{"class":487},[14,7533,913],{"class":533},[14,7535,1151],{"class":487},[14,7537,1025],{"class":479},[14,7539,7273],{"class":487},[14,7541,1025],{"class":479},[14,7543,5077],{"class":487},[14,7545,4328],{"class":479},[14,7547,5827],{"class":533},[14,7549,1705],{"class":479},[14,7551,4058],{"class":487},[14,7553,1154],{"class":479},[14,7555,6394],{"class":487},[14,7557,1025],{"class":479},[14,7559,4182],{"class":487},[14,7561,4719],{"class":479},[14,7563,5040],{"class":533},[14,7565,3875],{"class":487},[14,7567,7569,7571,7573,7575,7577,7579,7581,7583,7585,7587,7589,7591,7593,7595,7597,7599,7601,7603,7605,7607,7610,7612,7614,7616,7618,7620,7622,7624,7626,7629,7631,7633,7635,7637,7639,7641,7643,7645,7647,7650,7652,7654,7656,7658,7660,7662,7664,7666,7668,7670,7672,7674,7676,7678,7680,7682,7684,7686,7689,7691,7693,7695,7697,7699,7701,7703,7705,7707,7709,7711,7713,7715,7717,7719,7721,7723,7725,7727,7729,7731,7733,7735,7737,7739,7741,7743,7745,7747,7749,7751,7753,7755,7758,7760,7762,7764,7766,7768,7770,7772,7774,7776,7778,7780,7782,7784,7786,7788,7790,7792,7794,7796,7798,7800,7802,7804,7806,7808,7810,7813,7815,7817,7820,7822,7824,7826,7828,7830,7832,7835,7837,7839,7841,7843,7845,7847,7849,7851,7853,7855,7857],{"class":475,"line":7568},173,[14,7570,6101],{"class":479},[14,7572,6104],{"class":487},[14,7574,5283],{"class":533},[14,7576,1022],{"class":487},[14,7578,988],{"class":479},[14,7580,6113],{"class":487},[14,7582,1025],{"class":479},[14,7584,5035],{"class":487},[14,7586,1699],{"class":479},[14,7588,6764],{"class":533},[14,7590,4724],{"class":479},[14,7592,7002],{"class":487},[14,7594,1091],{"class":479},[14,7596,3913],{"class":487},[14,7598,1025],{"class":479},[14,7600,3918],{"class":487},[14,7602,1154],{"class":479},[14,7604,3862],{"class":487},[14,7606,1154],{"class":479},[14,7608,7609],{"class":487}," t94) ",[14,7611,1025],{"class":479},[14,7613,4003],{"class":487},[14,7615,1154],{"class":479},[14,7617,3862],{"class":487},[14,7619,1154],{"class":479},[14,7621,3883],{"class":487},[14,7623,1154],{"class":479},[14,7625,1014],{"class":479},[14,7627,7628],{"class":487},"r0) ",[14,7630,1025],{"class":479},[14,7632,7002],{"class":487},[14,7634,1091],{"class":479},[14,7636,3948],{"class":487},[14,7638,1025],{"class":479},[14,7640,4003],{"class":487},[14,7642,1154],{"class":479},[14,7644,4008],{"class":487},[14,7646,1154],{"class":479},[14,7648,7649],{"class":487}," t94)) ",[14,7651,1154],{"class":479},[14,7653,6181],{"class":487},[14,7655,1025],{"class":479},[14,7657,3935],{"class":487},[14,7659,1025],{"class":479},[14,7661,4199],{"class":487},[14,7663,569],{"class":533},[14,7665,428],{"class":487},[14,7667,534],{"class":533},[14,7669,1151],{"class":487},[14,7671,1154],{"class":479},[14,7673,4116],{"class":487},[14,7675,1154],{"class":479},[14,7677,6300],{"class":487},[14,7679,1025],{"class":479},[14,7681,4039],{"class":487},[14,7683,1025],{"class":479},[14,7685,1014],{"class":479},[14,7687,7688],{"class":487},"(((sat0 ",[14,7690,1137],{"class":479},[14,7692,1140],{"class":487},[14,7694,1031],{"class":533},[14,7696,428],{"class":487},[14,7698,534],{"class":533},[14,7700,537],{"class":487},[14,7702,6345],{"class":533},[14,7704,1171],{"class":487},[14,7706,1154],{"class":479},[14,7708,6133],{"class":487},[14,7710,1031],{"class":533},[14,7712,1022],{"class":487},[14,7714,1154],{"class":479},[14,7716,6266],{"class":487},[14,7718,328],{"class":533},[14,7720,1034],{"class":487},[14,7722,1025],{"class":479},[14,7724,1014],{"class":479},[14,7726,5116],{"class":487},[14,7728,540],{"class":533},[14,7730,1022],{"class":487},[14,7732,1025],{"class":479},[14,7734,6266],{"class":487},[14,7736,569],{"class":533},[14,7738,1328],{"class":487},[14,7740,1025],{"class":479},[14,7742,6257],{"class":487},[14,7744,328],{"class":533},[14,7746,1022],{"class":487},[14,7748,1154],{"class":479},[14,7750,1014],{"class":479},[14,7752,5116],{"class":487},[14,7754,540],{"class":533},[14,7756,7757],{"class":487},"])) ^ lfsr0[",[14,7759,5283],{"class":533},[14,7761,1328],{"class":487},[14,7763,1154],{"class":479},[14,7765,5077],{"class":487},[14,7767,1699],{"class":479},[14,7769,6667],{"class":533},[14,7771,4724],{"class":479},[14,7773,7002],{"class":487},[14,7775,1091],{"class":479},[14,7777,3913],{"class":487},[14,7779,1025],{"class":479},[14,7781,3918],{"class":487},[14,7783,1154],{"class":479},[14,7785,3862],{"class":487},[14,7787,1154],{"class":479},[14,7789,7609],{"class":487},[14,7791,1025],{"class":479},[14,7793,4003],{"class":487},[14,7795,1154],{"class":479},[14,7797,3862],{"class":487},[14,7799,1154],{"class":479},[14,7801,3883],{"class":487},[14,7803,1154],{"class":479},[14,7805,1014],{"class":479},[14,7807,7628],{"class":487},[14,7809,1025],{"class":479},[14,7811,7812],{"class":487}," (t93 ",[14,7814,1154],{"class":479},[14,7816,1014],{"class":479},[14,7818,7819],{"class":487},"(success_q ",[14,7821,1154],{"class":479},[14,7823,4008],{"class":487},[14,7825,1025],{"class":479},[14,7827,3867],{"class":487},[14,7829,4719],{"class":479},[14,7831,3892],{"class":533},[14,7833,7834],{"class":487},")) ",[14,7836,1025],{"class":479},[14,7838,4182],{"class":487},[14,7840,4719],{"class":479},[14,7842,5040],{"class":533},[14,7844,4724],{"class":479},[14,7846,5077],{"class":487},[14,7848,1699],{"class":479},[14,7850,6667],{"class":533},[14,7852,1705],{"class":479},[14,7854,4058],{"class":487},[14,7856,1154],{"class":479},[14,7858,7859],{"class":487}," t108);\n",[14,7861,7863,7865,7867,7869,7871,7873,7875,7877,7879,7881,7883,7885,7887,7889,7891,7893,7895,7897,7899,7901,7903,7905,7907,7909,7911,7913,7915,7917,7919,7921,7924,7926,7928,7930,7932,7934,7936,7938,7940,7942,7944,7946,7948,7950,7952,7954,7956,7958,7960,7962,7964,7966,7968,7970,7972,7974,7976,7978,7980,7982,7984,7986,7988,7990,7992,7994,7996,7998,8000,8002,8004,8006,8008,8010,8012,8014,8016,8018,8021,8023,8025,8027,8029,8031,8033,8035,8037,8039,8041,8043,8045,8047,8049,8051,8053,8056,8058,8060,8062,8064,8066,8068,8070,8072,8074,8076,8078,8080,8082,8084,8086,8088,8090,8092,8094,8096],{"class":475,"line":7862},174,[14,7864,6101],{"class":479},[14,7866,6104],{"class":487},[14,7868,1143],{"class":533},[14,7870,1022],{"class":487},[14,7872,988],{"class":479},[14,7874,6113],{"class":487},[14,7876,1025],{"class":479},[14,7878,5077],{"class":487},[14,7880,1699],{"class":479},[14,7882,7282],{"class":533},[14,7884,1705],{"class":479},[14,7886,4182],{"class":487},[14,7888,1699],{"class":479},[14,7890,6440],{"class":533},[14,7892,1705],{"class":479},[14,7894,4058],{"class":487},[14,7896,1154],{"class":479},[14,7898,4075],{"class":487},[14,7900,1154],{"class":479},[14,7902,4199],{"class":487},[14,7904,540],{"class":533},[14,7906,537],{"class":487},[14,7908,1031],{"class":533},[14,7910,428],{"class":487},[14,7912,1711],{"class":533},[14,7914,537],{"class":487},[14,7916,1143],{"class":533},[14,7918,1151],{"class":487},[14,7920,1025],{"class":479},[14,7922,7923],{"class":487}," (((sat0[",[14,7925,328],{"class":533},[14,7927,1022],{"class":487},[14,7929,1154],{"class":479},[14,7931,1014],{"class":479},[14,7933,6646],{"class":487},[14,7935,540],{"class":533},[14,7937,1022],{"class":487},[14,7939,1025],{"class":479},[14,7941,6257],{"class":487},[14,7943,1031],{"class":533},[14,7945,1022],{"class":487},[14,7947,1154],{"class":479},[14,7949,6266],{"class":487},[14,7951,569],{"class":533},[14,7953,1129],{"class":487},[14,7955,1025],{"class":479},[14,7957,4131],{"class":487},[14,7959,1025],{"class":479},[14,7961,4182],{"class":487},[14,7963,4328],{"class":479},[14,7965,7378],{"class":533},[14,7967,4364],{"class":487},[14,7969,1154],{"class":479},[14,7971,6181],{"class":487},[14,7973,1025],{"class":479},[14,7975,3935],{"class":487},[14,7977,1025],{"class":479},[14,7979,4182],{"class":487},[14,7981,1137],{"class":479},[14,7983,1140],{"class":487},[14,7985,569],{"class":533},[14,7987,428],{"class":487},[14,7989,534],{"class":533},[14,7991,1171],{"class":487},[14,7993,1025],{"class":479},[14,7995,4182],{"class":487},[14,7997,4328],{"class":479},[14,7999,1702],{"class":533},[14,8001,4364],{"class":487},[14,8003,1154],{"class":479},[14,8005,4116],{"class":487},[14,8007,1154],{"class":479},[14,8009,6300],{"class":487},[14,8011,1025],{"class":479},[14,8013,4039],{"class":487},[14,8015,1025],{"class":479},[14,8017,1014],{"class":479},[14,8019,8020],{"class":487},"(((sat0[",[14,8022,1031],{"class":533},[14,8024,1022],{"class":487},[14,8026,1025],{"class":479},[14,8028,6257],{"class":487},[14,8030,328],{"class":533},[14,8032,1022],{"class":487},[14,8034,1154],{"class":479},[14,8036,1014],{"class":479},[14,8038,5116],{"class":487},[14,8040,540],{"class":533},[14,8042,1328],{"class":487},[14,8044,1154],{"class":479},[14,8046,4199],{"class":487},[14,8048,328],{"class":533},[14,8050,428],{"class":487},[14,8052,569],{"class":533},[14,8054,8055],{"class":487},"}) ^ lfsr0[",[14,8057,1031],{"class":533},[14,8059,1328],{"class":487},[14,8061,1154],{"class":479},[14,8063,6693],{"class":487},[14,8065,1025],{"class":479},[14,8067,4199],{"class":487},[14,8069,540],{"class":533},[14,8071,537],{"class":487},[14,8073,1031],{"class":533},[14,8075,428],{"class":487},[14,8077,1711],{"class":533},[14,8079,537],{"class":487},[14,8081,534],{"class":533},[14,8083,1171],{"class":487},[14,8085,1025],{"class":479},[14,8087,6730],{"class":487},[14,8089,1025],{"class":479},[14,8091,4182],{"class":487},[14,8093,4719],{"class":479},[14,8095,5040],{"class":533},[14,8097,3875],{"class":487},[14,8099,8101,8103,8105,8107,8109,8111,8113,8115,8117,8119,8121,8123,8125,8128,8130,8132,8134,8136,8138,8140,8142,8144,8146,8148,8150,8152,8154,8156,8158,8160,8162,8164,8166,8168,8170,8172,8174,8176,8178,8180,8182,8184,8186,8188,8190,8192,8194,8196,8198,8200,8202,8204,8206,8208],{"class":475,"line":8100},175,[14,8102,6101],{"class":479},[14,8104,6104],{"class":487},[14,8106,534],{"class":533},[14,8108,1022],{"class":487},[14,8110,988],{"class":479},[14,8112,6113],{"class":487},[14,8114,1025],{"class":479},[14,8116,4099],{"class":487},[14,8118,1025],{"class":479},[14,8120,1014],{"class":479},[14,8122,5502],{"class":487},[14,8124,534],{"class":533},[14,8126,8127],{"class":487},"] ^ (sat0 in [",[14,8129,1711],{"class":533},[14,8131,537],{"class":487},[14,8133,1143],{"class":533},[14,8135,1022],{"class":487},[14,8137,1154],{"class":479},[14,8139,7002],{"class":487},[14,8141,1091],{"class":479},[14,8143,6646],{"class":487},[14,8145,1031],{"class":533},[14,8147,1022],{"class":487},[14,8149,1154],{"class":479},[14,8151,6266],{"class":487},[14,8153,328],{"class":533},[14,8155,1034],{"class":487},[14,8157,1154],{"class":479},[14,8159,6257],{"class":487},[14,8161,540],{"class":533},[14,8163,1022],{"class":487},[14,8165,1025],{"class":479},[14,8167,6266],{"class":487},[14,8169,328],{"class":533},[14,8171,1328],{"class":487},[14,8173,1025],{"class":479},[14,8175,1532],{"class":487},[14,8177,1091],{"class":479},[14,8179,5116],{"class":487},[14,8181,540],{"class":533},[14,8183,1022],{"class":487},[14,8185,1154],{"class":479},[14,8187,6266],{"class":487},[14,8189,569],{"class":533},[14,8191,6688],{"class":487},[14,8193,1025],{"class":479},[14,8195,3902],{"class":487},[14,8197,1025],{"class":479},[14,8199,4039],{"class":487},[14,8201,1025],{"class":479},[14,8203,4182],{"class":487},[14,8205,4719],{"class":479},[14,8207,5040],{"class":533},[14,8209,3875],{"class":487},[14,8211,8213,8215,8218,8220],{"class":475,"line":8212},176,[14,8214,6101],{"class":479},[14,8216,8217],{"class":487}," success ",[14,8219,988],{"class":479},[14,8221,8222],{"class":487}," success_q;\n",[14,8224,8226],{"class":475,"line":8225},177,[14,8227,8228],{"class":479},"endmodule\n",[14,8230,8232],{"class":475,"line":8231},178,[14,8233,970],{"emptyLinePlaceholder":969},[14,8235,8237],{"class":475,"line":8236},179,[14,8238,8239],{"class":557},"  \u002F\u002F ---------------- legend ----------------\n",[14,8241,8243],{"class":475,"line":8242},180,[14,8244,8245],{"class":557},"  \u002F\u002F ctr0[3:0] = {dfrtp#39, dfrtp#38, dfrtp#41, dfrtp#40} (msb..lsb)\n",[14,8247,8249],{"class":475,"line":8248},181,[14,8250,8251],{"class":557},"  \u002F\u002F ctr1[3:0] = {dfrtp#66, dfrtp#67, dfrtp#69, dfrtp#68} (msb..lsb)\n",[14,8253,8255],{"class":475,"line":8254},182,[14,8256,8257],{"class":557},"  \u002F\u002F lfsr0[7:0] = {dfstp#4, dfstp#3, dfstp#2, dfstp#1, dfrtp#36, dfrtp#35, dfrtp#34, dfrtp#33} (msb..lsb)\n",[14,8259,8261],{"class":475,"line":8260},183,[14,8262,8263],{"class":557},"  \u002F\u002F sh0[11:0] = {dfrtp#46, dfrtp#48, dfrtp#51, dfrtp#50, dfrtp#54, dfrtp#42, dfrtp#49, dfrtp#44, dfrtp#52, dfrtp#45, dfrtp#53, dfrtp#43} (msb..lsb)\n",[14,8265,8267],{"class":475,"line":8266},184,[14,8268,8269],{"class":557},"  \u002F\u002F arr0[0:10] : 2-bit saturating\n",[14,8271,8273],{"class":475,"line":8272},185,[14,8274,8275],{"class":557},"  \u002F\u002F sat0[3:0] = {dfxtp#4, dfxtp#1, dfxtp#3, dfxtp#2} (msb..lsb)\n",[14,8277,8279],{"class":475,"line":8278},186,[14,8280,8281],{"class":557},"  \u002F\u002F sat1[1:0] = {dfrtp#25, dfrtp#28} (msb..lsb)\n",[14,8283,8285],{"class":475,"line":8284},187,[14,8286,8287],{"class":557},"  \u002F\u002F sat2[1:0] = {dfrtp#26, dfrtp#29} (msb..lsb)\n",[14,8289,8291],{"class":475,"line":8290},188,[14,8292,8293],{"class":557},"  \u002F\u002F sat3[1:0] = {dfrtp#32, dfrtp#30} (msb..lsb)\n",[14,8295,8297],{"class":475,"line":8296},189,[14,8298,8299],{"class":557},"  \u002F\u002F sat4[1:0] = {dfrtp#74, dfrtp#31} (msb..lsb)\n",[14,8301,8303],{"class":475,"line":8302},190,[14,8304,8305],{"class":557},"  \u002F\u002F sat5[1:0] = {dfrtp#55, dfrtp#57} (msb..lsb)\n",[14,8307,8309],{"class":475,"line":8308},191,[14,8310,8311],{"class":557},"  \u002F\u002F sat6[1:0] = {dfrtp#70, dfrtp#84} (msb..lsb)\n",[14,8313,8315],{"class":475,"line":8314},192,[14,8316,8317],{"class":557},"  \u002F\u002F sat7[1:0] = {dfrtp#71, dfrtp#77} (msb..lsb)\n",[14,8319,8321],{"class":475,"line":8320},193,[14,8322,8323],{"class":557},"  \u002F\u002F sat8[1:0] = {dfrtp#72, dfrtp#79} (msb..lsb)\n",[14,8325,8327],{"class":475,"line":8326},194,[14,8328,8329],{"class":557},"  \u002F\u002F sat9[1:0] = {dfrtp#73, dfrtp#78} (msb..lsb)\n",[14,8331,8333],{"class":475,"line":8332},195,[14,8334,8335],{"class":557},"  \u002F\u002F sat10[1:0] = {dfrtp#81, dfrtp#75} (msb..lsb)\n",[14,8337,8339],{"class":475,"line":8338},196,[14,8340,8341],{"class":557},"  \u002F\u002F sat11[1:0] = {dfrtp#80, dfrtp#76} (msb..lsb)\n",[14,8343,8345],{"class":475,"line":8344},197,[14,8346,8347],{"class":557},"  \u002F\u002F sat12[1:0] = {dfrtp#82, dfrtp#83} (msb..lsb)\n",[14,8349,8351],{"class":475,"line":8350},198,[14,8352,8353],{"class":557},"  \u002F\u002F acc0[7:0] = {dfrtp#62, dfrtp#65, dfrtp#63, dfrtp#64, dfrtp#58, dfrtp#59, dfrtp#60, dfrtp#61} (msb..lsb)\n",[14,8355,8357],{"class":475,"line":8356},199,[14,8358,8359],{"class":557},"  \u002F\u002F flag0    = dfrtp#1\n",[14,8361,8363],{"class":475,"line":8362},200,[14,8364,8365],{"class":557},"  \u002F\u002F r0       = dfrtp#2\n",[14,8367,8369],{"class":475,"line":8368},201,[14,8370,8371],{"class":557},"  \u002F\u002F success_q = dfrtp#3\n",[14,8373,8375],{"class":475,"line":8374},202,[14,8376,8377],{"class":557},"  \u002F\u002F flag1    = dfrtp#37\n",[14,8379,8381],{"class":475,"line":8380},203,[14,8382,8383],{"class":557},"  \u002F\u002F flag2    = dfrtp#47\n",[14,8385,8387],{"class":475,"line":8386},204,[14,8388,8389],{"class":557},"  \u002F\u002F flag3    = dfrtp#56\n",[14,8391,8393],{"class":475,"line":8392},205,[14,8394,8395],{"class":557},"  \u002F\u002F arr0 is indexed directly by ctr0:\n",[11,8397,8398],{},"We can slice it out, or throw the whole text, into LLM and ask it to explain it\nfor us. This requires no agent and we can actually audit their outputs.",[8400,8401,8402,8403,8407,8418,8421,8426,8441,8460,8467,8477,8481,8552,8556,8561,8613,8618,8682,8687],"details",{},"\n  ",[8404,8405,8406],"summary",{},"Full output from Gemini with this context alone",[11,8408,8409,8410,8413,8414,8417],{},"Based on a detailed analysis of the Verilog code, this module is a hardware validator for a grid-based logic puzzle known as ",[129,8411,8412],{},"Star Battle"," (also known as ",[129,8415,8416],{},"\"Two Not Touch\"",").",[11,8419,8420],{},"Here is the complete reverse engineering of what the module is doing and what each variable represents.",[8422,8423,8425],"h3",{"id":8424},"_1-high-level-overview-what-is-this","1. High-Level Overview: What is this?",[11,8427,8428,8429,8432,8433,8436,8437,8440],{},"The module takes a serial bitstream (",[29,8430,8431],{},"I",") representing an ",[129,8434,8435],{},"11x11 grid"," (121 bits total), evaluated one cell per clock cycle in a left-to-right, top-to-bottom fashion. The goal of a Star Battle puzzle is to place exactly ",[129,8438,8439],{},"two stars (represented by 1s)"," in every:",[8442,8443,8444,8449,8454],"ol",{},[302,8445,8446],{},[129,8447,8448],{},"Row",[302,8450,8451],{},[129,8452,8453],{},"Column",[302,8455,8456,8459],{},[129,8457,8458],{},"Region"," (The board is divided into 11 uniquely shaped regions)",[11,8461,8462,8463,8466],{},"Furthermore, the \"Two Not Touch\" rule dictates that ",[129,8464,8465],{},"no two stars may touch each other",", not even diagonally.",[11,8468,8469,8470,8472,8473,8476],{},"If you feed the module the correct 121-bit solution, the ",[29,8471,31],{}," output goes high, and the module decrypts and prints out a 16-character string (likely a CTF flag) on the output ",[29,8474,8475],{},"O",".",[8422,8478,8480],{"id":8479},"_2-what-are-the-flags","2. What are the Flags?",[299,8482,8483,8503,8526,8539],{},[302,8484,8485,8490,8491,8494,8495,8498,8499,8502],{},[129,8486,8487],{},[29,8488,8489],{},"flag1",": ",[129,8492,8493],{},"End of Input Flag."," Triggered when ",[29,8496,8497],{},"ctr1 == 10"," and ",[29,8500,8501],{},"ctr0 == 10"," (the 121st and final cell of the grid). It transitions the hardware from the \"reading inputs\" state to the \"evaluating\u002Foutputting\" state.",[302,8504,8505,8490,8510,8513,8514,8516,8517,8519,8520,8523,8524,8476],{},[129,8506,8507],{},[29,8508,8509],{},"flag0",[129,8511,8512],{},"Output Phase Flag."," It is set to ",[29,8515,328],{}," one clock cycle after ",[29,8518,8489],{},". It turns on the output character generator, allowing ",[29,8521,8522],{},"sat0"," to count from 0 to 15 to spit out the 16-byte message on ",[29,8525,8475],{},[302,8527,8528,8490,8533,8513,8536,8538],{},[129,8529,8530],{},[29,8531,8532],{},"flag2",[129,8534,8535],{},"Adjacency Violation Flag.",[29,8537,328],{}," if any two stars are touching.",[302,8540,8541,8490,8546,8513,8549,8551],{},[129,8542,8543],{},[29,8544,8545],{},"flag3",[129,8547,8548],{},"Row Violation Flag.",[29,8550,328],{}," at the end of any row if that row does not contain exactly two stars.",[8422,8553,8555],{"id":8554},"_3-what-are-the-other-variables","3. What are the other variables?",[11,8557,8558],{},[129,8559,8560],{},"Grid Navigation:",[299,8562,8563,8581],{},[302,8564,8565,8573,8574,8498,8577,8580],{},[129,8566,8567,8498,8570],{},[29,8568,8569],{},"ctr0",[29,8571,8572],{},"ctr1",": These are modulo-11 counters representing the ",[129,8575,8576],{},"X (column)",[129,8578,8579],{},"Y (row)"," coordinates of the 11x11 grid currently being scanned.",[302,8582,8583,8588,8589,8591,8592,8595,8596,8599,8600,8603,8604,8607,8608,8610,8611,8476],{},[129,8584,8585],{},[29,8586,8587],{},"sh0",": A 12-bit shift register that remembers the last 12 bits (cells) inputted. It is used exclusively to check the \"no touching\" rule. When a ",[29,8590,328],{}," is inputted, it checks ",[29,8593,8594],{},"sh0[0]"," (left neighbor), ",[29,8597,8598],{},"sh0[9]"," (top-right neighbor), ",[29,8601,8602],{},"sh0[10]"," (top neighbor), and ",[29,8605,8606],{},"sh0[11]"," (top-left neighbor). If any are ",[29,8609,328],{},", it trips ",[29,8612,8532],{},[11,8614,8615],{},[129,8616,8617],{},"The Star Counters (Saturating Counters):",[299,8619,8620,8628,8642,8657],{},[302,8621,8622,8627],{},[129,8623,8624],{},[29,8625,8626],{},"acc0",": Counts the total number of stars on the board. The winning condition expects exactly 22.",[302,8629,8630,8635,8636,8639,8640,8476],{},[129,8631,8632],{},[29,8633,8634],{},"sat5",": Counts the number of stars in the ",[338,8637,8638],{},"current row",". It resets to 0 at the start of a new row. Used to evaluate ",[29,8641,8545],{},[302,8643,8644,8649,8650,8653,8654,8476],{},[129,8645,8646],{},[29,8647,8648],{},"arr0[0:10]",": An array of 11 counters keeping track of the number of stars in each of the 11 ",[338,8651,8652],{},"columns",". The winning condition requires ",[29,8655,8656],{},"all(arr0 == 2)",[302,8658,8659,8664,8665,8668,8669,8672,8673,8676,8677,8498,8679,8681],{},[129,8660,8661],{},[29,8662,8663],{},"sat1, sat2, sat3, sat4, sat6, sat7, sat8, sat9, sat10, sat11, sat12",": Notice how there are exactly 11 of these? These count the number of stars in the ",[129,8666,8667],{},"11 irregularly shaped regions"," of the board. The massive block of combinational logic (",[29,8670,8671],{},"t6"," through ",[29,8674,8675],{},"t88",") simply defines the geometric borders of these regions based on the current ",[29,8678,8572],{},[29,8680,8569],{}," coordinates.",[11,8683,8684],{},[129,8685,8686],{},"Winning States and Outputs:",[299,8688,8689,8707,8722,8732],{},[302,8690,8691,8700,8701,8498,8704,8417],{},[129,8692,8693,8696,8697,8699],{},[29,8694,8695],{},"success_q"," (and ",[29,8698,31],{},")",": The ultimate win flag. True if all region counters = 2, total stars = 22, all column counters = 2, and no violations occurred (",[29,8702,8703],{},"!flag2",[29,8705,8706],{},"!flag3",[302,8708,8709,8714,8715,8718,8719,8721],{},[129,8710,8711],{},[29,8712,8713],{},"r0",": A \"Near-Miss\" flag. It becomes true if you got all the math\u002Fcounts perfectly correct, but you broke the rules by letting stars touch (",[29,8716,8717],{},"flag2 & !flag3","). The hardware likely outputs an alternate \"troll\" or failure message on ",[29,8720,8475],{}," if this is met.",[302,8723,8724,8728,8729,8476],{},[129,8725,8726],{},[29,8727,8522],{},": A 4-bit counter (0 to 15) used during the output generation phase to sequence the 16 characters of the final text string output ",[29,8730,8731],{},"O[7:0]",[302,8733,8734,8739,8740,8743],{},[129,8735,8736],{},[29,8737,8738],{},"lfsr0",": An 8-bit Linear Feedback Shift Register. During the puzzle input, it shifts and scrambles based on your inputs. By the end, its state serves as the \"decryption key\" for the giant block of ",[29,8741,8742],{},"assign O[x] = ..."," logic. Because there is only one valid solution to the Star Battle puzzle, this acts as a hash ensuring you cannot easily extract the final text without actually solving the board.",[51,8745,8747],{"label":8746},"For nitpicking sake",[11,8748,8749],{},"After looking into the decompiler output myself, there is a check for acc0 = 22. It\nlooks like you are wasting silicons here because other rules already implies this.",[11,8751,8752],{},"We didn't find new easter egg here. However, by reading the code, we are sure of it. This assumes our decompiler is not buggy of course.",[11,8754,8755],{},"Only now have we truly understood the logic. We can leverage this to recover the regions\nfor the original puzzle itself (for fun) easily for example. By probing each cell by assigning it with a star, we can look at which region counter increases. Two cells belonging to the same region would increase the same counter.",[51,8757,8759],{"label":8758},"Technically...",[11,8760,8761],{},"We can probably solve for original board state with Z3 but let's all pretend I vibe coded a bespoke decompiler for something productive here.",[276,8763],{":rows":278,"caption":8764,"markGlyph":280,"marks":281,":colorRegions":222,":groups":8765,"mode":8766},"The puzzle itself","[\"IIIIICCHGGA\",\"IIKIICHHGGA\",\"IIKCCCCHHGA\",\"IIKCJJJAHHA\",\"KIKCJAAAAAA\",\"KKKCJJJAEEE\",\"CCCCCCJAEBB\",\"CDDDJJJAEBB\",\"CDDFAAAAEBB\",\"CCDFFAAAEEE\",\"CDDFAAAAAAA\"]","marks",[11,8768,8769,8770,8773,8774,8777,8778,8781],{},"Very nice easter egg: ",[129,8771,8772],{},"J","ane ",[129,8775,8776],{},"S","treet ",[129,8779,8780],{},"C","apital.",[37,8783,8785],{"id":8784},"conclusion","Conclusion",[11,8787,8788],{},"In the end we solve the puzzle and found multiple easter eggs:",[299,8790,8791,8794,8797,8800],{},[302,8792,8793],{},"PER ARENAM AD ASTRA - Through the sand to the stars.",[302,8795,8796],{},"Leap second",[302,8798,8799],{},"JSC",[302,8801,8802],{},"Rules of the game and failure messages: BIG BANG, EMPTY SKY, TWO\"NOT TOUCH",[11,8804,8805],{},"However, hardware decompilation problem is still there.",[8807,8808,8809],"style",{},"html pre.shiki code .szBVR, html code.shiki .szBVR{--shiki-default:#D73A49;--shiki-dark:#F97583}html pre.shiki code .sScJk, html code.shiki .sScJk{--shiki-default:#6F42C1;--shiki-dark:#B392F0}html pre.shiki code .sVt8B, html code.shiki .sVt8B{--shiki-default:#24292E;--shiki-dark:#E1E4E8}html pre.shiki code .sj4cs, html code.shiki .sj4cs{--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .sJ8bj, html code.shiki .sJ8bj{--shiki-default:#6A737D;--shiki-dark:#6A737D}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":125,"searchDepth":500,"depth":500,"links":8811},[8812,8813,8814,8815,8816,8817,8818,8819,8824],{"id":39,"depth":491,"text":40},{"id":48,"depth":491,"text":70},{"id":101,"depth":491,"text":102},{"id":111,"depth":491,"text":112},{"id":162,"depth":491,"text":163},{"id":290,"depth":491,"text":291},{"id":332,"depth":491,"text":333},{"id":414,"depth":491,"text":415,"children":8820},[8821,8822,8823],{"id":8424,"depth":500,"text":8425},{"id":8479,"depth":500,"text":8480},{"id":8554,"depth":500,"text":8555},{"id":8784,"depth":491,"text":8785},"2026-08-11","Jane Street gave us a chip layout and a success signal. We reverse engineered the circuit, solved the challenge, and found more along the way.",null,"md",{},"\u002Fblog\u002Fthrough-sand-and-star",{"title":6,"description":8826},"blog\u002Fthrough-sand-and-star",false,"4kefxa5-652ZVSEczJ2FsbocfQvFtwCofHCcXZzslKI",{"id":8836,"title":8837,"body":8838,"date":29265,"description":29266,"endMark":8827,"extension":8828,"illustration":8827,"meta":29267,"navigation":969,"path":29268,"seo":29269,"stem":29270,"unlisted":8833,"__hash__":29271},"blog\u002Fblog\u002Freading-memory-by-painting-it.md","Reading memory by painting it",{"type":8,"value":8839,"toc":29215},[8840,8847,8850,8853,8856,8860,8867,9174,9177,9180,9184,9187,9191,9195,9198,9201,9204,9207,9211,9214,9249,9253,9256,9262,9265,9285,9292,9295,9299,9302,9306,9414,9417,9420,9459,9462,9468,9472,9762,10901,10906,10909,10913,10916,10920,10923,10926,10931,10935,10938,10958,10961,10968,10971,10974,10979,10982,10986,10990,10993,11228,11231,11234,11238,11925,12434,12437,12443,12446,12449,12456,12460,12463,12477,12480,12484,12487,12507,12510,12514,12517,12520,12526,12530,12533,12536,12654,12657,12661,12664,12667,12672,12675,12679,12682,12702,12705,12709,12712,12732,12735,12739,12742,12746,12749,12753,12756,12759,12763,12766,12769,12773,12776,12790,12793,12799,12802,12805,12809,12812,12815,12823,12826,12829,13042,13045,13190,13194,13197,13399,13402,13405,14308,14311,14632,14705,15024,15027,15265,15993,16456,16530,16639,16944,17307,17310,17315,17318,17322,17325,17328,17331,17334,17342,17345,18153,18743,18825,19084,20000,20259,20483,20486,21051,21577,22463,22933,23038,23821,24084,24284,24374,24513,24574,24710,24741,24872,24875,25275,25281,25284,25288,25291,25295,25298,25324,25327,25331,25334,25337,25343,25350,25355,25359,25362,25365,25547,25553,25556,25560,25563,25566,25572,25575,25579,25582,25621,25624,25627,25633,25636,25641,25645,25648,25653,25656,25660,25667,26106,26675,26678,26681,28127,28130,28144,28147,28795,28798,28803,28808,28814,28819,28822,28826,28829,28926,28929,28934,28937,28943,28946,28950,28953,28973,28976,28987,28990,28994,29066,29070,29131,29135,29167,29171,29174,29181,29212],[11,8841,8842,8846],{},[14,8843,8845],{"class":16,"style":8844},"--dc-w: 1.28em","T","he GPU process is a one-way pipe: draw commands in, pixels out, almost\nnothing else. So you do the only thing the pipe allows: have the GPU paint\nthe memory onto a canvas and read the painting back.",[11,8848,8849],{},"That is the core of a renderer-to-GPU sandbox escape I wrote up for Chrome\n146. A Skia integer overflow corrupts a neighboring path object, and the GPU\nreads chosen bytes as float coordinates and rasterizes them. The renderer\nreads the pixels back and reconstructs the original values.",[11,8851,8852],{},"Think of the value as an unknown coordinate, a pin on an infinite plane, and\nthe canvas as a fixed-size map the GPU draws the pin onto. Mostly the pin\nlands off the map, since a random byte read as a float is usually\nastronomically large or vanishingly small. The search is a pan-and-zoom.\nFirst find the zoom that brings the pin onto the map at all, which fixes the\nexponent, the scale where the value lives. Then zoom in and pan to keep the\npin centered, each step pinning down more digits of the coordinate. After a\nfew rounds the exact coordinate is recovered, a few bits at a time.",[8854,8855],"reading-memory-pan-zoom",{},[37,8857,8859],{"id":8858},"why-the-pin-doesnt-drift","Why the pin doesn't drift",[11,8861,8862,8863,8866],{},"Pan-and-zoom runs on floating point, which normally loses bits, and a map\nthat drifts as you zoom is useless. Two choices keep it exact. Zooming by a\npower of two only shifts the exponent and never rounds the mantissa. Panning\nsubtracts two close, same-signed values, which ",[129,8864,8865],{},"Sterbenz's Lemma"," guarantees\nis computed with zero rounding error.",[51,8868,8869],{"label":8865},[11,8870,8871,8872,8498,8904,8935,8936,9119,9120,9173],{},"In a floating-point number system with subnormal numbers, if ",[14,8873,8875,8890],{"className":8874},[188],[14,8876,8878],{"className":8877},[192],[194,8879,8880],{"xmlns":196},[198,8881,8882,8888],{},[201,8883,8884],{},[8885,8886,8887],"mi",{},"x",[214,8889,8887],{"encoding":216},[14,8891,8893],{"className":8892,"ariaHidden":222},[221],[14,8894,8896,8900],{"className":8895},[226],[14,8897],{"className":8898,"style":8899},[230],"height:0.4306em;",[14,8901,8887],{"className":8902},[235,8903],"mathnormal",[14,8905,8907,8921],{"className":8906},[188],[14,8908,8910],{"className":8909},[192],[194,8911,8912],{"xmlns":196},[198,8913,8914,8919],{},[201,8915,8916],{},[8885,8917,8918],{},"y",[214,8920,8918],{"encoding":216},[14,8922,8924],{"className":8923,"ariaHidden":222},[221],[14,8925,8927,8931],{"className":8926},[226],[14,8928],{"className":8929,"style":8930},[230],"height:0.625em;vertical-align:-0.1944em;",[14,8932,8918],{"className":8933,"style":8934},[235,8903],"margin-right:0.0359em;","\nare floating-point numbers with\n",[14,8937,8939,8972],{"className":8938},[188],[14,8940,8942],{"className":8941},[192],[194,8943,8944],{"xmlns":196},[198,8945,8946,8969],{},[201,8947,8948,8955,8958,8960,8962,8964,8966],{},[8949,8950,8951,8953],"mfrac",{},[8885,8952,8918],{},[204,8954,1031],{},[208,8956,8957],{},"≤",[8885,8959,8887],{},[208,8961,8957],{},[204,8963,1031],{},[8885,8965,8918],{},[208,8967,8968],{"separator":222},",",[214,8970,8971],{"encoding":216},"\\frac{y}{2} \\le x \\le 2y,",[14,8973,8975,9083,9102],{"className":8974,"ariaHidden":222},[221],[14,8976,8978,8982,9072,9076,9080],{"className":8977},[226],[14,8979],{"className":8980,"style":8981},[230],"height:1.0925em;vertical-align:-0.345em;",[14,8983,8985,8990,9068],{"className":8984},[235],[14,8986],{"className":8987},[8988,8989],"mopen","nulldelimiter",[14,8991,8993],{"className":8992},[8949],[14,8994,8998,9059],{"className":8995},[8996,8997],"vlist-t","vlist-t2",[14,8999,9002,9054],{"className":9000},[9001],"vlist-r",[14,9003,9007,9028,9039],{"className":9004,"style":9006},[9005],"vlist","height:0.7475em;",[14,9008,9010,9015],{"style":9009},"top:-2.655em;",[14,9011],{"className":9012,"style":9014},[9013],"pstrut","height:3em;",[14,9016,9022],{"className":9017},[9018,9019,9020,9021],"sizing","reset-size6","size3","mtight",[14,9023,9025],{"className":9024},[235,9021],[14,9026,1031],{"className":9027},[235,9021],[14,9029,9031,9034],{"style":9030},"top:-3.23em;",[14,9032],{"className":9033,"style":9014},[9013],[14,9035],{"className":9036,"style":9038},[9037],"frac-line","border-bottom-width:0.04em;",[14,9040,9042,9045],{"style":9041},"top:-3.4461em;",[14,9043],{"className":9044,"style":9014},[9013],[14,9046,9048],{"className":9047},[9018,9019,9020,9021],[14,9049,9051],{"className":9050},[235,9021],[14,9052,8918],{"className":9053,"style":8934},[235,8903,9021],[14,9055,9058],{"className":9056},[9057],"vlist-s","​",[14,9060,9062],{"className":9061},[9001],[14,9063,9066],{"className":9064,"style":9065},[9005],"height:0.345em;",[14,9067],{},[14,9069],{"className":9070},[9071,8989],"mclose",[14,9073],{"className":9074,"style":9075},[239],"margin-right:0.2778em;",[14,9077,8957],{"className":9078},[9079],"mrel",[14,9081],{"className":9082,"style":9075},[239],[14,9084,9086,9090,9093,9096,9099],{"className":9085},[226],[14,9087],{"className":9088,"style":9089},[230],"height:0.7719em;vertical-align:-0.136em;",[14,9091,8887],{"className":9092},[235,8903],[14,9094],{"className":9095,"style":9075},[239],[14,9097,8957],{"className":9098},[9079],[14,9100],{"className":9101,"style":9075},[239],[14,9103,9105,9109,9112,9115],{"className":9104},[226],[14,9106],{"className":9107,"style":9108},[230],"height:0.8389em;vertical-align:-0.1944em;",[14,9110,1031],{"className":9111},[235],[14,9113,8918],{"className":9114,"style":8934},[235,8903],[14,9116,8968],{"className":9117},[9118],"mpunct","\nthen ",[14,9121,9123,9142],{"className":9122},[188],[14,9124,9126],{"className":9125},[192],[194,9127,9128],{"xmlns":196},[198,9129,9130,9139],{},[201,9131,9132,9134,9137],{},[8885,9133,8887],{},[208,9135,9136],{},"−",[8885,9138,8918],{},[214,9140,9141],{"encoding":216},"x - y",[14,9143,9145,9164],{"className":9144,"ariaHidden":222},[221],[14,9146,9148,9152,9155,9158,9161],{"className":9147},[226],[14,9149],{"className":9150,"style":9151},[230],"height:0.6667em;vertical-align:-0.0833em;",[14,9153,8887],{"className":9154},[235,8903],[14,9156],{"className":9157,"style":240},[239],[14,9159,9136],{"className":9160},[244],[14,9162],{"className":9163,"style":240},[239],[14,9165,9167,9170],{"className":9166},[226],[14,9168],{"className":9169,"style":8930},[230],[14,9171,8918],{"className":9172,"style":8934},[235,8903]," is a floating-point number, so the subtraction is computed\nexactly.",[11,9175,9176],{},"So the coordinate you recover is the one actually in memory.",[11,9178,9179],{},"That sketch makes it sound like one trick. The engineering is rather more\ninvolved than that, and the rest of it lives in the full writeup.",[37,9181,9183],{"id":9182},"what-makes-it-unusual","What makes it unusual",[11,9185,9186],{},"The odd part is the mix of fields. The attack is shaped like a problem in\nnumerical analysis and computational geometry, and its reliability is a\ntheorem, not a measurement. That is the difference between a read and a leak.",[9188,9189],"divider",{"text":9190},"Full write-up",[37,9192,9194],{"id":9193},"introduction","Introduction",[11,9196,9197],{},"This article's contribution is a visual memory-read primitive: reading GPU-process memory by drawing it. We use it to build a renderer-to-GPU-process sandbox escape for Chrome Stable M146 on Linux. A Skia integer overflow corrupts an adjacent path object so the GPU interprets chosen memory bytes as float coordinates and renders them as pixels; the renderer reads those pixels back and reconstructs the original pointer.",[11,9199,9200],{},"A pointer is an exact number; the canvas it gets drawn on is a grid only a few hundred pixels wide, so reading the pointer back off the pixels should lose most of it. It does not. The read recovers a pointer a few bits at a time, zooming the drawing so each successive slice fills the screen, and exploits exact properties of IEEE-754 floats and Skia's antialiasing so the recovered bits faithfully match memory.",[11,9202,9203],{},"The whole exploit bootstraps from two bugs: a Skia out-of-bounds write and a one-shot heap-address leak that defeats ASLR. We upgrade the OOB write to gain arbitrary write and read capabilities over the heap; the leak gives the one address everything else is computed from. From there the rest follows: groom PartitionAlloc, trigger the overflow, walk the heap to locate a function-pointer table, and hijack one of its entries. That final call reuses an indirect call site that the compiler leaves out of its Control Flow Integrity (CFI) checks, the defense that would otherwise reject a call through a corrupted function pointer.",[11,9205,9206],{},"All constants are from Chrome stable 146.0.7680.164 on Linux x64.",[37,9208,9210],{"id":9209},"mitigation-surface","Mitigation surface",[11,9212,9213],{},"The GPU process enforces several standard memory-safety mitigations. To establish a reliable exploit pipeline, we must bypass or operate within the constraints of each defense:",[299,9215,9216,9222,9228,9234,9243],{},[302,9217,9218,9221],{},[129,9219,9220],{},"ASLR (Chrome binary)"," — randomizes the base address of executable code. Enabled: yes. Handling: bypassed by reading a code pointer from the heap once arbitrary memory reads are established, then calculating offsets to target functions.",[302,9223,9224,9227],{},[129,9225,9226],{},"ASLR (PA pool)"," — randomizes PartitionAlloc heap regions. Enabled: yes. Handling: defeated by an initial heap address leak exposed in a GPU-to-renderer error message.",[302,9229,9230,9233],{},[129,9231,9232],{},"PartitionAlloc bucket segregation"," — segregates allocations by size. Enabled: yes. Handling: bypassed by grooming target allocations into adjacent pages of the same size class.",[302,9235,9236,9242],{},[129,9237,9238,9239,8699],{},"BackupRefPtr (",[29,9240,9241],{},"raw_ptr\u003CT>"," — Chrome's UAF protection. Enabled: yes (for PartitionAlloc's BRP pool). Handling: avoided by targeting a heap object managed by a third-party smart pointer instead of Chrome's protected raw_ptr type.",[302,9244,9245,9248],{},[129,9246,9247],{},"LLVM CFI (-fsanitize=cfi-icall)"," — forward-edge control flow integrity. Enabled: yes. Handling: bypassed by hijacking an indirect call site that is explicitly excluded from CFI compilation checks.",[8422,9250,9252],{"id":9251},"ipc-primer","IPC primer",[11,9254,9255],{},"The exploit drives the GPU process over IPC, specifically the raster command-buffer channel. The compromised renderer cannot directly instantiate C++ objects in the GPU process. Instead, it serializes command streams and maps Shared Memory (SHM) handles. The GPU process deserializes these streams into Skia commands using its hardware-accelerated rasterization backend (Ganesh).",[9257,9258],"diagram-columns",{":groups":9259,"left":9260,"right":9261},"[{\"rows\":[{\"left\":\"IPC Command Buffer\",\"right\":\"RasterDecoderImpl\",\"dir\":\"right\"},{\"left\":\"BeginRaster \u002F EndRaster\",\"right\":\"open \u002F flush SkCanvas\",\"indent\":true},{\"left\":\"Raster(shm_id, off, sz)\",\"right\":\"deserialize PaintOps\",\"indent\":true},{\"left\":\"Create\u002FDelete TC\",\"right\":\"mutate transfer cache\",\"indent\":true},{\"left\":\"ReadbackARGB(out_shm)\",\"right\":\"copy pixels to SHM\",\"dir\":\"left\",\"indent\":true}]},{\"rows\":[{\"left\":\"SHM transfer buffers\",\"right\":\"paths, PaintOps, blobs\",\"dir\":\"right\"},{\"left\":\"SHM readback buffer\",\"right\":\"output pixels (ARGB)\",\"dir\":\"left\"}]}]","Renderer","GPU process (Ganesh)",[11,9263,9264],{},"Three command types matter for this chain:",[8442,9266,9267,9273,9279],{},[302,9268,9269,9272],{},[129,9270,9271],{},"Raster (geometry)",": Raster(shm_id, off, size) maps renderer SHM and calls PaintOp::Deserialize. This turns serialized byte streams into real Skia operations on the GPU thread.",[302,9274,9275,9278],{},[129,9276,9277],{},"Transfer cache (heap grooming)",": CreateTransferCacheEntryINTERNAL maps renderer SHM into a GPU-side buffer, registering it under a unique ID. DeleteTransferCacheEntryINTERNAL drops the entry, reclaiming its backing allocation. Because command processing maintains strict FIFO order, this allows precise heap grooming.",[302,9280,9281,9284],{},[129,9282,9283],{},"Readback (data exfiltration)",": ReadbackARGBImagePixelsINTERNAL copies rasterized pixels back into renderer-owned SHM. The renderer scans these pixels to reconstruct the leaked memory. Thus, our arbitrary read primitive must encode memory bytes into renderable color values.",[9286,9287,9289],"callout",{"type":9288},"tip",[11,9290,9291],{},"IPC command serialization allows the renderer to trigger arbitrary allocations (Transfer Cache) and read back rasterized canvas pixels in a strictly ordered execution sequence.",[11,9293,9294],{},"Our first obstacle in executing the exploit chain is defeating ASLR by finding out where we are in memory.",[37,9296,9298],{"id":9297},"the-address-leak-defeating-heap-aslr","The address leak: defeating heap ASLR",[11,9300,9301],{},"The leak comes from a hex string the GPU returns over an IPC message.",[8422,9303,9305],{"id":9304},"the-logger-as-leak-primitive","The Logger-as-leak primitive",[117,9307,9311],{"className":9308,"code":9309,"language":9310,"meta":125,"style":125},"language-cpp shiki shiki-themes github-light github-dark","\u002F\u002F gpu\u002Fcommand_buffer\u002Fservice\u002Flogger.cc (Logger::Logger; signature condensed)\nLogger::Logger(const DebugMarkerManager* debug_marker_manager, ...) {\n    Logger* this_temp = this;\n    this_in_hex_ = std::string(\"GroupMarkerNotSet(crbug.com\u002F242999)!:\")\n                   + base::HexEncode(&this_temp, sizeof(this_temp));\n}\n","cpp",[29,9312,9313,9318,9342,9359,9383,9409],{"__ignoreMap":125},[14,9314,9315],{"class":475,"line":476},[14,9316,9317],{"class":557},"\u002F\u002F gpu\u002Fcommand_buffer\u002Fservice\u002Flogger.cc (Logger::Logger; signature condensed)\n",[14,9319,9320,9323,9326,9328,9331,9334,9337,9339],{"class":475,"line":491},[14,9321,9322],{"class":483},"Logger",[14,9324,9325],{"class":487},"::",[14,9327,9322],{"class":483},[14,9329,9330],{"class":487},"(",[14,9332,9333],{"class":479},"const",[14,9335,9336],{"class":487}," DebugMarkerManager",[14,9338,281],{"class":479},[14,9340,9341],{"class":487}," debug_marker_manager, ...) {\n",[14,9343,9344,9347,9349,9352,9354,9357],{"class":475,"line":500},[14,9345,9346],{"class":483},"    Logger",[14,9348,281],{"class":479},[14,9350,9351],{"class":487}," this_temp ",[14,9353,988],{"class":479},[14,9355,9356],{"class":533}," this",[14,9358,3875],{"class":487},[14,9360,9361,9364,9366,9369,9371,9374,9376,9380],{"class":475,"line":508},[14,9362,9363],{"class":487},"    this_in_hex_ ",[14,9365,988],{"class":479},[14,9367,9368],{"class":483}," std",[14,9370,9325],{"class":487},[14,9372,9373],{"class":483},"string",[14,9375,9330],{"class":487},[14,9377,9379],{"class":9378},"sZZnC","\"GroupMarkerNotSet(crbug.com\u002F242999)!:\"",[14,9381,9382],{"class":487},")\n",[14,9384,9385,9388,9391,9393,9396,9398,9400,9403,9406],{"class":475,"line":516},[14,9386,9387],{"class":479},"                   +",[14,9389,9390],{"class":483}," base",[14,9392,9325],{"class":487},[14,9394,9395],{"class":483},"HexEncode",[14,9397,9330],{"class":487},[14,9399,1025],{"class":479},[14,9401,9402],{"class":487},"this_temp, ",[14,9404,9405],{"class":479},"sizeof",[14,9407,9408],{"class":487},"(this_temp));\n",[14,9410,9411],{"class":475,"line":524},[14,9412,9413],{"class":487},"}\n",[11,9415,9416],{},"This formats the Logger instance's address as a hex string. This string is prepended to every GL error message the Logger emits.",[11,9418,9419],{},"The renderer triggers a synthetic GL error via IPC by calling BeginQueryEXT(0). Since target 0 is invalid, the GPU dispatches an error:",[117,9421,9423],{"className":9308,"code":9422,"language":9310,"meta":125,"style":125},"\u002F\u002F raster_decoder.cc, RasterDecoderImpl::HandleBeginQueryEXT\n\u002F\u002F (via the LOCAL_SET_GL_ERROR macro)\nerror_state_->SetGLError(GL_INVALID_ENUM, \"glBeginQueryEXT\",\n                         \"unknown query target\");\n",[29,9424,9425,9430,9435,9452],{"__ignoreMap":125},[14,9426,9427],{"class":475,"line":476},[14,9428,9429],{"class":557},"\u002F\u002F raster_decoder.cc, RasterDecoderImpl::HandleBeginQueryEXT\n",[14,9431,9432],{"class":475,"line":491},[14,9433,9434],{"class":557},"\u002F\u002F (via the LOCAL_SET_GL_ERROR macro)\n",[14,9436,9437,9440,9443,9446,9449],{"class":475,"line":500},[14,9438,9439],{"class":487},"error_state_->",[14,9441,9442],{"class":483},"SetGLError",[14,9444,9445],{"class":487},"(GL_INVALID_ENUM, ",[14,9447,9448],{"class":9378},"\"glBeginQueryEXT\"",[14,9450,9451],{"class":487},",\n",[14,9453,9454,9457],{"class":475,"line":508},[14,9455,9456],{"class":9378},"                         \"unknown query target\"",[14,9458,4442],{"class":487},[11,9460,9461],{},"So the renderer receives:",[117,9463,9466],{"className":9464,"code":9465,"language":122,"meta":125},[120],"[GroupMarkerNotSet(crbug.com\u002F242999)!:009B5C01DC1A0000]GL ERROR ...\n                                      ^^^^^^^^^^^^^^^^\n                                      HexEncode(&logger_)\n",[29,9467,9465],{"__ignoreMap":125},[8422,9469,9471],{"id":9470},"deriving-pool_base-and-decoder","Deriving pool_base and decoder",[11,9473,9474,9475,9543,9544,9633,9634,537],{},"Logger lives in chromium's PartitionAlloc BRP pool. On 64-bit Linux, PA reserves the Regular and BRP pools as one glued 32 GiB region aligned to ",[14,9476,9478,9498],{"className":9477},[188],[14,9479,9481],{"className":9480},[192],[194,9482,9483],{"xmlns":196},[198,9484,9485,9495],{},[201,9486,9487],{},[9488,9489,9490,9492],"msup",{},[204,9491,1031],{},[204,9493,9494],{},"35",[214,9496,9497],{"encoding":216},"2^{35}",[14,9499,9501],{"className":9500,"ariaHidden":222},[221],[14,9502,9504,9508],{"className":9503},[226],[14,9505],{"className":9506,"style":9507},[230],"height:0.8141em;",[14,9509,9511,9514],{"className":9510},[235],[14,9512,1031],{"className":9513},[235],[14,9515,9518],{"className":9516},[9517],"msupsub",[14,9519,9521],{"className":9520},[8996],[14,9522,9524],{"className":9523},[9001],[14,9525,9527],{"className":9526,"style":9507},[9005],[14,9528,9530,9534],{"style":9529},"top:-3.063em;margin-right:0.05em;",[14,9531],{"className":9532,"style":9533},[9013],"height:2.7em;",[14,9535,9537],{"className":9536},[9018,9019,9020,9021],[14,9538,9540],{"className":9539},[235,9021],[14,9541,9494],{"className":9542},[235,9021],", so masking the low 35 bits off the leaked address gives that region's base. Logger is also an embedded member of RasterDecoderImpl at a build-constant offset (",[14,9545,9547,9571],{"className":9546},[188],[14,9548,9550],{"className":9549},[192],[194,9551,9552],{"xmlns":196},[198,9553,9554,9568],{},[201,9555,9556,9558],{},[208,9557,4432],{},[9559,9560,9561,9565],"msub",{},[9562,9563,9564],"mtext",{},"150",[204,9566,9567],{},"16",[214,9569,9570],{"encoding":216},"+\\text{150}_{16}",[14,9572,9574],{"className":9573,"ariaHidden":222},[221],[14,9575,9577,9581,9584],{"className":9576},[226],[14,9578],{"className":9579,"style":9580},[230],"height:0.7944em;vertical-align:-0.15em;",[14,9582,4432],{"className":9583},[235],[14,9585,9587,9593],{"className":9586},[235],[14,9588,9590],{"className":9589},[235,122],[14,9591,9564],{"className":9592},[235],[14,9594,9596],{"className":9595},[9517],[14,9597,9599,9624],{"className":9598},[8996,8997],[14,9600,9602,9621],{"className":9601},[9001],[14,9603,9606],{"className":9604,"style":9605},[9005],"height:0.3011em;",[14,9607,9609,9612],{"style":9608},"top:-2.55em;margin-right:0.05em;",[14,9610],{"className":9611,"style":9533},[9013],[14,9613,9615],{"className":9614},[9018,9019,9020,9021],[14,9616,9618],{"className":9617},[235,9021],[14,9619,9567],{"className":9620},[235,9021],[14,9622,9058],{"className":9623},[9057],[14,9625,9627],{"className":9626},[9001],[14,9628,9631],{"className":9629,"style":9630},[9005],"height:0.15em;",[14,9632],{},") from the decoder base. From the single leaked ",[14,9635,9637,9680],{"className":9636},[188],[14,9638,9640],{"className":9639},[192],[194,9641,9642],{"xmlns":196},[198,9643,9644,9677],{},[201,9645,9646,9649,9668,9670],{},[8885,9647,1025],{"mathvariant":9648},"normal",[201,9650,9651,9654,9657,9660,9662,9665],{},[8885,9652,9653],{"mathvariant":9648},"L",[8885,9655,9656],{"mathvariant":9648},"o",[8885,9658,9659],{"mathvariant":9648},"g",[8885,9661,9659],{"mathvariant":9648},[8885,9663,9664],{"mathvariant":9648},"e",[8885,9666,9667],{"mathvariant":9648},"r",[208,9669,988],{},[9559,9671,9672,9675],{},[9562,9673,9674],{},"1ADC015C9B00",[204,9676,9567],{},[214,9678,9679],{"encoding":216},"\\&\\mathrm{Logger} = \\text{1ADC015C9B00}_{16}",[14,9681,9683,9709],{"className":9682,"ariaHidden":222},[221],[14,9684,9686,9690,9693,9700,9703,9706],{"className":9685},[226],[14,9687],{"className":9688,"style":9689},[230],"height:0.8889em;vertical-align:-0.1944em;",[14,9691,1025],{"className":9692},[235],[14,9694,9696],{"className":9695},[235],[14,9697,9322],{"className":9698},[235,9699],"mathrm",[14,9701],{"className":9702,"style":9075},[239],[14,9704,988],{"className":9705},[9079],[14,9707],{"className":9708,"style":9075},[239],[14,9710,9712,9716],{"className":9711},[226],[14,9713],{"className":9714,"style":9715},[230],"height:0.8333em;vertical-align:-0.15em;",[14,9717,9719,9725],{"className":9718},[235],[14,9720,9722],{"className":9721},[235,122],[14,9723,9674],{"className":9724},[235],[14,9726,9728],{"className":9727},[9517],[14,9729,9731,9754],{"className":9730},[8996,8997],[14,9732,9734,9751],{"className":9733},[9001],[14,9735,9737],{"className":9736,"style":9605},[9005],[14,9738,9739,9742],{"style":9608},[14,9740],{"className":9741,"style":9533},[9013],[14,9743,9745],{"className":9744},[9018,9019,9020,9021],[14,9746,9748],{"className":9747},[235,9021],[14,9749,9567],{"className":9750},[235,9021],[14,9752,9058],{"className":9753},[9057],[14,9755,9757],{"className":9756},[9001],[14,9758,9760],{"className":9759,"style":9630},[9005],[14,9761],{},[14,9763,9766],{"className":9764},[9765],"katex-display",[14,9767,9769,10117],{"className":9768},[188],[14,9770,9772],{"className":9771},[192],[194,9773,9775],{"xmlns":196,"display":9774},"block",[198,9776,9777,10114],{},[9778,9779,9783,9872,9905,9947,10030],"mtable",{"rowspacing":9780,"columnalign":9781,"columnspacing":9782},"0.25em","right left right left","0em 1em 0em",[9784,9785,9786,9816],"mtr",{},[9787,9788,9789],"mtd",{},[9790,9791,9792],"mstyle",{"scriptlevel":540,"displaystyle":222},[201,9793,9794,9796,9798,9800,9803,9806,9809,9811,9814],{},[8885,9795,11],{"mathvariant":9648},[8885,9797,9656],{"mathvariant":9648},[8885,9799,9656],{"mathvariant":9648},[8885,9801,9802],{"mathvariant":9648},"l",[8885,9804,9805],{"mathvariant":9648},"_",[8885,9807,9808],{"mathvariant":9648},"b",[8885,9810,21],{"mathvariant":9648},[8885,9812,9813],{"mathvariant":9648},"s",[8885,9815,9664],{"mathvariant":9648},[9787,9817,9818],{},[9790,9819,9820],{"scriptlevel":540,"displaystyle":222},[201,9821,9822,9824,9826,9828,9842,9845,9848,9851,9855,9857,9859,9862,9864,9866,9868,9870],{},[201,9823],{},[208,9825,988],{},[8885,9827,1025],{"mathvariant":9648},[201,9829,9830,9832,9834,9836,9838,9840],{},[8885,9831,9653],{"mathvariant":9648},[8885,9833,9656],{"mathvariant":9648},[8885,9835,9659],{"mathvariant":9648},[8885,9837,9659],{"mathvariant":9648},[8885,9839,9664],{"mathvariant":9648},[8885,9841,9667],{"mathvariant":9648},[208,9843,1025],{"mathvariant":9648,"lspace":9844,"rspace":9844},"0.22em",[208,9846,9847],{},"∼",[9562,9849,9850],{}," ⁣",[208,9852,9330],{"fence":9853,"stretchy":222,"minsize":9854,"maxsize":9854},"false","1.2em",[208,9856,9330],{"stretchy":9853},[204,9858,328],{},[208,9860,9861],{},"≪",[204,9863,9494],{},[208,9865,8699],{"stretchy":9853},[208,9867,9136],{},[204,9869,328],{},[208,9871,8699],{"fence":9853,"stretchy":222,"minsize":9854,"maxsize":9854},[9784,9873,9874,9880],{},[9787,9875,9876],{},[9790,9877,9878],{"scriptlevel":540,"displaystyle":222},[201,9879],{},[9787,9881,9882],{},[9790,9883,9884],{"scriptlevel":540,"displaystyle":222},[201,9885,9886,9888,9890,9896,9898],{},[201,9887],{},[208,9889,988],{},[9559,9891,9892,9894],{},[9562,9893,9674],{},[204,9895,9567],{},[208,9897,1025],{"mathvariant":9648,"lspace":9844,"rspace":9844},[9559,9899,9900,9903],{},[9562,9901,9902],{},"FFFFFFF800000000",[204,9904,9567],{},[9784,9906,9907,9913,9930,9936],{},[9787,9908,9909],{},[9790,9910,9911],{"scriptlevel":540,"displaystyle":222},[201,9912],{},[9787,9914,9915],{},[9790,9916,9917],{"scriptlevel":540,"displaystyle":222},[201,9918,9919,9921,9923],{},[201,9920],{},[208,9922,988],{},[9559,9924,9925,9928],{},[9562,9926,9927],{},"1AD800000000",[204,9929,9567],{},[9787,9931,9932],{},[9790,9933,9934],{"scriptlevel":540,"displaystyle":222},[201,9935],{},[9787,9937,9938],{},[9790,9939,9940],{"scriptlevel":540,"displaystyle":222},[201,9941,9942,9944],{},[201,9943],{},[9562,9945,9946],{},"(cleared low 35 bits)",[9784,9948,9949,9972,10013,10019],{},[9787,9950,9951],{},[9790,9952,9953],{"scriptlevel":540,"displaystyle":222},[201,9954,9955,9957,9959,9961,9963,9965,9968,9970],{},[8885,9956,11],{"mathvariant":9648},[8885,9958,9656],{"mathvariant":9648},[8885,9960,9656],{"mathvariant":9648},[8885,9962,9802],{"mathvariant":9648},[8885,9964,9805],{"mathvariant":9648},[8885,9966,9967],{"mathvariant":9648},"t",[8885,9969,21],{"mathvariant":9648},[8885,9971,9659],{"mathvariant":9648},[9787,9973,9974],{},[9790,9975,9976],{"scriptlevel":540,"displaystyle":222},[201,9977,9978,9980,9982,9984,9998,10001,10004,10006],{},[201,9979],{},[208,9981,988],{},[8885,9983,1025],{"mathvariant":9648},[201,9985,9986,9988,9990,9992,9994,9996],{},[8885,9987,9653],{"mathvariant":9648},[8885,9989,9656],{"mathvariant":9648},[8885,9991,9659],{"mathvariant":9648},[8885,9993,9659],{"mathvariant":9648},[8885,9995,9664],{"mathvariant":9648},[8885,9997,9667],{"mathvariant":9648},[208,9999,10000],{},"≫",[204,10002,10003],{},"32",[208,10005,988],{},[9559,10007,10008,10011],{},[9562,10009,10010],{},"1ADC",[204,10012,9567],{},[9787,10014,10015],{},[9790,10016,10017],{"scriptlevel":540,"displaystyle":222},[201,10018],{},[9787,10020,10021],{},[9790,10022,10023],{"scriptlevel":540,"displaystyle":222},[201,10024,10025,10027],{},[201,10026],{},[9562,10028,10029],{},"(top 16 bits)",[9784,10031,10032,10054,10097,10103],{},[9787,10033,10034],{},[9790,10035,10036],{"scriptlevel":540,"displaystyle":222},[201,10037,10038,10041,10043,10046,10048,10050,10052],{},[8885,10039,10040],{"mathvariant":9648},"d",[8885,10042,9664],{"mathvariant":9648},[8885,10044,10045],{"mathvariant":9648},"c",[8885,10047,9656],{"mathvariant":9648},[8885,10049,10040],{"mathvariant":9648},[8885,10051,9664],{"mathvariant":9648},[8885,10053,9667],{"mathvariant":9648},[9787,10055,10056],{},[9790,10057,10058],{"scriptlevel":540,"displaystyle":222},[201,10059,10060,10062,10064,10066,10080,10082,10088,10090],{},[201,10061],{},[208,10063,988],{},[8885,10065,1025],{"mathvariant":9648},[201,10067,10068,10070,10072,10074,10076,10078],{},[8885,10069,9653],{"mathvariant":9648},[8885,10071,9656],{"mathvariant":9648},[8885,10073,9659],{"mathvariant":9648},[8885,10075,9659],{"mathvariant":9648},[8885,10077,9664],{"mathvariant":9648},[8885,10079,9667],{"mathvariant":9648},[208,10081,9136],{},[9559,10083,10084,10086],{},[9562,10085,9564],{},[204,10087,9567],{},[208,10089,988],{},[9559,10091,10092,10095],{},[9562,10093,10094],{},"1ADC015C99B0",[204,10096,9567],{},[9787,10098,10099],{},[9790,10100,10101],{"scriptlevel":540,"displaystyle":222},[201,10102],{},[9787,10104,10105],{},[9790,10106,10107],{"scriptlevel":540,"displaystyle":222},[201,10108,10109,10111],{},[201,10110],{},[9562,10112,10113],{},"(decoder base)",[214,10115,10116],{"encoding":216},"\\begin{aligned}\n\\mathrm{pool\\_base} &= \\&\\mathrm{Logger} \\mathbin{\\&} \\sim\\!\\big((1 \\ll 35) - 1\\big) \\\\\n&= \\text{1ADC015C9B00}_{16} \\mathbin{\\&} \\text{FFFFFFF800000000}_{16} \\\\\n&= \\text{1AD800000000}_{16} &&\\text{(cleared low 35 bits)} \\\\[4pt]\n\\mathrm{pool\\_tag} &= \\&\\mathrm{Logger} \\gg 32 = \\text{1ADC}_{16} &&\\text{(top 16 bits)} \\\\[4pt]\n\\mathrm{decoder} &= \\&\\mathrm{Logger} - \\text{150}_{16} = \\text{1ADC015C99B0}_{16} &&\\text{(decoder base)}\n\\end{aligned}",[14,10118,10120],{"className":10119,"ariaHidden":222},[221],[14,10121,10123,10127],{"className":10122},[226],[14,10124],{"className":10125,"style":10126},[230],"height:8.01em;vertical-align:-3.755em;",[14,10128,10130],{"className":10129},[235],[14,10131,10133,10226,10770,10775,10827],{"className":10132},[9778],[14,10134,10137],{"className":10135},[10136],"col-align-r",[14,10138,10140,10217],{"className":10139},[8996,8997],[14,10141,10143,10214],{"className":10142},[9001],[14,10144,10147,10163,10172,10181,10198],{"className":10145,"style":10146},[9005],"height:4.255em;",[14,10148,10150,10153],{"style":10149},"top:-6.405em;",[14,10151],{"className":10152,"style":9014},[9013],[14,10154,10156],{"className":10155},[235],[14,10157,10159],{"className":10158},[235],[14,10160,10162],{"className":10161},[235,9699],"pool_base",[14,10164,10166,10169],{"style":10165},"top:-4.905em;",[14,10167],{"className":10168,"style":9014},[9013],[14,10170],{"className":10171},[235],[14,10173,10175,10178],{"style":10174},"top:-3.405em;",[14,10176],{"className":10177,"style":9014},[9013],[14,10179],{"className":10180},[235],[14,10182,10184,10187],{"style":10183},"top:-1.505em;",[14,10185],{"className":10186,"style":9014},[9013],[14,10188,10190],{"className":10189},[235],[14,10191,10193],{"className":10192},[235],[14,10194,10197],{"className":10195,"style":10196},[235,9699],"margin-right:0.0139em;","pool_tag",[14,10199,10201,10204],{"style":10200},"top:0.395em;",[14,10202],{"className":10203,"style":9014},[9013],[14,10205,10207],{"className":10206},[235],[14,10208,10210],{"className":10209},[235],[14,10211,10213],{"className":10212},[235,9699],"decoder",[14,10215,9058],{"className":10216},[9057],[14,10218,10220],{"className":10219},[9001],[14,10221,10224],{"className":10222,"style":10223},[9005],"height:3.755em;",[14,10225],{},[14,10227,10230],{"className":10228},[10229],"col-align-l",[14,10231,10233,10762],{"className":10232},[8996,8997],[14,10234,10236,10759],{"className":10235},[9001],[14,10237,10239,10334,10458,10524,10620],{"className":10238,"style":10146},[9005],[14,10240,10241,10244],{"style":10149},[14,10242],{"className":10243,"style":9014},[9013],[14,10245,10247,10250,10253,10256,10259,10262,10268,10274,10277,10280,10284,10287,10295,10298,10301,10304,10307,10310,10313,10316,10319,10322,10325,10328],{"className":10246},[235],[14,10248],{"className":10249},[235],[14,10251],{"className":10252,"style":9075},[239],[14,10254,988],{"className":10255},[9079],[14,10257],{"className":10258,"style":9075},[239],[14,10260,1025],{"className":10261},[235],[14,10263,10265],{"className":10264},[235],[14,10266,9322],{"className":10267},[235,9699],[14,10269,10271],{"className":10270},[235],[14,10272,1025],{"className":10273},[235],[14,10275],{"className":10276,"style":9075},[239],[14,10278,9847],{"className":10279},[9079],[14,10281],{"className":10282,"style":10283},[239],"margin-right:-0.1667em;",[14,10285],{"className":10286,"style":9075},[239],[14,10288,10290],{"className":10289},[235],[14,10291,9330],{"className":10292},[10293,10294],"delimsizing","size1",[14,10296,9330],{"className":10297},[8988],[14,10299,328],{"className":10300},[235],[14,10302],{"className":10303,"style":9075},[239],[14,10305,9861],{"className":10306},[9079],[14,10308],{"className":10309,"style":9075},[239],[14,10311,9494],{"className":10312},[235],[14,10314,8699],{"className":10315},[9071],[14,10317],{"className":10318,"style":240},[239],[14,10320,9136],{"className":10321},[244],[14,10323],{"className":10324,"style":240},[239],[14,10326,328],{"className":10327},[235],[14,10329,10331],{"className":10330},[235],[14,10332,8699],{"className":10333},[10293,10294],[14,10335,10336,10339],{"style":10165},[14,10337],{"className":10338,"style":9014},[9013],[14,10340,10342,10345,10348,10351,10354,10400,10403,10409,10412],{"className":10341},[235],[14,10343],{"className":10344},[235],[14,10346],{"className":10347,"style":9075},[239],[14,10349,988],{"className":10350},[9079],[14,10352],{"className":10353,"style":9075},[239],[14,10355,10357,10363],{"className":10356},[235],[14,10358,10360],{"className":10359},[235,122],[14,10361,9674],{"className":10362},[235],[14,10364,10366],{"className":10365},[9517],[14,10367,10369,10392],{"className":10368},[8996,8997],[14,10370,10372,10389],{"className":10371},[9001],[14,10373,10375],{"className":10374,"style":9605},[9005],[14,10376,10377,10380],{"style":9608},[14,10378],{"className":10379,"style":9533},[9013],[14,10381,10383],{"className":10382},[9018,9019,9020,9021],[14,10384,10386],{"className":10385},[235,9021],[14,10387,9567],{"className":10388},[235,9021],[14,10390,9058],{"className":10391},[9057],[14,10393,10395],{"className":10394},[9001],[14,10396,10398],{"className":10397,"style":9630},[9005],[14,10399],{},[14,10401],{"className":10402,"style":240},[239],[14,10404,10406],{"className":10405},[244],[14,10407,1025],{"className":10408},[235],[14,10410],{"className":10411,"style":240},[239],[14,10413,10415,10421],{"className":10414},[235],[14,10416,10418],{"className":10417},[235,122],[14,10419,9902],{"className":10420},[235],[14,10422,10424],{"className":10423},[9517],[14,10425,10427,10450],{"className":10426},[8996,8997],[14,10428,10430,10447],{"className":10429},[9001],[14,10431,10433],{"className":10432,"style":9605},[9005],[14,10434,10435,10438],{"style":9608},[14,10436],{"className":10437,"style":9533},[9013],[14,10439,10441],{"className":10440},[9018,9019,9020,9021],[14,10442,10444],{"className":10443},[235,9021],[14,10445,9567],{"className":10446},[235,9021],[14,10448,9058],{"className":10449},[9057],[14,10451,10453],{"className":10452},[9001],[14,10454,10456],{"className":10455,"style":9630},[9005],[14,10457],{},[14,10459,10460,10463],{"style":10174},[14,10461],{"className":10462,"style":9014},[9013],[14,10464,10466,10469,10472,10475,10478],{"className":10465},[235],[14,10467],{"className":10468},[235],[14,10470],{"className":10471,"style":9075},[239],[14,10473,988],{"className":10474},[9079],[14,10476],{"className":10477,"style":9075},[239],[14,10479,10481,10487],{"className":10480},[235],[14,10482,10484],{"className":10483},[235,122],[14,10485,9927],{"className":10486},[235],[14,10488,10490],{"className":10489},[9517],[14,10491,10493,10516],{"className":10492},[8996,8997],[14,10494,10496,10513],{"className":10495},[9001],[14,10497,10499],{"className":10498,"style":9605},[9005],[14,10500,10501,10504],{"style":9608},[14,10502],{"className":10503,"style":9533},[9013],[14,10505,10507],{"className":10506},[9018,9019,9020,9021],[14,10508,10510],{"className":10509},[235,9021],[14,10511,9567],{"className":10512},[235,9021],[14,10514,9058],{"className":10515},[9057],[14,10517,10519],{"className":10518},[9001],[14,10520,10522],{"className":10521,"style":9630},[9005],[14,10523],{},[14,10525,10526,10529],{"style":10183},[14,10527],{"className":10528,"style":9014},[9013],[14,10530,10532,10535,10538,10541,10544,10547,10553,10556,10559,10562,10565,10568,10571,10574],{"className":10531},[235],[14,10533],{"className":10534},[235],[14,10536],{"className":10537,"style":9075},[239],[14,10539,988],{"className":10540},[9079],[14,10542],{"className":10543,"style":9075},[239],[14,10545,1025],{"className":10546},[235],[14,10548,10550],{"className":10549},[235],[14,10551,9322],{"className":10552},[235,9699],[14,10554],{"className":10555,"style":9075},[239],[14,10557,10000],{"className":10558},[9079],[14,10560],{"className":10561,"style":9075},[239],[14,10563,10003],{"className":10564},[235],[14,10566],{"className":10567,"style":9075},[239],[14,10569,988],{"className":10570},[9079],[14,10572],{"className":10573,"style":9075},[239],[14,10575,10577,10583],{"className":10576},[235],[14,10578,10580],{"className":10579},[235,122],[14,10581,10010],{"className":10582},[235],[14,10584,10586],{"className":10585},[9517],[14,10587,10589,10612],{"className":10588},[8996,8997],[14,10590,10592,10609],{"className":10591},[9001],[14,10593,10595],{"className":10594,"style":9605},[9005],[14,10596,10597,10600],{"style":9608},[14,10598],{"className":10599,"style":9533},[9013],[14,10601,10603],{"className":10602},[9018,9019,9020,9021],[14,10604,10606],{"className":10605},[235,9021],[14,10607,9567],{"className":10608},[235,9021],[14,10610,9058],{"className":10611},[9057],[14,10613,10615],{"className":10614},[9001],[14,10616,10618],{"className":10617,"style":9630},[9005],[14,10619],{},[14,10621,10622,10625],{"style":10200},[14,10623],{"className":10624,"style":9014},[9013],[14,10626,10628,10631,10634,10637,10640,10643,10649,10652,10655,10658,10704,10707,10710,10713],{"className":10627},[235],[14,10629],{"className":10630},[235],[14,10632],{"className":10633,"style":9075},[239],[14,10635,988],{"className":10636},[9079],[14,10638],{"className":10639,"style":9075},[239],[14,10641,1025],{"className":10642},[235],[14,10644,10646],{"className":10645},[235],[14,10647,9322],{"className":10648},[235,9699],[14,10650],{"className":10651,"style":240},[239],[14,10653,9136],{"className":10654},[244],[14,10656],{"className":10657,"style":240},[239],[14,10659,10661,10667],{"className":10660},[235],[14,10662,10664],{"className":10663},[235,122],[14,10665,9564],{"className":10666},[235],[14,10668,10670],{"className":10669},[9517],[14,10671,10673,10696],{"className":10672},[8996,8997],[14,10674,10676,10693],{"className":10675},[9001],[14,10677,10679],{"className":10678,"style":9605},[9005],[14,10680,10681,10684],{"style":9608},[14,10682],{"className":10683,"style":9533},[9013],[14,10685,10687],{"className":10686},[9018,9019,9020,9021],[14,10688,10690],{"className":10689},[235,9021],[14,10691,9567],{"className":10692},[235,9021],[14,10694,9058],{"className":10695},[9057],[14,10697,10699],{"className":10698},[9001],[14,10700,10702],{"className":10701,"style":9630},[9005],[14,10703],{},[14,10705],{"className":10706,"style":9075},[239],[14,10708,988],{"className":10709},[9079],[14,10711],{"className":10712,"style":9075},[239],[14,10714,10716,10722],{"className":10715},[235],[14,10717,10719],{"className":10718},[235,122],[14,10720,10094],{"className":10721},[235],[14,10723,10725],{"className":10724},[9517],[14,10726,10728,10751],{"className":10727},[8996,8997],[14,10729,10731,10748],{"className":10730},[9001],[14,10732,10734],{"className":10733,"style":9605},[9005],[14,10735,10736,10739],{"style":9608},[14,10737],{"className":10738,"style":9533},[9013],[14,10740,10742],{"className":10741},[9018,9019,9020,9021],[14,10743,10745],{"className":10744},[235,9021],[14,10746,9567],{"className":10747},[235,9021],[14,10749,9058],{"className":10750},[9057],[14,10752,10754],{"className":10753},[9001],[14,10755,10757],{"className":10756,"style":9630},[9005],[14,10758],{},[14,10760,9058],{"className":10761},[9057],[14,10763,10765],{"className":10764},[9001],[14,10766,10768],{"className":10767,"style":10223},[9005],[14,10769],{},[14,10771],{"className":10772,"style":10774},[10773],"arraycolsep","width:1em;",[14,10776,10778],{"className":10777},[10136],[14,10779,10781,10819],{"className":10780},[8996,8997],[14,10782,10784,10816],{"className":10783},[9001],[14,10785,10788,10798,10807],{"className":10786,"style":10787},[9005],"height:1.245em;",[14,10789,10791,10795],{"style":10790},"top:-3.245em;",[14,10792],{"className":10793,"style":10794},[9013],"height:2.84em;",[14,10796],{"className":10797},[235],[14,10799,10801,10804],{"style":10800},"top:-1.345em;",[14,10802],{"className":10803,"style":10794},[9013],[14,10805],{"className":10806},[235],[14,10808,10810,10813],{"style":10809},"top:0.555em;",[14,10811],{"className":10812,"style":10794},[9013],[14,10814],{"className":10815},[235],[14,10817,9058],{"className":10818},[9057],[14,10820,10822],{"className":10821},[9001],[14,10823,10825],{"className":10824,"style":10223},[9005],[14,10826],{},[14,10828,10830],{"className":10829},[10229],[14,10831,10833,10893],{"className":10832},[8996,8997],[14,10834,10836,10890],{"className":10835},[9001],[14,10837,10839,10856,10873],{"className":10838,"style":10787},[9005],[14,10840,10841,10844],{"style":10174},[14,10842],{"className":10843,"style":9014},[9013],[14,10845,10847,10850],{"className":10846},[235],[14,10848],{"className":10849},[235],[14,10851,10853],{"className":10852},[235,122],[14,10854,9946],{"className":10855},[235],[14,10857,10858,10861],{"style":10183},[14,10859],{"className":10860,"style":9014},[9013],[14,10862,10864,10867],{"className":10863},[235],[14,10865],{"className":10866},[235],[14,10868,10870],{"className":10869},[235,122],[14,10871,10029],{"className":10872},[235],[14,10874,10875,10878],{"style":10200},[14,10876],{"className":10877,"style":9014},[9013],[14,10879,10881,10884],{"className":10880},[235],[14,10882],{"className":10883},[235],[14,10885,10887],{"className":10886},[235,122],[14,10888,10113],{"className":10889},[235],[14,10891,9058],{"className":10892},[9057],[14,10894,10896],{"className":10895},[9001],[14,10897,10899],{"className":10898,"style":10223},[9005],[14,10900],{},[9286,10902,10903],{"type":9288},[11,10904,10905],{},"One leaked heap address yields both the PA pool base and the decoder object. Every later pointer is computed from these two.",[11,10907,10908],{},"Now that we have derived the base address of the PartitionAlloc pool, we need to understand how the allocator arranges memory so we can manipulate it.",[37,10910,10912],{"id":10911},"partitionalloc-primer","PartitionAlloc primer",[11,10914,10915],{},"The chain manipulates PA at several points. Understanding the allocator's specific behavior is useful to follow.",[8422,10917,10919],{"id":10918},"buckets","Buckets",[11,10921,10922],{},"PartitionAlloc segregates allocations by size class. Every allocation rounds up to a fixed bucket size under the root's bucket distribution. The GPU process, where this exploit runs, uses the kNeutral distribution.",[11,10924,10925],{},"PA manages memory by grouping allocations into size classes (buckets) using dedicated virtual memory regions for each size. Because an allocation's size class is permanently bound to its memory address, calling free(ptr) automatically routes the freed slot back to its original bucket. Thus, freeing a 56 KiB object instantly makes its slot available in that bucket's freelist, allowing us to reclaim and overwrite it by allocating another object of the exact same size.",[9286,10927,10928],{"type":9288},[11,10929,10930],{},"For an out-of-bounds write to hit a target object, both the source and the victim must be sized into the exact same bucket.",[8422,10932,10934],{"id":10933},"slot-spans-and-adjacent-overflows","Slot spans and adjacent overflows",[11,10936,10937],{},"Depending on size, PartitionAlloc allocates memory in one of three regimes:",[8442,10939,10940,10946,10952],{},[302,10941,10942,10945],{},[129,10943,10944],{},"Multi-slot spans",": smaller buckets (like 10240 B) pack multiple slots contiguous inside a single span.",[302,10947,10948,10951],{},[129,10949,10950],{},"Single-slot spans",": medium\u002Flarge buckets hold exactly one slot per span.",[302,10953,10954,10957],{},[129,10955,10956],{},"Direct-mapped",": allocations above ~960 KiB get dedicated virtual memory regions isolated by unmapped guard pages. An OOB write here triggers an immediate SIGSEGV.",[11,10959,10960],{},"To avoid guard pages, the exploit targets bucketed allocations. Specifically, it uses bucket-57344, which operates under the single-slot regime.",[10962,10963],"diagram-stack",{":items":10964,"title":10965,"direction":10966,"spanNote":10967},"[{\"label\":\"span A\",\"note\":\"reservation 64K, alloc \u003C 64K\"},{\"label\":\"span B\",\"note\":\"reservation 64K, alloc \u003C 64K\"},{\"label\":\"span C\",\"note\":\"reservation 64K, alloc \u003C 64K\"}]","Adjacent single-slot spans (same bucket)","horizontal","OOB WRITE",[11,10969,10970],{},"PartitionAlloc carves slot spans sequentially. On Linux, the allocator commits the entire 64 KiB reservation for each span, even when the allocation inside it is smaller. The committed but unused tail is fully writable. When an OOB write overflows span A's allocation, it crosses the 64 KiB boundary directly into span B without hitting any unmapped pages. Same-bucket sizing forces adjacent spans to share this corridor.",[11,10972,10973],{},"Note: the specific choice of bucket-57344 is flexible. We could target other buckets as well. However, if it is too small, you would need to deal with the thread cache (requiring a different grooming strategy). It must not be too big, or it will fall into the direct-mapped case.",[9286,10975,10976],{"type":9288},[11,10977,10978],{},"Allocations must stay bucketed, not direct-mapped, whose guard pages SIGSEGV. Linux commits the whole single-slot span, so an overflow crosses into the adjacent span, not an unmapped page.",[11,10980,10981],{},"Let's see how we can trigger the out-of-bounds write.",[37,10983,10985],{"id":10984},"the-vulnerability-and-the-oob-site","The vulnerability and the OOB site",[8422,10987,10989],{"id":10988},"the-bug","The bug",[11,10991,10992],{},"This is a simple integer overflow bug.",[117,10994,10996],{"className":9308,"code":10995,"language":9310,"meta":125,"style":125},"\u002F\u002F third_party\u002Fskia\u002Fsrc\u002Fcore\u002FPathStencilCoverOp.cpp\n\u002F\u002F PathStencilCoverOp::onPrepare\nint maxTrianglesInFans = std::max(fTotalCombinedPathVerbCnt - 2, 0);\nint fanTriangleCount = 0;\nif (VertexWriter triangleVertexWriter =\n            vertexAlloc.lockWriter(\n                    sizeof(SkPoint), maxTrianglesInFans * 3)) {\n    for (auto [pathMatrix, path, color] : *fPathDrawList) {\n        tess::AffineMatrix m(pathMatrix);\n        for (tess::PathMiddleOutFanIter it(path); !it.done();) {\n            for (auto [p0, p1, p2] : it.nextStack()) {\n                triangleVertexWriter \u003C\u003C m.map2Points(p0, p1)\n                                     \u003C\u003C m.mapPoint(p2);\n                ++fanTriangleCount;\n            }\n        }\n    }\n}\n",[29,10997,10998,11003,11008,11039,11052,11062,11073,11088,11106,11122,11153,11171,11188,11201,11209,11214,11219,11224],{"__ignoreMap":125},[14,10999,11000],{"class":475,"line":476},[14,11001,11002],{"class":557},"\u002F\u002F third_party\u002Fskia\u002Fsrc\u002Fcore\u002FPathStencilCoverOp.cpp\n",[14,11004,11005],{"class":475,"line":491},[14,11006,11007],{"class":557},"\u002F\u002F PathStencilCoverOp::onPrepare\n",[14,11009,11010,11013,11016,11018,11020,11022,11025,11028,11031,11033,11035,11037],{"class":475,"line":500},[14,11011,11012],{"class":479},"int",[14,11014,11015],{"class":487}," maxTrianglesInFans ",[14,11017,988],{"class":479},[14,11019,9368],{"class":483},[14,11021,9325],{"class":487},[14,11023,11024],{"class":483},"max",[14,11026,11027],{"class":487},"(fTotalCombinedPathVerbCnt ",[14,11029,11030],{"class":479},"-",[14,11032,5827],{"class":533},[14,11034,428],{"class":487},[14,11036,540],{"class":533},[14,11038,4442],{"class":487},[14,11040,11041,11043,11046,11048,11050],{"class":475,"line":508},[14,11042,11012],{"class":479},[14,11044,11045],{"class":487}," fanTriangleCount ",[14,11047,988],{"class":479},[14,11049,3892],{"class":533},[14,11051,3875],{"class":487},[14,11053,11054,11056,11059],{"class":475,"line":516},[14,11055,427],{"class":479},[14,11057,11058],{"class":487}," (VertexWriter triangleVertexWriter ",[14,11060,11061],{"class":479},"=\n",[14,11063,11064,11067,11070],{"class":475,"line":524},[14,11065,11066],{"class":487},"            vertexAlloc.",[14,11068,11069],{"class":483},"lockWriter",[14,11071,11072],{"class":487},"(\n",[14,11074,11075,11078,11081,11083,11085],{"class":475,"line":546},[14,11076,11077],{"class":479},"                    sizeof",[14,11079,11080],{"class":487},"(SkPoint), maxTrianglesInFans ",[14,11082,281],{"class":479},[14,11084,6667],{"class":533},[14,11086,11087],{"class":487},")) {\n",[14,11089,11090,11093,11095,11098,11101,11103],{"class":475,"line":554},[14,11091,11092],{"class":479},"    for",[14,11094,1532],{"class":487},[14,11096,11097],{"class":479},"auto",[14,11099,11100],{"class":487}," [pathMatrix, path, color] : ",[14,11102,281],{"class":479},[14,11104,11105],{"class":487},"fPathDrawList) {\n",[14,11107,11108,11111,11113,11116,11119],{"class":475,"line":561},[14,11109,11110],{"class":483},"        tess",[14,11112,9325],{"class":487},[14,11114,11115],{"class":483},"AffineMatrix",[14,11117,11118],{"class":483}," m",[14,11120,11121],{"class":487},"(pathMatrix);\n",[14,11123,11124,11126,11128,11131,11133,11136,11139,11142,11144,11147,11150],{"class":475,"line":582},[14,11125,4315],{"class":479},[14,11127,1532],{"class":487},[14,11129,11130],{"class":483},"tess",[14,11132,9325],{"class":487},[14,11134,11135],{"class":483},"PathMiddleOutFanIter",[14,11137,11138],{"class":483}," it",[14,11140,11141],{"class":487},"(path); ",[14,11143,1091],{"class":479},[14,11145,11146],{"class":487},"it.",[14,11148,11149],{"class":483},"done",[14,11151,11152],{"class":487},"();) {\n",[14,11154,11155,11158,11160,11162,11165,11168],{"class":475,"line":600},[14,11156,11157],{"class":479},"            for",[14,11159,1532],{"class":487},[14,11161,11097],{"class":479},[14,11163,11164],{"class":487}," [p0, p1, p2] : it.",[14,11166,11167],{"class":483},"nextStack",[14,11169,11170],{"class":487},"()) {\n",[14,11172,11173,11176,11179,11182,11185],{"class":475,"line":619},[14,11174,11175],{"class":487},"                triangleVertexWriter ",[14,11177,11178],{"class":479},"\u003C\u003C",[14,11180,11181],{"class":487}," m.",[14,11183,11184],{"class":483},"map2Points",[14,11186,11187],{"class":487},"(p0, p1)\n",[14,11189,11190,11193,11195,11198],{"class":475,"line":638},[14,11191,11192],{"class":479},"                                     \u003C\u003C",[14,11194,11181],{"class":487},[14,11196,11197],{"class":483},"mapPoint",[14,11199,11200],{"class":487},"(p2);\n",[14,11202,11203,11206],{"class":475,"line":657},[14,11204,11205],{"class":479},"                ++",[14,11207,11208],{"class":487},"fanTriangleCount;\n",[14,11210,11211],{"class":475,"line":676},[14,11212,11213],{"class":487},"            }\n",[14,11215,11216],{"class":475,"line":695},[14,11217,11218],{"class":487},"        }\n",[14,11220,11221],{"class":475,"line":713},[14,11222,11223],{"class":487},"    }\n",[14,11225,11226],{"class":475,"line":731},[14,11227,9413],{"class":487},[11,11229,11230],{},"fTotalCombinedPathVerbCnt is an int32_t. If we send a draw batch where (verbs - 2) * 3 overflows, maxTrianglesInFans * 3 wraps to a small positive number. The lockWriter function allocates a small vertex block, but the emission loop writes the true number of triangles, blowing past the buffer's end.",[11,11232,11233],{},"The next issue is how can we ship a big number of vertices without triggering the out-of-memory killer.",[8422,11235,11237],{"id":11236},"the-math","The math",[14,11239,11241],{"className":11240},[9765],[14,11242,11244,11471],{"className":11243},[188],[14,11245,11247],{"className":11246},[192],[194,11248,11249],{"xmlns":196,"display":9774},[198,11250,11251,11468],{},[9778,11252,11253,11310,11383,11404],{"rowspacing":9780,"columnalign":9781,"columnspacing":9782},[9784,11254,11255,11288],{},[9787,11256,11257],{},[9790,11258,11259],{"scriptlevel":540,"displaystyle":222},[201,11260,11261,11264,11266,11268,11270,11272,11275,11277,11280,11282,11284,11286],{},[8885,11262,11263],{"mathvariant":9648},"m",[8885,11265,21],{"mathvariant":9648},[8885,11267,8887],{"mathvariant":9648},[8885,11269,8845],{"mathvariant":9648},[8885,11271,9667],{"mathvariant":9648},[8885,11273,11274],{"mathvariant":9648},"i",[8885,11276,21],{"mathvariant":9648},[8885,11278,11279],{"mathvariant":9648},"n",[8885,11281,9659],{"mathvariant":9648},[8885,11283,9802],{"mathvariant":9648},[8885,11285,9664],{"mathvariant":9648},[8885,11287,9813],{"mathvariant":9648},[9787,11289,11290],{},[9790,11291,11292],{"scriptlevel":540,"displaystyle":222},[201,11293,11294,11296,11298,11301,11303,11305,11307],{},[201,11295],{},[208,11297,988],{},[8885,11299,11300],{},"V",[208,11302,9136],{},[204,11304,1031],{},[208,11306,988],{},[204,11308,11309],{},"1,431,657,140",[9784,11311,11312,11342],{},[9787,11313,11314],{},[9790,11315,11316],{"scriptlevel":540,"displaystyle":222},[201,11317,11318,11321,11323,11325,11327,11329,11331,11333,11335,11338,11340],{},[8885,11319,11320],{"mathvariant":9648},"v",[8885,11322,9664],{"mathvariant":9648},[8885,11324,9667],{"mathvariant":9648},[8885,11326,9967],{"mathvariant":9648},[8885,11328,9664],{"mathvariant":9648},[8885,11330,8887],{"mathvariant":9648},[8885,11332,8780],{"mathvariant":9648},[8885,11334,9656],{"mathvariant":9648},[8885,11336,11337],{"mathvariant":9648},"u",[8885,11339,11279],{"mathvariant":9648},[8885,11341,9967],{"mathvariant":9648},[9787,11343,11344],{},[9790,11345,11346],{"scriptlevel":540,"displaystyle":222},[201,11347,11348,11350,11352,11378,11381],{},[201,11349],{},[208,11351,988],{},[201,11353,11354,11356,11358,11360,11362,11364,11366,11368,11370,11372,11374,11376],{},[8885,11355,11263],{"mathvariant":9648},[8885,11357,21],{"mathvariant":9648},[8885,11359,8887],{"mathvariant":9648},[8885,11361,8845],{"mathvariant":9648},[8885,11363,9667],{"mathvariant":9648},[8885,11365,11274],{"mathvariant":9648},[8885,11367,21],{"mathvariant":9648},[8885,11369,11279],{"mathvariant":9648},[8885,11371,9659],{"mathvariant":9648},[8885,11373,9802],{"mathvariant":9648},[8885,11375,9664],{"mathvariant":9648},[8885,11377,9813],{"mathvariant":9648},[208,11379,11380],{},"⋅",[204,11382,569],{},[9784,11384,11385,11391],{},[9787,11386,11387],{},[9790,11388,11389],{"scriptlevel":540,"displaystyle":222},[201,11390],{},[9787,11392,11393],{},[9790,11394,11395],{"scriptlevel":540,"displaystyle":222},[201,11396,11397,11399,11401],{},[201,11398],{},[208,11400,988],{},[204,11402,11403],{},"4,294,971,420",[9784,11405,11406,11412,11451,11457],{},[9787,11407,11408],{},[9790,11409,11410],{"scriptlevel":540,"displaystyle":222},[201,11411],{},[9787,11413,11414],{},[9790,11415,11416],{"scriptlevel":540,"displaystyle":222},[201,11417,11418,11420,11422,11425,11427,11430,11432,11440,11443,11449],{},[201,11419],{},[208,11421,988],{},[204,11423,11424],{},"4,124",[239,11426],{},[239,11428],{"width":11429},"1em",[208,11431,9330],{"stretchy":9853},[201,11433,11434,11436,11438],{},[8885,11435,11263],{"mathvariant":9648},[8885,11437,9656],{"mathvariant":9648},[8885,11439,10040],{"mathvariant":9648},[239,11441],{"width":11442},"0.3333em",[9488,11444,11445,11447],{},[204,11446,1031],{},[204,11448,10003],{},[208,11450,8699],{"stretchy":9853},[9787,11452,11453],{},[9790,11454,11455],{"scriptlevel":540,"displaystyle":222},[201,11456],{},[9787,11458,11459],{},[9790,11460,11461],{"scriptlevel":540,"displaystyle":222},[201,11462,11463,11465],{},[201,11464],{},[9562,11466,11467],{},"(int32 overflow)",[214,11469,11470],{"encoding":216},"\\begin{aligned}\n\\mathrm{maxTriangles} &= V - 2 = 1{,}431{,}657{,}140 \\\\\n\\mathrm{vertexCount} &= \\mathrm{maxTriangles} \\cdot 3 \\\\\n&= 4{,}294{,}971{,}420 \\\\\n&= 4{,}124 \\pmod{2^{32}} &&\\text{(int32 overflow)}\n\\end{aligned}",[14,11472,11474],{"className":11473,"ariaHidden":222},[221],[14,11475,11477,11481],{"className":11476},[226],[14,11478],{"className":11479,"style":11480},[230],"height:5.7241em;vertical-align:-2.6121em;",[14,11482,11484],{"className":11483},[235],[14,11485,11487,11562,11848,11851,11885],{"className":11486},[9778],[14,11488,11490],{"className":11489},[10136],[14,11491,11493,11553],{"className":11492},[8996,8997],[14,11494,11496,11550],{"className":11495},[9001],[14,11497,11500,11516,11532,11541],{"className":11498,"style":11499},[9005],"height:3.1121em;",[14,11501,11503,11506],{"style":11502},"top:-5.2721em;",[14,11504],{"className":11505,"style":9014},[9013],[14,11507,11509],{"className":11508},[235],[14,11510,11512],{"className":11511},[235],[14,11513,11515],{"className":11514},[235,9699],"maxTriangles",[14,11517,11519,11522],{"style":11518},"top:-3.7721em;",[14,11520],{"className":11521,"style":9014},[9013],[14,11523,11525],{"className":11524},[235],[14,11526,11528],{"className":11527},[235],[14,11529,11531],{"className":11530},[235,9699],"vertexCount",[14,11533,11535,11538],{"style":11534},"top:-2.2721em;",[14,11536],{"className":11537,"style":9014},[9013],[14,11539],{"className":11540},[235],[14,11542,11544,11547],{"style":11543},"top:-0.7479em;",[14,11545],{"className":11546,"style":9014},[9013],[14,11548],{"className":11549},[235],[14,11551,9058],{"className":11552},[9057],[14,11554,11556],{"className":11555},[9001],[14,11557,11560],{"className":11558,"style":11559},[9005],"height:2.6121em;",[14,11561],{},[14,11563,11565],{"className":11564},[10229],[14,11566,11568,11840],{"className":11567},[8996,8997],[14,11569,11571,11837],{"className":11570},[9001],[14,11572,11574,11651,11689,11742],{"className":11573,"style":11499},[9005],[14,11575,11576,11579],{"style":11502},[14,11577],{"className":11578,"style":9014},[9013],[14,11580,11582,11585,11588,11591,11594,11597,11600,11603,11606,11609,11612,11615,11618,11621,11627,11631,11637,11641,11647],{"className":11581},[235],[14,11583],{"className":11584},[235],[14,11586],{"className":11587,"style":9075},[239],[14,11589,988],{"className":11590},[9079],[14,11592],{"className":11593,"style":9075},[239],[14,11595,11300],{"className":11596,"style":240},[235,8903],[14,11598],{"className":11599,"style":240},[239],[14,11601,9136],{"className":11602},[244],[14,11604],{"className":11605,"style":240},[239],[14,11607,1031],{"className":11608},[235],[14,11610],{"className":11611,"style":9075},[239],[14,11613,988],{"className":11614},[9079],[14,11616],{"className":11617,"style":9075},[239],[14,11619,328],{"className":11620},[235],[14,11622,11624],{"className":11623},[235],[14,11625,8968],{"className":11626},[9118],[14,11628,11630],{"className":11629},[235],"431",[14,11632,11634],{"className":11633},[235],[14,11635,8968],{"className":11636},[9118],[14,11638,11640],{"className":11639},[235],"657",[14,11642,11644],{"className":11643},[235],[14,11645,8968],{"className":11646},[9118],[14,11648,11650],{"className":11649},[235],"140",[14,11652,11653,11656],{"style":11518},[14,11654],{"className":11655,"style":9014},[9013],[14,11657,11659,11662,11665,11668,11671,11677,11680,11683,11686],{"className":11658},[235],[14,11660],{"className":11661},[235],[14,11663],{"className":11664,"style":9075},[239],[14,11666,988],{"className":11667},[9079],[14,11669],{"className":11670,"style":9075},[239],[14,11672,11674],{"className":11673},[235],[14,11675,11515],{"className":11676},[235,9699],[14,11678],{"className":11679,"style":240},[239],[14,11681,11380],{"className":11682},[244],[14,11684],{"className":11685,"style":240},[239],[14,11687,569],{"className":11688},[235],[14,11690,11691,11694],{"style":11534},[14,11692],{"className":11693,"style":9014},[9013],[14,11695,11697,11700,11703,11706,11709,11712,11718,11722,11728,11732,11738],{"className":11696},[235],[14,11698],{"className":11699},[235],[14,11701],{"className":11702,"style":9075},[239],[14,11704,988],{"className":11705},[9079],[14,11707],{"className":11708,"style":9075},[239],[14,11710,1711],{"className":11711},[235],[14,11713,11715],{"className":11714},[235],[14,11716,8968],{"className":11717},[9118],[14,11719,11721],{"className":11720},[235],"294",[14,11723,11725],{"className":11724},[235],[14,11726,8968],{"className":11727},[9118],[14,11729,11731],{"className":11730},[235],"971",[14,11733,11735],{"className":11734},[235],[14,11736,8968],{"className":11737},[9118],[14,11739,11741],{"className":11740},[235],"420",[14,11743,11744,11747],{"style":11543},[14,11745],{"className":11746,"style":9014},[9013],[14,11748,11750,11753,11756,11759,11762,11765,11771,11775,11779,11783,11786,11796,11800,11834],{"className":11749},[235],[14,11751],{"className":11752},[235],[14,11754],{"className":11755,"style":9075},[239],[14,11757,988],{"className":11758},[9079],[14,11760],{"className":11761,"style":9075},[239],[14,11763,1711],{"className":11764},[235],[14,11766,11768],{"className":11767},[235],[14,11769,8968],{"className":11770},[9118],[14,11772,11774],{"className":11773},[235],"124",[14,11776],{"className":11777},[239,11778],"allowbreak",[14,11780],{"className":11781,"style":11782},[239],"margin-right:1em;",[14,11784,9330],{"className":11785},[8988],[14,11787,11789],{"className":11788},[235],[14,11790,11792],{"className":11791},[235],[14,11793,11795],{"className":11794},[235,9699],"mod",[14,11797],{"className":11798,"style":11799},[239],"margin-right:0.3333em;",[14,11801,11803,11806],{"className":11802},[235],[14,11804,1031],{"className":11805},[235],[14,11807,11809],{"className":11808},[9517],[14,11810,11812],{"className":11811},[8996],[14,11813,11815],{"className":11814},[9001],[14,11816,11819],{"className":11817,"style":11818},[9005],"height:0.8641em;",[14,11820,11822,11825],{"style":11821},"top:-3.113em;margin-right:0.05em;",[14,11823],{"className":11824,"style":9533},[9013],[14,11826,11828],{"className":11827},[9018,9019,9020,9021],[14,11829,11831],{"className":11830},[235,9021],[14,11832,10003],{"className":11833},[235,9021],[14,11835,8699],{"className":11836},[9071],[14,11838,9058],{"className":11839},[9057],[14,11841,11843],{"className":11842},[9001],[14,11844,11846],{"className":11845,"style":11559},[9005],[14,11847],{},[14,11849],{"className":11850,"style":10774},[10773],[14,11852,11854],{"className":11853},[10136],[14,11855,11857,11877],{"className":11856},[8996,8997],[14,11858,11860,11874],{"className":11859},[9001],[14,11861,11864],{"className":11862,"style":11863},[9005],"height:-1.3879em;",[14,11865,11867,11871],{"style":11866},"top:-0.6121em;",[14,11868],{"className":11869,"style":11870},[9013],"height:2.8641em;",[14,11872],{"className":11873},[235],[14,11875,9058],{"className":11876},[9057],[14,11878,11880],{"className":11879},[9001],[14,11881,11883],{"className":11882,"style":11559},[9005],[14,11884],{},[14,11886,11888],{"className":11887},[10229],[14,11889,11891,11917],{"className":11890},[8996,8997],[14,11892,11894,11914],{"className":11893},[9001],[14,11895,11897],{"className":11896,"style":11863},[9005],[14,11898,11899,11902],{"style":11543},[14,11900],{"className":11901,"style":9014},[9013],[14,11903,11905,11908],{"className":11904},[235],[14,11906],{"className":11907},[235],[14,11909,11911],{"className":11910},[235,122],[14,11912,11467],{"className":11913},[235],[14,11915,9058],{"className":11916},[9057],[14,11918,11920],{"className":11919},[9001],[14,11921,11923],{"className":11922,"style":11559},[9005],[14,11924],{},[14,11926,11928],{"className":11927},[9765],[14,11929,11931,12104],{"className":11930},[188],[14,11932,11934],{"className":11933},[192],[194,11935,11936],{"xmlns":196,"display":9774},[198,11937,11938,12101],{},[9778,11939,11942,12000,12079],{"rowspacing":9780,"columnalign":11940,"columnspacing":11941},"right left","0em",[9784,11943,11944,11974],{},[9787,11945,11946],{},[9790,11947,11948],{"scriptlevel":540,"displaystyle":222},[201,11949,11950,11952,11954,11957,11959,11961,11963,11965,11967,11969,11972],{},[8885,11951,9667],{"mathvariant":9648},[8885,11953,9664],{"mathvariant":9648},[8885,11955,11956],{"mathvariant":9648},"q",[8885,11958,11337],{"mathvariant":9648},[8885,11960,9664],{"mathvariant":9648},[8885,11962,9813],{"mathvariant":9648},[8885,11964,9967],{"mathvariant":9648},[8885,11966,8776],{"mathvariant":9648},[8885,11968,11274],{"mathvariant":9648},[8885,11970,11971],{"mathvariant":9648},"z",[8885,11973,9664],{"mathvariant":9648},[9787,11975,11976],{},[9790,11977,11978],{"scriptlevel":540,"displaystyle":222},[201,11979,11980,11982,11984,11986,11988,11990,11993,11995,11998],{},[201,11981],{},[208,11983,988],{},[204,11985,11424],{},[208,11987,11380],{},[204,11989,1202],{},[9562,11991,11992],{}," bytes",[208,11994,988],{},[204,11996,11997],{},"32,992",[9562,11999,11992],{},[9784,12001,12002,12037],{},[9787,12003,12004],{},[9790,12005,12006],{"scriptlevel":540,"displaystyle":222},[201,12007,12008,12011,12014,12017,12019,12021,12023,12025,12027,12029,12031,12033,12035],{},[8885,12009,12010],{"mathvariant":9648},"P",[8885,12012,12013],{"mathvariant":9648},"A",[9562,12015,12016],{}," ",[8885,12018,21],{"mathvariant":9648},[8885,12020,9802],{"mathvariant":9648},[8885,12022,9802],{"mathvariant":9648},[8885,12024,9656],{"mathvariant":9648},[8885,12026,10045],{"mathvariant":9648},[8885,12028,21],{"mathvariant":9648},[8885,12030,9967],{"mathvariant":9648},[8885,12032,11274],{"mathvariant":9648},[8885,12034,9656],{"mathvariant":9648},[8885,12036,11279],{"mathvariant":9648},[9787,12038,12039],{},[9790,12040,12041],{"scriptlevel":540,"displaystyle":222},[201,12042,12043,12045,12047,12050,12052,12054,12057,12059,12061,12063,12065,12067,12070,12072,12074,12077],{},[201,12044],{},[208,12046,988],{},[204,12048,12049],{},"49,152",[9562,12051,12016],{},[208,12053,9330],{"stretchy":9853},[9562,12055,12056],{},"Skia bin",[208,12058,8699],{"stretchy":9853},[208,12060,4432],{},[204,12062,10003],{},[9562,12064,12016],{},[208,12066,9330],{"stretchy":9853},[9562,12068,12069],{},"metadata",[208,12071,8699],{"stretchy":9853},[208,12073,988],{},[204,12075,12076],{},"49,184",[9562,12078,11992],{},[9784,12080,12081,12087],{},[9787,12082,12083],{},[9790,12084,12085],{"scriptlevel":540,"displaystyle":222},[201,12086],{},[9787,12088,12089],{},[9790,12090,12091],{"scriptlevel":540,"displaystyle":222},[201,12092,12093,12095,12098],{},[201,12094],{},[208,12096,12097],{},"→",[9562,12099,12100],{},"bucket-57344",[214,12102,12103],{"encoding":216},"\\begin{aligned}\n\\mathrm{requestSize} &= 4{,}124 \\cdot 8\\ \\text{bytes} = 32{,}992\\ \\text{bytes} \\\\\n\\mathrm{PA\\ allocation} &= 49{,}152\\ (\\text{Skia bin}) + 32\\ (\\text{metadata}) = 49{,}184\\ \\text{bytes} \\\\\n&\\to \\text{bucket-57344}\n\\end{aligned}",[14,12105,12107],{"className":12106,"ariaHidden":222},[221],[14,12108,12110,12114],{"className":12109},[226],[14,12111],{"className":12112,"style":12113},[230],"height:4.2em;vertical-align:-1.85em;",[14,12115,12117],{"className":12116},[235],[14,12118,12120,12193],{"className":12119},[9778],[14,12121,12123],{"className":12122},[10136],[14,12124,12126,12184],{"className":12125},[8996,8997],[14,12127,12129,12181],{"className":12128},[9001],[14,12130,12133,12149,12172],{"className":12131,"style":12132},[9005],"height:2.35em;",[14,12134,12136,12139],{"style":12135},"top:-4.51em;",[14,12137],{"className":12138,"style":9014},[9013],[14,12140,12142],{"className":12141},[235],[14,12143,12145],{"className":12144},[235],[14,12146,12148],{"className":12147},[235,9699],"requestSize",[14,12150,12152,12155],{"style":12151},"top:-3.01em;",[14,12153],{"className":12154,"style":9014},[9013],[14,12156,12158],{"className":12157},[235],[14,12159,12161,12165,12168],{"className":12160},[235],[14,12162,12164],{"className":12163},[235,9699],"PA",[14,12166,12016],{"className":12167},[239],[14,12169,12171],{"className":12170},[235,9699],"allocation",[14,12173,12175,12178],{"style":12174},"top:-1.51em;",[14,12176],{"className":12177,"style":9014},[9013],[14,12179],{"className":12180},[235],[14,12182,9058],{"className":12183},[9057],[14,12185,12187],{"className":12186},[9001],[14,12188,12191],{"className":12189,"style":12190},[9005],"height:1.85em;",[14,12192],{},[14,12194,12196],{"className":12195},[10229],[14,12197,12199,12426],{"className":12198},[8996,8997],[14,12200,12202,12423],{"className":12201},[9001],[14,12203,12205,12290,12397],{"className":12204,"style":12132},[9005],[14,12206,12207,12210],{"style":12135},[14,12208],{"className":12209,"style":9014},[9013],[14,12211,12213,12216,12219,12222,12225,12228,12234,12237,12240,12243,12246,12249,12252,12259,12262,12265,12268,12271,12277,12281,12284],{"className":12212},[235],[14,12214],{"className":12215},[235],[14,12217],{"className":12218,"style":9075},[239],[14,12220,988],{"className":12221},[9079],[14,12223],{"className":12224,"style":9075},[239],[14,12226,1711],{"className":12227},[235],[14,12229,12231],{"className":12230},[235],[14,12232,8968],{"className":12233},[9118],[14,12235,11774],{"className":12236},[235],[14,12238],{"className":12239,"style":240},[239],[14,12241,11380],{"className":12242},[244],[14,12244],{"className":12245,"style":240},[239],[14,12247,1202],{"className":12248},[235],[14,12250,12016],{"className":12251},[239],[14,12253,12255],{"className":12254},[235,122],[14,12256,12258],{"className":12257},[235],"bytes",[14,12260],{"className":12261,"style":9075},[239],[14,12263,988],{"className":12264},[9079],[14,12266],{"className":12267,"style":9075},[239],[14,12269,10003],{"className":12270},[235],[14,12272,12274],{"className":12273},[235],[14,12275,8968],{"className":12276},[9118],[14,12278,12280],{"className":12279},[235],"992",[14,12282,12016],{"className":12283},[239],[14,12285,12287],{"className":12286},[235,122],[14,12288,12258],{"className":12289},[235],[14,12291,12292,12295],{"style":12151},[14,12293],{"className":12294,"style":9014},[9013],[14,12296,12298,12301,12304,12307,12310,12314,12320,12324,12327,12330,12336,12339,12342,12345,12348,12351,12354,12357,12363,12366,12369,12372,12375,12378,12384,12388,12391],{"className":12297},[235],[14,12299],{"className":12300},[235],[14,12302],{"className":12303,"style":9075},[239],[14,12305,988],{"className":12306},[9079],[14,12308],{"className":12309,"style":9075},[239],[14,12311,12313],{"className":12312},[235],"49",[14,12315,12317],{"className":12316},[235],[14,12318,8968],{"className":12319},[9118],[14,12321,12323],{"className":12322},[235],"152",[14,12325,12016],{"className":12326},[239],[14,12328,9330],{"className":12329},[8988],[14,12331,12333],{"className":12332},[235,122],[14,12334,12056],{"className":12335},[235],[14,12337,8699],{"className":12338},[9071],[14,12340],{"className":12341,"style":240},[239],[14,12343,4432],{"className":12344},[244],[14,12346],{"className":12347,"style":240},[239],[14,12349,10003],{"className":12350},[235],[14,12352,12016],{"className":12353},[239],[14,12355,9330],{"className":12356},[8988],[14,12358,12360],{"className":12359},[235,122],[14,12361,12069],{"className":12362},[235],[14,12364,8699],{"className":12365},[9071],[14,12367],{"className":12368,"style":9075},[239],[14,12370,988],{"className":12371},[9079],[14,12373],{"className":12374,"style":9075},[239],[14,12376,12313],{"className":12377},[235],[14,12379,12381],{"className":12380},[235],[14,12382,8968],{"className":12383},[9118],[14,12385,12387],{"className":12386},[235],"184",[14,12389,12016],{"className":12390},[239],[14,12392,12394],{"className":12393},[235,122],[14,12395,12258],{"className":12396},[235],[14,12398,12399,12402],{"style":12174},[14,12400],{"className":12401,"style":9014},[9013],[14,12403,12405,12408,12411,12414,12417],{"className":12404},[235],[14,12406],{"className":12407},[235],[14,12409],{"className":12410,"style":9075},[239],[14,12412,12097],{"className":12413},[9079],[14,12415],{"className":12416,"style":9075},[239],[14,12418,12420],{"className":12419},[235,122],[14,12421,12100],{"className":12422},[235],[14,12424,9058],{"className":12425},[9057],[14,12427,12429],{"className":12428},[9001],[14,12430,12432],{"className":12431,"style":12190},[9005],[14,12433],{},[11,12435,12436],{},"This is not a 1.43B-vertex upload. The renderer sends a compact PaintOp stream backed by SHM:",[12438,12439],"diagram-sequence",{":steps":12440,":summary":12441,"left":9260,"right":12442},"[{\"arrow\":\"1) Inline: Payload+Remainder\",\"note\":\"Verb sum += 57,142\"},{\"arrow\":\"2) Upload 3.6 MB Noise Chunk\",\"note\":\"(Saved to PaintCache) Verb sum += 400,000\"},{\"arrow\":\"3) Draw 3,578 Cached Copies (Tiny IPC cache IDs)\",\"note\":\"Verb sum += 1.431B\"}]","[\"Total V = 1.43B\",\"(V - 2) * 3 -> 4,124\"]","GPU (Ganesh)",[11,12444,12445],{},"The noise path uses 200,000 move\u002Fline pairs to inflate the verb accumulator without generating real geometry (zero fan triangles). The actual overflow happens later during the allocation calculation: (V - 2) * 3. Because the geometry is cached, subsequent OOB write triggers only require a small IPC payload.",[11,12447,12448],{},"The 32,992-byte vertex request lands in bucket-57344. Skia's allocator rounds the request to 49,152 bytes (a power-of-two midpoint size), backing it with a GrCpuBuffer. This results in a 49,184-byte allocation, which PartitionAlloc bins to bucket-57344.",[12450,12451],"diagram-nested",{":after":12452,":children":12453,"label":12454,"size":12455},"[\"(8,160 bytes unused tail)\"]","[{\"label\":\"PartitionAlloc allocation\",\"size\":\"49,184 bytes\",\"before\":[\"GrCpuBuffer header (sizeof(GrCpuBuffer))\"],\"children\":[{\"label\":\"GrCpuBuffer staging data\",\"size\":\"49,152 bytes\",\"children\":[{\"label\":\"Wrapped Vertex Data\",\"size\":\"32,992 bytes\"}],\"after\":[\"(16,160 bytes of buffer slack)\"]}]}]","bucket-57344 slot","57,344 bytes",[8422,12457,12459],{"id":12458},"the-oob-geometry","The OOB geometry",[11,12461,12462],{},"To trigger the overflow, we decouple the allocated buffer size from the actual write extent by splitting the input path cascade into two distinct phases:",[8442,12464,12465,12471],{},[302,12466,12467,12470],{},[129,12468,12469],{},"Inflation (noise path)",": we use a path containing hundreds of thousands of verbs (move\u002Fline pairs) that produce zero triangles during tessellation. These verbs inflate the total verb accumulator (V).",[302,12472,12473,12476],{},[129,12474,12475],{},"Corruption (payload path)",": a hand-crafted path containing real triangles whose (x, y) vertex coordinates represent the exact byte values we want to write.",[11,12478,12479],{},"By placing the payload path at a specific position in the cascade, its OOB writes land on the adjacent victim's SkPathData structure, corrupting its pointers.",[37,12481,12483],{"id":12482},"why-skpath-is-the-victim","Why SkPath is the victim",[11,12485,12486],{},"To turn our OOB write into a useful arbitrary read\u002Fwrite primitive, we must find a \"victim\" data structure to overwrite in memory. We are hunting for a structure that satisfies three requirements:",[8442,12488,12489,12495,12501],{},[302,12490,12491,12494],{},[129,12492,12493],{},"Dynamic sizing",": the object must be dynamically sized so we can force it into the same PartitionAlloc bucket as our overflow source.",[302,12496,12497,12500],{},[129,12498,12499],{},"Unified allocation",": the object's pointer-bearing control header must reside in the exact same contiguous allocation as its raw payload. If they are split into separate allocations (like std::vector or SkBitmap), our OOB write will only reach the raw data buffer, leaving the control pointers untouched.",[302,12502,12503,12506],{},[129,12504,12505],{},"Observability",": overwriting the object's pointers must allow us to read arbitrary memory and leak the data back to the renderer (e.g., by having an observable side effect).",[11,12508,12509],{},"SkPath is a strong victim candidate because its underlying storage class, SkPathData, meets all three criteria.",[8422,12511,12513],{"id":12512},"constraint-1-bucket-and-span-matching-via-dynamic-sizing","Constraint 1: bucket and span matching via dynamic sizing",[11,12515,12516],{},"The victim needs a large, pointer-bearing allocation in the next single-slot reservation. The source is operator new(49184) in bucket-57344, so the victim is sized into bucket-57344 as well. The groom then controls the order of adjacent 64 KiB slot-span reservations inside the BRP pool.",[11,12518,12519],{},"SkPath has variable-sized internal storage governed by verb and point counts:",[117,12521,12524],{"className":12522,"code":12523,"language":122,"meta":125},[120],"SkPathData storage = header + (npts x 8) + verb\u002Fconic arrays\n",[29,12525,12523],{"__ignoreMap":125},[8422,12527,12529],{"id":12528},"constraint-2-contiguous-header-and-payload","Constraint 2: contiguous header and payload",[11,12531,12532],{},"We want to corrupt pointers. Variable size alone is insufficient. Objects like std::vector, SharedImage, or SkBitmap separate their pointer-bearing headers from their bulk data. Our OOB write only reaches the bulk data allocation, leaving the header pointers untouched in a separate bucket.",[11,12534,12535],{},"SkPath's storage allocates both the SkPathData header and the verbs\u002Fpoints arrays in a single contiguous block of memory.",[117,12537,12539],{"className":9308,"code":12538,"language":9310,"meta":125,"style":125},"\u002F\u002F third_party\u002Fskia\u002Fsrc\u002Fcore\u002FSkPathData.cpp\nsk_sp\u003CSkPathData> SkPathData::Alloc(size_t npts, size_t nvbs, ...) {\n    \u002F\u002F (Accumulator math calculates total = header + pts\n    \u002F\u002F + conics + verbs)\n    void* storage = ::operator new(*size);\n    return sk_sp\u003CSkPathData>(new (storage) SkPathData(...));\n}\n",[29,12540,12541,12546,12586,12591,12596,12624,12650],{"__ignoreMap":125},[14,12542,12543],{"class":475,"line":476},[14,12544,12545],{"class":557},"\u002F\u002F third_party\u002Fskia\u002Fsrc\u002Fcore\u002FSkPathData.cpp\n",[14,12547,12548,12551,12554,12557,12560,12562,12564,12567,12569,12572,12576,12578,12580,12583],{"class":475,"line":491},[14,12549,12550],{"class":483},"sk_sp",[14,12552,12553],{"class":487},"\u003C",[14,12555,12556],{"class":483},"SkPathData",[14,12558,12559],{"class":487},"> ",[14,12561,12556],{"class":483},[14,12563,9325],{"class":487},[14,12565,12566],{"class":483},"Alloc",[14,12568,9330],{"class":487},[14,12570,12571],{"class":479},"size_t",[14,12573,12575],{"class":12574},"s4XuR"," npts",[14,12577,428],{"class":487},[14,12579,12571],{"class":479},[14,12581,12582],{"class":12574}," nvbs",[14,12584,12585],{"class":487},", ...) {\n",[14,12587,12588],{"class":475,"line":500},[14,12589,12590],{"class":557},"    \u002F\u002F (Accumulator math calculates total = header + pts\n",[14,12592,12593],{"class":475,"line":508},[14,12594,12595],{"class":557},"    \u002F\u002F + conics + verbs)\n",[14,12597,12598,12601,12604,12606,12609,12612,12615,12617,12619,12622],{"class":475,"line":516},[14,12599,12600],{"class":479},"    void*",[14,12602,12603],{"class":487}," storage ",[14,12605,988],{"class":479},[14,12607,12608],{"class":487}," ::",[14,12610,12611],{"class":479},"operator",[14,12613,12614],{"class":483}," new",[14,12616,9330],{"class":487},[14,12618,281],{"class":479},[14,12620,12621],{"class":12574},"size",[14,12623,4442],{"class":487},[14,12625,12626,12629,12632,12634,12636,12639,12642,12645,12647],{"class":475,"line":524},[14,12627,12628],{"class":479},"    return",[14,12630,12631],{"class":483}," sk_sp",[14,12633,12553],{"class":487},[14,12635,12556],{"class":483},[14,12637,12638],{"class":487},">(",[14,12640,12641],{"class":479},"new",[14,12643,12644],{"class":487}," (storage) ",[14,12646,12556],{"class":483},[14,12648,12649],{"class":487},"(...));\n",[14,12651,12652],{"class":475,"line":546},[14,12653,9413],{"class":487},[11,12655,12656],{},"The header, containing the fPoints\u002FfVerbs pointers, is fused to the payload.",[8422,12658,12660],{"id":12659},"constraint-3-observable-side-effect","Constraint 3: observable side effect",[11,12662,12663],{},"The victim also needs post-corruption observability. The GPU process is almost a one-way data sink: the renderer issues draw commands; the GPU returns rendered pixels and very little else.",[11,12665,12666],{},"SkPath is useful because it gets rendered to pixels. Once we corrupt its fPoints pointer to alias another memory location, asking the GPU to draw the path reads bytes from that memory location, interprets them as floats, transforms them through the canvas matrix, and rasterizes them. The renderer can then call ReadbackARGB and get the pixels.",[85,12668,12669],{},[11,12670,12671],{},"How do we recover the pointer from pixels though?",[11,12673,12674],{},"But first, we must work out the tedious mechanical details: how to groom the heap so we can reach the victim in the first place.",[37,12676,12678],{"id":12677},"the-forge-primitive-write","The forge primitive (write)",[11,12680,12681],{},"Our goal is to build a write primitive, forge(W, V, AF). A single execution corrupts the victim SkPathData header with three pointers:",[299,12683,12684,12690,12696],{},[302,12685,12686,12689],{},[129,12687,12688],{},"W (fPoints)",": the address from which Skia reads coordinate data when drawing the path.",[302,12691,12692,12695],{},[129,12693,12694],{},"V (fVerbs)",": the address from which Skia reads verbs. We point this to a {Move, Line} sequence so the coordinates are consumed.",[302,12697,12698,12701],{},[129,12699,12700],{},"AF (listener.data)",": the address of a callback list. If the ownership bit is set, evicting the path calls sk_free(AF).",[11,12703,12704],{},"Because the GPU must iterate 1.43 billion verbs to trigger the overflow, each forge takes ~3.5 seconds. The rest of the exploit must therefore be designed to use as few writes as possible.",[8422,12706,12708],{"id":12707},"the-heap-spray-groom-pinunpin","The heap-spray groom (\"pin\u002Funpin\")",[11,12710,12711],{},"To corrupt the victim, we must force the allocator to place our overflow buffer immediately before the victim in memory. We achieve this in three steps:",[8442,12713,12714,12720,12726],{},[302,12715,12716,12719],{},[129,12717,12718],{},"Pin",": fill empty space, place the victim, and add trailing cushions.",[302,12721,12722,12725],{},[129,12723,12724],{},"Unpin",": free the allocation directly preceding the victim to leave a vacancy.",[302,12727,12728,12731],{},[129,12729,12730],{},"Reclaim",": allocate the overflow buffer in the vacancy and trigger the OOB write.",[11,12733,12734],{},"More concretely:",[10962,12736],{":items":12737,"title":12738},"[{\"label\":\"TC[94] (Pre-slot padding)\"},{\"label\":\"TC[95] (The \\\"Pin\\\" slot)\"},{\"label\":\"SkPathData (The \\\"Victim\\\")\",\"highlight\":\"victim\"},{\"label\":\"TC[96] (Cushion landing zone)\"}]","Step 1: The Pin",[11,12740,12741],{},"We allocate 96 entries (TC[0..95]) to fill active heap slots. Right after TC[95], we allocate the victim SkPathData. We then allocate 64 cushion entries (TC[96..159]) so the victim does not land next to unmapped memory. This pins the victim directly between TC[95] and TC[96].",[10962,12743],{":items":12744,"title":12745},"[{\"label\":\"TC[94] (Pre-slot padding)\"},{\"label\":\"[ EMPTY HOLE ]\",\"note\":\"Target\",\"highlight\":\"empty\"},{\"label\":\"SkPathData (The \\\"Victim\\\")\",\"highlight\":\"victim\"},{\"label\":\"TC[96] (Cushion landing zone)\"}]","Step 2: The Unpin",[11,12747,12748],{},"We delete TC[95]. Because this size class allocates one object per page block, freeing TC[95] leaves its slot vacant while keeping the adjacent victim in place.",[10962,12750],{":items":12751,"title":12752},"[{\"label\":\"TC[94] (Pre-slot padding)\"},{\"label\":\"[ Overflow Geometry ]\",\"note\":\"cascades down\"},{\"label\":\"SkPathData (The \\\"Victim\\\")\",\"note\":\"Corrupts header!\",\"highlight\":\"victim\"},{\"label\":\"TC[96] (Cushion landing zone)\"}]","Step 3: Reallocation & Overflow",[11,12754,12755],{},"We trigger the path overflow. Skia requests a vertex buffer of the same size class, which the allocator places in the vacant TC[95] slot. The overflow write cascades directly into the adjacent victim.",[11,12757,12758],{},"Okay, I lied about the three easy-peasy steps for heap grooming. In reality, because the visual read (see the c1read primitive below) requires repeating this groom dozens of times, we need one final step to maintain stability:",[10962,12760],{":items":12761,"title":12762},"[{\"label\":\"TC[94] (Pre-slot padding)\"},{\"label\":\"[ Re-secured Pin Slot ]\",\"note\":\"Repinned\",\"highlight\":\"target\"},{\"label\":\"SkPathData (The \\\"Victim\\\")\",\"highlight\":\"victim\"},{\"label\":\"TC[96] (Cushion landing zone)\"}]","Step 4: The Re-pin",[11,12764,12765],{},"To do this, we delete the pin, trigger the overflow, and create a new pin all in one command batch. The moment the overflow buffer is freed, the new pin re-occupies the slot, preventing other allocations from stealing it before our next write.",[11,12767,12768],{},"Note: these counts of 96 and 64 are engineering choices.",[8422,12770,12772],{"id":12771},"the-dual-use-corruption","The dual-use corruption",[11,12774,12775],{},"We want to achieve two distinct goals with our corruption: memory reading (for the walk) and arbitrary freeing (for the hijack).",[8442,12777,12778,12784],{},[302,12779,12780,12783],{},[129,12781,12782],{},"The read",": to read memory, we corrupt the points and verbs arrays in SkPathData. We set points = W (the memory address to read) and verbs = V (pointing to a {kMove, kLine} sequence). When Skia draws the path, it reads the bytes at W as float coordinates and draws a line, rendering the memory to pixels.",[302,12785,12786,12789],{},[129,12787,12788],{},"The free",": to free memory, we corrupt the listener array. We set listener.data = AF (the address to free), listener.size = 0, and listener.own = 1. When the path is evicted from the cache, Skia's destructor cleans up the listener array and calls sk_free(listener.data).",[11,12791,12792],{},"Because these fields occupy different offsets within the SkPathData structure, we can do both at the same time:",[117,12794,12797],{"className":12795,"code":12796,"language":122,"meta":125},[120],"SkPathData\n  refcount = 1\n  listener.data = AF   \u003C--- Address to free\n  listener.size = 0\n  listener.own  = 1\n  points        = W    \u003C--- Memory address to read\n  points.count  = 2\n  conics        = 0\n  verbs         = V    \u003C--- Points to {kMove, kLine}\n  verbs.count   = 2\n",[29,12798,12796],{"__ignoreMap":125},[11,12800,12801],{},"A single forge(W, V, AF) can configure both primitives, saving us from performing separate heap grooms.",[11,12803,12804],{},"With the ability to write arbitrary values into the victim's control structure and trigger arbitrary frees, we now need a way to read arbitrary memory so we can inspect the GPU heap.",[37,12806,12808],{"id":12807},"the-c1read-primitive-read","The c1read primitive (read)",[11,12810,12811],{},"To read memory, we must handle the fact that the GPU is a data sink that draws pixels but does not return raw memory. The visual read primitive (c1read) achieves this.",[11,12813,12814],{},"We do not have a direct memory read, but we have:",[299,12816,12817,12820],{},[302,12818,12819],{},"A write (forge) to overwrite the victim's points pointer (fPoints).",[302,12821,12822],{},"An IPC command (ReadbackARGB) to copy rendered pixels back to the renderer.",[11,12824,12825],{},"If we overwrite the victim path's points pointer with the target memory address W, and ask Skia to draw the path, Skia dereferences W, reads the bytes there as coordinate floats, and renders a line. Scanning the resulting pixels reconstructs the original float value, recovering the memory bytes stored at W.",[11,12827,12828],{},"When Skia draws the path, it translates the coordinate values (floats) to actual pixel coordinates on our 640-pixel wide canvas:",[11,12830,12831],{},[14,12832,12834,12872],{"className":12833},[188],[14,12835,12837],{"className":12836},[192],[194,12838,12839],{"xmlns":196},[198,12840,12841,12869],{},[201,12842,12843,12850,12852,12858,12861,12863],{},[9559,12844,12845,12848],{},[8885,12846,12847],{},"D",[8885,12849,8887],{},[208,12851,988],{},[9559,12853,12854,12856],{},[8885,12855,8776],{},[8885,12857,8887],{},[8885,12859,12860],{},"X",[208,12862,4432],{},[9559,12864,12865,12867],{},[8885,12866,8845],{},[8885,12868,8887],{},[214,12870,12871],{"encoding":216},"D_x = S_x X + T_x",[14,12873,12875,12933,12994],{"className":12874,"ariaHidden":222},[221],[14,12876,12878,12881,12924,12927,12930],{"className":12877},[226],[14,12879],{"className":12880,"style":9715},[230],[14,12882,12884,12888],{"className":12883},[235],[14,12885,12847],{"className":12886,"style":12887},[235,8903],"margin-right:0.0278em;",[14,12889,12891],{"className":12890},[9517],[14,12892,12894,12916],{"className":12893},[8996,8997],[14,12895,12897,12913],{"className":12896},[9001],[14,12898,12901],{"className":12899,"style":12900},[9005],"height:0.1514em;",[14,12902,12904,12907],{"style":12903},"top:-2.55em;margin-left:-0.0278em;margin-right:0.05em;",[14,12905],{"className":12906,"style":9533},[9013],[14,12908,12910],{"className":12909},[9018,9019,9020,9021],[14,12911,8887],{"className":12912},[235,8903,9021],[14,12914,9058],{"className":12915},[9057],[14,12917,12919],{"className":12918},[9001],[14,12920,12922],{"className":12921,"style":9630},[9005],[14,12923],{},[14,12925],{"className":12926,"style":9075},[239],[14,12928,988],{"className":12929},[9079],[14,12931],{"className":12932,"style":9075},[239],[14,12934,12936,12939,12981,12985,12988,12991],{"className":12935},[226],[14,12937],{"className":12938,"style":9715},[230],[14,12940,12942,12946],{"className":12941},[235],[14,12943,8776],{"className":12944,"style":12945},[235,8903],"margin-right:0.0576em;",[14,12947,12949],{"className":12948},[9517],[14,12950,12952,12973],{"className":12951},[8996,8997],[14,12953,12955,12970],{"className":12954},[9001],[14,12956,12958],{"className":12957,"style":12900},[9005],[14,12959,12961,12964],{"style":12960},"top:-2.55em;margin-left:-0.0576em;margin-right:0.05em;",[14,12962],{"className":12963,"style":9533},[9013],[14,12965,12967],{"className":12966},[9018,9019,9020,9021],[14,12968,8887],{"className":12969},[235,8903,9021],[14,12971,9058],{"className":12972},[9057],[14,12974,12976],{"className":12975},[9001],[14,12977,12979],{"className":12978,"style":9630},[9005],[14,12980],{},[14,12982,12860],{"className":12983,"style":12984},[235,8903],"margin-right:0.0785em;",[14,12986],{"className":12987,"style":240},[239],[14,12989,4432],{"className":12990},[244],[14,12992],{"className":12993,"style":240},[239],[14,12995,12997,13000],{"className":12996},[226],[14,12998],{"className":12999,"style":9715},[230],[14,13001,13003,13007],{"className":13002},[235],[14,13004,8845],{"className":13005,"style":13006},[235,8903],"margin-right:0.1389em;",[14,13008,13010],{"className":13009},[9517],[14,13011,13013,13034],{"className":13012},[8996,8997],[14,13014,13016,13031],{"className":13015},[9001],[14,13017,13019],{"className":13018,"style":12900},[9005],[14,13020,13022,13025],{"style":13021},"top:-2.55em;margin-left:-0.1389em;margin-right:0.05em;",[14,13023],{"className":13024,"style":9533},[9013],[14,13026,13028],{"className":13027},[9018,9019,9020,9021],[14,13029,8887],{"className":13030},[235,8903,9021],[14,13032,9058],{"className":13033},[9057],[14,13035,13037],{"className":13036},[9001],[14,13038,13040],{"className":13039,"style":9630},[9005],[14,13041],{},[11,13043,13044],{},"If we don't scale the drawing, most arbitrary memory values (read as floats) will be far too large or too small to land on our screen, leaving the line completely invisible. Even if a coordinate does land on our canvas, a single 640-pixel screen can only show us a rough estimate of the value, not the precise 32-bit float.",[11,13046,13047,13048,13118,13119,13189],{},"To find the exact value of the float, we zoom in (scale ",[14,13049,13051,13069],{"className":13050},[188],[14,13052,13054],{"className":13053},[192],[194,13055,13056],{"xmlns":196},[198,13057,13058,13066],{},[201,13059,13060],{},[9559,13061,13062,13064],{},[8885,13063,8776],{},[8885,13065,8887],{},[214,13067,13068],{"encoding":216},"S_x",[14,13070,13072],{"className":13071,"ariaHidden":222},[221],[14,13073,13075,13078],{"className":13074},[226],[14,13076],{"className":13077,"style":9715},[230],[14,13079,13081,13084],{"className":13080},[235],[14,13082,8776],{"className":13083,"style":12945},[235,8903],[14,13085,13087],{"className":13086},[9517],[14,13088,13090,13110],{"className":13089},[8996,8997],[14,13091,13093,13107],{"className":13092},[9001],[14,13094,13096],{"className":13095,"style":12900},[9005],[14,13097,13098,13101],{"style":12960},[14,13099],{"className":13100,"style":9533},[9013],[14,13102,13104],{"className":13103},[9018,9019,9020,9021],[14,13105,8887],{"className":13106},[235,8903,9021],[14,13108,9058],{"className":13109},[9057],[14,13111,13113],{"className":13112},[9001],[14,13114,13116],{"className":13115,"style":9630},[9005],[14,13117],{},") and shift the drawing (translate ",[14,13120,13122,13140],{"className":13121},[188],[14,13123,13125],{"className":13124},[192],[194,13126,13127],{"xmlns":196},[198,13128,13129,13137],{},[201,13130,13131],{},[9559,13132,13133,13135],{},[8885,13134,8845],{},[8885,13136,8887],{},[214,13138,13139],{"encoding":216},"T_x",[14,13141,13143],{"className":13142,"ariaHidden":222},[221],[14,13144,13146,13149],{"className":13145},[226],[14,13147],{"className":13148,"style":9715},[230],[14,13150,13152,13155],{"className":13151},[235],[14,13153,8845],{"className":13154,"style":13006},[235,8903],[14,13156,13158],{"className":13157},[9517],[14,13159,13161,13181],{"className":13160},[8996,8997],[14,13162,13164,13178],{"className":13163},[9001],[14,13165,13167],{"className":13166,"style":12900},[9005],[14,13168,13169,13172],{"style":13021},[14,13170],{"className":13171,"style":9533},[9013],[14,13173,13175],{"className":13174},[9018,9019,9020,9021],[14,13176,8887],{"className":13177},[235,8903,9021],[14,13179,9058],{"className":13180},[9057],[14,13182,13184],{"className":13183},[9001],[14,13185,13187],{"className":13186,"style":9630},[9005],[14,13188],{},") over multiple drawing attempts. By progressively magnifying the line and adjusting its position, we can piece together its precise bits. This is our zoom search ladder.",[8422,13191,13193],{"id":13192},"the-zoom-search-and-refinement","The zoom search and refinement",[11,13195,13196],{},"To resolve the float X using the zoom search ladder, we first assume a 1-dimensional coordinate space where the screen position is:",[11,13198,13199],{},[14,13200,13202,13237],{"className":13201},[188],[14,13203,13205],{"className":13204},[192],[194,13206,13207],{"xmlns":196},[198,13208,13209,13235],{},[201,13210,13211,13217,13219,13225,13227,13229],{},[9559,13212,13213,13215],{},[8885,13214,12847],{},[8885,13216,8887],{},[208,13218,988],{},[9559,13220,13221,13223],{},[8885,13222,8776],{},[8885,13224,8887],{},[8885,13226,12860],{},[208,13228,4432],{},[9559,13230,13231,13233],{},[8885,13232,8845],{},[8885,13234,8887],{},[214,13236,12871],{"encoding":216},[14,13238,13240,13295,13353],{"className":13239,"ariaHidden":222},[221],[14,13241,13243,13246,13286,13289,13292],{"className":13242},[226],[14,13244],{"className":13245,"style":9715},[230],[14,13247,13249,13252],{"className":13248},[235],[14,13250,12847],{"className":13251,"style":12887},[235,8903],[14,13253,13255],{"className":13254},[9517],[14,13256,13258,13278],{"className":13257},[8996,8997],[14,13259,13261,13275],{"className":13260},[9001],[14,13262,13264],{"className":13263,"style":12900},[9005],[14,13265,13266,13269],{"style":12903},[14,13267],{"className":13268,"style":9533},[9013],[14,13270,13272],{"className":13271},[9018,9019,9020,9021],[14,13273,8887],{"className":13274},[235,8903,9021],[14,13276,9058],{"className":13277},[9057],[14,13279,13281],{"className":13280},[9001],[14,13282,13284],{"className":13283,"style":9630},[9005],[14,13285],{},[14,13287],{"className":13288,"style":9075},[239],[14,13290,988],{"className":13291},[9079],[14,13293],{"className":13294,"style":9075},[239],[14,13296,13298,13301,13341,13344,13347,13350],{"className":13297},[226],[14,13299],{"className":13300,"style":9715},[230],[14,13302,13304,13307],{"className":13303},[235],[14,13305,8776],{"className":13306,"style":12945},[235,8903],[14,13308,13310],{"className":13309},[9517],[14,13311,13313,13333],{"className":13312},[8996,8997],[14,13314,13316,13330],{"className":13315},[9001],[14,13317,13319],{"className":13318,"style":12900},[9005],[14,13320,13321,13324],{"style":12960},[14,13322],{"className":13323,"style":9533},[9013],[14,13325,13327],{"className":13326},[9018,9019,9020,9021],[14,13328,8887],{"className":13329},[235,8903,9021],[14,13331,9058],{"className":13332},[9057],[14,13334,13336],{"className":13335},[9001],[14,13337,13339],{"className":13338,"style":9630},[9005],[14,13340],{},[14,13342,12860],{"className":13343,"style":12984},[235,8903],[14,13345],{"className":13346,"style":240},[239],[14,13348,4432],{"className":13349},[244],[14,13351],{"className":13352,"style":240},[239],[14,13354,13356,13359],{"className":13355},[226],[14,13357],{"className":13358,"style":9715},[230],[14,13360,13362,13365],{"className":13361},[235],[14,13363,8845],{"className":13364,"style":13006},[235,8903],[14,13366,13368],{"className":13367},[9517],[14,13369,13371,13391],{"className":13370},[8996,8997],[14,13372,13374,13388],{"className":13373},[9001],[14,13375,13377],{"className":13376,"style":12900},[9005],[14,13378,13379,13382],{"style":13021},[14,13380],{"className":13381,"style":9533},[9013],[14,13383,13385],{"className":13384},[9018,9019,9020,9021],[14,13386,8887],{"className":13387},[235,8903,9021],[14,13389,9058],{"className":13390},[9057],[14,13392,13394],{"className":13393},[9001],[14,13395,13397],{"className":13396,"style":9630},[9005],[14,13398],{},[11,13400,13401],{},"We must coordinate our probes to handle two main constraints: the low-resolution canvas and the risk of the coordinate mapping off-screen.",[11,13403,13404],{},"Our intuition to solve this 1D problem is structured as follows:",[8442,13406,13407,13413,13489,13495],{},[302,13408,13409,13412],{},[129,13410,13411],{},"Low-resolution channel",": a 640-pixel canvas provides only about 9 bits of resolution. We cannot read a 32-bit float directly.",[302,13414,13415,13418,13419,13488],{},[129,13416,13417],{},"Magnification",": we must zoom in (scale up ",[14,13420,13422,13439],{"className":13421},[188],[14,13423,13425],{"className":13424},[192],[194,13426,13427],{"xmlns":196},[198,13428,13429,13437],{},[201,13430,13431],{},[9559,13432,13433,13435],{},[8885,13434,8776],{},[8885,13436,8887],{},[214,13438,13068],{"encoding":216},[14,13440,13442],{"className":13441,"ariaHidden":222},[221],[14,13443,13445,13448],{"className":13444},[226],[14,13446],{"className":13447,"style":9715},[230],[14,13449,13451,13454],{"className":13450},[235],[14,13452,8776],{"className":13453,"style":12945},[235,8903],[14,13455,13457],{"className":13456},[9517],[14,13458,13460,13480],{"className":13459},[8996,8997],[14,13461,13463,13477],{"className":13462},[9001],[14,13464,13466],{"className":13465,"style":12900},[9005],[14,13467,13468,13471],{"style":12960},[14,13469],{"className":13470,"style":9533},[9013],[14,13472,13474],{"className":13473},[9018,9019,9020,9021],[14,13475,8887],{"className":13476},[235,8903,9021],[14,13478,9058],{"className":13479},[9057],[14,13481,13483],{"className":13482},[9001],[14,13484,13486],{"className":13485,"style":9630},[9005],[14,13487],{},") to expose the fine details of the float's mantissa.",[302,13490,13491,13494],{},[129,13492,13493],{},"Re-centering",": zooming in pushes the coordinate off-screen unless we center the viewport. We shift the viewport by subtracting our current estimate (est) of the float, drawing the residual error (X − est) scaled up.",[302,13496,13497,13500,13501,13570,13571,13646,13647,13872,13873,14073,14074,8498,14148,14307],{},[129,13498,13499],{},"Exact arithmetic",": we choose scale ",[14,13502,13504,13521],{"className":13503},[188],[14,13505,13507],{"className":13506},[192],[194,13508,13509],{"xmlns":196},[198,13510,13511,13519],{},[201,13512,13513],{},[9559,13514,13515,13517],{},[8885,13516,8776],{},[8885,13518,8887],{},[214,13520,13068],{"encoding":216},[14,13522,13524],{"className":13523,"ariaHidden":222},[221],[14,13525,13527,13530],{"className":13526},[226],[14,13528],{"className":13529,"style":9715},[230],[14,13531,13533,13536],{"className":13532},[235],[14,13534,8776],{"className":13535,"style":12945},[235,8903],[14,13537,13539],{"className":13538},[9517],[14,13540,13542,13562],{"className":13541},[8996,8997],[14,13543,13545,13559],{"className":13544},[9001],[14,13546,13548],{"className":13547,"style":12900},[9005],[14,13549,13550,13553],{"style":12960},[14,13551],{"className":13552,"style":9533},[9013],[14,13554,13556],{"className":13555},[9018,9019,9020,9021],[14,13557,8887],{"className":13558},[235,8903,9021],[14,13560,9058],{"className":13561},[9057],[14,13563,13565],{"className":13564},[9001],[14,13566,13568],{"className":13567,"style":9630},[9005],[14,13569],{}," to be a power of 2, so multiplying ",[14,13572,13574,13594],{"className":13573},[188],[14,13575,13577],{"className":13576},[192],[194,13578,13579],{"xmlns":196},[198,13580,13581,13591],{},[201,13582,13583,13589],{},[9559,13584,13585,13587],{},[8885,13586,8776],{},[8885,13588,8887],{},[8885,13590,12860],{},[214,13592,13593],{"encoding":216},"S_x X",[14,13595,13597],{"className":13596,"ariaHidden":222},[221],[14,13598,13600,13603,13643],{"className":13599},[226],[14,13601],{"className":13602,"style":9715},[230],[14,13604,13606,13609],{"className":13605},[235],[14,13607,8776],{"className":13608,"style":12945},[235,8903],[14,13610,13612],{"className":13611},[9517],[14,13613,13615,13635],{"className":13614},[8996,8997],[14,13616,13618,13632],{"className":13617},[9001],[14,13619,13621],{"className":13620,"style":12900},[9005],[14,13622,13623,13626],{"style":12960},[14,13624],{"className":13625,"style":9533},[9013],[14,13627,13629],{"className":13628},[9018,9019,9020,9021],[14,13630,8887],{"className":13631},[235,8903,9021],[14,13633,9058],{"className":13634},[9057],[14,13636,13638],{"className":13637},[9001],[14,13639,13641],{"className":13640,"style":9630},[9005],[14,13642],{},[14,13644,12860],{"className":13645,"style":12984},[235,8903]," only shifts the exponent without rounding the mantissa. We precompute ",[14,13648,13650,13689],{"className":13649},[188],[14,13651,13653],{"className":13652},[192],[194,13654,13655],{"xmlns":196},[198,13656,13657,13686],{},[201,13658,13659,13665,13667,13673,13675,13678,13680],{},[9559,13660,13661,13663],{},[8885,13662,8845],{},[8885,13664,8887],{},[208,13666,988],{},[9559,13668,13669,13671],{},[8885,13670,10045],{},[204,13672,540],{},[208,13674,9136],{},[9562,13676,13677],{},"est",[208,13679,11380],{},[9559,13681,13682,13684],{},[8885,13683,8776],{},[8885,13685,8887],{},[214,13687,13688],{"encoding":216},"T_x = c_0 - \\text{est} \\cdot S_x",[14,13690,13692,13747,13804,13826],{"className":13691,"ariaHidden":222},[221],[14,13693,13695,13698,13738,13741,13744],{"className":13694},[226],[14,13696],{"className":13697,"style":9715},[230],[14,13699,13701,13704],{"className":13700},[235],[14,13702,8845],{"className":13703,"style":13006},[235,8903],[14,13705,13707],{"className":13706},[9517],[14,13708,13710,13730],{"className":13709},[8996,8997],[14,13711,13713,13727],{"className":13712},[9001],[14,13714,13716],{"className":13715,"style":12900},[9005],[14,13717,13718,13721],{"style":13021},[14,13719],{"className":13720,"style":9533},[9013],[14,13722,13724],{"className":13723},[9018,9019,9020,9021],[14,13725,8887],{"className":13726},[235,8903,9021],[14,13728,9058],{"className":13729},[9057],[14,13731,13733],{"className":13732},[9001],[14,13734,13736],{"className":13735,"style":9630},[9005],[14,13737],{},[14,13739],{"className":13740,"style":9075},[239],[14,13742,988],{"className":13743},[9079],[14,13745],{"className":13746,"style":9075},[239],[14,13748,13750,13754,13795,13798,13801],{"className":13749},[226],[14,13751],{"className":13752,"style":13753},[230],"height:0.7333em;vertical-align:-0.15em;",[14,13755,13757,13760],{"className":13756},[235],[14,13758,10045],{"className":13759},[235,8903],[14,13761,13763],{"className":13762},[9517],[14,13764,13766,13787],{"className":13765},[8996,8997],[14,13767,13769,13784],{"className":13768},[9001],[14,13770,13772],{"className":13771,"style":9605},[9005],[14,13773,13775,13778],{"style":13774},"top:-2.55em;margin-left:0em;margin-right:0.05em;",[14,13776],{"className":13777,"style":9533},[9013],[14,13779,13781],{"className":13780},[9018,9019,9020,9021],[14,13782,540],{"className":13783},[235,9021],[14,13785,9058],{"className":13786},[9057],[14,13788,13790],{"className":13789},[9001],[14,13791,13793],{"className":13792,"style":9630},[9005],[14,13794],{},[14,13796],{"className":13797,"style":240},[239],[14,13799,9136],{"className":13800},[244],[14,13802],{"className":13803,"style":240},[239],[14,13805,13807,13811,13817,13820,13823],{"className":13806},[226],[14,13808],{"className":13809,"style":13810},[230],"height:0.6151em;",[14,13812,13814],{"className":13813},[235,122],[14,13815,13677],{"className":13816},[235],[14,13818],{"className":13819,"style":240},[239],[14,13821,11380],{"className":13822},[244],[14,13824],{"className":13825,"style":240},[239],[14,13827,13829,13832],{"className":13828},[226],[14,13830],{"className":13831,"style":9715},[230],[14,13833,13835,13838],{"className":13834},[235],[14,13836,8776],{"className":13837,"style":12945},[235,8903],[14,13839,13841],{"className":13840},[9517],[14,13842,13844,13864],{"className":13843},[8996,8997],[14,13845,13847,13861],{"className":13846},[9001],[14,13848,13850],{"className":13849,"style":12900},[9005],[14,13851,13852,13855],{"style":12960},[14,13853],{"className":13854,"style":9533},[9013],[14,13856,13858],{"className":13857},[9018,9019,9020,9021],[14,13859,8887],{"className":13860},[235,8903,9021],[14,13862,9058],{"className":13863},[9057],[14,13865,13867],{"className":13866},[9001],[14,13868,13870],{"className":13869,"style":9630},[9005],[14,13871],{}," in JavaScript. When the GPU calculates ",[14,13874,13876,13911],{"className":13875},[188],[14,13877,13879],{"className":13878},[192],[194,13880,13881],{"xmlns":196},[198,13882,13883,13909],{},[201,13884,13885,13891,13893,13899,13901,13903],{},[9559,13886,13887,13889],{},[8885,13888,12847],{},[8885,13890,8887],{},[208,13892,988],{},[9559,13894,13895,13897],{},[8885,13896,8776],{},[8885,13898,8887],{},[8885,13900,12860],{},[208,13902,4432],{},[9559,13904,13905,13907],{},[8885,13906,8845],{},[8885,13908,8887],{},[214,13910,12871],{"encoding":216},[14,13912,13914,13969,14027],{"className":13913,"ariaHidden":222},[221],[14,13915,13917,13920,13960,13963,13966],{"className":13916},[226],[14,13918],{"className":13919,"style":9715},[230],[14,13921,13923,13926],{"className":13922},[235],[14,13924,12847],{"className":13925,"style":12887},[235,8903],[14,13927,13929],{"className":13928},[9517],[14,13930,13932,13952],{"className":13931},[8996,8997],[14,13933,13935,13949],{"className":13934},[9001],[14,13936,13938],{"className":13937,"style":12900},[9005],[14,13939,13940,13943],{"style":12903},[14,13941],{"className":13942,"style":9533},[9013],[14,13944,13946],{"className":13945},[9018,9019,9020,9021],[14,13947,8887],{"className":13948},[235,8903,9021],[14,13950,9058],{"className":13951},[9057],[14,13953,13955],{"className":13954},[9001],[14,13956,13958],{"className":13957,"style":9630},[9005],[14,13959],{},[14,13961],{"className":13962,"style":9075},[239],[14,13964,988],{"className":13965},[9079],[14,13967],{"className":13968,"style":9075},[239],[14,13970,13972,13975,14015,14018,14021,14024],{"className":13971},[226],[14,13973],{"className":13974,"style":9715},[230],[14,13976,13978,13981],{"className":13977},[235],[14,13979,8776],{"className":13980,"style":12945},[235,8903],[14,13982,13984],{"className":13983},[9517],[14,13985,13987,14007],{"className":13986},[8996,8997],[14,13988,13990,14004],{"className":13989},[9001],[14,13991,13993],{"className":13992,"style":12900},[9005],[14,13994,13995,13998],{"style":12960},[14,13996],{"className":13997,"style":9533},[9013],[14,13999,14001],{"className":14000},[9018,9019,9020,9021],[14,14002,8887],{"className":14003},[235,8903,9021],[14,14005,9058],{"className":14006},[9057],[14,14008,14010],{"className":14009},[9001],[14,14011,14013],{"className":14012,"style":9630},[9005],[14,14014],{},[14,14016,12860],{"className":14017,"style":12984},[235,8903],[14,14019],{"className":14020,"style":240},[239],[14,14022,4432],{"className":14023},[244],[14,14025],{"className":14026,"style":240},[239],[14,14028,14030,14033],{"className":14029},[226],[14,14031],{"className":14032,"style":9715},[230],[14,14034,14036,14039],{"className":14035},[235],[14,14037,8845],{"className":14038,"style":13006},[235,8903],[14,14040,14042],{"className":14041},[9517],[14,14043,14045,14065],{"className":14044},[8996,8997],[14,14046,14048,14062],{"className":14047},[9001],[14,14049,14051],{"className":14050,"style":12900},[9005],[14,14052,14053,14056],{"style":13021},[14,14054],{"className":14055,"style":9533},[9013],[14,14057,14059],{"className":14058},[9018,9019,9020,9021],[14,14060,8887],{"className":14061},[235,8903,9021],[14,14063,9058],{"className":14064},[9057],[14,14066,14068],{"className":14067},[9001],[14,14069,14071],{"className":14070,"style":9630},[9005],[14,14072],{},", the addition behaves as a subtraction between two values of similar magnitude (",[14,14075,14077,14096],{"className":14076},[188],[14,14078,14080],{"className":14079},[192],[194,14081,14082],{"xmlns":196},[198,14083,14084,14094],{},[201,14085,14086,14092],{},[9559,14087,14088,14090],{},[8885,14089,8776],{},[8885,14091,8887],{},[8885,14093,12860],{},[214,14095,13593],{"encoding":216},[14,14097,14099],{"className":14098,"ariaHidden":222},[221],[14,14100,14102,14105,14145],{"className":14101},[226],[14,14103],{"className":14104,"style":9715},[230],[14,14106,14108,14111],{"className":14107},[235],[14,14109,8776],{"className":14110,"style":12945},[235,8903],[14,14112,14114],{"className":14113},[9517],[14,14115,14117,14137],{"className":14116},[8996,8997],[14,14118,14120,14134],{"className":14119},[9001],[14,14121,14123],{"className":14122,"style":12900},[9005],[14,14124,14125,14128],{"style":12960},[14,14126],{"className":14127,"style":9533},[9013],[14,14129,14131],{"className":14130},[9018,9019,9020,9021],[14,14132,8887],{"className":14133},[235,8903,9021],[14,14135,9058],{"className":14136},[9057],[14,14138,14140],{"className":14139},[9001],[14,14141,14143],{"className":14142,"style":9630},[9005],[14,14144],{},[14,14146,12860],{"className":14147,"style":12984},[235,8903],[14,14149,14151,14181],{"className":14150},[188],[14,14152,14154],{"className":14153},[192],[194,14155,14156],{"xmlns":196},[198,14157,14158,14178],{},[201,14159,14160,14162,14164,14170,14172],{},[9562,14161,13677],{},[208,14163,11380],{},[9559,14165,14166,14168],{},[8885,14167,8776],{},[8885,14169,8887],{},[208,14171,9136],{},[9559,14173,14174,14176],{},[8885,14175,10045],{},[204,14177,540],{},[214,14179,14180],{"encoding":216},"\\text{est} \\cdot S_x - c_0",[14,14182,14184,14205,14260],{"className":14183,"ariaHidden":222},[221],[14,14185,14187,14190,14196,14199,14202],{"className":14186},[226],[14,14188],{"className":14189,"style":13810},[230],[14,14191,14193],{"className":14192},[235,122],[14,14194,13677],{"className":14195},[235],[14,14197],{"className":14198,"style":240},[239],[14,14200,11380],{"className":14201},[244],[14,14203],{"className":14204,"style":240},[239],[14,14206,14208,14211,14251,14254,14257],{"className":14207},[226],[14,14209],{"className":14210,"style":9715},[230],[14,14212,14214,14217],{"className":14213},[235],[14,14215,8776],{"className":14216,"style":12945},[235,8903],[14,14218,14220],{"className":14219},[9517],[14,14221,14223,14243],{"className":14222},[8996,8997],[14,14224,14226,14240],{"className":14225},[9001],[14,14227,14229],{"className":14228,"style":12900},[9005],[14,14230,14231,14234],{"style":12960},[14,14232],{"className":14233,"style":9533},[9013],[14,14235,14237],{"className":14236},[9018,9019,9020,9021],[14,14238,8887],{"className":14239},[235,8903,9021],[14,14241,9058],{"className":14242},[9057],[14,14244,14246],{"className":14245},[9001],[14,14247,14249],{"className":14248,"style":9630},[9005],[14,14250],{},[14,14252],{"className":14253,"style":240},[239],[14,14255,9136],{"className":14256},[244],[14,14258],{"className":14259,"style":240},[239],[14,14261,14263,14267],{"className":14262},[226],[14,14264],{"className":14265,"style":14266},[230],"height:0.5806em;vertical-align:-0.15em;",[14,14268,14270,14273],{"className":14269},[235],[14,14271,10045],{"className":14272},[235,8903],[14,14274,14276],{"className":14275},[9517],[14,14277,14279,14299],{"className":14278},[8996,8997],[14,14280,14282,14296],{"className":14281},[9001],[14,14283,14285],{"className":14284,"style":9605},[9005],[14,14286,14287,14290],{"style":13774},[14,14288],{"className":14289,"style":9533},[9013],[14,14291,14293],{"className":14292},[9018,9019,9020,9021],[14,14294,540],{"className":14295},[235,9021],[14,14297,9058],{"className":14298},[9057],[14,14300,14302],{"className":14301},[9001],[14,14303,14305],{"className":14304,"style":9630},[9005],[14,14306],{},"). Under IEEE-754 rules, this subtraction is exact (Sterbenz's Lemma), ensuring no mantissa bits are lost to rounding.",[11,14309,14310],{},"This is implemented in two phases:",[8442,14312,14313,14486],{},[302,14314,14315,14318,14319,14457,14458,8476],{},[129,14316,14317],{},"Coarse search (find exponent)",": we binary search the scale ",[14,14320,14322,14355],{"className":14321},[188],[14,14323,14325],{"className":14324},[192],[194,14326,14327],{"xmlns":196},[198,14328,14329,14352],{},[201,14330,14331,14337,14339],{},[9559,14332,14333,14335],{},[8885,14334,8776],{},[8885,14336,8887],{},[208,14338,988],{},[9488,14340,14341,14343],{},[204,14342,1031],{},[201,14344,14345,14348,14350],{},[204,14346,14347],{},"135",[208,14349,9136],{},[8885,14351,9664],{},[214,14353,14354],{"encoding":216},"S_x = 2^{135-e}",[14,14356,14358,14413],{"className":14357,"ariaHidden":222},[221],[14,14359,14361,14364,14404,14407,14410],{"className":14360},[226],[14,14362],{"className":14363,"style":9715},[230],[14,14365,14367,14370],{"className":14366},[235],[14,14368,8776],{"className":14369,"style":12945},[235,8903],[14,14371,14373],{"className":14372},[9517],[14,14374,14376,14396],{"className":14375},[8996,8997],[14,14377,14379,14393],{"className":14378},[9001],[14,14380,14382],{"className":14381,"style":12900},[9005],[14,14383,14384,14387],{"style":12960},[14,14385],{"className":14386,"style":9533},[9013],[14,14388,14390],{"className":14389},[9018,9019,9020,9021],[14,14391,8887],{"className":14392},[235,8903,9021],[14,14394,9058],{"className":14395},[9057],[14,14397,14399],{"className":14398},[9001],[14,14400,14402],{"className":14401,"style":9630},[9005],[14,14403],{},[14,14405],{"className":14406,"style":9075},[239],[14,14408,988],{"className":14409},[9079],[14,14411],{"className":14412,"style":9075},[239],[14,14414,14416,14419],{"className":14415},[226],[14,14417],{"className":14418,"style":9507},[230],[14,14420,14422,14425],{"className":14421},[235],[14,14423,1031],{"className":14424},[235],[14,14426,14428],{"className":14427},[9517],[14,14429,14431],{"className":14430},[8996],[14,14432,14434],{"className":14433},[9001],[14,14435,14437],{"className":14436,"style":9507},[9005],[14,14438,14439,14442],{"style":9529},[14,14440],{"className":14441,"style":9533},[9013],[14,14443,14445],{"className":14444},[9018,9019,9020,9021],[14,14446,14448,14451,14454],{"className":14447},[235,9021],[14,14449,14347],{"className":14450},[235,9021],[14,14452,9136],{"className":14453},[244,9021],[14,14455,9664],{"className":14456},[235,8903,9021]," until the line's edge lands on the canvas. A dark-pixel bounding box tells us if the line is off-screen (all white), overflowing (clamped), or on-screen (interior). This gives us the float's exponent ",[14,14459,14461,14474],{"className":14460},[188],[14,14462,14464],{"className":14463},[192],[194,14465,14466],{"xmlns":196},[198,14467,14468,14472],{},[201,14469,14470],{},[8885,14471,9664],{},[214,14473,9664],{"encoding":216},[14,14475,14477],{"className":14476,"ariaHidden":222},[221],[14,14478,14480,14483],{"className":14479},[226],[14,14481],{"className":14482,"style":8899},[230],[14,14484,9664],{"className":14485},[235,8903],[302,14487,14488,14491,14492,14561,14562,14631],{},[129,14489,14490],{},"Fine refinement (find mantissa)",": we zoom in further by increasing ",[14,14493,14495,14512],{"className":14494},[188],[14,14496,14498],{"className":14497},[192],[194,14499,14500],{"xmlns":196},[198,14501,14502,14510],{},[201,14503,14504],{},[9559,14505,14506,14508],{},[8885,14507,8776],{},[8885,14509,8887],{},[214,14511,13068],{"encoding":216},[14,14513,14515],{"className":14514,"ariaHidden":222},[221],[14,14516,14518,14521],{"className":14517},[226],[14,14519],{"className":14520,"style":9715},[230],[14,14522,14524,14527],{"className":14523},[235],[14,14525,8776],{"className":14526,"style":12945},[235,8903],[14,14528,14530],{"className":14529},[9517],[14,14531,14533,14553],{"className":14532},[8996,8997],[14,14534,14536,14550],{"className":14535},[9001],[14,14537,14539],{"className":14538,"style":12900},[9005],[14,14540,14541,14544],{"style":12960},[14,14542],{"className":14543,"style":9533},[9013],[14,14545,14547],{"className":14546},[9018,9019,9020,9021],[14,14548,8887],{"className":14549},[235,8903,9021],[14,14551,9058],{"className":14552},[9057],[14,14554,14556],{"className":14555},[9001],[14,14557,14559],{"className":14558,"style":9630},[9005],[14,14560],{},", translating the viewport by ",[14,14563,14565,14582],{"className":14564},[188],[14,14566,14568],{"className":14567},[192],[194,14569,14570],{"xmlns":196},[198,14571,14572,14580],{},[201,14573,14574],{},[9559,14575,14576,14578],{},[8885,14577,8845],{},[8885,14579,8887],{},[214,14581,13139],{"encoding":216},[14,14583,14585],{"className":14584,"ariaHidden":222},[221],[14,14586,14588,14591],{"className":14587},[226],[14,14589],{"className":14590,"style":9715},[230],[14,14592,14594,14597],{"className":14593},[235],[14,14595,8845],{"className":14596,"style":13006},[235,8903],[14,14598,14600],{"className":14599},[9517],[14,14601,14603,14623],{"className":14602},[8996,8997],[14,14604,14606,14620],{"className":14605},[9001],[14,14607,14609],{"className":14608,"style":12900},[9005],[14,14610,14611,14614],{"style":13021},[14,14612],{"className":14613,"style":9533},[9013],[14,14615,14617],{"className":14616},[9018,9019,9020,9021],[14,14618,8887],{"className":14619},[235,8903,9021],[14,14621,9058],{"className":14622},[9057],[14,14624,14626],{"className":14625},[9001],[14,14627,14629],{"className":14628,"style":9630},[9005],[14,14630],{}," to keep the target edge on canvas as it resolves progressively finer mantissa bits.",[11,14633,14634,14635,14704],{},"To keep the edge on canvas, we translate the viewport by adjusting ",[14,14636,14638,14655],{"className":14637},[188],[14,14639,14641],{"className":14640},[192],[194,14642,14643],{"xmlns":196},[198,14644,14645,14653],{},[201,14646,14647],{},[9559,14648,14649,14651],{},[8885,14650,8845],{},[8885,14652,8887],{},[214,14654,13139],{"encoding":216},[14,14656,14658],{"className":14657,"ariaHidden":222},[221],[14,14659,14661,14664],{"className":14660},[226],[14,14662],{"className":14663,"style":9715},[230],[14,14665,14667,14670],{"className":14666},[235],[14,14668,8845],{"className":14669,"style":13006},[235,8903],[14,14671,14673],{"className":14672},[9517],[14,14674,14676,14696],{"className":14675},[8996,8997],[14,14677,14679,14693],{"className":14678},[9001],[14,14680,14682],{"className":14681,"style":12900},[9005],[14,14683,14684,14687],{"style":13021},[14,14685],{"className":14686,"style":9533},[9013],[14,14688,14690],{"className":14689},[9018,9019,9020,9021],[14,14691,8887],{"className":14692},[235,8903,9021],[14,14694,9058],{"className":14695},[9057],[14,14697,14699],{"className":14698},[9001],[14,14700,14702],{"className":14701,"style":9630},[9005],[14,14703],{}," using our current estimate:",[11,14706,14707],{},[14,14708,14710,14769],{"className":14709},[188],[14,14711,14713],{"className":14712},[192],[194,14714,14715],{"xmlns":196},[198,14716,14717,14766],{},[201,14718,14719,14725,14727,14733,14735,14737,14739,14745,14748,14750,14756,14758,14761,14764],{},[9559,14720,14721,14723],{},[8885,14722,8845],{},[8885,14724,8887],{},[208,14726,988],{},[9559,14728,14729,14731],{},[8885,14730,10045],{},[204,14732,540],{},[208,14734,9136],{},[9562,14736,13677],{},[208,14738,11380],{},[9559,14740,14741,14743],{},[8885,14742,8776],{},[8885,14744,8887],{},[239,14746],{"width":14747},"2em",[208,14749,9330],{"stretchy":9853},[9559,14751,14752,14754],{},[8885,14753,10045],{},[204,14755,540],{},[208,14757,988],{},[204,14759,14760],{},"320",[9562,14762,14763],{}," is the canvas center",[208,14765,8699],{"stretchy":9853},[214,14767,14768],{"encoding":216},"T_x = c_0 - \\text{est} \\cdot S_x \\qquad (c_0 = 320 \\text{ is the canvas center})",[14,14770,14772,14827,14882,14903,15006],{"className":14771,"ariaHidden":222},[221],[14,14773,14775,14778,14818,14821,14824],{"className":14774},[226],[14,14776],{"className":14777,"style":9715},[230],[14,14779,14781,14784],{"className":14780},[235],[14,14782,8845],{"className":14783,"style":13006},[235,8903],[14,14785,14787],{"className":14786},[9517],[14,14788,14790,14810],{"className":14789},[8996,8997],[14,14791,14793,14807],{"className":14792},[9001],[14,14794,14796],{"className":14795,"style":12900},[9005],[14,14797,14798,14801],{"style":13021},[14,14799],{"className":14800,"style":9533},[9013],[14,14802,14804],{"className":14803},[9018,9019,9020,9021],[14,14805,8887],{"className":14806},[235,8903,9021],[14,14808,9058],{"className":14809},[9057],[14,14811,14813],{"className":14812},[9001],[14,14814,14816],{"className":14815,"style":9630},[9005],[14,14817],{},[14,14819],{"className":14820,"style":9075},[239],[14,14822,988],{"className":14823},[9079],[14,14825],{"className":14826,"style":9075},[239],[14,14828,14830,14833,14873,14876,14879],{"className":14829},[226],[14,14831],{"className":14832,"style":13753},[230],[14,14834,14836,14839],{"className":14835},[235],[14,14837,10045],{"className":14838},[235,8903],[14,14840,14842],{"className":14841},[9517],[14,14843,14845,14865],{"className":14844},[8996,8997],[14,14846,14848,14862],{"className":14847},[9001],[14,14849,14851],{"className":14850,"style":9605},[9005],[14,14852,14853,14856],{"style":13774},[14,14854],{"className":14855,"style":9533},[9013],[14,14857,14859],{"className":14858},[9018,9019,9020,9021],[14,14860,540],{"className":14861},[235,9021],[14,14863,9058],{"className":14864},[9057],[14,14866,14868],{"className":14867},[9001],[14,14869,14871],{"className":14870,"style":9630},[9005],[14,14872],{},[14,14874],{"className":14875,"style":240},[239],[14,14877,9136],{"className":14878},[244],[14,14880],{"className":14881,"style":240},[239],[14,14883,14885,14888,14894,14897,14900],{"className":14884},[226],[14,14886],{"className":14887,"style":13810},[230],[14,14889,14891],{"className":14890},[235,122],[14,14892,13677],{"className":14893},[235],[14,14895],{"className":14896,"style":240},[239],[14,14898,11380],{"className":14899},[244],[14,14901],{"className":14902,"style":240},[239],[14,14904,14906,14910,14950,14954,14957,14997,15000,15003],{"className":14905},[226],[14,14907],{"className":14908,"style":14909},[230],"height:1em;vertical-align:-0.25em;",[14,14911,14913,14916],{"className":14912},[235],[14,14914,8776],{"className":14915,"style":12945},[235,8903],[14,14917,14919],{"className":14918},[9517],[14,14920,14922,14942],{"className":14921},[8996,8997],[14,14923,14925,14939],{"className":14924},[9001],[14,14926,14928],{"className":14927,"style":12900},[9005],[14,14929,14930,14933],{"style":12960},[14,14931],{"className":14932,"style":9533},[9013],[14,14934,14936],{"className":14935},[9018,9019,9020,9021],[14,14937,8887],{"className":14938},[235,8903,9021],[14,14940,9058],{"className":14941},[9057],[14,14943,14945],{"className":14944},[9001],[14,14946,14948],{"className":14947,"style":9630},[9005],[14,14949],{},[14,14951],{"className":14952,"style":14953},[239],"margin-right:2em;",[14,14955,9330],{"className":14956},[8988],[14,14958,14960,14963],{"className":14959},[235],[14,14961,10045],{"className":14962},[235,8903],[14,14964,14966],{"className":14965},[9517],[14,14967,14969,14989],{"className":14968},[8996,8997],[14,14970,14972,14986],{"className":14971},[9001],[14,14973,14975],{"className":14974,"style":9605},[9005],[14,14976,14977,14980],{"style":13774},[14,14978],{"className":14979,"style":9533},[9013],[14,14981,14983],{"className":14982},[9018,9019,9020,9021],[14,14984,540],{"className":14985},[235,9021],[14,14987,9058],{"className":14988},[9057],[14,14990,14992],{"className":14991},[9001],[14,14993,14995],{"className":14994,"style":9630},[9005],[14,14996],{},[14,14998],{"className":14999,"style":9075},[239],[14,15001,988],{"className":15002},[9079],[14,15004],{"className":15005,"style":9075},[239],[14,15007,15009,15012,15015,15021],{"className":15008},[226],[14,15010],{"className":15011,"style":14909},[230],[14,15013,14760],{"className":15014},[235],[14,15016,15018],{"className":15017},[235,122],[14,15019,14763],{"className":15020},[235],[14,15022,8699],{"className":15023},[9071],[11,15025,15026],{},"This makes the drawn position:",[11,15028,15029],{},[14,15030,15032,15076],{"className":15031},[188],[14,15033,15035],{"className":15034},[192],[194,15036,15037],{"xmlns":196},[198,15038,15039,15073],{},[201,15040,15041,15047,15049,15055,15057,15059,15061,15063,15065,15067],{},[9559,15042,15043,15045],{},[8885,15044,12847],{},[8885,15046,8887],{},[208,15048,988],{},[9559,15050,15051,15053],{},[8885,15052,8776],{},[8885,15054,8887],{},[208,15056,9330],{"stretchy":9853},[8885,15058,12860],{},[208,15060,9136],{},[9562,15062,13677],{},[208,15064,8699],{"stretchy":9853},[208,15066,4432],{},[9559,15068,15069,15071],{},[8885,15070,10045],{},[204,15072,540],{},[214,15074,15075],{"encoding":216},"D_x = S_x (X - \\text{est}) + c_0",[14,15077,15079,15134,15195,15219],{"className":15078,"ariaHidden":222},[221],[14,15080,15082,15085,15125,15128,15131],{"className":15081},[226],[14,15083],{"className":15084,"style":9715},[230],[14,15086,15088,15091],{"className":15087},[235],[14,15089,12847],{"className":15090,"style":12887},[235,8903],[14,15092,15094],{"className":15093},[9517],[14,15095,15097,15117],{"className":15096},[8996,8997],[14,15098,15100,15114],{"className":15099},[9001],[14,15101,15103],{"className":15102,"style":12900},[9005],[14,15104,15105,15108],{"style":12903},[14,15106],{"className":15107,"style":9533},[9013],[14,15109,15111],{"className":15110},[9018,9019,9020,9021],[14,15112,8887],{"className":15113},[235,8903,9021],[14,15115,9058],{"className":15116},[9057],[14,15118,15120],{"className":15119},[9001],[14,15121,15123],{"className":15122,"style":9630},[9005],[14,15124],{},[14,15126],{"className":15127,"style":9075},[239],[14,15129,988],{"className":15130},[9079],[14,15132],{"className":15133,"style":9075},[239],[14,15135,15137,15140,15180,15183,15186,15189,15192],{"className":15136},[226],[14,15138],{"className":15139,"style":14909},[230],[14,15141,15143,15146],{"className":15142},[235],[14,15144,8776],{"className":15145,"style":12945},[235,8903],[14,15147,15149],{"className":15148},[9517],[14,15150,15152,15172],{"className":15151},[8996,8997],[14,15153,15155,15169],{"className":15154},[9001],[14,15156,15158],{"className":15157,"style":12900},[9005],[14,15159,15160,15163],{"style":12960},[14,15161],{"className":15162,"style":9533},[9013],[14,15164,15166],{"className":15165},[9018,9019,9020,9021],[14,15167,8887],{"className":15168},[235,8903,9021],[14,15170,9058],{"className":15171},[9057],[14,15173,15175],{"className":15174},[9001],[14,15176,15178],{"className":15177,"style":9630},[9005],[14,15179],{},[14,15181,9330],{"className":15182},[8988],[14,15184,12860],{"className":15185,"style":12984},[235,8903],[14,15187],{"className":15188,"style":240},[239],[14,15190,9136],{"className":15191},[244],[14,15193],{"className":15194,"style":240},[239],[14,15196,15198,15201,15207,15210,15213,15216],{"className":15197},[226],[14,15199],{"className":15200,"style":14909},[230],[14,15202,15204],{"className":15203},[235,122],[14,15205,13677],{"className":15206},[235],[14,15208,8699],{"className":15209},[9071],[14,15211],{"className":15212,"style":240},[239],[14,15214,4432],{"className":15215},[244],[14,15217],{"className":15218,"style":240},[239],[14,15220,15222,15225],{"className":15221},[226],[14,15223],{"className":15224,"style":14266},[230],[14,15226,15228,15231],{"className":15227},[235],[14,15229,10045],{"className":15230},[235,8903],[14,15232,15234],{"className":15233},[9517],[14,15235,15237,15257],{"className":15236},[8996,8997],[14,15238,15240,15254],{"className":15239},[9001],[14,15241,15243],{"className":15242,"style":9605},[9005],[14,15244,15245,15248],{"style":13774},[14,15246],{"className":15247,"style":9533},[9013],[14,15249,15251],{"className":15250},[9018,9019,9020,9021],[14,15252,540],{"className":15253},[235,9021],[14,15255,9058],{"className":15256},[9057],[14,15258,15260],{"className":15259},[9001],[14,15261,15263],{"className":15262,"style":9630},[9005],[14,15264],{},[11,15266,15267,15268,15337,15338,15405,15406,15480,15481,15510,15511,15606,15607,15681,15682,15893,15894,15963,15964,15992],{},"Why is this math exact? First, ",[14,15269,15271,15288],{"className":15270},[188],[14,15272,15274],{"className":15273},[192],[194,15275,15276],{"xmlns":196},[198,15277,15278,15286],{},[201,15279,15280],{},[9559,15281,15282,15284],{},[8885,15283,8776],{},[8885,15285,8887],{},[214,15287,13068],{"encoding":216},[14,15289,15291],{"className":15290,"ariaHidden":222},[221],[14,15292,15294,15297],{"className":15293},[226],[14,15295],{"className":15296,"style":9715},[230],[14,15298,15300,15303],{"className":15299},[235],[14,15301,8776],{"className":15302,"style":12945},[235,8903],[14,15304,15306],{"className":15305},[9517],[14,15307,15309,15329],{"className":15308},[8996,8997],[14,15310,15312,15326],{"className":15311},[9001],[14,15313,15315],{"className":15314,"style":12900},[9005],[14,15316,15317,15320],{"style":12960},[14,15318],{"className":15319,"style":9533},[9013],[14,15321,15323],{"className":15322},[9018,9019,9020,9021],[14,15324,8887],{"className":15325},[235,8903,9021],[14,15327,9058],{"className":15328},[9057],[14,15330,15332],{"className":15331},[9001],[14,15333,15335],{"className":15334,"style":9630},[9005],[14,15336],{}," is always a power of 2 (e.g. ",[14,15339,15341,15360],{"className":15340},[188],[14,15342,15344],{"className":15343},[192],[194,15345,15346],{"xmlns":196},[198,15347,15348,15357],{},[201,15349,15350],{},[9488,15351,15352,15354],{},[204,15353,1031],{},[9562,15355,15356],{},"exp",[214,15358,15359],{"encoding":216},"2^{\\text{exp}}",[14,15361,15363],{"className":15362,"ariaHidden":222},[221],[14,15364,15366,15370],{"className":15365},[226],[14,15367],{"className":15368,"style":15369},[230],"height:0.6644em;",[14,15371,15373,15376],{"className":15372},[235],[14,15374,1031],{"className":15375},[235],[14,15377,15379],{"className":15378},[9517],[14,15380,15382],{"className":15381},[8996],[14,15383,15385],{"className":15384},[9001],[14,15386,15388],{"className":15387,"style":15369},[9005],[14,15389,15390,15393],{"style":9529},[14,15391],{"className":15392,"style":9533},[9013],[14,15394,15396],{"className":15395},[9018,9019,9020,9021],[14,15397,15399],{"className":15398},[235,9021],[14,15400,15402],{"className":15401},[235,122,9021],[14,15403,15356],{"className":15404},[235,9021],"), meaning the product ",[14,15407,15409,15428],{"className":15408},[188],[14,15410,15412],{"className":15411},[192],[194,15413,15414],{"xmlns":196},[198,15415,15416,15426],{},[201,15417,15418,15424],{},[9559,15419,15420,15422],{},[8885,15421,8776],{},[8885,15423,8887],{},[8885,15425,12860],{},[214,15427,13593],{"encoding":216},[14,15429,15431],{"className":15430,"ariaHidden":222},[221],[14,15432,15434,15437,15477],{"className":15433},[226],[14,15435],{"className":15436,"style":9715},[230],[14,15438,15440,15443],{"className":15439},[235],[14,15441,8776],{"className":15442,"style":12945},[235,8903],[14,15444,15446],{"className":15445},[9517],[14,15447,15449,15469],{"className":15448},[8996,8997],[14,15450,15452,15466],{"className":15451},[9001],[14,15453,15455],{"className":15454,"style":12900},[9005],[14,15456,15457,15460],{"style":12960},[14,15458],{"className":15459,"style":9533},[9013],[14,15461,15463],{"className":15462},[9018,9019,9020,9021],[14,15464,8887],{"className":15465},[235,8903,9021],[14,15467,9058],{"className":15468},[9057],[14,15470,15472],{"className":15471},[9001],[14,15473,15475],{"className":15474,"style":9630},[9005],[14,15476],{},[14,15478,12860],{"className":15479,"style":12984},[235,8903]," incurs no rounding error — it merely shifts the float's exponent. Second, because our estimate (est) is close to ",[14,15482,15484,15497],{"className":15483},[188],[14,15485,15487],{"className":15486},[192],[194,15488,15489],{"xmlns":196},[198,15490,15491,15495],{},[201,15492,15493],{},[8885,15494,12860],{},[214,15496,12860],{"encoding":216},[14,15498,15500],{"className":15499,"ariaHidden":222},[221],[14,15501,15503,15507],{"className":15502},[226],[14,15504],{"className":15505,"style":15506},[230],"height:0.6833em;",[14,15508,12860],{"className":15509,"style":12984},[235,8903],", the term ",[14,15512,15514,15536],{"className":15513},[188],[14,15515,15517],{"className":15516},[192],[194,15518,15519],{"xmlns":196},[198,15520,15521,15533],{},[201,15522,15523,15525,15527],{},[9562,15524,13677],{},[208,15526,11380],{},[9559,15528,15529,15531],{},[8885,15530,8776],{},[8885,15532,8887],{},[214,15534,15535],{"encoding":216},"\\text{est} \\cdot S_x",[14,15537,15539,15560],{"className":15538,"ariaHidden":222},[221],[14,15540,15542,15545,15551,15554,15557],{"className":15541},[226],[14,15543],{"className":15544,"style":13810},[230],[14,15546,15548],{"className":15547},[235,122],[14,15549,13677],{"className":15550},[235],[14,15552],{"className":15553,"style":240},[239],[14,15555,11380],{"className":15556},[244],[14,15558],{"className":15559,"style":240},[239],[14,15561,15563,15566],{"className":15562},[226],[14,15564],{"className":15565,"style":9715},[230],[14,15567,15569,15572],{"className":15568},[235],[14,15570,8776],{"className":15571,"style":12945},[235,8903],[14,15573,15575],{"className":15574},[9517],[14,15576,15578,15598],{"className":15577},[8996,8997],[14,15579,15581,15595],{"className":15580},[9001],[14,15582,15584],{"className":15583,"style":12900},[9005],[14,15585,15586,15589],{"style":12960},[14,15587],{"className":15588,"style":9533},[9013],[14,15590,15592],{"className":15591},[9018,9019,9020,9021],[14,15593,8887],{"className":15594},[235,8903,9021],[14,15596,9058],{"className":15597},[9057],[14,15599,15601],{"className":15600},[9001],[14,15602,15604],{"className":15603,"style":9630},[9005],[14,15605],{}," has the same sign and similar magnitude to ",[14,15608,15610,15629],{"className":15609},[188],[14,15611,15613],{"className":15612},[192],[194,15614,15615],{"xmlns":196},[198,15616,15617,15627],{},[201,15618,15619,15625],{},[9559,15620,15621,15623],{},[8885,15622,8776],{},[8885,15624,8887],{},[8885,15626,12860],{},[214,15628,13593],{"encoding":216},[14,15630,15632],{"className":15631,"ariaHidden":222},[221],[14,15633,15635,15638,15678],{"className":15634},[226],[14,15636],{"className":15637,"style":9715},[230],[14,15639,15641,15644],{"className":15640},[235],[14,15642,8776],{"className":15643,"style":12945},[235,8903],[14,15645,15647],{"className":15646},[9517],[14,15648,15650,15670],{"className":15649},[8996,8997],[14,15651,15653,15667],{"className":15652},[9001],[14,15654,15656],{"className":15655,"style":12900},[9005],[14,15657,15658,15661],{"style":12960},[14,15659],{"className":15660,"style":9533},[9013],[14,15662,15664],{"className":15663},[9018,9019,9020,9021],[14,15665,8887],{"className":15666},[235,8903,9021],[14,15668,9058],{"className":15669},[9057],[14,15671,15673],{"className":15672},[9001],[14,15674,15676],{"className":15675,"style":9630},[9005],[14,15677],{},[14,15679,12860],{"className":15680,"style":12984},[235,8903],". Third, when the GPU evaluates ",[14,15683,15685,15725],{"className":15684},[188],[14,15686,15688],{"className":15687},[192],[194,15689,15690],{"xmlns":196},[198,15691,15692,15722],{},[201,15693,15694,15700,15702,15704,15710,15712,15714,15716],{},[9559,15695,15696,15698],{},[8885,15697,12847],{},[8885,15699,8887],{},[208,15701,988],{},[208,15703,9330],{"stretchy":9853},[9559,15705,15706,15708],{},[8885,15707,8776],{},[8885,15709,8887],{},[8885,15711,12860],{},[208,15713,8699],{"stretchy":9853},[208,15715,4432],{},[9559,15717,15718,15720],{},[8885,15719,8845],{},[8885,15721,8887],{},[214,15723,15724],{"encoding":216},"D_x = (S_x X) + T_x",[14,15726,15728,15783,15847],{"className":15727,"ariaHidden":222},[221],[14,15729,15731,15734,15774,15777,15780],{"className":15730},[226],[14,15732],{"className":15733,"style":9715},[230],[14,15735,15737,15740],{"className":15736},[235],[14,15738,12847],{"className":15739,"style":12887},[235,8903],[14,15741,15743],{"className":15742},[9517],[14,15744,15746,15766],{"className":15745},[8996,8997],[14,15747,15749,15763],{"className":15748},[9001],[14,15750,15752],{"className":15751,"style":12900},[9005],[14,15753,15754,15757],{"style":12903},[14,15755],{"className":15756,"style":9533},[9013],[14,15758,15760],{"className":15759},[9018,9019,9020,9021],[14,15761,8887],{"className":15762},[235,8903,9021],[14,15764,9058],{"className":15765},[9057],[14,15767,15769],{"className":15768},[9001],[14,15770,15772],{"className":15771,"style":9630},[9005],[14,15773],{},[14,15775],{"className":15776,"style":9075},[239],[14,15778,988],{"className":15779},[9079],[14,15781],{"className":15782,"style":9075},[239],[14,15784,15786,15789,15792,15832,15835,15838,15841,15844],{"className":15785},[226],[14,15787],{"className":15788,"style":14909},[230],[14,15790,9330],{"className":15791},[8988],[14,15793,15795,15798],{"className":15794},[235],[14,15796,8776],{"className":15797,"style":12945},[235,8903],[14,15799,15801],{"className":15800},[9517],[14,15802,15804,15824],{"className":15803},[8996,8997],[14,15805,15807,15821],{"className":15806},[9001],[14,15808,15810],{"className":15809,"style":12900},[9005],[14,15811,15812,15815],{"style":12960},[14,15813],{"className":15814,"style":9533},[9013],[14,15816,15818],{"className":15817},[9018,9019,9020,9021],[14,15819,8887],{"className":15820},[235,8903,9021],[14,15822,9058],{"className":15823},[9057],[14,15825,15827],{"className":15826},[9001],[14,15828,15830],{"className":15829,"style":9630},[9005],[14,15831],{},[14,15833,12860],{"className":15834,"style":12984},[235,8903],[14,15836,8699],{"className":15837},[9071],[14,15839],{"className":15840,"style":240},[239],[14,15842,4432],{"className":15843},[244],[14,15845],{"className":15846,"style":240},[239],[14,15848,15850,15853],{"className":15849},[226],[14,15851],{"className":15852,"style":9715},[230],[14,15854,15856,15859],{"className":15855},[235],[14,15857,8845],{"className":15858,"style":13006},[235,8903],[14,15860,15862],{"className":15861},[9517],[14,15863,15865,15885],{"className":15864},[8996,8997],[14,15866,15868,15882],{"className":15867},[9001],[14,15869,15871],{"className":15870,"style":12900},[9005],[14,15872,15873,15876],{"style":13021},[14,15874],{"className":15875,"style":9533},[9013],[14,15877,15879],{"className":15878},[9018,9019,9020,9021],[14,15880,8887],{"className":15881},[235,8903,9021],[14,15883,9058],{"className":15884},[9057],[14,15886,15888],{"className":15887},[9001],[14,15889,15891],{"className":15890,"style":9630},[9005],[14,15892],{},", it adds a negative ",[14,15895,15897,15914],{"className":15896},[188],[14,15898,15900],{"className":15899},[192],[194,15901,15902],{"xmlns":196},[198,15903,15904,15912],{},[201,15905,15906],{},[9559,15907,15908,15910],{},[8885,15909,8845],{},[8885,15911,8887],{},[214,15913,13139],{"encoding":216},[14,15915,15917],{"className":15916,"ariaHidden":222},[221],[14,15918,15920,15923],{"className":15919},[226],[14,15921],{"className":15922,"style":9715},[230],[14,15924,15926,15929],{"className":15925},[235],[14,15927,8845],{"className":15928,"style":13006},[235,8903],[14,15930,15932],{"className":15931},[9517],[14,15933,15935,15955],{"className":15934},[8996,8997],[14,15936,15938,15952],{"className":15937},[9001],[14,15939,15941],{"className":15940,"style":12900},[9005],[14,15942,15943,15946],{"style":13021},[14,15944],{"className":15945,"style":9533},[9013],[14,15947,15949],{"className":15948},[9018,9019,9020,9021],[14,15950,8887],{"className":15951},[235,8903,9021],[14,15953,9058],{"className":15954},[9057],[14,15956,15958],{"className":15957},[9001],[14,15959,15961],{"className":15960,"style":9630},[9005],[14,15962],{}," (for positive ",[14,15965,15967,15980],{"className":15966},[188],[14,15968,15970],{"className":15969},[192],[194,15971,15972],{"xmlns":196},[198,15973,15974,15978],{},[201,15975,15976],{},[8885,15977,12860],{},[214,15979,12860],{"encoding":216},[14,15981,15983],{"className":15982,"ariaHidden":222},[221],[14,15984,15986,15989],{"className":15985},[226],[14,15987],{"className":15988,"style":15506},[230],[14,15990,12860],{"className":15991,"style":12984},[235,8903]," and est). This is equivalent to:",[11,15994,15995],{},[14,15996,15998,16081],{"className":15997},[188],[14,15999,16001],{"className":16000},[192],[194,16002,16003],{"xmlns":196},[198,16004,16005,16078],{},[201,16006,16007,16013,16015,16017,16023,16025,16027,16029,16032,16038,16040,16042,16044,16050,16052,16054,16056,16058,16060,16062,16068,16070,16076],{},[9559,16008,16009,16011],{},[8885,16010,12847],{},[8885,16012,8887],{},[208,16014,988],{},[208,16016,9330],{"stretchy":9853},[9559,16018,16019,16021],{},[8885,16020,8776],{},[8885,16022,8887],{},[8885,16024,12860],{},[208,16026,8699],{"stretchy":9853},[208,16028,9136],{},[8885,16030,16031],{"mathvariant":9648},"∣",[9559,16033,16034,16036],{},[8885,16035,8845],{},[8885,16037,8887],{},[8885,16039,16031],{"mathvariant":9648},[208,16041,988],{},[208,16043,9330],{"stretchy":9853},[9559,16045,16046,16048],{},[8885,16047,8776],{},[8885,16049,8887],{},[8885,16051,12860],{},[208,16053,8699],{"stretchy":9853},[208,16055,9136],{},[208,16057,9330],{"stretchy":9853},[9562,16059,13677],{},[208,16061,11380],{},[9559,16063,16064,16066],{},[8885,16065,8776],{},[8885,16067,8887],{},[208,16069,9136],{},[9559,16071,16072,16074],{},[8885,16073,10045],{},[204,16075,540],{},[208,16077,8699],{"stretchy":9853},[214,16079,16080],{"encoding":216},"D_x = (S_x X) - |T_x| = (S_x X) - (\\text{est} \\cdot S_x - c_0)",[14,16082,16084,16139,16203,16264,16328,16352,16407],{"className":16083,"ariaHidden":222},[221],[14,16085,16087,16090,16130,16133,16136],{"className":16086},[226],[14,16088],{"className":16089,"style":9715},[230],[14,16091,16093,16096],{"className":16092},[235],[14,16094,12847],{"className":16095,"style":12887},[235,8903],[14,16097,16099],{"className":16098},[9517],[14,16100,16102,16122],{"className":16101},[8996,8997],[14,16103,16105,16119],{"className":16104},[9001],[14,16106,16108],{"className":16107,"style":12900},[9005],[14,16109,16110,16113],{"style":12903},[14,16111],{"className":16112,"style":9533},[9013],[14,16114,16116],{"className":16115},[9018,9019,9020,9021],[14,16117,8887],{"className":16118},[235,8903,9021],[14,16120,9058],{"className":16121},[9057],[14,16123,16125],{"className":16124},[9001],[14,16126,16128],{"className":16127,"style":9630},[9005],[14,16129],{},[14,16131],{"className":16132,"style":9075},[239],[14,16134,988],{"className":16135},[9079],[14,16137],{"className":16138,"style":9075},[239],[14,16140,16142,16145,16148,16188,16191,16194,16197,16200],{"className":16141},[226],[14,16143],{"className":16144,"style":14909},[230],[14,16146,9330],{"className":16147},[8988],[14,16149,16151,16154],{"className":16150},[235],[14,16152,8776],{"className":16153,"style":12945},[235,8903],[14,16155,16157],{"className":16156},[9517],[14,16158,16160,16180],{"className":16159},[8996,8997],[14,16161,16163,16177],{"className":16162},[9001],[14,16164,16166],{"className":16165,"style":12900},[9005],[14,16167,16168,16171],{"style":12960},[14,16169],{"className":16170,"style":9533},[9013],[14,16172,16174],{"className":16173},[9018,9019,9020,9021],[14,16175,8887],{"className":16176},[235,8903,9021],[14,16178,9058],{"className":16179},[9057],[14,16181,16183],{"className":16182},[9001],[14,16184,16186],{"className":16185,"style":9630},[9005],[14,16187],{},[14,16189,12860],{"className":16190,"style":12984},[235,8903],[14,16192,8699],{"className":16193},[9071],[14,16195],{"className":16196,"style":240},[239],[14,16198,9136],{"className":16199},[244],[14,16201],{"className":16202,"style":240},[239],[14,16204,16206,16209,16212,16252,16255,16258,16261],{"className":16205},[226],[14,16207],{"className":16208,"style":14909},[230],[14,16210,16031],{"className":16211},[235],[14,16213,16215,16218],{"className":16214},[235],[14,16216,8845],{"className":16217,"style":13006},[235,8903],[14,16219,16221],{"className":16220},[9517],[14,16222,16224,16244],{"className":16223},[8996,8997],[14,16225,16227,16241],{"className":16226},[9001],[14,16228,16230],{"className":16229,"style":12900},[9005],[14,16231,16232,16235],{"style":13021},[14,16233],{"className":16234,"style":9533},[9013],[14,16236,16238],{"className":16237},[9018,9019,9020,9021],[14,16239,8887],{"className":16240},[235,8903,9021],[14,16242,9058],{"className":16243},[9057],[14,16245,16247],{"className":16246},[9001],[14,16248,16250],{"className":16249,"style":9630},[9005],[14,16251],{},[14,16253,16031],{"className":16254},[235],[14,16256],{"className":16257,"style":9075},[239],[14,16259,988],{"className":16260},[9079],[14,16262],{"className":16263,"style":9075},[239],[14,16265,16267,16270,16273,16313,16316,16319,16322,16325],{"className":16266},[226],[14,16268],{"className":16269,"style":14909},[230],[14,16271,9330],{"className":16272},[8988],[14,16274,16276,16279],{"className":16275},[235],[14,16277,8776],{"className":16278,"style":12945},[235,8903],[14,16280,16282],{"className":16281},[9517],[14,16283,16285,16305],{"className":16284},[8996,8997],[14,16286,16288,16302],{"className":16287},[9001],[14,16289,16291],{"className":16290,"style":12900},[9005],[14,16292,16293,16296],{"style":12960},[14,16294],{"className":16295,"style":9533},[9013],[14,16297,16299],{"className":16298},[9018,9019,9020,9021],[14,16300,8887],{"className":16301},[235,8903,9021],[14,16303,9058],{"className":16304},[9057],[14,16306,16308],{"className":16307},[9001],[14,16309,16311],{"className":16310,"style":9630},[9005],[14,16312],{},[14,16314,12860],{"className":16315,"style":12984},[235,8903],[14,16317,8699],{"className":16318},[9071],[14,16320],{"className":16321,"style":240},[239],[14,16323,9136],{"className":16324},[244],[14,16326],{"className":16327,"style":240},[239],[14,16329,16331,16334,16337,16343,16346,16349],{"className":16330},[226],[14,16332],{"className":16333,"style":14909},[230],[14,16335,9330],{"className":16336},[8988],[14,16338,16340],{"className":16339},[235,122],[14,16341,13677],{"className":16342},[235],[14,16344],{"className":16345,"style":240},[239],[14,16347,11380],{"className":16348},[244],[14,16350],{"className":16351,"style":240},[239],[14,16353,16355,16358,16398,16401,16404],{"className":16354},[226],[14,16356],{"className":16357,"style":9715},[230],[14,16359,16361,16364],{"className":16360},[235],[14,16362,8776],{"className":16363,"style":12945},[235,8903],[14,16365,16367],{"className":16366},[9517],[14,16368,16370,16390],{"className":16369},[8996,8997],[14,16371,16373,16387],{"className":16372},[9001],[14,16374,16376],{"className":16375,"style":12900},[9005],[14,16377,16378,16381],{"style":12960},[14,16379],{"className":16380,"style":9533},[9013],[14,16382,16384],{"className":16383},[9018,9019,9020,9021],[14,16385,8887],{"className":16386},[235,8903,9021],[14,16388,9058],{"className":16389},[9057],[14,16391,16393],{"className":16392},[9001],[14,16394,16396],{"className":16395,"style":9630},[9005],[14,16397],{},[14,16399],{"className":16400,"style":240},[239],[14,16402,9136],{"className":16403},[244],[14,16405],{"className":16406,"style":240},[239],[14,16408,16410,16413,16453],{"className":16409},[226],[14,16411],{"className":16412,"style":14909},[230],[14,16414,16416,16419],{"className":16415},[235],[14,16417,10045],{"className":16418},[235,8903],[14,16420,16422],{"className":16421},[9517],[14,16423,16425,16445],{"className":16424},[8996,8997],[14,16426,16428,16442],{"className":16427},[9001],[14,16429,16431],{"className":16430,"style":9605},[9005],[14,16432,16433,16436],{"style":13774},[14,16434],{"className":16435,"style":9533},[9013],[14,16437,16439],{"className":16438},[9018,9019,9020,9021],[14,16440,540],{"className":16441},[235,9021],[14,16443,9058],{"className":16444},[9057],[14,16446,16448],{"className":16447},[9001],[14,16449,16451],{"className":16450,"style":9630},[9005],[14,16452],{},[14,16454,8699],{"className":16455},[9071],[11,16457,16458,16459,16529],{},"Since ",[14,16460,16462,16480],{"className":16461},[188],[14,16463,16465],{"className":16464},[192],[194,16466,16467],{"xmlns":196},[198,16468,16469,16477],{},[201,16470,16471],{},[9559,16472,16473,16475],{},[8885,16474,10045],{},[204,16476,540],{},[214,16478,16479],{"encoding":216},"c_0",[14,16481,16483],{"className":16482,"ariaHidden":222},[221],[14,16484,16486,16489],{"className":16485},[226],[14,16487],{"className":16488,"style":14266},[230],[14,16490,16492,16495],{"className":16491},[235],[14,16493,10045],{"className":16494},[235,8903],[14,16496,16498],{"className":16497},[9517],[14,16499,16501,16521],{"className":16500},[8996,8997],[14,16502,16504,16518],{"className":16503},[9001],[14,16505,16507],{"className":16506,"style":9605},[9005],[14,16508,16509,16512],{"style":13774},[14,16510],{"className":16511,"style":9533},[9013],[14,16513,16515],{"className":16514},[9018,9019,9020,9021],[14,16516,540],{"className":16517},[235,9021],[14,16519,9058],{"className":16520},[9057],[14,16522,16524],{"className":16523},[9001],[14,16525,16527],{"className":16526,"style":9630},[9005],[14,16528],{}," (320) is small compared to the scaled values, the two operands are well within a factor of 2 of each other. Sterbenz's Lemma guarantees that the difference of any two floating-point numbers of the same sign within a factor of 2 of each other is computed with zero rounding error. The GPU thus renders the exact residual difference without losing any precision.",[11,16531,16532,16533,16567,16568,16638],{},"We read back the pixel centroid (",[14,16534,16536,16552],{"className":16535},[188],[14,16537,16539],{"className":16538},[192],[194,16540,16541],{"xmlns":196},[198,16542,16543,16549],{},[201,16544,16545,16547],{},[8885,16546,10045],{},[8885,16548,8887],{},[214,16550,16551],{"encoding":216},"cx",[14,16553,16555],{"className":16554,"ariaHidden":222},[221],[14,16556,16558,16561,16564],{"className":16557},[226],[14,16559],{"className":16560,"style":8899},[230],[14,16562,10045],{"className":16563},[235,8903],[14,16565,8887],{"className":16566},[235,8903],") of the resulting strip to calculate the true ",[14,16569,16571,16589],{"className":16570},[188],[14,16572,16574],{"className":16573},[192],[194,16575,16576],{"xmlns":196},[198,16577,16578,16586],{},[201,16579,16580],{},[9559,16581,16582,16584],{},[8885,16583,12847],{},[8885,16585,8887],{},[214,16587,16588],{"encoding":216},"D_x",[14,16590,16592],{"className":16591,"ariaHidden":222},[221],[14,16593,16595,16598],{"className":16594},[226],[14,16596],{"className":16597,"style":9715},[230],[14,16599,16601,16604],{"className":16600},[235],[14,16602,12847],{"className":16603,"style":12887},[235,8903],[14,16605,16607],{"className":16606},[9517],[14,16608,16610,16630],{"className":16609},[8996,8997],[14,16611,16613,16627],{"className":16612},[9001],[14,16614,16616],{"className":16615,"style":12900},[9005],[14,16617,16618,16621],{"style":12903},[14,16619],{"className":16620,"style":9533},[9013],[14,16622,16624],{"className":16623},[9018,9019,9020,9021],[14,16625,8887],{"className":16626},[235,8903,9021],[14,16628,9058],{"className":16629},[9057],[14,16631,16633],{"className":16632},[9001],[14,16634,16636],{"className":16635,"style":9630},[9005],[14,16637],{},". We then invert the math to update our estimate:",[11,16640,16641],{},[14,16642,16644,16696],{"className":16643},[188],[14,16645,16647],{"className":16646},[192],[194,16648,16649],{"xmlns":196},[198,16650,16651,16693],{},[201,16652,16653,16659,16661],{},[9559,16654,16655,16657],{},[9562,16656,13677],{},[9562,16658,12641],{},[208,16660,988],{},[8949,16662,16663,16687],{},[201,16664,16665,16667,16670,16672,16674,16676,16679,16681],{},[204,16666,1031],{},[9562,16668,16669],{}," ",[8885,16671,10045],{},[8885,16673,8887],{},[208,16675,9136],{},[8885,16677,16678],{},"E",[208,16680,9136],{},[9559,16682,16683,16685],{},[8885,16684,8845],{},[8885,16686,8887],{},[9559,16688,16689,16691],{},[8885,16690,8776],{},[8885,16692,8887],{},[214,16694,16695],{"encoding":216},"\\text{est}_{\\text{new}} = \\frac{2 \\, cx - E - T_x}{S_x}",[14,16697,16699,16764],{"className":16698,"ariaHidden":222},[221],[14,16700,16702,16706,16755,16758,16761],{"className":16701},[226],[14,16703],{"className":16704,"style":16705},[230],"height:0.7651em;vertical-align:-0.15em;",[14,16707,16709,16715],{"className":16708},[235],[14,16710,16712],{"className":16711},[235,122],[14,16713,13677],{"className":16714},[235],[14,16716,16718],{"className":16717},[9517],[14,16719,16721,16747],{"className":16720},[8996,8997],[14,16722,16724,16744],{"className":16723},[9001],[14,16725,16727],{"className":16726,"style":12900},[9005],[14,16728,16729,16732],{"style":9608},[14,16730],{"className":16731,"style":9533},[9013],[14,16733,16735],{"className":16734},[9018,9019,9020,9021],[14,16736,16738],{"className":16737},[235,9021],[14,16739,16741],{"className":16740},[235,122,9021],[14,16742,12641],{"className":16743},[235,9021],[14,16745,9058],{"className":16746},[9057],[14,16748,16750],{"className":16749},[9001],[14,16751,16753],{"className":16752,"style":9630},[9005],[14,16754],{},[14,16756],{"className":16757,"style":9075},[239],[14,16759,988],{"className":16760},[9079],[14,16762],{"className":16763,"style":9075},[239],[14,16765,16767,16771],{"className":16766},[226],[14,16768],{"className":16769,"style":16770},[230],"height:1.3335em;vertical-align:-0.4451em;",[14,16772,16774,16777,16941],{"className":16773},[235],[14,16775],{"className":16776},[8988,8989],[14,16778,16780],{"className":16779},[8949],[14,16781,16783,16932],{"className":16782},[8996,8997],[14,16784,16786,16929],{"className":16785},[9001],[14,16787,16790,16846,16854],{"className":16788,"style":16789},[9005],"height:0.8884em;",[14,16791,16792,16795],{"style":9009},[14,16793],{"className":16794,"style":9014},[9013],[14,16796,16798],{"className":16797},[9018,9019,9020,9021],[14,16799,16801],{"className":16800},[235,9021],[14,16802,16804,16807],{"className":16803},[235,9021],[14,16805,8776],{"className":16806,"style":12945},[235,8903,9021],[14,16808,16810],{"className":16809},[9517],[14,16811,16813,16837],{"className":16812},[8996,8997],[14,16814,16816,16834],{"className":16815},[9001],[14,16817,16820],{"className":16818,"style":16819},[9005],"height:0.1645em;",[14,16821,16823,16827],{"style":16822},"top:-2.357em;margin-left:-0.0576em;margin-right:0.0714em;",[14,16824],{"className":16825,"style":16826},[9013],"height:2.5em;",[14,16828,16831],{"className":16829},[9018,16830,10294,9021],"reset-size3",[14,16832,8887],{"className":16833},[235,8903,9021],[14,16835,9058],{"className":16836},[9057],[14,16838,16840],{"className":16839},[9001],[14,16841,16844],{"className":16842,"style":16843},[9005],"height:0.143em;",[14,16845],{},[14,16847,16848,16851],{"style":9030},[14,16849],{"className":16850,"style":9014},[9013],[14,16852],{"className":16853,"style":9038},[9037],[14,16855,16857,16860],{"style":16856},"top:-3.4101em;",[14,16858],{"className":16859,"style":9014},[9013],[14,16861,16863],{"className":16862},[9018,9019,9020,9021],[14,16864,16866,16869,16873,16876,16879,16882,16885,16888],{"className":16865},[235,9021],[14,16867,1031],{"className":16868},[235,9021],[14,16870],{"className":16871,"style":16872},[239,9021],"margin-right:0.1952em;",[14,16874,10045],{"className":16875},[235,8903,9021],[14,16877,8887],{"className":16878},[235,8903,9021],[14,16880,9136],{"className":16881},[244,9021],[14,16883,16678],{"className":16884,"style":12945},[235,8903,9021],[14,16886,9136],{"className":16887},[244,9021],[14,16889,16891,16894],{"className":16890},[235,9021],[14,16892,8845],{"className":16893,"style":13006},[235,8903,9021],[14,16895,16897],{"className":16896},[9517],[14,16898,16900,16921],{"className":16899},[8996,8997],[14,16901,16903,16918],{"className":16902},[9001],[14,16904,16906],{"className":16905,"style":16819},[9005],[14,16907,16909,16912],{"style":16908},"top:-2.357em;margin-left:-0.1389em;margin-right:0.0714em;",[14,16910],{"className":16911,"style":16826},[9013],[14,16913,16915],{"className":16914},[9018,16830,10294,9021],[14,16916,8887],{"className":16917},[235,8903,9021],[14,16919,9058],{"className":16920},[9057],[14,16922,16924],{"className":16923},[9001],[14,16925,16927],{"className":16926,"style":16843},[9005],[14,16928],{},[14,16930,9058],{"className":16931},[9057],[14,16933,16935],{"className":16934},[9001],[14,16936,16939],{"className":16937,"style":16938},[9005],"height:0.4451em;",[14,16940],{},[14,16942],{"className":16943},[9071,8989],[11,16945,16946,16947,16975,16976,17045,17046,17106,17107,17186,17187,17246,17247,17306],{},"where ",[14,16948,16950,16963],{"className":16949},[188],[14,16951,16953],{"className":16952},[192],[194,16954,16955],{"xmlns":196},[198,16956,16957,16961],{},[201,16958,16959],{},[8885,16960,16678],{},[214,16962,16678],{"encoding":216},[14,16964,16966],{"className":16965,"ariaHidden":222},[221],[14,16967,16969,16972],{"className":16968},[226],[14,16970],{"className":16971,"style":15506},[230],[14,16973,16678],{"className":16974,"style":12945},[235,8903]," is the screen edge (0 or 640). The three refinement rounds set ",[14,16977,16979,16996],{"className":16978},[188],[14,16980,16982],{"className":16981},[192],[194,16983,16984],{"xmlns":196},[198,16985,16986,16994],{},[201,16987,16988],{},[9559,16989,16990,16992],{},[8885,16991,8776],{},[8885,16993,8887],{},[214,16995,13068],{"encoding":216},[14,16997,16999],{"className":16998,"ariaHidden":222},[221],[14,17000,17002,17005],{"className":17001},[226],[14,17003],{"className":17004,"style":9715},[230],[14,17006,17008,17011],{"className":17007},[235],[14,17009,8776],{"className":17010,"style":12945},[235,8903],[14,17012,17014],{"className":17013},[9517],[14,17015,17017,17037],{"className":17016},[8996,8997],[14,17018,17020,17034],{"className":17019},[9001],[14,17021,17023],{"className":17022,"style":12900},[9005],[14,17024,17025,17028],{"style":12960},[14,17026],{"className":17027,"style":9533},[9013],[14,17029,17031],{"className":17030},[9018,9019,9020,9021],[14,17032,8887],{"className":17033},[235,8903,9021],[14,17035,9058],{"className":17036},[9057],[14,17038,17040],{"className":17039},[9001],[14,17041,17043],{"className":17042,"style":9630},[9005],[14,17044],{}," to ",[14,17047,17049,17067],{"className":17048},[188],[14,17050,17052],{"className":17051},[192],[194,17053,17054],{"xmlns":196},[198,17055,17056,17064],{},[201,17057,17058],{},[9488,17059,17060,17062],{},[204,17061,1031],{},[8885,17063,10040],{},[214,17065,17066],{"encoding":216},"2^d",[14,17068,17070],{"className":17069,"ariaHidden":222},[221],[14,17071,17073,17077],{"className":17072},[226],[14,17074],{"className":17075,"style":17076},[230],"height:0.8491em;",[14,17078,17080,17083],{"className":17079},[235],[14,17081,1031],{"className":17082},[235],[14,17084,17086],{"className":17085},[9517],[14,17087,17089],{"className":17088},[8996],[14,17090,17092],{"className":17091},[9001],[14,17093,17095],{"className":17094,"style":17076},[9005],[14,17096,17097,17100],{"style":9529},[14,17098],{"className":17099,"style":9533},[9013],[14,17101,17103],{"className":17102},[9018,9019,9020,9021],[14,17104,10040],{"className":17105},[235,8903,9021]," times the coarse-search scale, with ",[14,17108,17110,17136],{"className":17109},[188],[14,17111,17113],{"className":17112},[192],[194,17114,17115],{"xmlns":196},[198,17116,17117,17133],{},[201,17118,17119,17121,17123,17125,17127,17129,17131],{},[8885,17120,10040],{},[208,17122,988],{},[204,17124,1143],{},[208,17126,8968],{"separator":222},[204,17128,206],{},[208,17130,8968],{"separator":222},[204,17132,1148],{},[214,17134,17135],{"encoding":216},"d = 6, 11, 15",[14,17137,17139,17158],{"className":17138,"ariaHidden":222},[221],[14,17140,17142,17146,17149,17152,17155],{"className":17141},[226],[14,17143],{"className":17144,"style":17145},[230],"height:0.6944em;",[14,17147,10040],{"className":17148},[235,8903],[14,17150],{"className":17151,"style":9075},[239],[14,17153,988],{"className":17154},[9079],[14,17156],{"className":17157,"style":9075},[239],[14,17159,17161,17164,17167,17170,17174,17177,17180,17183],{"className":17160},[226],[14,17162],{"className":17163,"style":9108},[230],[14,17165,1143],{"className":17166},[235],[14,17168,8968],{"className":17169},[9118],[14,17171],{"className":17172,"style":17173},[239],"margin-right:0.1667em;",[14,17175,206],{"className":17176},[235],[14,17178,8968],{"className":17179},[9118],[14,17181],{"className":17182,"style":17173},[239],[14,17184,1148],{"className":17185},[235],"; successive rounds therefore zoom in by ",[14,17188,17190,17208],{"className":17189},[188],[14,17191,17193],{"className":17192},[192],[194,17194,17195],{"xmlns":196},[198,17196,17197,17205],{},[201,17198,17199],{},[9488,17200,17201,17203],{},[204,17202,1031],{},[204,17204,5283],{},[214,17206,17207],{"encoding":216},"2^5",[14,17209,17211],{"className":17210,"ariaHidden":222},[221],[14,17212,17214,17217],{"className":17213},[226],[14,17215],{"className":17216,"style":9507},[230],[14,17218,17220,17223],{"className":17219},[235],[14,17221,1031],{"className":17222},[235],[14,17224,17226],{"className":17225},[9517],[14,17227,17229],{"className":17228},[8996],[14,17230,17232],{"className":17231},[9001],[14,17233,17235],{"className":17234,"style":9507},[9005],[14,17236,17237,17240],{"style":9529},[14,17238],{"className":17239,"style":9533},[9013],[14,17241,17243],{"className":17242},[9018,9019,9020,9021],[14,17244,5283],{"className":17245},[235,9021]," then ",[14,17248,17250,17268],{"className":17249},[188],[14,17251,17253],{"className":17252},[192],[194,17254,17255],{"xmlns":196},[198,17256,17257,17265],{},[201,17258,17259],{},[9488,17260,17261,17263],{},[204,17262,1031],{},[204,17264,1711],{},[214,17266,17267],{"encoding":216},"2^4",[14,17269,17271],{"className":17270,"ariaHidden":222},[221],[14,17272,17274,17277],{"className":17273},[226],[14,17275],{"className":17276,"style":9507},[230],[14,17278,17280,17283],{"className":17279},[235],[14,17281,1031],{"className":17282},[235],[14,17284,17286],{"className":17285},[9517],[14,17287,17289],{"className":17288},[8996],[14,17290,17292],{"className":17291},[9001],[14,17293,17295],{"className":17294,"style":9507},[9005],[14,17296,17297,17300],{"style":9529},[14,17298],{"className":17299,"style":9533},[9013],[14,17301,17303],{"className":17302},[9018,9019,9020,9021],[14,17304,1711],{"className":17305},[235,9021],", re-centering the viewport to resolve progressively finer mantissa bits.",[11,17308,17309],{},"Each readback probe reads from the already corrupted and cached path in GPU memory, without re-triggering the expensive 1.43B-verb cascade. This asymmetry lets us probe 4-9 times per c1read without incurring massive performance costs.",[9286,17311,17312],{"type":9288},[11,17313,17314],{},"Power-of-2 scaling avoids mantissa rounding; Sterbenz's Lemma makes the GPU's subtraction exact. Each probe refines the float without losing bits.",[11,17316,17317],{},"Rendering on a canvas is a 2-dimensional operation. However, if the line is axis-aligned then we can reduce the problem into the solvable 1D one above. Let's handle the easy case first.",[8422,17319,17321],{"id":17320},"leaking-aslr-vptr","Leaking ASLR (vptr)",[11,17323,17324],{},"The ASLR leak relies on three known inputs. First, we know the heap address of the RasterDecoderImpl object, which was leaked via the Logger earlier. This heap address allows us to forge a pointer W to point inside the object. Second, we know the relative layout of the compiled chrome.so library, including the build-constant offsets (Relative Virtual Addresses, or RVAs) between symbols and the load base. Third, we know that chrome.so is aligned to a 4 KiB page boundary, so the low 12 bits of any library pointer are predictable.",[11,17326,17327],{},"What we do not know is the randomized load address of chrome.so (chrome_base) or the absolute 64-bit virtual addresses of its vtable pointers.",[11,17329,17330],{},"To locate chrome_base, we must resolve the absolute value of the primary vtable pointer. RasterDecoderImpl uses multiple inheritance, meaning the compiler places two vtable pointers at the start of the object: vptr1 at offset 0x00, and vptr2 (which points to vptr1 + 0x260) at offset 0x08. Because both point into the same read-only segment of chrome.so and differ only by the static 0x260 offset, their middle bytes (2..5) are usually identical.",[11,17332,17333],{},"By setting the forged coordinate array pointer W to decoder + 2, we force Skia to read the object memory as point coordinates. Each point in a path is represented as an SkPoint struct, consisting of two 32-bit floats (fX and fY). This results in the following little-endian byte alignment:",[17335,17336],"diagram-bytes",{":columns":17337,":rows":17338,":brackets":17339,":pointer":17340,"columnNote":17341},"[\"0\",\"1\",\"2\",\"3\",\"4\",\"5\",\"6\",\"7\",\"8\",\"9\",\"A\",\"B\",\"C\",\"D\",\"E\",\"F\",\"\",\"\"]","[{\"fields\":[{\"label\":\"vptr1\",\"start\":0,\"span\":8},{\"label\":\"vptr2\",\"start\":8,\"span\":8}]},{\"fields\":[{\"label\":\"vptr1[0..1]\",\"start\":0,\"span\":2},{\"label\":\"vptr1[2..5]\",\"start\":2,\"span\":4},{\"label\":\"vptr1[6..7]\",\"start\":6,\"span\":2},{\"label\":\"vptr2[0..1]\",\"start\":8,\"span\":2},{\"label\":\"vptr2[2..5]\",\"start\":10,\"span\":4},{\"label\":\"vptr2[6..7]\",\"start\":14,\"span\":2}]},{\"fields\":[{\"label\":\"P0.x\",\"sub\":\"(float32)\",\"start\":2,\"span\":4},{\"label\":\"P0.y\",\"sub\":\"(float32)\",\"start\":6,\"span\":4},{\"label\":\"P1.x\",\"sub\":\"(float32)\",\"start\":10,\"span\":4},{\"label\":\"P1.y\",\"sub\":\"(float32)\",\"start\":14,\"span\":4}]}]","[{\"label\":\"Point P0\",\"start\":2,\"span\":8},{\"label\":\"Point P1\",\"start\":10,\"span\":8}]","{\"label\":\"W = decoder + 2\",\"atColumn\":2}","(Offset)",[11,17343,17344],{},"Since W starts at decoder + 2:",[299,17346,17347,17616,17894],{},[302,17348,17349,17429,17430,17533,17534,8699],{},[14,17350,17352,17374],{"className":17351},[188],[14,17353,17355],{"className":17354},[192],[194,17356,17357],{"xmlns":196},[198,17358,17359,17371],{},[201,17360,17361],{},[9559,17362,17363,17365],{},[8885,17364,12010],{},[201,17366,17367,17369],{},[204,17368,540],{},[8885,17370,8887],{},[214,17372,17373],{"encoding":216},"P_{0x}",[14,17375,17377],{"className":17376,"ariaHidden":222},[221],[14,17378,17380,17383],{"className":17379},[226],[14,17381],{"className":17382,"style":9715},[230],[14,17384,17386,17389],{"className":17385},[235],[14,17387,12010],{"className":17388,"style":13006},[235,8903],[14,17390,17392],{"className":17391},[9517],[14,17393,17395,17421],{"className":17394},[8996,8997],[14,17396,17398,17418],{"className":17397},[9001],[14,17399,17401],{"className":17400,"style":9605},[9005],[14,17402,17403,17406],{"style":13021},[14,17404],{"className":17405,"style":9533},[9013],[14,17407,17409],{"className":17408},[9018,9019,9020,9021],[14,17410,17412,17415],{"className":17411},[235,9021],[14,17413,540],{"className":17414},[235,9021],[14,17416,8887],{"className":17417},[235,8903,9021],[14,17419,9058],{"className":17420},[9057],[14,17422,17424],{"className":17423},[9001],[14,17425,17427],{"className":17426,"style":9630},[9005],[14,17428],{}," overlays ",[14,17431,17433,17468],{"className":17432},[188],[14,17434,17436],{"className":17435},[192],[194,17437,17438],{"xmlns":196},[198,17439,17440,17465],{},[201,17441,17442,17456,17459,17462],{},[9559,17443,17444,17454],{},[201,17445,17446,17448,17450,17452],{},[8885,17447,11320],{"mathvariant":9648},[8885,17449,11],{"mathvariant":9648},[8885,17451,9967],{"mathvariant":9648},[8885,17453,9667],{"mathvariant":9648},[204,17455,328],{},[208,17457,17458],{"stretchy":9853},"[",[204,17460,17461],{},"2..5",[208,17463,17464],{"stretchy":9853},"]",[214,17466,17467],{"encoding":216},"\\mathrm{vptr}_1[2..5]",[14,17469,17471],{"className":17470,"ariaHidden":222},[221],[14,17472,17474,17477,17524,17527,17530],{"className":17473},[226],[14,17475],{"className":17476,"style":14909},[230],[14,17478,17480,17487],{"className":17479},[235],[14,17481,17483],{"className":17482},[235],[14,17484,17486],{"className":17485},[235,9699],"vptr",[14,17488,17490],{"className":17489},[9517],[14,17491,17493,17515],{"className":17492},[8996,8997],[14,17494,17496,17512],{"className":17495},[9001],[14,17497,17500],{"className":17498,"style":17499},[9005],"height:0.207em;",[14,17501,17503,17506],{"style":17502},"top:-2.4559em;margin-right:0.05em;",[14,17504],{"className":17505,"style":9533},[9013],[14,17507,17509],{"className":17508},[9018,9019,9020,9021],[14,17510,328],{"className":17511},[235,9021],[14,17513,9058],{"className":17514},[9057],[14,17516,17518],{"className":17517},[9001],[14,17519,17522],{"className":17520,"style":17521},[9005],"height:0.2441em;",[14,17523],{},[14,17525,17458],{"className":17526},[8988],[14,17528,17461],{"className":17529},[235],[14,17531,17464],{"className":17532},[9071]," (middle bytes of ",[14,17535,17537,17563],{"className":17536},[188],[14,17538,17540],{"className":17539},[192],[194,17541,17542],{"xmlns":196},[198,17543,17544,17560],{},[201,17545,17546],{},[9559,17547,17548,17558],{},[201,17549,17550,17552,17554,17556],{},[8885,17551,11320],{"mathvariant":9648},[8885,17553,11],{"mathvariant":9648},[8885,17555,9967],{"mathvariant":9648},[8885,17557,9667],{"mathvariant":9648},[204,17559,328],{},[214,17561,17562],{"encoding":216},"\\mathrm{vptr}_1",[14,17564,17566],{"className":17565,"ariaHidden":222},[221],[14,17567,17569,17573],{"className":17568},[226],[14,17570],{"className":17571,"style":17572},[230],"height:0.8592em;vertical-align:-0.2441em;",[14,17574,17576,17582],{"className":17575},[235],[14,17577,17579],{"className":17578},[235],[14,17580,17486],{"className":17581},[235,9699],[14,17583,17585],{"className":17584},[9517],[14,17586,17588,17608],{"className":17587},[8996,8997],[14,17589,17591,17605],{"className":17590},[9001],[14,17592,17594],{"className":17593,"style":17499},[9005],[14,17595,17596,17599],{"style":17502},[14,17597],{"className":17598,"style":9533},[9013],[14,17600,17602],{"className":17601},[9018,9019,9020,9021],[14,17603,328],{"className":17604},[235,9021],[14,17606,9058],{"className":17607},[9057],[14,17609,17611],{"className":17610},[9001],[14,17612,17614],{"className":17613,"style":17521},[9005],[14,17615],{},[302,17617,17618,17429,17700,8498,17797],{},[14,17619,17621,17643],{"className":17620},[188],[14,17622,17624],{"className":17623},[192],[194,17625,17626],{"xmlns":196},[198,17627,17628,17640],{},[201,17629,17630],{},[9559,17631,17632,17634],{},[8885,17633,12010],{},[201,17635,17636,17638],{},[204,17637,540],{},[8885,17639,8918],{},[214,17641,17642],{"encoding":216},"P_{0y}",[14,17644,17646],{"className":17645,"ariaHidden":222},[221],[14,17647,17649,17653],{"className":17648},[226],[14,17650],{"className":17651,"style":17652},[230],"height:0.9694em;vertical-align:-0.2861em;",[14,17654,17656,17659],{"className":17655},[235],[14,17657,12010],{"className":17658,"style":13006},[235,8903],[14,17660,17662],{"className":17661},[9517],[14,17663,17665,17691],{"className":17664},[8996,8997],[14,17666,17668,17688],{"className":17667},[9001],[14,17669,17671],{"className":17670,"style":9605},[9005],[14,17672,17673,17676],{"style":13021},[14,17674],{"className":17675,"style":9533},[9013],[14,17677,17679],{"className":17678},[9018,9019,9020,9021],[14,17680,17682,17685],{"className":17681},[235,9021],[14,17683,540],{"className":17684},[235,9021],[14,17686,8918],{"className":17687,"style":8934},[235,8903,9021],[14,17689,9058],{"className":17690},[9057],[14,17692,17694],{"className":17693},[9001],[14,17695,17698],{"className":17696,"style":17697},[9005],"height:0.2861em;",[14,17699],{},[14,17701,17703,17736],{"className":17702},[188],[14,17704,17706],{"className":17705},[192],[194,17707,17708],{"xmlns":196},[198,17709,17710,17733],{},[201,17711,17712,17726,17728,17731],{},[9559,17713,17714,17724],{},[201,17715,17716,17718,17720,17722],{},[8885,17717,11320],{"mathvariant":9648},[8885,17719,11],{"mathvariant":9648},[8885,17721,9967],{"mathvariant":9648},[8885,17723,9667],{"mathvariant":9648},[204,17725,328],{},[208,17727,17458],{"stretchy":9853},[204,17729,17730],{},"6..7",[208,17732,17464],{"stretchy":9853},[214,17734,17735],{"encoding":216},"\\mathrm{vptr}_1[6..7]",[14,17737,17739],{"className":17738,"ariaHidden":222},[221],[14,17740,17742,17745,17788,17791,17794],{"className":17741},[226],[14,17743],{"className":17744,"style":14909},[230],[14,17746,17748,17754],{"className":17747},[235],[14,17749,17751],{"className":17750},[235],[14,17752,17486],{"className":17753},[235,9699],[14,17755,17757],{"className":17756},[9517],[14,17758,17760,17780],{"className":17759},[8996,8997],[14,17761,17763,17777],{"className":17762},[9001],[14,17764,17766],{"className":17765,"style":17499},[9005],[14,17767,17768,17771],{"style":17502},[14,17769],{"className":17770,"style":9533},[9013],[14,17772,17774],{"className":17773},[9018,9019,9020,9021],[14,17775,328],{"className":17776},[235,9021],[14,17778,9058],{"className":17779},[9057],[14,17781,17783],{"className":17782},[9001],[14,17784,17786],{"className":17785,"style":17521},[9005],[14,17787],{},[14,17789,17458],{"className":17790},[8988],[14,17792,17730],{"className":17793},[235],[14,17795,17464],{"className":17796},[9071],[14,17798,17800,17833],{"className":17799},[188],[14,17801,17803],{"className":17802},[192],[194,17804,17805],{"xmlns":196},[198,17806,17807,17830],{},[201,17808,17809,17823,17825,17828],{},[9559,17810,17811,17821],{},[201,17812,17813,17815,17817,17819],{},[8885,17814,11320],{"mathvariant":9648},[8885,17816,11],{"mathvariant":9648},[8885,17818,9967],{"mathvariant":9648},[8885,17820,9667],{"mathvariant":9648},[204,17822,1031],{},[208,17824,17458],{"stretchy":9853},[204,17826,17827],{},"0..1",[208,17829,17464],{"stretchy":9853},[214,17831,17832],{"encoding":216},"\\mathrm{vptr}_2[0..1]",[14,17834,17836],{"className":17835,"ariaHidden":222},[221],[14,17837,17839,17842,17885,17888,17891],{"className":17838},[226],[14,17840],{"className":17841,"style":14909},[230],[14,17843,17845,17851],{"className":17844},[235],[14,17846,17848],{"className":17847},[235],[14,17849,17486],{"className":17850},[235,9699],[14,17852,17854],{"className":17853},[9517],[14,17855,17857,17877],{"className":17856},[8996,8997],[14,17858,17860,17874],{"className":17859},[9001],[14,17861,17863],{"className":17862,"style":17499},[9005],[14,17864,17865,17868],{"style":17502},[14,17866],{"className":17867,"style":9533},[9013],[14,17869,17871],{"className":17870},[9018,9019,9020,9021],[14,17872,1031],{"className":17873},[235,9021],[14,17875,9058],{"className":17876},[9057],[14,17878,17880],{"className":17879},[9001],[14,17881,17883],{"className":17882,"style":17521},[9005],[14,17884],{},[14,17886,17458],{"className":17887},[8988],[14,17889,17827],{"className":17890},[235],[14,17892,17464],{"className":17893},[9071],[302,17895,17896,17429,17976,17533,18072,8699],{},[14,17897,17899,17921],{"className":17898},[188],[14,17900,17902],{"className":17901},[192],[194,17903,17904],{"xmlns":196},[198,17905,17906,17918],{},[201,17907,17908],{},[9559,17909,17910,17912],{},[8885,17911,12010],{},[201,17913,17914,17916],{},[204,17915,328],{},[8885,17917,8887],{},[214,17919,17920],{"encoding":216},"P_{1x}",[14,17922,17924],{"className":17923,"ariaHidden":222},[221],[14,17925,17927,17930],{"className":17926},[226],[14,17928],{"className":17929,"style":9715},[230],[14,17931,17933,17936],{"className":17932},[235],[14,17934,12010],{"className":17935,"style":13006},[235,8903],[14,17937,17939],{"className":17938},[9517],[14,17940,17942,17968],{"className":17941},[8996,8997],[14,17943,17945,17965],{"className":17944},[9001],[14,17946,17948],{"className":17947,"style":9605},[9005],[14,17949,17950,17953],{"style":13021},[14,17951],{"className":17952,"style":9533},[9013],[14,17954,17956],{"className":17955},[9018,9019,9020,9021],[14,17957,17959,17962],{"className":17958},[235,9021],[14,17960,328],{"className":17961},[235,9021],[14,17963,8887],{"className":17964},[235,8903,9021],[14,17966,9058],{"className":17967},[9057],[14,17969,17971],{"className":17970},[9001],[14,17972,17974],{"className":17973,"style":9630},[9005],[14,17975],{},[14,17977,17979,18011],{"className":17978},[188],[14,17980,17982],{"className":17981},[192],[194,17983,17984],{"xmlns":196},[198,17985,17986,18008],{},[201,17987,17988,18002,18004,18006],{},[9559,17989,17990,18000],{},[201,17991,17992,17994,17996,17998],{},[8885,17993,11320],{"mathvariant":9648},[8885,17995,11],{"mathvariant":9648},[8885,17997,9967],{"mathvariant":9648},[8885,17999,9667],{"mathvariant":9648},[204,18001,1031],{},[208,18003,17458],{"stretchy":9853},[204,18005,17461],{},[208,18007,17464],{"stretchy":9853},[214,18009,18010],{"encoding":216},"\\mathrm{vptr}_2[2..5]",[14,18012,18014],{"className":18013,"ariaHidden":222},[221],[14,18015,18017,18020,18063,18066,18069],{"className":18016},[226],[14,18018],{"className":18019,"style":14909},[230],[14,18021,18023,18029],{"className":18022},[235],[14,18024,18026],{"className":18025},[235],[14,18027,17486],{"className":18028},[235,9699],[14,18030,18032],{"className":18031},[9517],[14,18033,18035,18055],{"className":18034},[8996,8997],[14,18036,18038,18052],{"className":18037},[9001],[14,18039,18041],{"className":18040,"style":17499},[9005],[14,18042,18043,18046],{"style":17502},[14,18044],{"className":18045,"style":9533},[9013],[14,18047,18049],{"className":18048},[9018,9019,9020,9021],[14,18050,1031],{"className":18051},[235,9021],[14,18053,9058],{"className":18054},[9057],[14,18056,18058],{"className":18057},[9001],[14,18059,18061],{"className":18060,"style":17521},[9005],[14,18062],{},[14,18064,17458],{"className":18065},[8988],[14,18067,17461],{"className":18068},[235],[14,18070,17464],{"className":18071},[9071],[14,18073,18075,18101],{"className":18074},[188],[14,18076,18078],{"className":18077},[192],[194,18079,18080],{"xmlns":196},[198,18081,18082,18098],{},[201,18083,18084],{},[9559,18085,18086,18096],{},[201,18087,18088,18090,18092,18094],{},[8885,18089,11320],{"mathvariant":9648},[8885,18091,11],{"mathvariant":9648},[8885,18093,9967],{"mathvariant":9648},[8885,18095,9667],{"mathvariant":9648},[204,18097,1031],{},[214,18099,18100],{"encoding":216},"\\mathrm{vptr}_2",[14,18102,18104],{"className":18103,"ariaHidden":222},[221],[14,18105,18107,18110],{"className":18106},[226],[14,18108],{"className":18109,"style":17572},[230],[14,18111,18113,18119],{"className":18112},[235],[14,18114,18116],{"className":18115},[235],[14,18117,17486],{"className":18118},[235,9699],[14,18120,18122],{"className":18121},[9517],[14,18123,18125,18145],{"className":18124},[8996,8997],[14,18126,18128,18142],{"className":18127},[9001],[14,18129,18131],{"className":18130,"style":17499},[9005],[14,18132,18133,18136],{"style":17502},[14,18134],{"className":18135,"style":9533},[9013],[14,18137,18139],{"className":18138},[9018,9019,9020,9021],[14,18140,1031],{"className":18141},[235,9021],[14,18143,9058],{"className":18144},[9057],[14,18146,18148],{"className":18147},[9001],[14,18149,18151],{"className":18150,"style":17521},[9005],[14,18152],{},[11,18154,18155,18156,8498,18236,18316,18317,18502,18503,18582,18583,18662,18663,18742],{},"Because the middle bytes of ",[14,18157,18159,18184],{"className":18158},[188],[14,18160,18162],{"className":18161},[192],[194,18163,18164],{"xmlns":196},[198,18165,18166,18182],{},[201,18167,18168],{},[9559,18169,18170,18180],{},[201,18171,18172,18174,18176,18178],{},[8885,18173,11320],{"mathvariant":9648},[8885,18175,11],{"mathvariant":9648},[8885,18177,9967],{"mathvariant":9648},[8885,18179,9667],{"mathvariant":9648},[204,18181,328],{},[214,18183,17562],{"encoding":216},[14,18185,18187],{"className":18186,"ariaHidden":222},[221],[14,18188,18190,18193],{"className":18189},[226],[14,18191],{"className":18192,"style":17572},[230],[14,18194,18196,18202],{"className":18195},[235],[14,18197,18199],{"className":18198},[235],[14,18200,17486],{"className":18201},[235,9699],[14,18203,18205],{"className":18204},[9517],[14,18206,18208,18228],{"className":18207},[8996,8997],[14,18209,18211,18225],{"className":18210},[9001],[14,18212,18214],{"className":18213,"style":17499},[9005],[14,18215,18216,18219],{"style":17502},[14,18217],{"className":18218,"style":9533},[9013],[14,18220,18222],{"className":18221},[9018,9019,9020,9021],[14,18223,328],{"className":18224},[235,9021],[14,18226,9058],{"className":18227},[9057],[14,18229,18231],{"className":18230},[9001],[14,18232,18234],{"className":18233,"style":17521},[9005],[14,18235],{},[14,18237,18239,18264],{"className":18238},[188],[14,18240,18242],{"className":18241},[192],[194,18243,18244],{"xmlns":196},[198,18245,18246,18262],{},[201,18247,18248],{},[9559,18249,18250,18260],{},[201,18251,18252,18254,18256,18258],{},[8885,18253,11320],{"mathvariant":9648},[8885,18255,11],{"mathvariant":9648},[8885,18257,9967],{"mathvariant":9648},[8885,18259,9667],{"mathvariant":9648},[204,18261,1031],{},[214,18263,18100],{"encoding":216},[14,18265,18267],{"className":18266,"ariaHidden":222},[221],[14,18268,18270,18273],{"className":18269},[226],[14,18271],{"className":18272,"style":17572},[230],[14,18274,18276,18282],{"className":18275},[235],[14,18277,18279],{"className":18278},[235],[14,18280,17486],{"className":18281},[235,9699],[14,18283,18285],{"className":18284},[9517],[14,18286,18288,18308],{"className":18287},[8996,8997],[14,18289,18291,18305],{"className":18290},[9001],[14,18292,18294],{"className":18293,"style":17499},[9005],[14,18295,18296,18299],{"style":17502},[14,18297],{"className":18298,"style":9533},[9013],[14,18300,18302],{"className":18301},[9018,9019,9020,9021],[14,18303,1031],{"className":18304},[235,9021],[14,18306,9058],{"className":18307},[9057],[14,18309,18311],{"className":18310},[9001],[14,18312,18314],{"className":18313,"style":17521},[9005],[14,18315],{}," are identical (",[14,18318,18320,18374],{"className":18319},[188],[14,18321,18323],{"className":18322},[192],[194,18324,18325],{"xmlns":196},[198,18326,18327,18371],{},[201,18328,18329,18343,18345,18347,18349,18351,18365,18367,18369],{},[9559,18330,18331,18341],{},[201,18332,18333,18335,18337,18339],{},[8885,18334,11320],{"mathvariant":9648},[8885,18336,11],{"mathvariant":9648},[8885,18338,9967],{"mathvariant":9648},[8885,18340,9667],{"mathvariant":9648},[204,18342,328],{},[208,18344,17458],{"stretchy":9853},[204,18346,17461],{},[208,18348,17464],{"stretchy":9853},[208,18350,988],{},[9559,18352,18353,18363],{},[201,18354,18355,18357,18359,18361],{},[8885,18356,11320],{"mathvariant":9648},[8885,18358,11],{"mathvariant":9648},[8885,18360,9967],{"mathvariant":9648},[8885,18362,9667],{"mathvariant":9648},[204,18364,1031],{},[208,18366,17458],{"stretchy":9853},[204,18368,17461],{},[208,18370,17464],{"stretchy":9853},[214,18372,18373],{"encoding":216},"\\mathrm{vptr}_1[2..5] = \\mathrm{vptr}_2[2..5]",[14,18375,18377,18444],{"className":18376,"ariaHidden":222},[221],[14,18378,18380,18383,18426,18429,18432,18435,18438,18441],{"className":18379},[226],[14,18381],{"className":18382,"style":14909},[230],[14,18384,18386,18392],{"className":18385},[235],[14,18387,18389],{"className":18388},[235],[14,18390,17486],{"className":18391},[235,9699],[14,18393,18395],{"className":18394},[9517],[14,18396,18398,18418],{"className":18397},[8996,8997],[14,18399,18401,18415],{"className":18400},[9001],[14,18402,18404],{"className":18403,"style":17499},[9005],[14,18405,18406,18409],{"style":17502},[14,18407],{"className":18408,"style":9533},[9013],[14,18410,18412],{"className":18411},[9018,9019,9020,9021],[14,18413,328],{"className":18414},[235,9021],[14,18416,9058],{"className":18417},[9057],[14,18419,18421],{"className":18420},[9001],[14,18422,18424],{"className":18423,"style":17521},[9005],[14,18425],{},[14,18427,17458],{"className":18428},[8988],[14,18430,17461],{"className":18431},[235],[14,18433,17464],{"className":18434},[9071],[14,18436],{"className":18437,"style":9075},[239],[14,18439,988],{"className":18440},[9079],[14,18442],{"className":18443,"style":9075},[239],[14,18445,18447,18450,18493,18496,18499],{"className":18446},[226],[14,18448],{"className":18449,"style":14909},[230],[14,18451,18453,18459],{"className":18452},[235],[14,18454,18456],{"className":18455},[235],[14,18457,17486],{"className":18458},[235,9699],[14,18460,18462],{"className":18461},[9517],[14,18463,18465,18485],{"className":18464},[8996,8997],[14,18466,18468,18482],{"className":18467},[9001],[14,18469,18471],{"className":18470,"style":17499},[9005],[14,18472,18473,18476],{"style":17502},[14,18474],{"className":18475,"style":9533},[9013],[14,18477,18479],{"className":18478},[9018,9019,9020,9021],[14,18480,1031],{"className":18481},[235,9021],[14,18483,9058],{"className":18484},[9057],[14,18486,18488],{"className":18487},[9001],[14,18489,18491],{"className":18490,"style":17521},[9005],[14,18492],{},[14,18494,17458],{"className":18495},[8988],[14,18497,17461],{"className":18498},[235],[14,18500,17464],{"className":18501},[9071],"), ",[14,18504,18506,18527],{"className":18505},[188],[14,18507,18509],{"className":18508},[192],[194,18510,18511],{"xmlns":196},[198,18512,18513,18525],{},[201,18514,18515],{},[9559,18516,18517,18519],{},[8885,18518,12010],{},[201,18520,18521,18523],{},[204,18522,540],{},[8885,18524,8887],{},[214,18526,17373],{"encoding":216},[14,18528,18530],{"className":18529,"ariaHidden":222},[221],[14,18531,18533,18536],{"className":18532},[226],[14,18534],{"className":18535,"style":9715},[230],[14,18537,18539,18542],{"className":18538},[235],[14,18540,12010],{"className":18541,"style":13006},[235,8903],[14,18543,18545],{"className":18544},[9517],[14,18546,18548,18574],{"className":18547},[8996,8997],[14,18549,18551,18571],{"className":18550},[9001],[14,18552,18554],{"className":18553,"style":9605},[9005],[14,18555,18556,18559],{"style":13021},[14,18557],{"className":18558,"style":9533},[9013],[14,18560,18562],{"className":18561},[9018,9019,9020,9021],[14,18563,18565,18568],{"className":18564},[235,9021],[14,18566,540],{"className":18567},[235,9021],[14,18569,8887],{"className":18570},[235,8903,9021],[14,18572,9058],{"className":18573},[9057],[14,18575,18577],{"className":18576},[9001],[14,18578,18580],{"className":18579,"style":9630},[9005],[14,18581],{}," is exactly equal to ",[14,18584,18586,18607],{"className":18585},[188],[14,18587,18589],{"className":18588},[192],[194,18590,18591],{"xmlns":196},[198,18592,18593,18605],{},[201,18594,18595],{},[9559,18596,18597,18599],{},[8885,18598,12010],{},[201,18600,18601,18603],{},[204,18602,328],{},[8885,18604,8887],{},[214,18606,17920],{"encoding":216},[14,18608,18610],{"className":18609,"ariaHidden":222},[221],[14,18611,18613,18616],{"className":18612},[226],[14,18614],{"className":18615,"style":9715},[230],[14,18617,18619,18622],{"className":18618},[235],[14,18620,12010],{"className":18621,"style":13006},[235,8903],[14,18623,18625],{"className":18624},[9517],[14,18626,18628,18654],{"className":18627},[8996,8997],[14,18629,18631,18651],{"className":18630},[9001],[14,18632,18634],{"className":18633,"style":9605},[9005],[14,18635,18636,18639],{"style":13021},[14,18637],{"className":18638,"style":9533},[9013],[14,18640,18642],{"className":18641},[9018,9019,9020,9021],[14,18643,18645,18648],{"className":18644},[235,9021],[14,18646,328],{"className":18647},[235,9021],[14,18649,8887],{"className":18650},[235,8903,9021],[14,18652,9058],{"className":18653},[9057],[14,18655,18657],{"className":18656},[9001],[14,18658,18660],{"className":18659,"style":9630},[9005],[14,18661],{},". When Skia processes this path in GrStyledShape::simplifyStroke, the identical X coordinates force the stroke to simplify into a perfectly straight, vertical line. This allows us to feed ",[14,18664,18666,18687],{"className":18665},[188],[14,18667,18669],{"className":18668},[192],[194,18670,18671],{"xmlns":196},[198,18672,18673,18685],{},[201,18674,18675],{},[9559,18676,18677,18679],{},[8885,18678,12010],{},[201,18680,18681,18683],{},[204,18682,540],{},[8885,18684,8887],{},[214,18686,17373],{"encoding":216},[14,18688,18690],{"className":18689,"ariaHidden":222},[221],[14,18691,18693,18696],{"className":18692},[226],[14,18694],{"className":18695,"style":9715},[230],[14,18697,18699,18702],{"className":18698},[235],[14,18700,12010],{"className":18701,"style":13006},[235,8903],[14,18703,18705],{"className":18704},[9517],[14,18706,18708,18734],{"className":18707},[8996,8997],[14,18709,18711,18731],{"className":18710},[9001],[14,18712,18714],{"className":18713,"style":9605},[9005],[14,18715,18716,18719],{"style":13021},[14,18717],{"className":18718,"style":9533},[9013],[14,18720,18722],{"className":18721},[9018,9019,9020,9021],[14,18723,18725,18728],{"className":18724},[235,9021],[14,18726,540],{"className":18727},[235,9021],[14,18729,8887],{"className":18730},[235,8903,9021],[14,18732,9058],{"className":18733},[9057],[14,18735,18737],{"className":18736},[9001],[14,18738,18740],{"className":18739,"style":9630},[9005],[14,18741],{}," directly into the 1D zoom search ladder described above to resolve the middle bytes.",[11,18744,18745,18746,8476],{},"However, the recovered middle bytes only pin the pointer to a 64 KiB window, leaving 16 possible 4 KiB pages. To resolve this ambiguity, we look at the companion coordinate ",[14,18747,18749,18770],{"className":18748},[188],[14,18750,18752],{"className":18751},[192],[194,18753,18754],{"xmlns":196},[198,18755,18756,18768],{},[201,18757,18758],{},[9559,18759,18760,18762],{},[8885,18761,12010],{},[201,18763,18764,18766],{},[204,18765,540],{},[8885,18767,8918],{},[214,18769,17642],{"encoding":216},[14,18771,18773],{"className":18772,"ariaHidden":222},[221],[14,18774,18776,18779],{"className":18775},[226],[14,18777],{"className":18778,"style":17652},[230],[14,18780,18782,18785],{"className":18781},[235],[14,18783,12010],{"className":18784,"style":13006},[235,8903],[14,18786,18788],{"className":18787},[9517],[14,18789,18791,18817],{"className":18790},[8996,8997],[14,18792,18794,18814],{"className":18793},[9001],[14,18795,18797],{"className":18796,"style":9605},[9005],[14,18798,18799,18802],{"style":13021},[14,18800],{"className":18801,"style":9533},[9013],[14,18803,18805],{"className":18804},[9018,9019,9020,9021],[14,18806,18808,18811],{"className":18807},[235,9021],[14,18809,540],{"className":18810},[235,9021],[14,18812,8918],{"className":18813,"style":8934},[235,8903,9021],[14,18815,9058],{"className":18816},[9057],[14,18818,18820],{"className":18819},[9001],[14,18821,18823],{"className":18822,"style":17697},[9005],[14,18824],{},[11,18826,18827,18828,1532,18908,19003,19004,19083],{},"In x86_64 user space, canonical pointers only use the low 48 bits, meaning the upper two bytes of ",[14,18829,18831,18856],{"className":18830},[188],[14,18832,18834],{"className":18833},[192],[194,18835,18836],{"xmlns":196},[198,18837,18838,18854],{},[201,18839,18840],{},[9559,18841,18842,18852],{},[201,18843,18844,18846,18848,18850],{},[8885,18845,11320],{"mathvariant":9648},[8885,18847,11],{"mathvariant":9648},[8885,18849,9967],{"mathvariant":9648},[8885,18851,9667],{"mathvariant":9648},[204,18853,328],{},[214,18855,17562],{"encoding":216},[14,18857,18859],{"className":18858,"ariaHidden":222},[221],[14,18860,18862,18865],{"className":18861},[226],[14,18863],{"className":18864,"style":17572},[230],[14,18866,18868,18874],{"className":18867},[235],[14,18869,18871],{"className":18870},[235],[14,18872,17486],{"className":18873},[235,9699],[14,18875,18877],{"className":18876},[9517],[14,18878,18880,18900],{"className":18879},[8996,8997],[14,18881,18883,18897],{"className":18882},[9001],[14,18884,18886],{"className":18885,"style":17499},[9005],[14,18887,18888,18891],{"style":17502},[14,18889],{"className":18890,"style":9533},[9013],[14,18892,18894],{"className":18893},[9018,9019,9020,9021],[14,18895,328],{"className":18896},[235,9021],[14,18898,9058],{"className":18899},[9057],[14,18901,18903],{"className":18902},[9001],[14,18904,18906],{"className":18905,"style":17521},[9005],[14,18907],{},[14,18909,18911,18942],{"className":18910},[188],[14,18912,18914],{"className":18913},[192],[194,18915,18916],{"xmlns":196},[198,18917,18918,18940],{},[201,18919,18920,18934,18936,18938],{},[9559,18921,18922,18932],{},[201,18923,18924,18926,18928,18930],{},[8885,18925,11320],{"mathvariant":9648},[8885,18927,11],{"mathvariant":9648},[8885,18929,9967],{"mathvariant":9648},[8885,18931,9667],{"mathvariant":9648},[204,18933,328],{},[208,18935,17458],{"stretchy":9853},[204,18937,17730],{},[208,18939,17464],{"stretchy":9853},[214,18941,17735],{"encoding":216},[14,18943,18945],{"className":18944,"ariaHidden":222},[221],[14,18946,18948,18951,18994,18997,19000],{"className":18947},[226],[14,18949],{"className":18950,"style":14909},[230],[14,18952,18954,18960],{"className":18953},[235],[14,18955,18957],{"className":18956},[235],[14,18958,17486],{"className":18959},[235,9699],[14,18961,18963],{"className":18962},[9517],[14,18964,18966,18986],{"className":18965},[8996,8997],[14,18967,18969,18983],{"className":18968},[9001],[14,18970,18972],{"className":18971,"style":17499},[9005],[14,18973,18974,18977],{"style":17502},[14,18975],{"className":18976,"style":9533},[9013],[14,18978,18980],{"className":18979},[9018,9019,9020,9021],[14,18981,328],{"className":18982},[235,9021],[14,18984,9058],{"className":18985},[9057],[14,18987,18989],{"className":18988},[9001],[14,18990,18992],{"className":18991,"style":17521},[9005],[14,18993],{},[14,18995,17458],{"className":18996},[8988],[14,18998,17730],{"className":18999},[235],[14,19001,17464],{"className":19002},[9071],") are always zero. In little-endian memory, ",[14,19005,19007,19028],{"className":19006},[188],[14,19008,19010],{"className":19009},[192],[194,19011,19012],{"xmlns":196},[198,19013,19014,19026],{},[201,19015,19016],{},[9559,19017,19018,19020],{},[8885,19019,12010],{},[201,19021,19022,19024],{},[204,19023,540],{},[8885,19025,8918],{},[214,19027,17642],{"encoding":216},[14,19029,19031],{"className":19030,"ariaHidden":222},[221],[14,19032,19034,19037],{"className":19033},[226],[14,19035],{"className":19036,"style":17652},[230],[14,19038,19040,19043],{"className":19039},[235],[14,19041,12010],{"className":19042,"style":13006},[235,8903],[14,19044,19046],{"className":19045},[9517],[14,19047,19049,19075],{"className":19048},[8996,8997],[14,19050,19052,19072],{"className":19051},[9001],[14,19053,19055],{"className":19054,"style":9605},[9005],[14,19056,19057,19060],{"style":13021},[14,19058],{"className":19059,"style":9533},[9013],[14,19061,19063],{"className":19062},[9018,9019,9020,9021],[14,19064,19066,19069],{"className":19065},[235,9021],[14,19067,540],{"className":19068},[235,9021],[14,19070,8918],{"className":19071,"style":8934},[235,8903,9021],[14,19073,9058],{"className":19074},[9057],[14,19076,19078],{"className":19077},[9001],[14,19079,19081],{"className":19080,"style":17697},[9005],[14,19082],{}," is read as:",[14,19085,19087],{"className":19086},[9765],[14,19088,19090,19324],{"className":19089},[188],[14,19091,19093],{"className":19092},[192],[194,19094,19095],{"xmlns":196,"display":9774},[198,19096,19097,19321],{},[9778,19098,19099,19236],{"rowspacing":9780,"columnalign":11940,"columnspacing":11941},[9784,19100,19101,19115],{},[9787,19102,19103],{},[9790,19104,19105],{"scriptlevel":540,"displaystyle":222},[9559,19106,19107,19109],{},[8885,19108,12010],{},[201,19110,19111,19113],{},[204,19112,540],{},[8885,19114,8918],{},[9787,19116,19117],{},[9790,19118,19119],{"scriptlevel":540,"displaystyle":222},[201,19120,19121,19123,19125,19127,19141,19143,19145,19147,19149,19152,19154,19156,19158,19172,19174,19176,19178,19180,19182,19184,19186,19188,19202,19204,19206,19208,19210,19212,19214,19216,19230,19232,19234],{},[201,19122],{},[208,19124,988],{},[208,19126,9330],{"stretchy":9853},[9559,19128,19129,19139],{},[201,19130,19131,19133,19135,19137],{},[8885,19132,11320],{"mathvariant":9648},[8885,19134,11],{"mathvariant":9648},[8885,19136,9967],{"mathvariant":9648},[8885,19138,9667],{"mathvariant":9648},[204,19140,1031],{},[208,19142,17458],{"stretchy":9853},[204,19144,328],{},[208,19146,17464],{"stretchy":9853},[208,19148,9861],{},[204,19150,19151],{},"24",[208,19153,8699],{"stretchy":9853},[208,19155,16031],{"mathvariant":9648,"lspace":9844,"rspace":9844},[208,19157,9330],{"stretchy":9853},[9559,19159,19160,19170],{},[201,19161,19162,19164,19166,19168],{},[8885,19163,11320],{"mathvariant":9648},[8885,19165,11],{"mathvariant":9648},[8885,19167,9967],{"mathvariant":9648},[8885,19169,9667],{"mathvariant":9648},[204,19171,1031],{},[208,19173,17458],{"stretchy":9853},[204,19175,540],{},[208,19177,17464],{"stretchy":9853},[208,19179,9861],{},[204,19181,9567],{},[208,19183,8699],{"stretchy":9853},[208,19185,16031],{"mathvariant":9648,"lspace":9844,"rspace":9844},[208,19187,9330],{"stretchy":9853},[9559,19189,19190,19200],{},[201,19191,19192,19194,19196,19198],{},[8885,19193,11320],{"mathvariant":9648},[8885,19195,11],{"mathvariant":9648},[8885,19197,9967],{"mathvariant":9648},[8885,19199,9667],{"mathvariant":9648},[204,19201,328],{},[208,19203,17458],{"stretchy":9853},[204,19205,534],{},[208,19207,17464],{"stretchy":9853},[208,19209,9861],{},[204,19211,1202],{},[208,19213,8699],{"stretchy":9853},[208,19215,16031],{"mathvariant":9648,"lspace":9844,"rspace":9844},[9559,19217,19218,19228],{},[201,19219,19220,19222,19224,19226],{},[8885,19221,11320],{"mathvariant":9648},[8885,19223,11],{"mathvariant":9648},[8885,19225,9967],{"mathvariant":9648},[8885,19227,9667],{"mathvariant":9648},[204,19229,328],{},[208,19231,17458],{"stretchy":9853},[204,19233,1143],{},[208,19235,17464],{"stretchy":9853},[9784,19237,19238,19244],{},[9787,19239,19240],{},[9790,19241,19242],{"scriptlevel":540,"displaystyle":222},[201,19243],{},[9787,19245,19246],{},[9790,19247,19248],{"scriptlevel":540,"displaystyle":222},[201,19249,19250,19252,19254,19256,19270,19272,19274,19276,19278,19280,19282,19284,19286,19300,19302,19304,19306,19308,19310,19312,19314],{},[201,19251],{},[208,19253,988],{},[208,19255,9330],{"stretchy":9853},[9559,19257,19258,19268],{},[201,19259,19260,19262,19264,19266],{},[8885,19261,11320],{"mathvariant":9648},[8885,19263,11],{"mathvariant":9648},[8885,19265,9967],{"mathvariant":9648},[8885,19267,9667],{"mathvariant":9648},[204,19269,1031],{},[208,19271,17458],{"stretchy":9853},[204,19273,328],{},[208,19275,17464],{"stretchy":9853},[208,19277,9861],{},[204,19279,19151],{},[208,19281,8699],{"stretchy":9853},[208,19283,16031],{"mathvariant":9648,"lspace":9844,"rspace":9844},[208,19285,9330],{"stretchy":9853},[9559,19287,19288,19298],{},[201,19289,19290,19292,19294,19296],{},[8885,19291,11320],{"mathvariant":9648},[8885,19293,11],{"mathvariant":9648},[8885,19295,9967],{"mathvariant":9648},[8885,19297,9667],{"mathvariant":9648},[204,19299,1031],{},[208,19301,17458],{"stretchy":9853},[204,19303,540],{},[208,19305,17464],{"stretchy":9853},[208,19307,9861],{},[204,19309,9567],{},[208,19311,8699],{"stretchy":9853},[208,19313,16031],{"mathvariant":9648,"lspace":9844,"rspace":9844},[9559,19315,19316,19319],{},[9562,19317,19318],{},"0000",[204,19320,9567],{},[214,19322,19323],{"encoding":216},"\\begin{aligned}\nP_{0y} &= (\\mathrm{vptr}_2[1] \\ll 24) \\mathbin{|} (\\mathrm{vptr}_2[0] \\ll 16) \\mathbin{|} (\\mathrm{vptr}_1[7] \\ll 8) \\mathbin{|} \\mathrm{vptr}_1[6] \\\\\n&= (\\mathrm{vptr}_2[1] \\ll 24) \\mathbin{|} (\\mathrm{vptr}_2[0] \\ll 16) \\mathbin{|} \\text{0000}_{16}\n\\end{aligned}",[14,19325,19327],{"className":19326,"ariaHidden":222},[221],[14,19328,19330,19334],{"className":19329},[226],[14,19331],{"className":19332,"style":19333},[230],"height:2.7em;vertical-align:-1.1em;",[14,19335,19337],{"className":19336},[235],[14,19338,19340,19429],{"className":19339},[9778],[14,19341,19343],{"className":19342},[10136],[14,19344,19346,19420],{"className":19345},[8996,8997],[14,19347,19349,19417],{"className":19348},[9001],[14,19350,19353,19408],{"className":19351,"style":19352},[9005],"height:1.6em;",[14,19354,19356,19359],{"style":19355},"top:-3.76em;",[14,19357],{"className":19358,"style":9014},[9013],[14,19360,19362],{"className":19361},[235],[14,19363,19365,19368],{"className":19364},[235],[14,19366,12010],{"className":19367,"style":13006},[235,8903],[14,19369,19371],{"className":19370},[9517],[14,19372,19374,19400],{"className":19373},[8996,8997],[14,19375,19377,19397],{"className":19376},[9001],[14,19378,19380],{"className":19379,"style":9605},[9005],[14,19381,19382,19385],{"style":13021},[14,19383],{"className":19384,"style":9533},[9013],[14,19386,19388],{"className":19387},[9018,9019,9020,9021],[14,19389,19391,19394],{"className":19390},[235,9021],[14,19392,540],{"className":19393},[235,9021],[14,19395,8918],{"className":19396,"style":8934},[235,8903,9021],[14,19398,9058],{"className":19399},[9057],[14,19401,19403],{"className":19402},[9001],[14,19404,19406],{"className":19405,"style":17697},[9005],[14,19407],{},[14,19409,19411,19414],{"style":19410},"top:-2.26em;",[14,19412],{"className":19413,"style":9014},[9013],[14,19415],{"className":19416},[235],[14,19418,9058],{"className":19419},[9057],[14,19421,19423],{"className":19422},[9001],[14,19424,19427],{"className":19425,"style":19426},[9005],"height:1.1em;",[14,19428],{},[14,19430,19432],{"className":19431},[10229],[14,19433,19435,19992],{"className":19434},[8996,8997],[14,19436,19438,19989],{"className":19437},[9001],[14,19439,19441,19759],{"className":19440,"style":19352},[9005],[14,19442,19443,19446],{"style":19355},[14,19444],{"className":19445,"style":9014},[9013],[14,19447,19449,19452,19455,19458,19461,19464,19507,19510,19513,19516,19519,19522,19525,19528,19531,19534,19540,19543,19546,19589,19592,19595,19598,19601,19604,19607,19610,19613,19616,19622,19625,19628,19671,19674,19677,19680,19683,19686,19689,19692,19695,19698,19704,19707,19750,19753,19756],{"className":19448},[235],[14,19450],{"className":19451},[235],[14,19453],{"className":19454,"style":9075},[239],[14,19456,988],{"className":19457},[9079],[14,19459],{"className":19460,"style":9075},[239],[14,19462,9330],{"className":19463},[8988],[14,19465,19467,19473],{"className":19466},[235],[14,19468,19470],{"className":19469},[235],[14,19471,17486],{"className":19472},[235,9699],[14,19474,19476],{"className":19475},[9517],[14,19477,19479,19499],{"className":19478},[8996,8997],[14,19480,19482,19496],{"className":19481},[9001],[14,19483,19485],{"className":19484,"style":17499},[9005],[14,19486,19487,19490],{"style":17502},[14,19488],{"className":19489,"style":9533},[9013],[14,19491,19493],{"className":19492},[9018,9019,9020,9021],[14,19494,1031],{"className":19495},[235,9021],[14,19497,9058],{"className":19498},[9057],[14,19500,19502],{"className":19501},[9001],[14,19503,19505],{"className":19504,"style":17521},[9005],[14,19506],{},[14,19508,17458],{"className":19509},[8988],[14,19511,328],{"className":19512},[235],[14,19514,17464],{"className":19515},[9071],[14,19517],{"className":19518,"style":9075},[239],[14,19520,9861],{"className":19521},[9079],[14,19523],{"className":19524,"style":9075},[239],[14,19526,19151],{"className":19527},[235],[14,19529,8699],{"className":19530},[9071],[14,19532],{"className":19533,"style":240},[239],[14,19535,19537],{"className":19536},[244],[14,19538,16031],{"className":19539},[235],[14,19541],{"className":19542,"style":240},[239],[14,19544,9330],{"className":19545},[8988],[14,19547,19549,19555],{"className":19548},[235],[14,19550,19552],{"className":19551},[235],[14,19553,17486],{"className":19554},[235,9699],[14,19556,19558],{"className":19557},[9517],[14,19559,19561,19581],{"className":19560},[8996,8997],[14,19562,19564,19578],{"className":19563},[9001],[14,19565,19567],{"className":19566,"style":17499},[9005],[14,19568,19569,19572],{"style":17502},[14,19570],{"className":19571,"style":9533},[9013],[14,19573,19575],{"className":19574},[9018,9019,9020,9021],[14,19576,1031],{"className":19577},[235,9021],[14,19579,9058],{"className":19580},[9057],[14,19582,19584],{"className":19583},[9001],[14,19585,19587],{"className":19586,"style":17521},[9005],[14,19588],{},[14,19590,17458],{"className":19591},[8988],[14,19593,540],{"className":19594},[235],[14,19596,17464],{"className":19597},[9071],[14,19599],{"className":19600,"style":9075},[239],[14,19602,9861],{"className":19603},[9079],[14,19605],{"className":19606,"style":9075},[239],[14,19608,9567],{"className":19609},[235],[14,19611,8699],{"className":19612},[9071],[14,19614],{"className":19615,"style":240},[239],[14,19617,19619],{"className":19618},[244],[14,19620,16031],{"className":19621},[235],[14,19623],{"className":19624,"style":240},[239],[14,19626,9330],{"className":19627},[8988],[14,19629,19631,19637],{"className":19630},[235],[14,19632,19634],{"className":19633},[235],[14,19635,17486],{"className":19636},[235,9699],[14,19638,19640],{"className":19639},[9517],[14,19641,19643,19663],{"className":19642},[8996,8997],[14,19644,19646,19660],{"className":19645},[9001],[14,19647,19649],{"className":19648,"style":17499},[9005],[14,19650,19651,19654],{"style":17502},[14,19652],{"className":19653,"style":9533},[9013],[14,19655,19657],{"className":19656},[9018,9019,9020,9021],[14,19658,328],{"className":19659},[235,9021],[14,19661,9058],{"className":19662},[9057],[14,19664,19666],{"className":19665},[9001],[14,19667,19669],{"className":19668,"style":17521},[9005],[14,19670],{},[14,19672,17458],{"className":19673},[8988],[14,19675,534],{"className":19676},[235],[14,19678,17464],{"className":19679},[9071],[14,19681],{"className":19682,"style":9075},[239],[14,19684,9861],{"className":19685},[9079],[14,19687],{"className":19688,"style":9075},[239],[14,19690,1202],{"className":19691},[235],[14,19693,8699],{"className":19694},[9071],[14,19696],{"className":19697,"style":240},[239],[14,19699,19701],{"className":19700},[244],[14,19702,16031],{"className":19703},[235],[14,19705],{"className":19706,"style":240},[239],[14,19708,19710,19716],{"className":19709},[235],[14,19711,19713],{"className":19712},[235],[14,19714,17486],{"className":19715},[235,9699],[14,19717,19719],{"className":19718},[9517],[14,19720,19722,19742],{"className":19721},[8996,8997],[14,19723,19725,19739],{"className":19724},[9001],[14,19726,19728],{"className":19727,"style":17499},[9005],[14,19729,19730,19733],{"style":17502},[14,19731],{"className":19732,"style":9533},[9013],[14,19734,19736],{"className":19735},[9018,9019,9020,9021],[14,19737,328],{"className":19738},[235,9021],[14,19740,9058],{"className":19741},[9057],[14,19743,19745],{"className":19744},[9001],[14,19746,19748],{"className":19747,"style":17521},[9005],[14,19749],{},[14,19751,17458],{"className":19752},[8988],[14,19754,1143],{"className":19755},[235],[14,19757,17464],{"className":19758},[9071],[14,19760,19761,19764],{"style":19410},[14,19762],{"className":19763,"style":9014},[9013],[14,19765,19767,19770,19773,19776,19779,19782,19825,19828,19831,19834,19837,19840,19843,19846,19849,19852,19858,19861,19864,19907,19910,19913,19916,19919,19922,19925,19928,19931,19934,19940,19943],{"className":19766},[235],[14,19768],{"className":19769},[235],[14,19771],{"className":19772,"style":9075},[239],[14,19774,988],{"className":19775},[9079],[14,19777],{"className":19778,"style":9075},[239],[14,19780,9330],{"className":19781},[8988],[14,19783,19785,19791],{"className":19784},[235],[14,19786,19788],{"className":19787},[235],[14,19789,17486],{"className":19790},[235,9699],[14,19792,19794],{"className":19793},[9517],[14,19795,19797,19817],{"className":19796},[8996,8997],[14,19798,19800,19814],{"className":19799},[9001],[14,19801,19803],{"className":19802,"style":17499},[9005],[14,19804,19805,19808],{"style":17502},[14,19806],{"className":19807,"style":9533},[9013],[14,19809,19811],{"className":19810},[9018,9019,9020,9021],[14,19812,1031],{"className":19813},[235,9021],[14,19815,9058],{"className":19816},[9057],[14,19818,19820],{"className":19819},[9001],[14,19821,19823],{"className":19822,"style":17521},[9005],[14,19824],{},[14,19826,17458],{"className":19827},[8988],[14,19829,328],{"className":19830},[235],[14,19832,17464],{"className":19833},[9071],[14,19835],{"className":19836,"style":9075},[239],[14,19838,9861],{"className":19839},[9079],[14,19841],{"className":19842,"style":9075},[239],[14,19844,19151],{"className":19845},[235],[14,19847,8699],{"className":19848},[9071],[14,19850],{"className":19851,"style":240},[239],[14,19853,19855],{"className":19854},[244],[14,19856,16031],{"className":19857},[235],[14,19859],{"className":19860,"style":240},[239],[14,19862,9330],{"className":19863},[8988],[14,19865,19867,19873],{"className":19866},[235],[14,19868,19870],{"className":19869},[235],[14,19871,17486],{"className":19872},[235,9699],[14,19874,19876],{"className":19875},[9517],[14,19877,19879,19899],{"className":19878},[8996,8997],[14,19880,19882,19896],{"className":19881},[9001],[14,19883,19885],{"className":19884,"style":17499},[9005],[14,19886,19887,19890],{"style":17502},[14,19888],{"className":19889,"style":9533},[9013],[14,19891,19893],{"className":19892},[9018,9019,9020,9021],[14,19894,1031],{"className":19895},[235,9021],[14,19897,9058],{"className":19898},[9057],[14,19900,19902],{"className":19901},[9001],[14,19903,19905],{"className":19904,"style":17521},[9005],[14,19906],{},[14,19908,17458],{"className":19909},[8988],[14,19911,540],{"className":19912},[235],[14,19914,17464],{"className":19915},[9071],[14,19917],{"className":19918,"style":9075},[239],[14,19920,9861],{"className":19921},[9079],[14,19923],{"className":19924,"style":9075},[239],[14,19926,9567],{"className":19927},[235],[14,19929,8699],{"className":19930},[9071],[14,19932],{"className":19933,"style":240},[239],[14,19935,19937],{"className":19936},[244],[14,19938,16031],{"className":19939},[235],[14,19941],{"className":19942,"style":240},[239],[14,19944,19946,19952],{"className":19945},[235],[14,19947,19949],{"className":19948},[235,122],[14,19950,19318],{"className":19951},[235],[14,19953,19955],{"className":19954},[9517],[14,19956,19958,19981],{"className":19957},[8996,8997],[14,19959,19961,19978],{"className":19960},[9001],[14,19962,19964],{"className":19963,"style":9605},[9005],[14,19965,19966,19969],{"style":9608},[14,19967],{"className":19968,"style":9533},[9013],[14,19970,19972],{"className":19971},[9018,9019,9020,9021],[14,19973,19975],{"className":19974},[235,9021],[14,19976,9567],{"className":19977},[235,9021],[14,19979,9058],{"className":19980},[9057],[14,19982,19984],{"className":19983},[9001],[14,19985,19987],{"className":19986,"style":9630},[9005],[14,19988],{},[14,19990,9058],{"className":19991},[9057],[14,19993,19995],{"className":19994},[9001],[14,19996,19998],{"className":19997,"style":19426},[9005],[14,19999],{},[11,20001,20002,20003,20098,20099,20179,20180,8476],{},"When this 32-bit integer is parsed as a float32, its sign and exponent bits are entirely determined by ",[14,20004,20006,20037],{"className":20005},[188],[14,20007,20009],{"className":20008},[192],[194,20010,20011],{"xmlns":196},[198,20012,20013,20035],{},[201,20014,20015,20029,20031,20033],{},[9559,20016,20017,20027],{},[201,20018,20019,20021,20023,20025],{},[8885,20020,11320],{"mathvariant":9648},[8885,20022,11],{"mathvariant":9648},[8885,20024,9967],{"mathvariant":9648},[8885,20026,9667],{"mathvariant":9648},[204,20028,1031],{},[208,20030,17458],{"stretchy":9853},[204,20032,17827],{},[208,20034,17464],{"stretchy":9853},[214,20036,17832],{"encoding":216},[14,20038,20040],{"className":20039,"ariaHidden":222},[221],[14,20041,20043,20046,20089,20092,20095],{"className":20042},[226],[14,20044],{"className":20045,"style":14909},[230],[14,20047,20049,20055],{"className":20048},[235],[14,20050,20052],{"className":20051},[235],[14,20053,17486],{"className":20054},[235,9699],[14,20056,20058],{"className":20057},[9517],[14,20059,20061,20081],{"className":20060},[8996,8997],[14,20062,20064,20078],{"className":20063},[9001],[14,20065,20067],{"className":20066,"style":17499},[9005],[14,20068,20069,20072],{"style":17502},[14,20070],{"className":20071,"style":9533},[9013],[14,20073,20075],{"className":20074},[9018,9019,9020,9021],[14,20076,1031],{"className":20077},[235,9021],[14,20079,9058],{"className":20080},[9057],[14,20082,20084],{"className":20083},[9001],[14,20085,20087],{"className":20086,"style":17521},[9005],[14,20088],{},[14,20090,17458],{"className":20091},[8988],[14,20093,17827],{"className":20094},[235],[14,20096,17464],{"className":20097},[9071],", which contains the randomized page offset and page bits of the secondary vtable. Each of the 16 candidate pages produces a different ",[14,20100,20102,20127],{"className":20101},[188],[14,20103,20105],{"className":20104},[192],[194,20106,20107],{"xmlns":196},[198,20108,20109,20125],{},[201,20110,20111],{},[9559,20112,20113,20123],{},[201,20114,20115,20117,20119,20121],{},[8885,20116,11320],{"mathvariant":9648},[8885,20118,11],{"mathvariant":9648},[8885,20120,9967],{"mathvariant":9648},[8885,20122,9667],{"mathvariant":9648},[204,20124,1031],{},[214,20126,18100],{"encoding":216},[14,20128,20130],{"className":20129,"ariaHidden":222},[221],[14,20131,20133,20136],{"className":20132},[226],[14,20134],{"className":20135,"style":17572},[230],[14,20137,20139,20145],{"className":20138},[235],[14,20140,20142],{"className":20141},[235],[14,20143,17486],{"className":20144},[235,9699],[14,20146,20148],{"className":20147},[9517],[14,20149,20151,20171],{"className":20150},[8996,8997],[14,20152,20154,20168],{"className":20153},[9001],[14,20155,20157],{"className":20156,"style":17499},[9005],[14,20158,20159,20162],{"style":17502},[14,20160],{"className":20161,"style":9533},[9013],[14,20163,20165],{"className":20164},[9018,9019,9020,9021],[14,20166,1031],{"className":20167},[235,9021],[14,20169,9058],{"className":20170},[9057],[14,20172,20174],{"className":20173},[9001],[14,20175,20177],{"className":20176,"style":17521},[9005],[14,20178],{}," value, mapping to a unique (exponent, sign) pair for ",[14,20181,20183,20204],{"className":20182},[188],[14,20184,20186],{"className":20185},[192],[194,20187,20188],{"xmlns":196},[198,20189,20190,20202],{},[201,20191,20192],{},[9559,20193,20194,20196],{},[8885,20195,12010],{},[201,20197,20198,20200],{},[204,20199,540],{},[8885,20201,8918],{},[214,20203,17642],{"encoding":216},[14,20205,20207],{"className":20206,"ariaHidden":222},[221],[14,20208,20210,20213],{"className":20209},[226],[14,20211],{"className":20212,"style":17652},[230],[14,20214,20216,20219],{"className":20215},[235],[14,20217,12010],{"className":20218,"style":13006},[235,8903],[14,20220,20222],{"className":20221},[9517],[14,20223,20225,20251],{"className":20224},[8996,8997],[14,20226,20228,20248],{"className":20227},[9001],[14,20229,20231],{"className":20230,"style":9605},[9005],[14,20232,20233,20236],{"style":13021},[14,20234],{"className":20235,"style":9533},[9013],[14,20237,20239],{"className":20238},[9018,9019,9020,9021],[14,20240,20242,20245],{"className":20241},[235,9021],[14,20243,540],{"className":20244},[235,9021],[14,20246,8918],{"className":20247,"style":8934},[235,8903,9021],[14,20249,9058],{"className":20250},[9057],[14,20252,20254],{"className":20253},[9001],[14,20255,20257],{"className":20256,"style":17697},[9005],[14,20258],{},[11,20260,20261,20262,20332,20333,20402,20403,20482],{},"Probing the canvas with different Y-scales ",[14,20263,20265,20283],{"className":20264},[188],[14,20266,20268],{"className":20267},[192],[194,20269,20270],{"xmlns":196},[198,20271,20272,20280],{},[201,20273,20274],{},[9559,20275,20276,20278],{},[8885,20277,8776],{},[8885,20279,8918],{},[214,20281,20282],{"encoding":216},"S_y",[14,20284,20286],{"className":20285,"ariaHidden":222},[221],[14,20287,20289,20292],{"className":20288},[226],[14,20290],{"className":20291,"style":17652},[230],[14,20293,20295,20298],{"className":20294},[235],[14,20296,8776],{"className":20297,"style":12945},[235,8903],[14,20299,20301],{"className":20300},[9517],[14,20302,20304,20324],{"className":20303},[8996,8997],[14,20305,20307,20321],{"className":20306},[9001],[14,20308,20310],{"className":20309,"style":12900},[9005],[14,20311,20312,20315],{"style":12960},[14,20313],{"className":20314,"style":9533},[9013],[14,20316,20318],{"className":20317},[9018,9019,9020,9021],[14,20319,8918],{"className":20320,"style":8934},[235,8903,9021],[14,20322,9058],{"className":20323},[9057],[14,20325,20327],{"className":20326},[9001],[14,20328,20330],{"className":20329,"style":17697},[9005],[14,20331],{}," will only render the line on-screen when ",[14,20334,20336,20353],{"className":20335},[188],[14,20337,20339],{"className":20338},[192],[194,20340,20341],{"xmlns":196},[198,20342,20343,20351],{},[201,20344,20345],{},[9559,20346,20347,20349],{},[8885,20348,8776],{},[8885,20350,8918],{},[214,20352,20282],{"encoding":216},[14,20354,20356],{"className":20355,"ariaHidden":222},[221],[14,20357,20359,20362],{"className":20358},[226],[14,20360],{"className":20361,"style":17652},[230],[14,20363,20365,20368],{"className":20364},[235],[14,20366,8776],{"className":20367,"style":12945},[235,8903],[14,20369,20371],{"className":20370},[9517],[14,20372,20374,20394],{"className":20373},[8996,8997],[14,20375,20377,20391],{"className":20376},[9001],[14,20378,20380],{"className":20379,"style":12900},[9005],[14,20381,20382,20385],{"style":12960},[14,20383],{"className":20384,"style":9533},[9013],[14,20386,20388],{"className":20387},[9018,9019,9020,9021],[14,20389,8918],{"className":20390,"style":8934},[235,8903,9021],[14,20392,9058],{"className":20393},[9057],[14,20395,20397],{"className":20396},[9001],[14,20398,20400],{"className":20399,"style":17697},[9005],[14,20401],{}," matches the true exponent of ",[14,20404,20406,20427],{"className":20405},[188],[14,20407,20409],{"className":20408},[192],[194,20410,20411],{"xmlns":196},[198,20412,20413,20425],{},[201,20414,20415],{},[9559,20416,20417,20419],{},[8885,20418,12010],{},[201,20420,20421,20423],{},[204,20422,540],{},[8885,20424,8918],{},[214,20426,17642],{"encoding":216},[14,20428,20430],{"className":20429,"ariaHidden":222},[221],[14,20431,20433,20436],{"className":20432},[226],[14,20434],{"className":20435,"style":17652},[230],[14,20437,20439,20442],{"className":20438},[235],[14,20440,12010],{"className":20441,"style":13006},[235,8903],[14,20443,20445],{"className":20444},[9517],[14,20446,20448,20474],{"className":20447},[8996,8997],[14,20449,20451,20471],{"className":20450},[9001],[14,20452,20454],{"className":20453,"style":9605},[9005],[14,20455,20456,20459],{"style":13021},[14,20457],{"className":20458,"style":9533},[9013],[14,20460,20462],{"className":20461},[9018,9019,9020,9021],[14,20463,20465,20468],{"className":20464},[235,9021],[14,20466,540],{"className":20467},[235,9021],[14,20469,8918],{"className":20470,"style":8934},[235,8903,9021],[14,20472,9058],{"className":20473},[9057],[14,20475,20477],{"className":20476},[9001],[14,20478,20480],{"className":20479,"style":17697},[9005],[14,20481],{},", while the direction it shifts reveals the sign. This fingerprint uniquely identifies the correct page, resolving the ambiguity.",[11,20484,20485],{},"We can express this mapping mathematically. The loading address of chrome.so is aligned to a 4 KiB page boundary, meaning the lowest 12 bits of chrome_base are always zero. The page index k (0..15) within the 64 KiB window occupies bits 12..15 of chrome_base, making the low 16 bits of the load base equal to (k \u003C\u003C 12). Adding the static RVA offset of the secondary vtable (0x0faa7e00) gives:",[14,20487,20489],{"className":20488},[9765],[14,20490,20492,20627],{"className":20491},[188],[14,20493,20495],{"className":20494},[192],[194,20496,20497],{"xmlns":196,"display":9774},[198,20498,20499,20624],{},[9778,20500,20501,20566],{"rowspacing":9780,"columnalign":11940,"columnspacing":11941},[9784,20502,20503,20536],{},[9787,20504,20505],{},[9790,20506,20507],{"scriptlevel":540,"displaystyle":222},[9559,20508,20509,20519],{},[201,20510,20511,20513,20515,20517],{},[8885,20512,11320],{"mathvariant":9648},[8885,20514,11],{"mathvariant":9648},[8885,20516,9967],{"mathvariant":9648},[8885,20518,9667],{"mathvariant":9648},[201,20520,20521,20523,20525],{},[204,20522,1031],{},[208,20524,8968],{"separator":222},[201,20526,20527,20529,20531,20534],{},[8885,20528,9802],{"mathvariant":9648},[8885,20530,9656],{"mathvariant":9648},[8885,20532,20533],{"mathvariant":9648},"w",[204,20535,9567],{},[9787,20537,20538],{},[9790,20539,20540],{"scriptlevel":540,"displaystyle":222},[201,20541,20542,20544,20546,20548,20551,20553,20555,20557,20559],{},[201,20543],{},[208,20545,988],{},[208,20547,9330],{"stretchy":9853},[8885,20549,20550],{},"k",[208,20552,9861],{},[204,20554,1168],{},[208,20556,8699],{"stretchy":9853},[208,20558,4432],{},[9559,20560,20561,20564],{},[9562,20562,20563],{},"7E00",[204,20565,9567],{},[9784,20567,20568,20574],{},[9787,20569,20570],{},[9790,20571,20572],{"scriptlevel":540,"displaystyle":222},[201,20573],{},[9787,20575,20576],{},[9790,20577,20578],{"scriptlevel":540,"displaystyle":222},[201,20579,20580,20582,20584,20586,20588,20590,20592,20594,20596,20598,20605,20607,20609,20611,20613,20615,20617],{},[201,20581],{},[208,20583,988],{},[208,20585,9330],{"fence":9853,"stretchy":222,"minsize":9854,"maxsize":9854},[208,20587,9330],{"stretchy":9853},[8885,20589,20550],{},[208,20591,4432],{},[204,20593,534],{},[208,20595,8699],{"stretchy":9853},[208,20597,1025],{"mathvariant":9648,"lspace":9844,"rspace":9844},[9559,20599,20600,20603],{},[9562,20601,20602],{},"F",[204,20604,9567],{},[208,20606,8699],{"fence":9853,"stretchy":222,"minsize":9854,"maxsize":9854},[208,20608,9861],{},[204,20610,1168],{},[9562,20612,12016],{},[208,20614,16031],{"mathvariant":9648,"lspace":9844,"rspace":9844},[9562,20616,12016],{},[9559,20618,20619,20622],{},[9562,20620,20621],{},"E00",[204,20623,9567],{},[214,20625,20626],{"encoding":216},"\\begin{aligned}\n\\mathrm{vptr}_{2,\\mathrm{low16}} &= (k \\ll 12) + \\text{7E00}_{16} \\\\\n&= \\big((k + 7) \\mathbin{\\&} \\text{F}_{16}\\big) \\ll 12 \\ \\mathbin{|}\\ \\text{E00}_{16}\n\\end{aligned}",[14,20628,20630],{"className":20629,"ariaHidden":222},[221],[14,20631,20633,20637],{"className":20632},[226],[14,20634],{"className":20635,"style":20636},[230],"height:2.7302em;vertical-align:-1.1151em;",[14,20638,20640],{"className":20639},[235],[14,20641,20643,20744],{"className":20642},[9778],[14,20644,20646],{"className":20645},[10136],[14,20647,20649,20735],{"className":20648},[8996,8997],[14,20650,20652,20732],{"className":20651},[9001],[14,20653,20656,20723],{"className":20654,"style":20655},[9005],"height:1.6151em;",[14,20657,20659,20662],{"style":20658},"top:-3.7751em;",[14,20660],{"className":20661,"style":9014},[9013],[14,20663,20665],{"className":20664},[235],[14,20666,20668,20674],{"className":20667},[235],[14,20669,20671],{"className":20670},[235],[14,20672,17486],{"className":20673},[235,9699],[14,20675,20677],{"className":20676},[9517],[14,20678,20680,20714],{"className":20679},[8996,8997],[14,20681,20683,20711],{"className":20682},[9001],[14,20684,20687],{"className":20685,"style":20686},[9005],"height:0.242em;",[14,20688,20689,20692],{"style":17502},[14,20690],{"className":20691,"style":9533},[9013],[14,20693,20695],{"className":20694},[9018,9019,9020,9021],[14,20696,20698,20701,20704],{"className":20697},[235,9021],[14,20699,1031],{"className":20700},[235,9021],[14,20702,8968],{"className":20703},[9118,9021],[14,20705,20707],{"className":20706},[235,9021],[14,20708,20710],{"className":20709},[235,9699,9021],"low16",[14,20712,9058],{"className":20713},[9057],[14,20715,20717],{"className":20716},[9001],[14,20718,20721],{"className":20719,"style":20720},[9005],"height:0.3802em;",[14,20722],{},[14,20724,20726,20729],{"style":20725},"top:-2.2449em;",[14,20727],{"className":20728,"style":9014},[9013],[14,20730],{"className":20731},[235],[14,20733,9058],{"className":20734},[9057],[14,20736,20738],{"className":20737},[9001],[14,20739,20742],{"className":20740,"style":20741},[9005],"height:1.1151em;",[14,20743],{},[14,20745,20747],{"className":20746},[10229],[14,20748,20750,21043],{"className":20749},[8996,8997],[14,20751,20753,21040],{"className":20752},[9001],[14,20754,20756,20853],{"className":20755,"style":20655},[9005],[14,20757,20758,20761],{"style":20658},[14,20759],{"className":20760,"style":9014},[9013],[14,20762,20764,20767,20770,20773,20776,20779,20783,20786,20789,20792,20795,20798,20801,20804,20807],{"className":20763},[235],[14,20765],{"className":20766},[235],[14,20768],{"className":20769,"style":9075},[239],[14,20771,988],{"className":20772},[9079],[14,20774],{"className":20775,"style":9075},[239],[14,20777,9330],{"className":20778},[8988],[14,20780,20550],{"className":20781,"style":20782},[235,8903],"margin-right:0.0315em;",[14,20784],{"className":20785,"style":9075},[239],[14,20787,9861],{"className":20788},[9079],[14,20790],{"className":20791,"style":9075},[239],[14,20793,1168],{"className":20794},[235],[14,20796,8699],{"className":20797},[9071],[14,20799],{"className":20800,"style":240},[239],[14,20802,4432],{"className":20803},[244],[14,20805],{"className":20806,"style":240},[239],[14,20808,20810,20816],{"className":20809},[235],[14,20811,20813],{"className":20812},[235,122],[14,20814,20563],{"className":20815},[235],[14,20817,20819],{"className":20818},[9517],[14,20820,20822,20845],{"className":20821},[8996,8997],[14,20823,20825,20842],{"className":20824},[9001],[14,20826,20828],{"className":20827,"style":9605},[9005],[14,20829,20830,20833],{"style":9608},[14,20831],{"className":20832,"style":9533},[9013],[14,20834,20836],{"className":20835},[9018,9019,9020,9021],[14,20837,20839],{"className":20838},[235,9021],[14,20840,9567],{"className":20841},[235,9021],[14,20843,9058],{"className":20844},[9057],[14,20846,20848],{"className":20847},[9001],[14,20849,20851],{"className":20850,"style":9630},[9005],[14,20852],{},[14,20854,20855,20858],{"style":20725},[14,20856],{"className":20857,"style":9014},[9013],[14,20859,20861,20864,20867,20870,20873,20879,20882,20885,20888,20891,20894,20897,20900,20903,20909,20912,20958,20964,20967,20970,20973,20976,20979,20982,20988,20991,20994],{"className":20860},[235],[14,20862],{"className":20863},[235],[14,20865],{"className":20866,"style":9075},[239],[14,20868,988],{"className":20869},[9079],[14,20871],{"className":20872,"style":9075},[239],[14,20874,20876],{"className":20875},[235],[14,20877,9330],{"className":20878},[10293,10294],[14,20880,9330],{"className":20881},[8988],[14,20883,20550],{"className":20884,"style":20782},[235,8903],[14,20886],{"className":20887,"style":240},[239],[14,20889,4432],{"className":20890},[244],[14,20892],{"className":20893,"style":240},[239],[14,20895,534],{"className":20896},[235],[14,20898,8699],{"className":20899},[9071],[14,20901],{"className":20902,"style":240},[239],[14,20904,20906],{"className":20905},[244],[14,20907,1025],{"className":20908},[235],[14,20910],{"className":20911,"style":240},[239],[14,20913,20915,20921],{"className":20914},[235],[14,20916,20918],{"className":20917},[235,122],[14,20919,20602],{"className":20920},[235],[14,20922,20924],{"className":20923},[9517],[14,20925,20927,20950],{"className":20926},[8996,8997],[14,20928,20930,20947],{"className":20929},[9001],[14,20931,20933],{"className":20932,"style":9605},[9005],[14,20934,20935,20938],{"style":9608},[14,20936],{"className":20937,"style":9533},[9013],[14,20939,20941],{"className":20940},[9018,9019,9020,9021],[14,20942,20944],{"className":20943},[235,9021],[14,20945,9567],{"className":20946},[235,9021],[14,20948,9058],{"className":20949},[9057],[14,20951,20953],{"className":20952},[9001],[14,20954,20956],{"className":20955,"style":9630},[9005],[14,20957],{},[14,20959,20961],{"className":20960},[235],[14,20962,8699],{"className":20963},[10293,10294],[14,20965],{"className":20966,"style":9075},[239],[14,20968,9861],{"className":20969},[9079],[14,20971],{"className":20972,"style":9075},[239],[14,20974,1168],{"className":20975},[235],[14,20977,12016],{"className":20978},[239],[14,20980],{"className":20981,"style":240},[239],[14,20983,20985],{"className":20984},[244],[14,20986,16031],{"className":20987},[235],[14,20989,12016],{"className":20990},[239],[14,20992],{"className":20993,"style":240},[239],[14,20995,20997,21003],{"className":20996},[235],[14,20998,21000],{"className":20999},[235,122],[14,21001,20621],{"className":21002},[235],[14,21004,21006],{"className":21005},[9517],[14,21007,21009,21032],{"className":21008},[8996,8997],[14,21010,21012,21029],{"className":21011},[9001],[14,21013,21015],{"className":21014,"style":9605},[9005],[14,21016,21017,21020],{"style":9608},[14,21018],{"className":21019,"style":9533},[9013],[14,21021,21023],{"className":21022},[9018,9019,9020,9021],[14,21024,21026],{"className":21025},[235,9021],[14,21027,9567],{"className":21028},[235,9021],[14,21030,9058],{"className":21031},[9057],[14,21033,21035],{"className":21034},[9001],[14,21036,21038],{"className":21037,"style":9630},[9005],[14,21039],{},[14,21041,9058],{"className":21042},[9057],[14,21044,21046],{"className":21045},[9001],[14,21047,21049],{"className":21048,"style":20741},[9005],[14,21050],{},[11,21052,21053,21054,21187,21188,21354,21355,8476],{},"Let ",[14,21055,21057,21101],{"className":21056},[188],[14,21058,21060],{"className":21059},[192],[194,21061,21062],{"xmlns":196},[198,21063,21064,21098],{},[201,21065,21066,21069,21071,21073,21075,21077,21079,21081,21084,21094,21096],{},[8885,21067,21068],{},"N",[208,21070,988],{},[208,21072,9330],{"stretchy":9853},[8885,21074,20550],{},[208,21076,4432],{},[204,21078,534],{},[208,21080,8699],{"stretchy":9853},[9562,21082,21083],{}," ",[208,21085,21086],{"lspace":9844,"rspace":9844},[201,21087,21088,21090,21092],{},[8885,21089,11263],{"mathvariant":9648},[8885,21091,9656],{"mathvariant":9648},[8885,21093,10040],{"mathvariant":9648},[9562,21095,21083],{},[204,21097,9567],{},[214,21099,21100],{"encoding":216},"N = (k + 7) \\bmod 16",[14,21102,21104,21123,21144,21178],{"className":21103,"ariaHidden":222},[221],[14,21105,21107,21110,21114,21117,21120],{"className":21106},[226],[14,21108],{"className":21109,"style":15506},[230],[14,21111,21068],{"className":21112,"style":21113},[235,8903],"margin-right:0.109em;",[14,21115],{"className":21116,"style":9075},[239],[14,21118,988],{"className":21119},[9079],[14,21121],{"className":21122,"style":9075},[239],[14,21124,21126,21129,21132,21135,21138,21141],{"className":21125},[226],[14,21127],{"className":21128,"style":14909},[230],[14,21130,9330],{"className":21131},[8988],[14,21133,20550],{"className":21134,"style":20782},[235,8903],[14,21136],{"className":21137,"style":240},[239],[14,21139,4432],{"className":21140},[244],[14,21142],{"className":21143,"style":240},[239],[14,21145,21147,21150,21153,21156,21160,21163,21172,21175],{"className":21146},[226],[14,21148],{"className":21149,"style":14909},[230],[14,21151,534],{"className":21152},[235],[14,21154,8699],{"className":21155},[9071],[14,21157],{"className":21158,"style":21159},[239],"margin-right:0.0556em;",[14,21161],{"className":21162,"style":240},[239],[14,21164,21166],{"className":21165},[244],[14,21167,21169],{"className":21168},[235],[14,21170,11795],{"className":21171},[235,9699],[14,21173],{"className":21174,"style":21159},[239],[14,21176],{"className":21177,"style":240},[239],[14,21179,21181,21184],{"className":21180},[226],[14,21182],{"className":21183,"style":254},[230],[14,21185,9567],{"className":21186},[235],". In little-endian bytes, this 16-bit value is stored as ",[14,21189,21191,21232],{"className":21190},[188],[14,21192,21194],{"className":21193},[192],[194,21195,21196],{"xmlns":196},[198,21197,21198,21229],{},[201,21199,21200,21214,21216,21218,21220,21222],{},[9559,21201,21202,21212],{},[201,21203,21204,21206,21208,21210],{},[8885,21205,11320],{"mathvariant":9648},[8885,21207,11],{"mathvariant":9648},[8885,21209,9967],{"mathvariant":9648},[8885,21211,9667],{"mathvariant":9648},[204,21213,1031],{},[208,21215,17458],{"stretchy":9853},[204,21217,540],{},[208,21219,17464],{"stretchy":9853},[208,21221,988],{},[9559,21223,21224,21227],{},[9562,21225,21226],{},"00",[204,21228,9567],{},[214,21230,21231],{"encoding":216},"\\mathrm{vptr}_2[0] = \\text{00}_{16}",[14,21233,21235,21302],{"className":21234,"ariaHidden":222},[221],[14,21236,21238,21241,21284,21287,21290,21293,21296,21299],{"className":21237},[226],[14,21239],{"className":21240,"style":14909},[230],[14,21242,21244,21250],{"className":21243},[235],[14,21245,21247],{"className":21246},[235],[14,21248,17486],{"className":21249},[235,9699],[14,21251,21253],{"className":21252},[9517],[14,21254,21256,21276],{"className":21255},[8996,8997],[14,21257,21259,21273],{"className":21258},[9001],[14,21260,21262],{"className":21261,"style":17499},[9005],[14,21263,21264,21267],{"style":17502},[14,21265],{"className":21266,"style":9533},[9013],[14,21268,21270],{"className":21269},[9018,9019,9020,9021],[14,21271,1031],{"className":21272},[235,9021],[14,21274,9058],{"className":21275},[9057],[14,21277,21279],{"className":21278},[9001],[14,21280,21282],{"className":21281,"style":17521},[9005],[14,21283],{},[14,21285,17458],{"className":21286},[8988],[14,21288,540],{"className":21289},[235],[14,21291,17464],{"className":21292},[9071],[14,21294],{"className":21295,"style":9075},[239],[14,21297,988],{"className":21298},[9079],[14,21300],{"className":21301,"style":9075},[239],[14,21303,21305,21308],{"className":21304},[226],[14,21306],{"className":21307,"style":9580},[230],[14,21309,21311,21317],{"className":21310},[235],[14,21312,21314],{"className":21313},[235,122],[14,21315,21226],{"className":21316},[235],[14,21318,21320],{"className":21319},[9517],[14,21321,21323,21346],{"className":21322},[8996,8997],[14,21324,21326,21343],{"className":21325},[9001],[14,21327,21329],{"className":21328,"style":9605},[9005],[14,21330,21331,21334],{"style":9608},[14,21332],{"className":21333,"style":9533},[9013],[14,21335,21337],{"className":21336},[9018,9019,9020,9021],[14,21338,21340],{"className":21339},[235,9021],[14,21341,9567],{"className":21342},[235,9021],[14,21344,9058],{"className":21345},[9057],[14,21347,21349],{"className":21348},[9001],[14,21350,21352],{"className":21351,"style":9630},[9005],[14,21353],{},", and ",[14,21356,21358,21410],{"className":21357},[188],[14,21359,21361],{"className":21360},[192],[194,21362,21363],{"xmlns":196},[198,21364,21365,21407],{},[201,21366,21367,21381,21383,21385,21387,21389,21391,21393,21395,21397,21399,21401],{},[9559,21368,21369,21379],{},[201,21370,21371,21373,21375,21377],{},[8885,21372,11320],{"mathvariant":9648},[8885,21374,11],{"mathvariant":9648},[8885,21376,9967],{"mathvariant":9648},[8885,21378,9667],{"mathvariant":9648},[204,21380,1031],{},[208,21382,17458],{"stretchy":9853},[204,21384,328],{},[208,21386,17464],{"stretchy":9853},[208,21388,988],{},[208,21390,9330],{"stretchy":9853},[8885,21392,21068],{},[208,21394,9861],{},[204,21396,1711],{},[208,21398,8699],{"stretchy":9853},[208,21400,16031],{"mathvariant":9648,"lspace":9844,"rspace":9844},[9559,21402,21403,21405],{},[9562,21404,16678],{},[204,21406,9567],{},[214,21408,21409],{"encoding":216},"\\mathrm{vptr}_2[1] = (N \\ll 4) \\mathbin{|} \\text{E}_{16}",[14,21411,21413,21480,21501,21525],{"className":21412,"ariaHidden":222},[221],[14,21414,21416,21419,21462,21465,21468,21471,21474,21477],{"className":21415},[226],[14,21417],{"className":21418,"style":14909},[230],[14,21420,21422,21428],{"className":21421},[235],[14,21423,21425],{"className":21424},[235],[14,21426,17486],{"className":21427},[235,9699],[14,21429,21431],{"className":21430},[9517],[14,21432,21434,21454],{"className":21433},[8996,8997],[14,21435,21437,21451],{"className":21436},[9001],[14,21438,21440],{"className":21439,"style":17499},[9005],[14,21441,21442,21445],{"style":17502},[14,21443],{"className":21444,"style":9533},[9013],[14,21446,21448],{"className":21447},[9018,9019,9020,9021],[14,21449,1031],{"className":21450},[235,9021],[14,21452,9058],{"className":21453},[9057],[14,21455,21457],{"className":21456},[9001],[14,21458,21460],{"className":21459,"style":17521},[9005],[14,21461],{},[14,21463,17458],{"className":21464},[8988],[14,21466,328],{"className":21467},[235],[14,21469,17464],{"className":21470},[9071],[14,21472],{"className":21473,"style":9075},[239],[14,21475,988],{"className":21476},[9079],[14,21478],{"className":21479,"style":9075},[239],[14,21481,21483,21486,21489,21492,21495,21498],{"className":21482},[226],[14,21484],{"className":21485,"style":14909},[230],[14,21487,9330],{"className":21488},[8988],[14,21490,21068],{"className":21491,"style":21113},[235,8903],[14,21493],{"className":21494,"style":9075},[239],[14,21496,9861],{"className":21497},[9079],[14,21499],{"className":21500,"style":9075},[239],[14,21502,21504,21507,21510,21513,21516,21522],{"className":21503},[226],[14,21505],{"className":21506,"style":14909},[230],[14,21508,1711],{"className":21509},[235],[14,21511,8699],{"className":21512},[9071],[14,21514],{"className":21515,"style":240},[239],[14,21517,21519],{"className":21518},[244],[14,21520,16031],{"className":21521},[235],[14,21523],{"className":21524,"style":240},[239],[14,21526,21528,21531],{"className":21527},[226],[14,21529],{"className":21530,"style":9715},[230],[14,21532,21534,21540],{"className":21533},[235],[14,21535,21537],{"className":21536},[235,122],[14,21538,16678],{"className":21539},[235],[14,21541,21543],{"className":21542},[9517],[14,21544,21546,21569],{"className":21545},[8996,8997],[14,21547,21549,21566],{"className":21548},[9001],[14,21550,21552],{"className":21551,"style":9605},[9005],[14,21553,21554,21557],{"style":9608},[14,21555],{"className":21556,"style":9533},[9013],[14,21558,21560],{"className":21559},[9018,9019,9020,9021],[14,21561,21563],{"className":21562},[235,9021],[14,21564,9567],{"className":21565},[235,9021],[14,21567,9058],{"className":21568},[9057],[14,21570,21572],{"className":21571},[9001],[14,21573,21575],{"className":21574,"style":9630},[9005],[14,21576],{},[11,21578,21579,21580,21659,21660,8498,21755,21850,21851,21931,21932,22097,22098,22177,22178,22462],{},"When read as a float32 coordinate, ",[14,21581,21583,21604],{"className":21582},[188],[14,21584,21586],{"className":21585},[192],[194,21587,21588],{"xmlns":196},[198,21589,21590,21602],{},[201,21591,21592],{},[9559,21593,21594,21596],{},[8885,21595,12010],{},[201,21597,21598,21600],{},[204,21599,540],{},[8885,21601,8918],{},[214,21603,17642],{"encoding":216},[14,21605,21607],{"className":21606,"ariaHidden":222},[221],[14,21608,21610,21613],{"className":21609},[226],[14,21611],{"className":21612,"style":17652},[230],[14,21614,21616,21619],{"className":21615},[235],[14,21617,12010],{"className":21618,"style":13006},[235,8903],[14,21620,21622],{"className":21621},[9517],[14,21623,21625,21651],{"className":21624},[8996,8997],[14,21626,21628,21648],{"className":21627},[9001],[14,21629,21631],{"className":21630,"style":9605},[9005],[14,21632,21633,21636],{"style":13021},[14,21634],{"className":21635,"style":9533},[9013],[14,21637,21639],{"className":21638},[9018,9019,9020,9021],[14,21640,21642,21645],{"className":21641},[235,9021],[14,21643,540],{"className":21644},[235,9021],[14,21646,8918],{"className":21647,"style":8934},[235,8903,9021],[14,21649,9058],{"className":21650},[9057],[14,21652,21654],{"className":21653},[9001],[14,21655,21657],{"className":21656,"style":17697},[9005],[14,21658],{}," spans ",[14,21661,21663,21694],{"className":21662},[188],[14,21664,21666],{"className":21665},[192],[194,21667,21668],{"xmlns":196},[198,21669,21670,21692],{},[201,21671,21672,21686,21688,21690],{},[9559,21673,21674,21684],{},[201,21675,21676,21678,21680,21682],{},[8885,21677,11320],{"mathvariant":9648},[8885,21679,11],{"mathvariant":9648},[8885,21681,9967],{"mathvariant":9648},[8885,21683,9667],{"mathvariant":9648},[204,21685,328],{},[208,21687,17458],{"stretchy":9853},[204,21689,17730],{},[208,21691,17464],{"stretchy":9853},[214,21693,17735],{"encoding":216},[14,21695,21697],{"className":21696,"ariaHidden":222},[221],[14,21698,21700,21703,21746,21749,21752],{"className":21699},[226],[14,21701],{"className":21702,"style":14909},[230],[14,21704,21706,21712],{"className":21705},[235],[14,21707,21709],{"className":21708},[235],[14,21710,17486],{"className":21711},[235,9699],[14,21713,21715],{"className":21714},[9517],[14,21716,21718,21738],{"className":21717},[8996,8997],[14,21719,21721,21735],{"className":21720},[9001],[14,21722,21724],{"className":21723,"style":17499},[9005],[14,21725,21726,21729],{"style":17502},[14,21727],{"className":21728,"style":9533},[9013],[14,21730,21732],{"className":21731},[9018,9019,9020,9021],[14,21733,328],{"className":21734},[235,9021],[14,21736,9058],{"className":21737},[9057],[14,21739,21741],{"className":21740},[9001],[14,21742,21744],{"className":21743,"style":17521},[9005],[14,21745],{},[14,21747,17458],{"className":21748},[8988],[14,21750,17730],{"className":21751},[235],[14,21753,17464],{"className":21754},[9071],[14,21756,21758,21789],{"className":21757},[188],[14,21759,21761],{"className":21760},[192],[194,21762,21763],{"xmlns":196},[198,21764,21765,21787],{},[201,21766,21767,21781,21783,21785],{},[9559,21768,21769,21779],{},[201,21770,21771,21773,21775,21777],{},[8885,21772,11320],{"mathvariant":9648},[8885,21774,11],{"mathvariant":9648},[8885,21776,9967],{"mathvariant":9648},[8885,21778,9667],{"mathvariant":9648},[204,21780,1031],{},[208,21782,17458],{"stretchy":9853},[204,21784,17827],{},[208,21786,17464],{"stretchy":9853},[214,21788,17832],{"encoding":216},[14,21790,21792],{"className":21791,"ariaHidden":222},[221],[14,21793,21795,21798,21841,21844,21847],{"className":21794},[226],[14,21796],{"className":21797,"style":14909},[230],[14,21799,21801,21807],{"className":21800},[235],[14,21802,21804],{"className":21803},[235],[14,21805,17486],{"className":21806},[235,9699],[14,21808,21810],{"className":21809},[9517],[14,21811,21813,21833],{"className":21812},[8996,8997],[14,21814,21816,21830],{"className":21815},[9001],[14,21817,21819],{"className":21818,"style":17499},[9005],[14,21820,21821,21824],{"style":17502},[14,21822],{"className":21823,"style":9533},[9013],[14,21825,21827],{"className":21826},[9018,9019,9020,9021],[14,21828,1031],{"className":21829},[235,9021],[14,21831,9058],{"className":21832},[9057],[14,21834,21836],{"className":21835},[9001],[14,21837,21839],{"className":21838,"style":17521},[9005],[14,21840],{},[14,21842,17458],{"className":21843},[8988],[14,21845,17827],{"className":21846},[235],[14,21848,17464],{"className":21849},[9071],". Because canonical user-space pointers on x86_64 only use the low 48 bits, the upper two bytes of ",[14,21852,21854,21879],{"className":21853},[188],[14,21855,21857],{"className":21856},[192],[194,21858,21859],{"xmlns":196},[198,21860,21861,21877],{},[201,21862,21863],{},[9559,21864,21865,21875],{},[201,21866,21867,21869,21871,21873],{},[8885,21868,11320],{"mathvariant":9648},[8885,21870,11],{"mathvariant":9648},[8885,21872,9967],{"mathvariant":9648},[8885,21874,9667],{"mathvariant":9648},[204,21876,328],{},[214,21878,17562],{"encoding":216},[14,21880,21882],{"className":21881,"ariaHidden":222},[221],[14,21883,21885,21888],{"className":21884},[226],[14,21886],{"className":21887,"style":17572},[230],[14,21889,21891,21897],{"className":21890},[235],[14,21892,21894],{"className":21893},[235],[14,21895,17486],{"className":21896},[235,9699],[14,21898,21900],{"className":21899},[9517],[14,21901,21903,21923],{"className":21902},[8996,8997],[14,21904,21906,21920],{"className":21905},[9001],[14,21907,21909],{"className":21908,"style":17499},[9005],[14,21910,21911,21914],{"style":17502},[14,21912],{"className":21913,"style":9533},[9013],[14,21915,21917],{"className":21916},[9018,9019,9020,9021],[14,21918,328],{"className":21919},[235,9021],[14,21921,9058],{"className":21922},[9057],[14,21924,21926],{"className":21925},[9001],[14,21927,21929],{"className":21928,"style":17521},[9005],[14,21930],{}," are always zero (",[14,21933,21935,21975],{"className":21934},[188],[14,21936,21938],{"className":21937},[192],[194,21939,21940],{"xmlns":196},[198,21941,21942,21972],{},[201,21943,21944,21958,21960,21962,21964,21966],{},[9559,21945,21946,21956],{},[201,21947,21948,21950,21952,21954],{},[8885,21949,11320],{"mathvariant":9648},[8885,21951,11],{"mathvariant":9648},[8885,21953,9967],{"mathvariant":9648},[8885,21955,9667],{"mathvariant":9648},[204,21957,328],{},[208,21959,17458],{"stretchy":9853},[204,21961,17730],{},[208,21963,17464],{"stretchy":9853},[208,21965,988],{},[9559,21967,21968,21970],{},[9562,21969,19318],{},[204,21971,9567],{},[214,21973,21974],{"encoding":216},"\\mathrm{vptr}_1[6..7] = \\text{0000}_{16}",[14,21976,21978,22045],{"className":21977,"ariaHidden":222},[221],[14,21979,21981,21984,22027,22030,22033,22036,22039,22042],{"className":21980},[226],[14,21982],{"className":21983,"style":14909},[230],[14,21985,21987,21993],{"className":21986},[235],[14,21988,21990],{"className":21989},[235],[14,21991,17486],{"className":21992},[235,9699],[14,21994,21996],{"className":21995},[9517],[14,21997,21999,22019],{"className":21998},[8996,8997],[14,22000,22002,22016],{"className":22001},[9001],[14,22003,22005],{"className":22004,"style":17499},[9005],[14,22006,22007,22010],{"style":17502},[14,22008],{"className":22009,"style":9533},[9013],[14,22011,22013],{"className":22012},[9018,9019,9020,9021],[14,22014,328],{"className":22015},[235,9021],[14,22017,9058],{"className":22018},[9057],[14,22020,22022],{"className":22021},[9001],[14,22023,22025],{"className":22024,"style":17521},[9005],[14,22026],{},[14,22028,17458],{"className":22029},[8988],[14,22031,17730],{"className":22032},[235],[14,22034,17464],{"className":22035},[9071],[14,22037],{"className":22038,"style":9075},[239],[14,22040,988],{"className":22041},[9079],[14,22043],{"className":22044,"style":9075},[239],[14,22046,22048,22051],{"className":22047},[226],[14,22049],{"className":22050,"style":9580},[230],[14,22052,22054,22060],{"className":22053},[235],[14,22055,22057],{"className":22056},[235,122],[14,22058,19318],{"className":22059},[235],[14,22061,22063],{"className":22062},[9517],[14,22064,22066,22089],{"className":22065},[8996,8997],[14,22067,22069,22086],{"className":22068},[9001],[14,22070,22072],{"className":22071,"style":9605},[9005],[14,22073,22074,22077],{"style":9608},[14,22075],{"className":22076,"style":9533},[9013],[14,22078,22080],{"className":22079},[9018,9019,9020,9021],[14,22081,22083],{"className":22082},[235,9021],[14,22084,9567],{"className":22085},[235,9021],[14,22087,9058],{"className":22088},[9057],[14,22090,22092],{"className":22091},[9001],[14,22093,22095],{"className":22094,"style":9630},[9005],[14,22096],{},"). Thus, the raw 32-bit memory buffer for ",[14,22099,22101,22122],{"className":22100},[188],[14,22102,22104],{"className":22103},[192],[194,22105,22106],{"xmlns":196},[198,22107,22108,22120],{},[201,22109,22110],{},[9559,22111,22112,22114],{},[8885,22113,12010],{},[201,22115,22116,22118],{},[204,22117,540],{},[8885,22119,8918],{},[214,22121,17642],{"encoding":216},[14,22123,22125],{"className":22124,"ariaHidden":222},[221],[14,22126,22128,22131],{"className":22127},[226],[14,22129],{"className":22130,"style":17652},[230],[14,22132,22134,22137],{"className":22133},[235],[14,22135,12010],{"className":22136,"style":13006},[235,8903],[14,22138,22140],{"className":22139},[9517],[14,22141,22143,22169],{"className":22142},[8996,8997],[14,22144,22146,22166],{"className":22145},[9001],[14,22147,22149],{"className":22148,"style":9605},[9005],[14,22150,22151,22154],{"style":13021},[14,22152],{"className":22153,"style":9533},[9013],[14,22155,22157],{"className":22156},[9018,9019,9020,9021],[14,22158,22160,22163],{"className":22159},[235,9021],[14,22161,540],{"className":22162},[235,9021],[14,22164,8918],{"className":22165,"style":8934},[235,8903,9021],[14,22167,9058],{"className":22168},[9057],[14,22170,22172],{"className":22171},[9001],[14,22173,22175],{"className":22174,"style":17697},[9005],[14,22176],{}," contains the bytes ",[14,22179,22181,22241],{"className":22180},[188],[14,22182,22184],{"className":22183},[192],[194,22185,22186],{"xmlns":196},[198,22187,22188,22238],{},[201,22189,22190,22192,22198,22200,22206,22208,22214,22216,22230,22232,22234,22236],{},[208,22191,17458],{"stretchy":9853},[9559,22193,22194,22196],{},[9562,22195,21226],{},[204,22197,9567],{},[208,22199,8968],{"separator":222},[9559,22201,22202,22204],{},[9562,22203,21226],{},[204,22205,9567],{},[208,22207,8968],{"separator":222},[9559,22209,22210,22212],{},[9562,22211,21226],{},[204,22213,9567],{},[208,22215,8968],{"separator":222},[9559,22217,22218,22228],{},[201,22219,22220,22222,22224,22226],{},[8885,22221,11320],{"mathvariant":9648},[8885,22223,11],{"mathvariant":9648},[8885,22225,9967],{"mathvariant":9648},[8885,22227,9667],{"mathvariant":9648},[204,22229,1031],{},[208,22231,17458],{"stretchy":9853},[204,22233,328],{},[208,22235,17464],{"stretchy":9853},[208,22237,17464],{"stretchy":9853},[214,22239,22240],{"encoding":216},"[\\text{00}_{16}, \\text{00}_{16}, \\text{00}_{16}, \\mathrm{vptr}_2[1]]",[14,22242,22244],{"className":22243,"ariaHidden":222},[221],[14,22245,22247,22250,22253,22299,22302,22305,22351,22354,22357,22403,22406,22409,22452,22455,22458],{"className":22246},[226],[14,22248],{"className":22249,"style":14909},[230],[14,22251,17458],{"className":22252},[8988],[14,22254,22256,22262],{"className":22255},[235],[14,22257,22259],{"className":22258},[235,122],[14,22260,21226],{"className":22261},[235],[14,22263,22265],{"className":22264},[9517],[14,22266,22268,22291],{"className":22267},[8996,8997],[14,22269,22271,22288],{"className":22270},[9001],[14,22272,22274],{"className":22273,"style":9605},[9005],[14,22275,22276,22279],{"style":9608},[14,22277],{"className":22278,"style":9533},[9013],[14,22280,22282],{"className":22281},[9018,9019,9020,9021],[14,22283,22285],{"className":22284},[235,9021],[14,22286,9567],{"className":22287},[235,9021],[14,22289,9058],{"className":22290},[9057],[14,22292,22294],{"className":22293},[9001],[14,22295,22297],{"className":22296,"style":9630},[9005],[14,22298],{},[14,22300,8968],{"className":22301},[9118],[14,22303],{"className":22304,"style":17173},[239],[14,22306,22308,22314],{"className":22307},[235],[14,22309,22311],{"className":22310},[235,122],[14,22312,21226],{"className":22313},[235],[14,22315,22317],{"className":22316},[9517],[14,22318,22320,22343],{"className":22319},[8996,8997],[14,22321,22323,22340],{"className":22322},[9001],[14,22324,22326],{"className":22325,"style":9605},[9005],[14,22327,22328,22331],{"style":9608},[14,22329],{"className":22330,"style":9533},[9013],[14,22332,22334],{"className":22333},[9018,9019,9020,9021],[14,22335,22337],{"className":22336},[235,9021],[14,22338,9567],{"className":22339},[235,9021],[14,22341,9058],{"className":22342},[9057],[14,22344,22346],{"className":22345},[9001],[14,22347,22349],{"className":22348,"style":9630},[9005],[14,22350],{},[14,22352,8968],{"className":22353},[9118],[14,22355],{"className":22356,"style":17173},[239],[14,22358,22360,22366],{"className":22359},[235],[14,22361,22363],{"className":22362},[235,122],[14,22364,21226],{"className":22365},[235],[14,22367,22369],{"className":22368},[9517],[14,22370,22372,22395],{"className":22371},[8996,8997],[14,22373,22375,22392],{"className":22374},[9001],[14,22376,22378],{"className":22377,"style":9605},[9005],[14,22379,22380,22383],{"style":9608},[14,22381],{"className":22382,"style":9533},[9013],[14,22384,22386],{"className":22385},[9018,9019,9020,9021],[14,22387,22389],{"className":22388},[235,9021],[14,22390,9567],{"className":22391},[235,9021],[14,22393,9058],{"className":22394},[9057],[14,22396,22398],{"className":22397},[9001],[14,22399,22401],{"className":22400,"style":9630},[9005],[14,22402],{},[14,22404,8968],{"className":22405},[9118],[14,22407],{"className":22408,"style":17173},[239],[14,22410,22412,22418],{"className":22411},[235],[14,22413,22415],{"className":22414},[235],[14,22416,17486],{"className":22417},[235,9699],[14,22419,22421],{"className":22420},[9517],[14,22422,22424,22444],{"className":22423},[8996,8997],[14,22425,22427,22441],{"className":22426},[9001],[14,22428,22430],{"className":22429,"style":17499},[9005],[14,22431,22432,22435],{"style":17502},[14,22433],{"className":22434,"style":9533},[9013],[14,22436,22438],{"className":22437},[9018,9019,9020,9021],[14,22439,1031],{"className":22440},[235,9021],[14,22442,9058],{"className":22443},[9057],[14,22445,22447],{"className":22446},[9001],[14,22448,22450],{"className":22449,"style":17521},[9005],[14,22451],{},[14,22453,17458],{"className":22454},[8988],[14,22456,328],{"className":22457},[235],[14,22459,22461],{"className":22460},[9071],"]]",", which translates to the bit pattern:",[14,22464,22466],{"className":22465},[9765],[14,22467,22469,22587],{"className":22468},[188],[14,22470,22472],{"className":22471},[192],[194,22473,22474],{"xmlns":196,"display":9774},[198,22475,22476,22584],{},[9778,22477,22478,22540],{"rowspacing":9780,"columnalign":11940,"columnspacing":11941},[9784,22479,22480,22506],{},[9787,22481,22482],{},[9790,22483,22484],{"scriptlevel":540,"displaystyle":222},[9559,22485,22486,22488],{},[8885,22487,12010],{},[201,22489,22490,22492,22494,22496],{},[204,22491,540],{},[8885,22493,8918],{},[208,22495,8968],{"separator":222},[201,22497,22498,22500,22502,22504],{},[8885,22499,9808],{"mathvariant":9648},[8885,22501,11274],{"mathvariant":9648},[8885,22503,9967],{"mathvariant":9648},[8885,22505,9813],{"mathvariant":9648},[9787,22507,22508],{},[9790,22509,22510],{"scriptlevel":540,"displaystyle":222},[201,22511,22512,22514,22516,22530,22532,22534,22536,22538],{},[201,22513],{},[208,22515,988],{},[9559,22517,22518,22528],{},[201,22519,22520,22522,22524,22526],{},[8885,22521,11320],{"mathvariant":9648},[8885,22523,11],{"mathvariant":9648},[8885,22525,9967],{"mathvariant":9648},[8885,22527,9667],{"mathvariant":9648},[204,22529,1031],{},[208,22531,17458],{"stretchy":9853},[204,22533,328],{},[208,22535,17464],{"stretchy":9853},[208,22537,9861],{},[204,22539,19151],{},[9784,22541,22542,22548],{},[9787,22543,22544],{},[9790,22545,22546],{"scriptlevel":540,"displaystyle":222},[201,22547],{},[9787,22549,22550],{},[9790,22551,22552],{"scriptlevel":540,"displaystyle":222},[201,22553,22554,22556,22558,22560,22562,22564,22566,22568,22570,22572,22578,22580,22582],{},[201,22555],{},[208,22557,988],{},[208,22559,9330],{"fence":9853,"stretchy":222,"minsize":9854,"maxsize":9854},[208,22561,9330],{"stretchy":9853},[8885,22563,21068],{},[208,22565,9861],{},[204,22567,1711],{},[208,22569,8699],{"stretchy":9853},[208,22571,16031],{"mathvariant":9648,"lspace":9844,"rspace":9844},[9559,22573,22574,22576],{},[9562,22575,16678],{},[204,22577,9567],{},[208,22579,8699],{"fence":9853,"stretchy":222,"minsize":9854,"maxsize":9854},[208,22581,9861],{},[204,22583,19151],{},[214,22585,22586],{"encoding":216},"\\begin{aligned}\nP_{0y,\\mathrm{bits}} &= \\mathrm{vptr}_2[1] \\ll 24 \\\\\n&= \\big((N \\ll 4) \\mathbin{|} \\text{E}_{16}\\big) \\ll 24\n\\end{aligned}",[14,22588,22590],{"className":22589,"ariaHidden":222},[221],[14,22591,22593,22597],{"className":22592},[226],[14,22594],{"className":22595,"style":22596},[230],"height:2.71em;vertical-align:-1.105em;",[14,22598,22600],{"className":22599},[235],[14,22601,22603,22703],{"className":22602},[9778],[14,22604,22606],{"className":22605},[10136],[14,22607,22609,22694],{"className":22608},[8996,8997],[14,22610,22612,22691],{"className":22611},[9001],[14,22613,22616,22682],{"className":22614,"style":22615},[9005],"height:1.605em;",[14,22617,22619,22622],{"style":22618},"top:-3.765em;",[14,22620],{"className":22621,"style":9014},[9013],[14,22623,22625],{"className":22624},[235],[14,22626,22628,22631],{"className":22627},[235],[14,22629,12010],{"className":22630,"style":13006},[235,8903],[14,22632,22634],{"className":22633},[9517],[14,22635,22637,22674],{"className":22636},[8996,8997],[14,22638,22640,22671],{"className":22639},[9001],[14,22641,22644],{"className":22642,"style":22643},[9005],"height:0.3361em;",[14,22645,22646,22649],{"style":13021},[14,22647],{"className":22648,"style":9533},[9013],[14,22650,22652],{"className":22651},[9018,9019,9020,9021],[14,22653,22655,22658,22661,22664],{"className":22654},[235,9021],[14,22656,540],{"className":22657},[235,9021],[14,22659,8918],{"className":22660,"style":8934},[235,8903,9021],[14,22662,8968],{"className":22663},[9118,9021],[14,22665,22667],{"className":22666},[235,9021],[14,22668,22670],{"className":22669},[235,9699,9021],"bits",[14,22672,9058],{"className":22673},[9057],[14,22675,22677],{"className":22676},[9001],[14,22678,22680],{"className":22679,"style":17697},[9005],[14,22681],{},[14,22683,22685,22688],{"style":22684},"top:-2.255em;",[14,22686],{"className":22687,"style":9014},[9013],[14,22689],{"className":22690},[235],[14,22692,9058],{"className":22693},[9057],[14,22695,22697],{"className":22696},[9001],[14,22698,22701],{"className":22699,"style":22700},[9005],"height:1.105em;",[14,22702],{},[14,22704,22706],{"className":22705},[10229],[14,22707,22709,22925],{"className":22708},[8996,8997],[14,22710,22712,22922],{"className":22711},[9001],[14,22713,22715,22799],{"className":22714,"style":22615},[9005],[14,22716,22717,22720],{"style":22618},[14,22718],{"className":22719,"style":9014},[9013],[14,22721,22723,22726,22729,22732,22735,22778,22781,22784,22787,22790,22793,22796],{"className":22722},[235],[14,22724],{"className":22725},[235],[14,22727],{"className":22728,"style":9075},[239],[14,22730,988],{"className":22731},[9079],[14,22733],{"className":22734,"style":9075},[239],[14,22736,22738,22744],{"className":22737},[235],[14,22739,22741],{"className":22740},[235],[14,22742,17486],{"className":22743},[235,9699],[14,22745,22747],{"className":22746},[9517],[14,22748,22750,22770],{"className":22749},[8996,8997],[14,22751,22753,22767],{"className":22752},[9001],[14,22754,22756],{"className":22755,"style":17499},[9005],[14,22757,22758,22761],{"style":17502},[14,22759],{"className":22760,"style":9533},[9013],[14,22762,22764],{"className":22763},[9018,9019,9020,9021],[14,22765,1031],{"className":22766},[235,9021],[14,22768,9058],{"className":22769},[9057],[14,22771,22773],{"className":22772},[9001],[14,22774,22776],{"className":22775,"style":17521},[9005],[14,22777],{},[14,22779,17458],{"className":22780},[8988],[14,22782,328],{"className":22783},[235],[14,22785,17464],{"className":22786},[9071],[14,22788],{"className":22789,"style":9075},[239],[14,22791,9861],{"className":22792},[9079],[14,22794],{"className":22795,"style":9075},[239],[14,22797,19151],{"className":22798},[235],[14,22800,22801,22804],{"style":22684},[14,22802],{"className":22803,"style":9014},[9013],[14,22805,22807,22810,22813,22816,22819,22825,22828,22831,22834,22837,22840,22843,22846,22849,22855,22858,22904,22910,22913,22916,22919],{"className":22806},[235],[14,22808],{"className":22809},[235],[14,22811],{"className":22812,"style":9075},[239],[14,22814,988],{"className":22815},[9079],[14,22817],{"className":22818,"style":9075},[239],[14,22820,22822],{"className":22821},[235],[14,22823,9330],{"className":22824},[10293,10294],[14,22826,9330],{"className":22827},[8988],[14,22829,21068],{"className":22830,"style":21113},[235,8903],[14,22832],{"className":22833,"style":9075},[239],[14,22835,9861],{"className":22836},[9079],[14,22838],{"className":22839,"style":9075},[239],[14,22841,1711],{"className":22842},[235],[14,22844,8699],{"className":22845},[9071],[14,22847],{"className":22848,"style":240},[239],[14,22850,22852],{"className":22851},[244],[14,22853,16031],{"className":22854},[235],[14,22856],{"className":22857,"style":240},[239],[14,22859,22861,22867],{"className":22860},[235],[14,22862,22864],{"className":22863},[235,122],[14,22865,16678],{"className":22866},[235],[14,22868,22870],{"className":22869},[9517],[14,22871,22873,22896],{"className":22872},[8996,8997],[14,22874,22876,22893],{"className":22875},[9001],[14,22877,22879],{"className":22878,"style":9605},[9005],[14,22880,22881,22884],{"style":9608},[14,22882],{"className":22883,"style":9533},[9013],[14,22885,22887],{"className":22886},[9018,9019,9020,9021],[14,22888,22890],{"className":22889},[235,9021],[14,22891,9567],{"className":22892},[235,9021],[14,22894,9058],{"className":22895},[9057],[14,22897,22899],{"className":22898},[9001],[14,22900,22902],{"className":22901,"style":9630},[9005],[14,22903],{},[14,22905,22907],{"className":22906},[235],[14,22908,8699],{"className":22909},[10293,10294],[14,22911],{"className":22912,"style":9075},[239],[14,22914,9861],{"className":22915},[9079],[14,22917],{"className":22918,"style":9075},[239],[14,22920,19151],{"className":22921},[235],[14,22923,9058],{"className":22924},[9057],[14,22926,22928],{"className":22927},[9001],[14,22929,22931],{"className":22930,"style":22700},[9005],[14,22932],{},[11,22934,22935,22936,23037],{},"In the IEEE 754 single-precision format, the 32 bits are divided into a sign bit (bit 31), an 8-bit exponent (bits 30..23), and a 23-bit mantissa (bits 22..0). Mapping ",[14,22937,22939,22973],{"className":22938},[188],[14,22940,22942],{"className":22941},[192],[194,22943,22944],{"xmlns":196},[198,22945,22946,22970],{},[201,22947,22948],{},[9559,22949,22950,22952],{},[8885,22951,12010],{},[201,22953,22954,22956,22958,22960],{},[204,22955,540],{},[8885,22957,8918],{},[208,22959,8968],{"separator":222},[201,22961,22962,22964,22966,22968],{},[8885,22963,9808],{"mathvariant":9648},[8885,22965,11274],{"mathvariant":9648},[8885,22967,9967],{"mathvariant":9648},[8885,22969,9813],{"mathvariant":9648},[214,22971,22972],{"encoding":216},"P_{0y,\\mathrm{bits}}",[14,22974,22976],{"className":22975,"ariaHidden":222},[221],[14,22977,22979,22982],{"className":22978},[226],[14,22980],{"className":22981,"style":17652},[230],[14,22983,22985,22988],{"className":22984},[235],[14,22986,12010],{"className":22987,"style":13006},[235,8903],[14,22989,22991],{"className":22990},[9517],[14,22992,22994,23029],{"className":22993},[8996,8997],[14,22995,22997,23026],{"className":22996},[9001],[14,22998,23000],{"className":22999,"style":22643},[9005],[14,23001,23002,23005],{"style":13021},[14,23003],{"className":23004,"style":9533},[9013],[14,23006,23008],{"className":23007},[9018,9019,9020,9021],[14,23009,23011,23014,23017,23020],{"className":23010},[235,9021],[14,23012,540],{"className":23013},[235,9021],[14,23015,8918],{"className":23016,"style":8934},[235,8903,9021],[14,23018,8968],{"className":23019},[9118,9021],[14,23021,23023],{"className":23022},[235,9021],[14,23024,22670],{"className":23025},[235,9699,9021],[14,23027,9058],{"className":23028},[9057],[14,23030,23032],{"className":23031},[9001],[14,23033,23035],{"className":23034,"style":17697},[9005],[14,23036],{}," to these fields yields:",[14,23039,23041],{"className":23040},[9765],[14,23042,23044,23281],{"className":23043},[188],[14,23045,23047],{"className":23046},[192],[194,23048,23049],{"xmlns":196,"display":9774},[198,23050,23051,23278],{},[9778,23052,23053,23145,23226],{"rowspacing":9780,"columnalign":11940,"columnspacing":11941},[9784,23054,23055,23061],{},[9787,23056,23057],{},[9790,23058,23059],{"scriptlevel":540,"displaystyle":222},[8885,23060,8776],{},[9787,23062,23063],{},[9790,23064,23065],{"scriptlevel":540,"displaystyle":222},[201,23066,23067,23069,23071,23074,23077,23080,23102,23104,23106,23108,23110,23124,23126,23128,23130,23132,23135,23137,23140,23142],{},[201,23068],{},[208,23070,988],{},[9562,23072,23073],{},"bit ",[204,23075,23076],{},"31",[9562,23078,23079],{}," of ",[9559,23081,23082,23084],{},[8885,23083,12010],{},[201,23085,23086,23088,23090,23092],{},[204,23087,540],{},[8885,23089,8918],{},[208,23091,8968],{"separator":222},[201,23093,23094,23096,23098,23100],{},[8885,23095,9808],{"mathvariant":9648},[8885,23097,11274],{"mathvariant":9648},[8885,23099,9967],{"mathvariant":9648},[8885,23101,9813],{"mathvariant":9648},[208,23103,988],{},[9562,23105,23073],{},[204,23107,534],{},[9562,23109,23079],{},[9559,23111,23112,23122],{},[201,23113,23114,23116,23118,23120],{},[8885,23115,11320],{"mathvariant":9648},[8885,23117,11],{"mathvariant":9648},[8885,23119,9967],{"mathvariant":9648},[8885,23121,9667],{"mathvariant":9648},[204,23123,1031],{},[208,23125,17458],{"stretchy":9853},[204,23127,328],{},[208,23129,17464],{"stretchy":9853},[208,23131,988],{},[208,23133,23134],{"stretchy":9853},"⌊",[8885,23136,21068],{},[8885,23138,23139],{"mathvariant":9648},"\u002F",[204,23141,1202],{},[208,23143,23144],{"stretchy":9853},"⌋",[9784,23146,23147,23153],{},[9787,23148,23149],{},[9790,23150,23151],{"scriptlevel":540,"displaystyle":222},[8885,23152,16678],{},[9787,23154,23155],{},[9790,23156,23157],{"scriptlevel":540,"displaystyle":222},[201,23158,23159,23161,23163,23166,23169,23171,23193,23195,23197,23199,23201,23211,23213,23215,23217,23219,23221,23223],{},[201,23160],{},[208,23162,988],{},[9562,23164,23165],{},"bits ",[204,23167,23168],{},"30..23",[9562,23170,23079],{},[9559,23172,23173,23175],{},[8885,23174,12010],{},[201,23176,23177,23179,23181,23183],{},[204,23178,540],{},[8885,23180,8918],{},[208,23182,8968],{"separator":222},[201,23184,23185,23187,23189,23191],{},[8885,23186,9808],{"mathvariant":9648},[8885,23188,11274],{"mathvariant":9648},[8885,23190,9967],{"mathvariant":9648},[8885,23192,9813],{"mathvariant":9648},[208,23194,988],{},[208,23196,9330],{"stretchy":9853},[8885,23198,21068],{},[9562,23200,21083],{},[208,23202,23203],{"lspace":9844,"rspace":9844},[201,23204,23205,23207,23209],{},[8885,23206,11263],{"mathvariant":9648},[8885,23208,9656],{"mathvariant":9648},[8885,23210,10040],{"mathvariant":9648},[9562,23212,21083],{},[204,23214,1202],{},[208,23216,8699],{"stretchy":9853},[208,23218,11380],{},[204,23220,10003],{},[208,23222,4432],{},[204,23224,23225],{},"28",[9784,23227,23228,23235],{},[9787,23229,23230],{},[9790,23231,23232],{"scriptlevel":540,"displaystyle":222},[8885,23233,23234],{},"M",[9787,23236,23237],{},[9790,23238,23239],{"scriptlevel":540,"displaystyle":222},[201,23240,23241,23243,23245,23247,23250,23252,23274,23276],{},[201,23242],{},[208,23244,988],{},[9562,23246,23165],{},[204,23248,23249],{},"22..0",[9562,23251,23079],{},[9559,23253,23254,23256],{},[8885,23255,12010],{},[201,23257,23258,23260,23262,23264],{},[204,23259,540],{},[8885,23261,8918],{},[208,23263,8968],{"separator":222},[201,23265,23266,23268,23270,23272],{},[8885,23267,9808],{"mathvariant":9648},[8885,23269,11274],{"mathvariant":9648},[8885,23271,9967],{"mathvariant":9648},[8885,23273,9813],{"mathvariant":9648},[208,23275,988],{},[204,23277,540],{},[214,23279,23280],{"encoding":216},"\\begin{aligned}\nS &= \\text{bit } 31 \\text{ of } P_{0y,\\mathrm{bits}} = \\text{bit } 7 \\text{ of } \\mathrm{vptr}_2[1] = \\lfloor N \u002F 8 \\rfloor \\\\\nE &= \\text{bits } 30..23 \\text{ of } P_{0y,\\mathrm{bits}} = (N \\bmod 8) \\cdot 32 + 28 \\\\\nM &= \\text{bits } 22..0 \\text{ of } P_{0y,\\mathrm{bits}} = 0\n\\end{aligned}",[14,23282,23284],{"className":23283,"ariaHidden":222},[221],[14,23285,23287,23290],{"className":23286},[226],[14,23288],{"className":23289,"style":12113},[230],[14,23291,23293],{"className":23292},[235],[14,23294,23296,23352],{"className":23295},[9778],[14,23297,23299],{"className":23298},[10136],[14,23300,23302,23344],{"className":23301},[8996,8997],[14,23303,23305,23341],{"className":23304},[9001],[14,23306,23308,23319,23330],{"className":23307,"style":12132},[9005],[14,23309,23310,23313],{"style":12135},[14,23311],{"className":23312,"style":9014},[9013],[14,23314,23316],{"className":23315},[235],[14,23317,8776],{"className":23318,"style":12945},[235,8903],[14,23320,23321,23324],{"style":12151},[14,23322],{"className":23323,"style":9014},[9013],[14,23325,23327],{"className":23326},[235],[14,23328,16678],{"className":23329,"style":12945},[235,8903],[14,23331,23332,23335],{"style":12174},[14,23333],{"className":23334,"style":9014},[9013],[14,23336,23338],{"className":23337},[235],[14,23339,23234],{"className":23340,"style":21113},[235,8903],[14,23342,9058],{"className":23343},[9057],[14,23345,23347],{"className":23346},[9001],[14,23348,23350],{"className":23349,"style":12190},[9005],[14,23351],{},[14,23353,23355],{"className":23354},[10229],[14,23356,23358,23813],{"className":23357},[8996,8997],[14,23359,23361,23810],{"className":23360},[9001],[14,23362,23364,23552,23708],{"className":23363,"style":12132},[9005],[14,23365,23366,23369],{"style":12135},[14,23367],{"className":23368,"style":9014},[9013],[14,23370,23372,23375,23378,23381,23384,23390,23393,23399,23454,23457,23460,23463,23469,23472,23478,23521,23524,23527,23530,23533,23536,23539,23542,23545,23549],{"className":23371},[235],[14,23373],{"className":23374},[235],[14,23376],{"className":23377,"style":9075},[239],[14,23379,988],{"className":23380},[9079],[14,23382],{"className":23383,"style":9075},[239],[14,23385,23387],{"className":23386},[235,122],[14,23388,23073],{"className":23389},[235],[14,23391,23076],{"className":23392},[235],[14,23394,23396],{"className":23395},[235,122],[14,23397,23079],{"className":23398},[235],[14,23400,23402,23405],{"className":23401},[235],[14,23403,12010],{"className":23404,"style":13006},[235,8903],[14,23406,23408],{"className":23407},[9517],[14,23409,23411,23446],{"className":23410},[8996,8997],[14,23412,23414,23443],{"className":23413},[9001],[14,23415,23417],{"className":23416,"style":22643},[9005],[14,23418,23419,23422],{"style":13021},[14,23420],{"className":23421,"style":9533},[9013],[14,23423,23425],{"className":23424},[9018,9019,9020,9021],[14,23426,23428,23431,23434,23437],{"className":23427},[235,9021],[14,23429,540],{"className":23430},[235,9021],[14,23432,8918],{"className":23433,"style":8934},[235,8903,9021],[14,23435,8968],{"className":23436},[9118,9021],[14,23438,23440],{"className":23439},[235,9021],[14,23441,22670],{"className":23442},[235,9699,9021],[14,23444,9058],{"className":23445},[9057],[14,23447,23449],{"className":23448},[9001],[14,23450,23452],{"className":23451,"style":17697},[9005],[14,23453],{},[14,23455],{"className":23456,"style":9075},[239],[14,23458,988],{"className":23459},[9079],[14,23461],{"className":23462,"style":9075},[239],[14,23464,23466],{"className":23465},[235,122],[14,23467,23073],{"className":23468},[235],[14,23470,534],{"className":23471},[235],[14,23473,23475],{"className":23474},[235,122],[14,23476,23079],{"className":23477},[235],[14,23479,23481,23487],{"className":23480},[235],[14,23482,23484],{"className":23483},[235],[14,23485,17486],{"className":23486},[235,9699],[14,23488,23490],{"className":23489},[9517],[14,23491,23493,23513],{"className":23492},[8996,8997],[14,23494,23496,23510],{"className":23495},[9001],[14,23497,23499],{"className":23498,"style":17499},[9005],[14,23500,23501,23504],{"style":17502},[14,23502],{"className":23503,"style":9533},[9013],[14,23505,23507],{"className":23506},[9018,9019,9020,9021],[14,23508,1031],{"className":23509},[235,9021],[14,23511,9058],{"className":23512},[9057],[14,23514,23516],{"className":23515},[9001],[14,23517,23519],{"className":23518,"style":17521},[9005],[14,23520],{},[14,23522,17458],{"className":23523},[8988],[14,23525,328],{"className":23526},[235],[14,23528,17464],{"className":23529},[9071],[14,23531],{"className":23532,"style":9075},[239],[14,23534,988],{"className":23535},[9079],[14,23537],{"className":23538,"style":9075},[239],[14,23540,23134],{"className":23541},[8988],[14,23543,21068],{"className":23544,"style":21113},[235,8903],[14,23546,23548],{"className":23547},[235],"\u002F8",[14,23550,23144],{"className":23551},[9071],[14,23553,23554,23557],{"style":12151},[14,23555],{"className":23556,"style":9014},[9013],[14,23558,23560,23563,23566,23569,23572,23578,23581,23587,23642,23645,23648,23651,23654,23657,23660,23663,23672,23675,23678,23681,23684,23687,23690,23693,23696,23699,23702,23705],{"className":23559},[235],[14,23561],{"className":23562},[235],[14,23564],{"className":23565,"style":9075},[239],[14,23567,988],{"className":23568},[9079],[14,23570],{"className":23571,"style":9075},[239],[14,23573,23575],{"className":23574},[235,122],[14,23576,23165],{"className":23577},[235],[14,23579,23168],{"className":23580},[235],[14,23582,23584],{"className":23583},[235,122],[14,23585,23079],{"className":23586},[235],[14,23588,23590,23593],{"className":23589},[235],[14,23591,12010],{"className":23592,"style":13006},[235,8903],[14,23594,23596],{"className":23595},[9517],[14,23597,23599,23634],{"className":23598},[8996,8997],[14,23600,23602,23631],{"className":23601},[9001],[14,23603,23605],{"className":23604,"style":22643},[9005],[14,23606,23607,23610],{"style":13021},[14,23608],{"className":23609,"style":9533},[9013],[14,23611,23613],{"className":23612},[9018,9019,9020,9021],[14,23614,23616,23619,23622,23625],{"className":23615},[235,9021],[14,23617,540],{"className":23618},[235,9021],[14,23620,8918],{"className":23621,"style":8934},[235,8903,9021],[14,23623,8968],{"className":23624},[9118,9021],[14,23626,23628],{"className":23627},[235,9021],[14,23629,22670],{"className":23630},[235,9699,9021],[14,23632,9058],{"className":23633},[9057],[14,23635,23637],{"className":23636},[9001],[14,23638,23640],{"className":23639,"style":17697},[9005],[14,23641],{},[14,23643],{"className":23644,"style":9075},[239],[14,23646,988],{"className":23647},[9079],[14,23649],{"className":23650,"style":9075},[239],[14,23652,9330],{"className":23653},[8988],[14,23655,21068],{"className":23656,"style":21113},[235,8903],[14,23658],{"className":23659,"style":21159},[239],[14,23661],{"className":23662,"style":240},[239],[14,23664,23666],{"className":23665},[244],[14,23667,23669],{"className":23668},[235],[14,23670,11795],{"className":23671},[235,9699],[14,23673],{"className":23674,"style":21159},[239],[14,23676],{"className":23677,"style":240},[239],[14,23679,1202],{"className":23680},[235],[14,23682,8699],{"className":23683},[9071],[14,23685],{"className":23686,"style":240},[239],[14,23688,11380],{"className":23689},[244],[14,23691],{"className":23692,"style":240},[239],[14,23694,10003],{"className":23695},[235],[14,23697],{"className":23698,"style":240},[239],[14,23700,4432],{"className":23701},[244],[14,23703],{"className":23704,"style":240},[239],[14,23706,23225],{"className":23707},[235],[14,23709,23710,23713],{"style":12174},[14,23711],{"className":23712,"style":9014},[9013],[14,23714,23716,23719,23722,23725,23728,23734,23737,23743,23798,23801,23804,23807],{"className":23715},[235],[14,23717],{"className":23718},[235],[14,23720],{"className":23721,"style":9075},[239],[14,23723,988],{"className":23724},[9079],[14,23726],{"className":23727,"style":9075},[239],[14,23729,23731],{"className":23730},[235,122],[14,23732,23165],{"className":23733},[235],[14,23735,23249],{"className":23736},[235],[14,23738,23740],{"className":23739},[235,122],[14,23741,23079],{"className":23742},[235],[14,23744,23746,23749],{"className":23745},[235],[14,23747,12010],{"className":23748,"style":13006},[235,8903],[14,23750,23752],{"className":23751},[9517],[14,23753,23755,23790],{"className":23754},[8996,8997],[14,23756,23758,23787],{"className":23757},[9001],[14,23759,23761],{"className":23760,"style":22643},[9005],[14,23762,23763,23766],{"style":13021},[14,23764],{"className":23765,"style":9533},[9013],[14,23767,23769],{"className":23768},[9018,9019,9020,9021],[14,23770,23772,23775,23778,23781],{"className":23771},[235,9021],[14,23773,540],{"className":23774},[235,9021],[14,23776,8918],{"className":23777,"style":8934},[235,8903,9021],[14,23779,8968],{"className":23780},[9118,9021],[14,23782,23784],{"className":23783},[235,9021],[14,23785,22670],{"className":23786},[235,9699,9021],[14,23788,9058],{"className":23789},[9057],[14,23791,23793],{"className":23792},[9001],[14,23794,23796],{"className":23795,"style":17697},[9005],[14,23797],{},[14,23799],{"className":23800,"style":9075},[239],[14,23802,988],{"className":23803},[9079],[14,23805],{"className":23806,"style":9075},[239],[14,23808,540],{"className":23809},[235],[14,23811,9058],{"className":23812},[9057],[14,23814,23816],{"className":23815},[9001],[14,23817,23819],{"className":23818,"style":12190},[9005],[14,23820],{},[11,23822,23823,23824,23852,23853,24054,24055,24083],{},"Because the mantissa ",[14,23825,23827,23840],{"className":23826},[188],[14,23828,23830],{"className":23829},[192],[194,23831,23832],{"xmlns":196},[198,23833,23834,23838],{},[201,23835,23836],{},[8885,23837,23234],{},[214,23839,23234],{"encoding":216},[14,23841,23843],{"className":23842,"ariaHidden":222},[221],[14,23844,23846,23849],{"className":23845},[226],[14,23847],{"className":23848,"style":15506},[230],[14,23850,23234],{"className":23851,"style":21113},[235,8903]," is zero, the float simplifies to ",[14,23854,23856,23900],{"className":23855},[188],[14,23857,23859],{"className":23858},[192],[194,23860,23861],{"xmlns":196},[198,23862,23863,23897],{},[201,23864,23865,23875,23877,23879,23881,23883,23889,23891],{},[9559,23866,23867,23869],{},[8885,23868,12010],{},[201,23870,23871,23873],{},[204,23872,540],{},[8885,23874,8918],{},[208,23876,988],{},[208,23878,9330],{"stretchy":9853},[208,23880,9136],{},[204,23882,328],{},[9488,23884,23885,23887],{},[208,23886,8699],{"stretchy":9853},[8885,23888,8776],{},[208,23890,11380],{},[9488,23892,23893,23895],{},[204,23894,1031],{},[8885,23896,9664],{},[214,23898,23899],{"encoding":216},"P_{0y} = (-1)^S \\cdot 2^e",[14,23901,23903,23964,24019],{"className":23902,"ariaHidden":222},[221],[14,23904,23906,23909,23955,23958,23961],{"className":23905},[226],[14,23907],{"className":23908,"style":17652},[230],[14,23910,23912,23915],{"className":23911},[235],[14,23913,12010],{"className":23914,"style":13006},[235,8903],[14,23916,23918],{"className":23917},[9517],[14,23919,23921,23947],{"className":23920},[8996,8997],[14,23922,23924,23944],{"className":23923},[9001],[14,23925,23927],{"className":23926,"style":9605},[9005],[14,23928,23929,23932],{"style":13021},[14,23930],{"className":23931,"style":9533},[9013],[14,23933,23935],{"className":23934},[9018,9019,9020,9021],[14,23936,23938,23941],{"className":23937},[235,9021],[14,23939,540],{"className":23940},[235,9021],[14,23942,8918],{"className":23943,"style":8934},[235,8903,9021],[14,23945,9058],{"className":23946},[9057],[14,23948,23950],{"className":23949},[9001],[14,23951,23953],{"className":23952,"style":17697},[9005],[14,23954],{},[14,23956],{"className":23957,"style":9075},[239],[14,23959,988],{"className":23960},[9079],[14,23962],{"className":23963,"style":9075},[239],[14,23965,23967,23971,23974,23977,23980,24010,24013,24016],{"className":23966},[226],[14,23968],{"className":23969,"style":23970},[230],"height:1.0913em;vertical-align:-0.25em;",[14,23972,9330],{"className":23973},[8988],[14,23975,9136],{"className":23976},[235],[14,23978,328],{"className":23979},[235],[14,23981,23983,23986],{"className":23982},[9071],[14,23984,8699],{"className":23985},[9071],[14,23987,23989],{"className":23988},[9517],[14,23990,23992],{"className":23991},[8996],[14,23993,23995],{"className":23994},[9001],[14,23996,23999],{"className":23997,"style":23998},[9005],"height:0.8413em;",[14,24000,24001,24004],{"style":9529},[14,24002],{"className":24003,"style":9533},[9013],[14,24005,24007],{"className":24006},[9018,9019,9020,9021],[14,24008,8776],{"className":24009,"style":12945},[235,8903,9021],[14,24011],{"className":24012,"style":240},[239],[14,24014,11380],{"className":24015},[244],[14,24017],{"className":24018,"style":240},[239],[14,24020,24022,24025],{"className":24021},[226],[14,24023],{"className":24024,"style":15369},[230],[14,24026,24028,24031],{"className":24027},[235],[14,24029,1031],{"className":24030},[235],[14,24032,24034],{"className":24033},[9517],[14,24035,24037],{"className":24036},[8996],[14,24038,24040],{"className":24039},[9001],[14,24041,24043],{"className":24042,"style":15369},[9005],[14,24044,24045,24048],{"style":9529},[14,24046],{"className":24047,"style":9533},[9013],[14,24049,24051],{"className":24050},[9018,9019,9020,9021],[14,24052,9664],{"className":24053},[235,8903,9021],", where the float exponent ",[14,24056,24058,24071],{"className":24057},[188],[14,24059,24061],{"className":24060},[192],[194,24062,24063],{"xmlns":196},[198,24064,24065,24069],{},[201,24066,24067],{},[8885,24068,9664],{},[214,24070,9664],{"encoding":216},[14,24072,24074],{"className":24073,"ariaHidden":222},[221],[14,24075,24077,24080],{"className":24076},[226],[14,24078],{"className":24079,"style":8899},[230],[14,24081,9664],{"className":24082},[235,8903]," is:",[11,24085,24086],{},[14,24087,24089,24145],{"className":24088},[188],[14,24090,24092],{"className":24091},[192],[194,24093,24094],{"xmlns":196},[198,24095,24096,24142],{},[201,24097,24098,24100,24102,24104,24106,24109,24111,24113,24115,24117,24127,24129,24131,24133,24135,24137,24139],{},[8885,24099,9664],{},[208,24101,988],{},[8885,24103,16678],{},[208,24105,9136],{},[204,24107,24108],{},"127",[208,24110,988],{},[208,24112,9330],{"stretchy":9853},[8885,24114,21068],{},[9562,24116,21083],{},[208,24118,24119],{"lspace":9844,"rspace":9844},[201,24120,24121,24123,24125],{},[8885,24122,11263],{"mathvariant":9648},[8885,24124,9656],{"mathvariant":9648},[8885,24126,10040],{"mathvariant":9648},[9562,24128,21083],{},[204,24130,1202],{},[208,24132,8699],{"stretchy":9853},[208,24134,11380],{},[204,24136,10003],{},[208,24138,9136],{},[204,24140,24141],{},"99",[214,24143,24144],{"encoding":216},"e = E - 127 = (N \\bmod 8) \\cdot 32 - 99",[14,24146,24148,24166,24185,24203,24236,24257,24275],{"className":24147,"ariaHidden":222},[221],[14,24149,24151,24154,24157,24160,24163],{"className":24150},[226],[14,24152],{"className":24153,"style":8899},[230],[14,24155,9664],{"className":24156},[235,8903],[14,24158],{"className":24159,"style":9075},[239],[14,24161,988],{"className":24162},[9079],[14,24164],{"className":24165,"style":9075},[239],[14,24167,24169,24173,24176,24179,24182],{"className":24168},[226],[14,24170],{"className":24171,"style":24172},[230],"height:0.7667em;vertical-align:-0.0833em;",[14,24174,16678],{"className":24175,"style":12945},[235,8903],[14,24177],{"className":24178,"style":240},[239],[14,24180,9136],{"className":24181},[244],[14,24183],{"className":24184,"style":240},[239],[14,24186,24188,24191,24194,24197,24200],{"className":24187},[226],[14,24189],{"className":24190,"style":254},[230],[14,24192,24108],{"className":24193},[235],[14,24195],{"className":24196,"style":9075},[239],[14,24198,988],{"className":24199},[9079],[14,24201],{"className":24202,"style":9075},[239],[14,24204,24206,24209,24212,24215,24218,24221,24230,24233],{"className":24205},[226],[14,24207],{"className":24208,"style":14909},[230],[14,24210,9330],{"className":24211},[8988],[14,24213,21068],{"className":24214,"style":21113},[235,8903],[14,24216],{"className":24217,"style":21159},[239],[14,24219],{"className":24220,"style":240},[239],[14,24222,24224],{"className":24223},[244],[14,24225,24227],{"className":24226},[235],[14,24228,11795],{"className":24229},[235,9699],[14,24231],{"className":24232,"style":21159},[239],[14,24234],{"className":24235,"style":240},[239],[14,24237,24239,24242,24245,24248,24251,24254],{"className":24238},[226],[14,24240],{"className":24241,"style":14909},[230],[14,24243,1202],{"className":24244},[235],[14,24246,8699],{"className":24247},[9071],[14,24249],{"className":24250,"style":240},[239],[14,24252,11380],{"className":24253},[244],[14,24255],{"className":24256,"style":240},[239],[14,24258,24260,24263,24266,24269,24272],{"className":24259},[226],[14,24261],{"className":24262,"style":231},[230],[14,24264,10003],{"className":24265},[235],[14,24267],{"className":24268,"style":240},[239],[14,24270,9136],{"className":24271},[244],[14,24273],{"className":24274,"style":240},[239],[14,24276,24278,24281],{"className":24277},[226],[14,24279],{"className":24280,"style":254},[230],[14,24282,24141],{"className":24283},[235],[11,24285,24286,24287,24315,24316,24344,24345,24373],{},"Once the canvas probes measure the exponent ",[14,24288,24290,24303],{"className":24289},[188],[14,24291,24293],{"className":24292},[192],[194,24294,24295],{"xmlns":196},[198,24296,24297,24301],{},[201,24298,24299],{},[8885,24300,9664],{},[214,24302,9664],{"encoding":216},[14,24304,24306],{"className":24305,"ariaHidden":222},[221],[14,24307,24309,24312],{"className":24308},[226],[14,24310],{"className":24311,"style":8899},[230],[14,24313,9664],{"className":24314},[235,8903]," and sign ",[14,24317,24319,24332],{"className":24318},[188],[14,24320,24322],{"className":24321},[192],[194,24323,24324],{"xmlns":196},[198,24325,24326,24330],{},[201,24327,24328],{},[8885,24329,8776],{},[214,24331,8776],{"encoding":216},[14,24333,24335],{"className":24334,"ariaHidden":222},[221],[14,24336,24338,24341],{"className":24337},[226],[14,24339],{"className":24340,"style":15506},[230],[14,24342,8776],{"className":24343,"style":12945},[235,8903]," (0 for positive, 1 for negative), we can algebraically invert these relations. First, we compute the remainder of ",[14,24346,24348,24361],{"className":24347},[188],[14,24349,24351],{"className":24350},[192],[194,24352,24353],{"xmlns":196},[198,24354,24355,24359],{},[201,24356,24357],{},[8885,24358,21068],{},[214,24360,21068],{"encoding":216},[14,24362,24364],{"className":24363,"ariaHidden":222},[221],[14,24365,24367,24370],{"className":24366},[226],[14,24368],{"className":24369,"style":15506},[230],[14,24371,21068],{"className":24372,"style":21113},[235,8903]," modulo 8 from the exponent:",[11,24375,24376],{},[14,24377,24379,24425],{"className":24378},[188],[14,24380,24382],{"className":24381},[192],[194,24383,24384],{"xmlns":196},[198,24385,24386,24422],{},[201,24387,24388,24390,24392,24402,24404,24406,24408,24410,24412,24414,24416,24418,24420],{},[8885,24389,21068],{},[9562,24391,21083],{},[208,24393,24394],{"lspace":9844,"rspace":9844},[201,24395,24396,24398,24400],{},[8885,24397,11263],{"mathvariant":9648},[8885,24399,9656],{"mathvariant":9648},[8885,24401,10040],{"mathvariant":9648},[9562,24403,21083],{},[204,24405,1202],{},[208,24407,988],{},[208,24409,9330],{"stretchy":9853},[8885,24411,9664],{},[208,24413,4432],{},[204,24415,24141],{},[208,24417,8699],{"stretchy":9853},[8885,24419,23139],{"mathvariant":9648},[204,24421,10003],{},[214,24423,24424],{"encoding":216},"N \\bmod 8 = (e + 99) \u002F 32",[14,24426,24428,24458,24476,24497],{"className":24427,"ariaHidden":222},[221],[14,24429,24431,24434,24437,24440,24443,24452,24455],{"className":24430},[226],[14,24432],{"className":24433,"style":17145},[230],[14,24435,21068],{"className":24436,"style":21113},[235,8903],[14,24438],{"className":24439,"style":21159},[239],[14,24441],{"className":24442,"style":240},[239],[14,24444,24446],{"className":24445},[244],[14,24447,24449],{"className":24448},[235],[14,24450,11795],{"className":24451},[235,9699],[14,24453],{"className":24454,"style":21159},[239],[14,24456],{"className":24457,"style":240},[239],[14,24459,24461,24464,24467,24470,24473],{"className":24460},[226],[14,24462],{"className":24463,"style":254},[230],[14,24465,1202],{"className":24466},[235],[14,24468],{"className":24469,"style":9075},[239],[14,24471,988],{"className":24472},[9079],[14,24474],{"className":24475,"style":9075},[239],[14,24477,24479,24482,24485,24488,24491,24494],{"className":24478},[226],[14,24480],{"className":24481,"style":14909},[230],[14,24483,9330],{"className":24484},[8988],[14,24486,9664],{"className":24487},[235,8903],[14,24489],{"className":24490,"style":240},[239],[14,24492,4432],{"className":24493},[244],[14,24495],{"className":24496,"style":240},[239],[14,24498,24500,24503,24506,24509],{"className":24499},[226],[14,24501],{"className":24502,"style":14909},[230],[14,24504,24141],{"className":24505},[235],[14,24507,8699],{"className":24508},[9071],[14,24510,24512],{"className":24511},[235],"\u002F32",[11,24514,24515,24516,24544,24545,24573],{},"Second, we reconstruct the complete 4-bit value of ",[14,24517,24519,24532],{"className":24518},[188],[14,24520,24522],{"className":24521},[192],[194,24523,24524],{"xmlns":196},[198,24525,24526,24530],{},[201,24527,24528],{},[8885,24529,21068],{},[214,24531,21068],{"encoding":216},[14,24533,24535],{"className":24534,"ariaHidden":222},[221],[14,24536,24538,24541],{"className":24537},[226],[14,24539],{"className":24540,"style":15506},[230],[14,24542,21068],{"className":24543,"style":21113},[235,8903]," by combining the quotient (",[14,24546,24548,24561],{"className":24547},[188],[14,24549,24551],{"className":24550},[192],[194,24552,24553],{"xmlns":196},[198,24554,24555,24559],{},[201,24556,24557],{},[8885,24558,8776],{},[214,24560,8776],{"encoding":216},[14,24562,24564],{"className":24563,"ariaHidden":222},[221],[14,24565,24567,24570],{"className":24566},[226],[14,24568],{"className":24569,"style":15506},[230],[14,24571,8776],{"className":24572,"style":12945},[235,8903],") and the remainder:",[11,24575,24576],{},[14,24577,24579,24617],{"className":24578},[188],[14,24580,24582],{"className":24581},[192],[194,24583,24584],{"xmlns":196},[198,24585,24586,24614],{},[201,24587,24588,24590,24592,24594,24596,24598,24600,24602,24604,24606,24608,24610,24612],{},[8885,24589,21068],{},[208,24591,988],{},[8885,24593,8776],{},[208,24595,11380],{},[204,24597,1202],{},[208,24599,4432],{},[208,24601,9330],{"stretchy":9853},[8885,24603,9664],{},[208,24605,4432],{},[204,24607,24141],{},[208,24609,8699],{"stretchy":9853},[8885,24611,23139],{"mathvariant":9648},[204,24613,10003],{},[214,24615,24616],{"encoding":216},"N = S \\cdot 8 + (e + 99) \u002F 32",[14,24618,24620,24638,24656,24674,24695],{"className":24619,"ariaHidden":222},[221],[14,24621,24623,24626,24629,24632,24635],{"className":24622},[226],[14,24624],{"className":24625,"style":15506},[230],[14,24627,21068],{"className":24628,"style":21113},[235,8903],[14,24630],{"className":24631,"style":9075},[239],[14,24633,988],{"className":24634},[9079],[14,24636],{"className":24637,"style":9075},[239],[14,24639,24641,24644,24647,24650,24653],{"className":24640},[226],[14,24642],{"className":24643,"style":15506},[230],[14,24645,8776],{"className":24646,"style":12945},[235,8903],[14,24648],{"className":24649,"style":240},[239],[14,24651,11380],{"className":24652},[244],[14,24654],{"className":24655,"style":240},[239],[14,24657,24659,24662,24665,24668,24671],{"className":24658},[226],[14,24660],{"className":24661,"style":231},[230],[14,24663,1202],{"className":24664},[235],[14,24666],{"className":24667,"style":240},[239],[14,24669,4432],{"className":24670},[244],[14,24672],{"className":24673,"style":240},[239],[14,24675,24677,24680,24683,24686,24689,24692],{"className":24676},[226],[14,24678],{"className":24679,"style":14909},[230],[14,24681,9330],{"className":24682},[8988],[14,24684,9664],{"className":24685},[235,8903],[14,24687],{"className":24688,"style":240},[239],[14,24690,4432],{"className":24691},[244],[14,24693],{"className":24694,"style":240},[239],[14,24696,24698,24701,24704,24707],{"className":24697},[226],[14,24699],{"className":24700,"style":14909},[230],[14,24702,24141],{"className":24703},[235],[14,24705,8699],{"className":24706},[9071],[14,24708,24512],{"className":24709},[235],[11,24711,24712,24713,537],{},"Finally, we reverse the constant shift to recover the exact page index ",[14,24714,24716,24729],{"className":24715},[188],[14,24717,24719],{"className":24718},[192],[194,24720,24721],{"xmlns":196},[198,24722,24723,24727],{},[201,24724,24725],{},[8885,24726,20550],{},[214,24728,20550],{"encoding":216},[14,24730,24732],{"className":24731,"ariaHidden":222},[221],[14,24733,24735,24738],{"className":24734},[226],[14,24736],{"className":24737,"style":17145},[230],[14,24739,20550],{"className":24740,"style":20782},[235,8903],[11,24742,24743],{},[14,24744,24746,24788],{"className":24745},[188],[14,24747,24749],{"className":24748},[192],[194,24750,24751],{"xmlns":196},[198,24752,24753,24785],{},[201,24754,24755,24757,24759,24761,24763,24765,24767,24769,24771,24781,24783],{},[8885,24756,20550],{},[208,24758,988],{},[208,24760,9330],{"stretchy":9853},[8885,24762,21068],{},[208,24764,9136],{},[204,24766,534],{},[208,24768,8699],{"stretchy":9853},[9562,24770,21083],{},[208,24772,24773],{"lspace":9844,"rspace":9844},[201,24774,24775,24777,24779],{},[8885,24776,11263],{"mathvariant":9648},[8885,24778,9656],{"mathvariant":9648},[8885,24780,10040],{"mathvariant":9648},[9562,24782,21083],{},[204,24784,9567],{},[214,24786,24787],{"encoding":216},"k = (N - 7) \\bmod 16",[14,24789,24791,24809,24830,24863],{"className":24790,"ariaHidden":222},[221],[14,24792,24794,24797,24800,24803,24806],{"className":24793},[226],[14,24795],{"className":24796,"style":17145},[230],[14,24798,20550],{"className":24799,"style":20782},[235,8903],[14,24801],{"className":24802,"style":9075},[239],[14,24804,988],{"className":24805},[9079],[14,24807],{"className":24808,"style":9075},[239],[14,24810,24812,24815,24818,24821,24824,24827],{"className":24811},[226],[14,24813],{"className":24814,"style":14909},[230],[14,24816,9330],{"className":24817},[8988],[14,24819,21068],{"className":24820,"style":21113},[235,8903],[14,24822],{"className":24823,"style":240},[239],[14,24825,9136],{"className":24826},[244],[14,24828],{"className":24829,"style":240},[239],[14,24831,24833,24836,24839,24842,24845,24848,24857,24860],{"className":24832},[226],[14,24834],{"className":24835,"style":14909},[230],[14,24837,534],{"className":24838},[235],[14,24840,8699],{"className":24841},[9071],[14,24843],{"className":24844,"style":21159},[239],[14,24846],{"className":24847,"style":240},[239],[14,24849,24851],{"className":24850},[244],[14,24852,24854],{"className":24853},[235],[14,24855,11795],{"className":24856},[235,9699],[14,24858],{"className":24859,"style":21159},[239],[14,24861],{"className":24862,"style":240},[239],[14,24864,24866,24869],{"className":24865},[226],[14,24867],{"className":24868,"style":254},[230],[14,24870,9567],{"className":24871},[235],[11,24873,24874],{},"Reconstructing the 64-bit vtable pointer (vptr) resolves the load base itself. Although ASLR shifts the absolute load address of chrome.so at boot, the internal layout of the compiled library is static. Subtracting the build-constant offset of the vtable (here, 0x0faa7ba0) from the leaked runtime pointer yields the absolute load address (chrome_base), allowing us to locate other interesting symbols (such as mkdir@plt at RVA 0x0f566840) by adding its RVA:",[14,24876,24878],{"className":24877},[9765],[14,24879,24881,25022],{"className":24880},[188],[14,24882,24884],{"className":24883},[192],[194,24885,24886],{"xmlns":196,"display":9774},[198,24887,24888,25019],{},[9778,24889,24890,24950],{"rowspacing":9780,"columnalign":11940,"columnspacing":11941},[9784,24891,24892,24921],{},[9787,24893,24894],{},[9790,24895,24896],{"scriptlevel":540,"displaystyle":222},[201,24897,24898,24900,24903,24905,24907,24909,24911,24913,24915,24917,24919],{},[8885,24899,10045],{"mathvariant":9648},[8885,24901,24902],{"mathvariant":9648},"h",[8885,24904,9667],{"mathvariant":9648},[8885,24906,9656],{"mathvariant":9648},[8885,24908,11263],{"mathvariant":9648},[8885,24910,9664],{"mathvariant":9648},[8885,24912,9805],{"mathvariant":9648},[8885,24914,9808],{"mathvariant":9648},[8885,24916,21],{"mathvariant":9648},[8885,24918,9813],{"mathvariant":9648},[8885,24920,9664],{"mathvariant":9648},[9787,24922,24923],{},[9790,24924,24925],{"scriptlevel":540,"displaystyle":222},[201,24926,24927,24929,24931,24941,24943],{},[201,24928],{},[208,24930,988],{},[201,24932,24933,24935,24937,24939],{},[8885,24934,11320],{"mathvariant":9648},[8885,24936,11],{"mathvariant":9648},[8885,24938,9967],{"mathvariant":9648},[8885,24940,9667],{"mathvariant":9648},[208,24942,9136],{},[9559,24944,24945,24948],{},[9562,24946,24947],{},"0FAA7BA0",[204,24949,9567],{},[9784,24951,24952,24976],{},[9787,24953,24954],{},[9790,24955,24956],{"scriptlevel":540,"displaystyle":222},[201,24957,24958,24960,24962,24964,24966,24968,24970,24972,24974],{},[8885,24959,11263],{"mathvariant":9648},[8885,24961,20550],{"mathvariant":9648},[8885,24963,10040],{"mathvariant":9648},[8885,24965,11274],{"mathvariant":9648},[8885,24967,9667],{"mathvariant":9648},[8885,24969,9805],{"mathvariant":9648},[8885,24971,21],{"mathvariant":9648},[8885,24973,9808],{"mathvariant":9648},[8885,24975,9813],{"mathvariant":9648},[9787,24977,24978],{},[9790,24979,24980],{"scriptlevel":540,"displaystyle":222},[201,24981,24982,24984,24986,25010,25012],{},[201,24983],{},[208,24985,988],{},[201,24987,24988,24990,24992,24994,24996,24998,25000,25002,25004,25006,25008],{},[8885,24989,10045],{"mathvariant":9648},[8885,24991,24902],{"mathvariant":9648},[8885,24993,9667],{"mathvariant":9648},[8885,24995,9656],{"mathvariant":9648},[8885,24997,11263],{"mathvariant":9648},[8885,24999,9664],{"mathvariant":9648},[8885,25001,9805],{"mathvariant":9648},[8885,25003,9808],{"mathvariant":9648},[8885,25005,21],{"mathvariant":9648},[8885,25007,9813],{"mathvariant":9648},[8885,25009,9664],{"mathvariant":9648},[208,25011,4432],{},[9559,25013,25014,25017],{},[9562,25015,25016],{},"0F566840",[204,25018,9567],{},[214,25020,25021],{"encoding":216},"\\begin{aligned}\n\\mathrm{chrome\\_base} &= \\mathrm{vptr} - \\text{0FAA7BA0}_{16} \\\\\n\\mathrm{mkdir\\_abs} &= \\mathrm{chrome\\_base} + \\text{0F566840}_{16}\n\\end{aligned}",[14,25023,25025],{"className":25024,"ariaHidden":222},[221],[14,25026,25028,25031],{"className":25027},[226],[14,25029],{"className":25030,"style":19333},[230],[14,25032,25034],{"className":25033},[235],[14,25035,25037,25090],{"className":25036},[9778],[14,25038,25040],{"className":25039},[10136],[14,25041,25043,25082],{"className":25042},[8996,8997],[14,25044,25046,25079],{"className":25045},[9001],[14,25047,25049,25064],{"className":25048,"style":19352},[9005],[14,25050,25051,25054],{"style":19355},[14,25052],{"className":25053,"style":9014},[9013],[14,25055,25057],{"className":25056},[235],[14,25058,25060],{"className":25059},[235],[14,25061,25063],{"className":25062},[235,9699],"chrome_base",[14,25065,25066,25069],{"style":19410},[14,25067],{"className":25068,"style":9014},[9013],[14,25070,25072],{"className":25071},[235],[14,25073,25075],{"className":25074},[235],[14,25076,25078],{"className":25077},[235,9699],"mkdir_abs",[14,25080,9058],{"className":25081},[9057],[14,25083,25085],{"className":25084},[9001],[14,25086,25088],{"className":25087,"style":19426},[9005],[14,25089],{},[14,25091,25093],{"className":25092},[10229],[14,25094,25096,25267],{"className":25095},[8996,8997],[14,25097,25099,25264],{"className":25098},[9001],[14,25100,25102,25183],{"className":25101,"style":19352},[9005],[14,25103,25104,25107],{"style":19355},[14,25105],{"className":25106,"style":9014},[9013],[14,25108,25110,25113,25116,25119,25122,25128,25131,25134,25137],{"className":25109},[235],[14,25111],{"className":25112},[235],[14,25114],{"className":25115,"style":9075},[239],[14,25117,988],{"className":25118},[9079],[14,25120],{"className":25121,"style":9075},[239],[14,25123,25125],{"className":25124},[235],[14,25126,17486],{"className":25127},[235,9699],[14,25129],{"className":25130,"style":240},[239],[14,25132,9136],{"className":25133},[244],[14,25135],{"className":25136,"style":240},[239],[14,25138,25140,25146],{"className":25139},[235],[14,25141,25143],{"className":25142},[235,122],[14,25144,24947],{"className":25145},[235],[14,25147,25149],{"className":25148},[9517],[14,25150,25152,25175],{"className":25151},[8996,8997],[14,25153,25155,25172],{"className":25154},[9001],[14,25156,25158],{"className":25157,"style":9605},[9005],[14,25159,25160,25163],{"style":9608},[14,25161],{"className":25162,"style":9533},[9013],[14,25164,25166],{"className":25165},[9018,9019,9020,9021],[14,25167,25169],{"className":25168},[235,9021],[14,25170,9567],{"className":25171},[235,9021],[14,25173,9058],{"className":25174},[9057],[14,25176,25178],{"className":25177},[9001],[14,25179,25181],{"className":25180,"style":9630},[9005],[14,25182],{},[14,25184,25185,25188],{"style":19410},[14,25186],{"className":25187,"style":9014},[9013],[14,25189,25191,25194,25197,25200,25203,25209,25212,25215,25218],{"className":25190},[235],[14,25192],{"className":25193},[235],[14,25195],{"className":25196,"style":9075},[239],[14,25198,988],{"className":25199},[9079],[14,25201],{"className":25202,"style":9075},[239],[14,25204,25206],{"className":25205},[235],[14,25207,25063],{"className":25208},[235,9699],[14,25210],{"className":25211,"style":240},[239],[14,25213,4432],{"className":25214},[244],[14,25216],{"className":25217,"style":240},[239],[14,25219,25221,25227],{"className":25220},[235],[14,25222,25224],{"className":25223},[235,122],[14,25225,25016],{"className":25226},[235],[14,25228,25230],{"className":25229},[9517],[14,25231,25233,25256],{"className":25232},[8996,8997],[14,25234,25236,25253],{"className":25235},[9001],[14,25237,25239],{"className":25238,"style":9605},[9005],[14,25240,25241,25244],{"style":9608},[14,25242],{"className":25243,"style":9533},[9013],[14,25245,25247],{"className":25246},[9018,9019,9020,9021],[14,25248,25250],{"className":25249},[235,9021],[14,25251,9567],{"className":25252},[235,9021],[14,25254,9058],{"className":25255},[9057],[14,25257,25259],{"className":25258},[9001],[14,25260,25262],{"className":25261,"style":9630},[9005],[14,25263],{},[14,25265,9058],{"className":25266},[9057],[14,25268,25270],{"className":25269},[9001],[14,25271,25273],{"className":25272,"style":19426},[9005],[14,25274],{},[51,25276,25278],{"label":25277},"Completely honest",[11,25279,25280],{},"I prompted an AI to do the math for me. It worked. Tested with our PoC, not pure slop.",[11,25282,25283],{},"With the arbitrary write (forge) primitive and the leaked base addresses (heap pool base and chrome code base), we can now proceed to execute code.",[37,25285,25287],{"id":25286},"the-arb-call","The Arb-Call",[11,25289,25290],{},"The forge primitive gives us a controlled write into the GPU process heap. To turn that into code execution we need an indirect call site where the function pointer is attacker-writable and the call is not guarded by CFI.",[8422,25292,25294],{"id":25293},"target-properties","Target properties",[11,25296,25297],{},"So we hunt for a heap structure with four specific properties:",[8442,25299,25300,25306,25312,25318],{},[302,25301,25302,25305],{},[129,25303,25304],{},"Address predictability",": we must be able to locate it (either via a stable static pool offset or a dynamic heap walk).",[302,25307,25308,25311],{},[129,25309,25310],{},"Function tables",": it must contain function pointers that are called during routine execution (so we can trigger our hijack).",[302,25313,25314,25317],{},[129,25315,25316],{},"CFI exemption",": calls through these pointers are not guarded by CFI.",[302,25319,25320,25323],{},[129,25321,25322],{},"Safe free path",": we must be able to free it (to put its slot back on the freelist) and reclaim it with our own payload.",[11,25325,25326],{},"GrGLInterface (Skia's OpenGL function table) fits this profile well.",[8422,25328,25330],{"id":25329},"why-grglinterface-bypasses-cfi","Why GrGLInterface bypasses CFI",[11,25332,25333],{},"GrGLInterface is Skia's OpenGL function-pointer table. The GPU calls through its entries on every GL operation.",[11,25335,25336],{},"While LLVM CFI's cfi-icall normally instruments indirect call sites to verify function signatures, the GrGLFunction call family is explicitly excluded in src\u002Ftools\u002Fcfi\u002Fignores.txt:",[117,25338,25341],{"className":25339,"code":25340,"language":122,"meta":125},[120],"# third_party\u002Fskia\u002Finclude\u002Fgpu\u002Fgl\u002FGrGLFunctions.h\nfun:*GrGLFunction*\n",[29,25342,25340],{"__ignoreMap":125},[11,25344,25345,25346,25349],{},"This exclusion is necessary because chromium loads GL function pointers at runtime via eglGetProcAddress() \u002F glXGetProcAddress(). Since the actual types are determined by the GL driver rather than compile-time information, CFI cannot validate them, and calls through ",[29,25347,25348],{},"GrGLFunction\u003C>"," are compiled without checks.",[9286,25351,25352],{"type":9288},[11,25353,25354],{},"GrGLFunction calls are excluded from CFI because GL pointers are loaded at runtime from the driver. Overwriting GrGLInterface gives us a CFI-free indirect call gate on the heap.",[8422,25356,25358],{"id":25357},"locating-the-target-static-offset","Locating the target (static offset)",[11,25360,25361],{},"GrGLInterface is allocated once during GPU process initialization, before any user rasterization traffic. Because the startup allocation sequence is highly deterministic for a given environment, this allocation lands at a \"stable\" offset within PartitionAlloc's pool.",[11,25363,25364],{},"However, this static offset is environment-dependent: it varies across different browser builds, compiler flags, and operating systems. In the target environment of this build, the GrGLInterface singleton sits at a constant pool offset from the leaked heap base:",[11,25366,25367],{},[14,25368,25370,25445],{"className":25369},[188],[14,25371,25373],{"className":25372},[192],[194,25374,25375],{"xmlns":196},[198,25376,25377,25442],{},[201,25378,25379,25381,25411,25413,25433,25435],{},[8885,25380,1025],{"mathvariant":9648},[201,25382,25383,25386,25388,25390,25392,25394,25396,25398,25400,25402,25405,25407,25409],{},[8885,25384,25385],{"mathvariant":9648},"G",[8885,25387,9667],{"mathvariant":9648},[8885,25389,25385],{"mathvariant":9648},[8885,25391,9653],{"mathvariant":9648},[8885,25393,8431],{"mathvariant":9648},[8885,25395,11279],{"mathvariant":9648},[8885,25397,9967],{"mathvariant":9648},[8885,25399,9664],{"mathvariant":9648},[8885,25401,9667],{"mathvariant":9648},[8885,25403,25404],{"mathvariant":9648},"f",[8885,25406,21],{"mathvariant":9648},[8885,25408,10045],{"mathvariant":9648},[8885,25410,9664],{"mathvariant":9648},[208,25412,988],{},[201,25414,25415,25417,25419,25421,25423,25425,25427,25429,25431],{},[8885,25416,11],{"mathvariant":9648},[8885,25418,9656],{"mathvariant":9648},[8885,25420,9656],{"mathvariant":9648},[8885,25422,9802],{"mathvariant":9648},[8885,25424,9805],{"mathvariant":9648},[8885,25426,9808],{"mathvariant":9648},[8885,25428,21],{"mathvariant":9648},[8885,25430,9813],{"mathvariant":9648},[8885,25432,9664],{"mathvariant":9648},[208,25434,4432],{},[9559,25436,25437,25440],{},[9562,25438,25439],{},"4008EA800",[204,25441,9567],{},[214,25443,25444],{"encoding":216},"\\&\\mathrm{GrGLInterface} = \\mathrm{pool\\_base} + \\text{4008EA800}_{16}",[14,25446,25448,25473,25495],{"className":25447,"ariaHidden":222},[221],[14,25449,25451,25454,25457,25464,25467,25470],{"className":25450},[226],[14,25452],{"className":25453,"style":17145},[230],[14,25455,1025],{"className":25456},[235],[14,25458,25460],{"className":25459},[235],[14,25461,25463],{"className":25462},[235,9699],"GrGLInterface",[14,25465],{"className":25466,"style":9075},[239],[14,25468,988],{"className":25469},[9079],[14,25471],{"className":25472,"style":9075},[239],[14,25474,25476,25480,25486,25489,25492],{"className":25475},[226],[14,25477],{"className":25478,"style":25479},[230],"height:1.0044em;vertical-align:-0.31em;",[14,25481,25483],{"className":25482},[235],[14,25484,10162],{"className":25485},[235,9699],[14,25487],{"className":25488,"style":240},[239],[14,25490,4432],{"className":25491},[244],[14,25493],{"className":25494,"style":240},[239],[14,25496,25498,25501],{"className":25497},[226],[14,25499],{"className":25500,"style":9715},[230],[14,25502,25504,25510],{"className":25503},[235],[14,25505,25507],{"className":25506},[235,122],[14,25508,25439],{"className":25509},[235],[14,25511,25513],{"className":25512},[9517],[14,25514,25516,25539],{"className":25515},[8996,8997],[14,25517,25519,25536],{"className":25518},[9001],[14,25520,25522],{"className":25521,"style":9605},[9005],[14,25523,25524,25527],{"style":9608},[14,25525],{"className":25526,"style":9533},[9013],[14,25528,25530],{"className":25529},[9018,9019,9020,9021],[14,25531,25533],{"className":25532},[235,9021],[14,25534,9567],{"className":25535},[235,9021],[14,25537,9058],{"className":25538},[9057],[14,25540,25542],{"className":25541},[9001],[14,25543,25545],{"className":25544,"style":9630},[9005],[14,25546],{},[9286,25548,25550],{"type":25549},"bunny",[11,25551,25552],{},"Wait, what if we want an environment-independent solution? Don't panic — jump hoops, walk the heap (see the dynamic-walk section below).",[11,25554,25555],{},"With the target address resolved, we can now proceed to hijack it.",[8422,25557,25559],{"id":25558},"the-free-reclaim","The free + reclaim",[11,25561,25562],{},"Our goal is to free GrGLInterface and immediately reclaim its slot with a controlled payload. Because the GPU process maintains a live pointer to this structure and continuously calls GL functions through it, overwriting this memory block allows us to intercept the next GL call and hijack execution.",[11,25564,25565],{},"First, we plant AF = &GrGLInterface into the victim's listener-array data pointer (the UAF target from the dual-use corruption above). Evicting the victim triggers the destructor cascade, freeing the interface:",[117,25567,25570],{"className":25568,"code":25569,"language":122,"meta":125},[120],"ring.clearPaintCache() -> ~SkPathData() -> sk_free(&GrGLInterface)\n",[29,25571,25569],{"__ignoreMap":125},[11,25573,25574],{},"GrGLInterface is an 8,240-byte object that lands in the multi-slot bucket-10240. When freed, its slot returns to that bucket's LIFO freelist. Within the same IPC batch, we reclaim the slot by allocating 64 same-sized transfer-cache entries (kTCRawMemory) filled with our payload. Because the freelist is LIFO, the first allocation pops the GrGLInterface slot we just freed and overwrites it with our payload. Spraying 64 allocations ensures we win the slot even if background thread activity creates noise.",[8422,25576,25578],{"id":25577},"payload-layout-and-execution-dispatch","Payload layout and execution dispatch",[11,25580,25581],{},"GrGLInterface consists of a header followed by an array of GrGLFunction entry wrappers. Each wrapper contains an invoker function pointer (fCall) and a local buffer (fBuf) for closure storage:",[117,25583,25585],{"className":9308,"code":25584,"language":9310,"meta":125,"style":125},"struct GrGLFunction {\n    void* fCall;\n    char  fBuf[32];\n};\n",[29,25586,25587,25598,25605,25617],{"__ignoreMap":125},[14,25588,25589,25592,25595],{"class":475,"line":476},[14,25590,25591],{"class":479},"struct",[14,25593,25594],{"class":483}," GrGLFunction",[14,25596,25597],{"class":487}," {\n",[14,25599,25600,25602],{"class":475,"line":491},[14,25601,12600],{"class":479},[14,25603,25604],{"class":487}," fCall;\n",[14,25606,25607,25610,25613,25615],{"class":475,"line":500},[14,25608,25609],{"class":479},"    char",[14,25611,25612],{"class":487},"  fBuf[",[14,25614,10003],{"class":533},[14,25616,2033],{"class":487},[14,25618,25619],{"class":475,"line":508},[14,25620,1001],{"class":487},[11,25622,25623],{},"Invoking any entry calls fCall(fBuf, args...). Because the invoker is always handed the address of fBuf as its first argument, we can hijack execution by pointing fCall to mkdir@plt and putting the string \"\u002Ftmp\u002Fpwned\" in fBuf.",[11,25625,25626],{},"To ensure this works regardless of which GL function Skia calls next, we tile this fake entry pattern across the entire reclaimed slot, zeroing out the header. When the GPU triggers the next GL call, the x86-64 SysV ABI passes the first argument (the address of fBuf, i.e., \"\u002Ftmp\u002Fpwned\") in rdi. This transforms the dispatch into a direct call:",[117,25628,25631],{"className":25629,"code":25630,"language":122,"meta":125},[120],"mkdir(\"\u002Ftmp\u002Fpwned\", mode)\n",[29,25632,25630],{"__ignoreMap":125},[11,25634,25635],{},"Since mkdir ignores any subsequent arguments, the directory is successfully created and code execution is achieved.",[51,25637,25638],{},[11,25639,25640],{},"mkdir is just a non-destructive sandbox escape demo to prove code execution. A real payload would require rop\u002Fshellcode, which is left as an exercise.",[37,25642,25644],{"id":25643},"chasing-pointers-the-dynamic-walk","Chasing pointers: the dynamic walk",[11,25646,25647],{},"Recall our progress: the c1read primitive bypassed code ASLR by reading coordinate floats from the double-vtable to locate mkdir@plt, and the Arb-Call section established our arbitrary call mechanics. However, the static offset shortcut above is highly environment-dependent. If the driver or operating system changes, the offset drifts, and we lack a generic method to locate the GrGLInterface address on the heap.",[51,25649,25650],{"bunny":222},[11,25651,25652],{},"Follow the heap pointers, Neo.",[11,25654,25655],{},"To resolve this dynamically, we must trace the GPU's internal object graph starting from our leaked decoder base. Doing so requires the ability to read arbitrary pointers from the heap, not just the special double-vtable layout.",[8422,25657,25659],{"id":25658},"general-pointer-reads-and-zero-framing-zazb","General pointer reads and Zero Framing (ZA\u002FZB)",[11,25661,25662,25663,25666],{},"To perform this walk, we need to read arbitrary 64-bit pointers. While our ASLR leak (the vptr section above) read a specific vptr that naturally came with a twin (vptr2), a general pointer ",[29,25664,25665],{},"*T"," at location T has no neighboring twin; its adjacent 8 bytes contain unrelated heap data.",[11,25668,25669,25670,8498,25888,26105],{},"This presents a major measurement problem. When Skia renders a line between two points ",[14,25671,25673,25719],{"className":25672},[188],[14,25674,25676],{"className":25675},[192],[194,25677,25678],{"xmlns":196},[198,25679,25680,25716],{},[201,25681,25682,25688,25690,25692,25702,25704,25714],{},[9559,25683,25684,25686],{},[8885,25685,12010],{},[204,25687,540],{},[208,25689,988],{},[208,25691,9330],{"stretchy":9853},[9559,25693,25694,25696],{},[8885,25695,12010],{},[201,25697,25698,25700],{},[204,25699,540],{},[8885,25701,8887],{},[208,25703,8968],{"separator":222},[9559,25705,25706,25708],{},[8885,25707,12010],{},[201,25709,25710,25712],{},[204,25711,540],{},[8885,25713,8918],{},[208,25715,8699],{"stretchy":9853},[214,25717,25718],{"encoding":216},"P_0 = (P_{0x}, P_{0y})",[14,25720,25722,25777],{"className":25721,"ariaHidden":222},[221],[14,25723,25725,25728,25768,25771,25774],{"className":25724},[226],[14,25726],{"className":25727,"style":9715},[230],[14,25729,25731,25734],{"className":25730},[235],[14,25732,12010],{"className":25733,"style":13006},[235,8903],[14,25735,25737],{"className":25736},[9517],[14,25738,25740,25760],{"className":25739},[8996,8997],[14,25741,25743,25757],{"className":25742},[9001],[14,25744,25746],{"className":25745,"style":9605},[9005],[14,25747,25748,25751],{"style":13021},[14,25749],{"className":25750,"style":9533},[9013],[14,25752,25754],{"className":25753},[9018,9019,9020,9021],[14,25755,540],{"className":25756},[235,9021],[14,25758,9058],{"className":25759},[9057],[14,25761,25763],{"className":25762},[9001],[14,25764,25766],{"className":25765,"style":9630},[9005],[14,25767],{},[14,25769],{"className":25770,"style":9075},[239],[14,25772,988],{"className":25773},[9079],[14,25775],{"className":25776,"style":9075},[239],[14,25778,25780,25784,25787,25833,25836,25839,25885],{"className":25779},[226],[14,25781],{"className":25782,"style":25783},[230],"height:1.0361em;vertical-align:-0.2861em;",[14,25785,9330],{"className":25786},[8988],[14,25788,25790,25793],{"className":25789},[235],[14,25791,12010],{"className":25792,"style":13006},[235,8903],[14,25794,25796],{"className":25795},[9517],[14,25797,25799,25825],{"className":25798},[8996,8997],[14,25800,25802,25822],{"className":25801},[9001],[14,25803,25805],{"className":25804,"style":9605},[9005],[14,25806,25807,25810],{"style":13021},[14,25808],{"className":25809,"style":9533},[9013],[14,25811,25813],{"className":25812},[9018,9019,9020,9021],[14,25814,25816,25819],{"className":25815},[235,9021],[14,25817,540],{"className":25818},[235,9021],[14,25820,8887],{"className":25821},[235,8903,9021],[14,25823,9058],{"className":25824},[9057],[14,25826,25828],{"className":25827},[9001],[14,25829,25831],{"className":25830,"style":9630},[9005],[14,25832],{},[14,25834,8968],{"className":25835},[9118],[14,25837],{"className":25838,"style":17173},[239],[14,25840,25842,25845],{"className":25841},[235],[14,25843,12010],{"className":25844,"style":13006},[235,8903],[14,25846,25848],{"className":25847},[9517],[14,25849,25851,25877],{"className":25850},[8996,8997],[14,25852,25854,25874],{"className":25853},[9001],[14,25855,25857],{"className":25856,"style":9605},[9005],[14,25858,25859,25862],{"style":13021},[14,25860],{"className":25861,"style":9533},[9013],[14,25863,25865],{"className":25864},[9018,9019,9020,9021],[14,25866,25868,25871],{"className":25867},[235,9021],[14,25869,540],{"className":25870},[235,9021],[14,25872,8918],{"className":25873,"style":8934},[235,8903,9021],[14,25875,9058],{"className":25876},[9057],[14,25878,25880],{"className":25879},[9001],[14,25881,25883],{"className":25882,"style":17697},[9005],[14,25884],{},[14,25886,8699],{"className":25887},[9071],[14,25889,25891,25937],{"className":25890},[188],[14,25892,25894],{"className":25893},[192],[194,25895,25896],{"xmlns":196},[198,25897,25898,25934],{},[201,25899,25900,25906,25908,25910,25920,25922,25932],{},[9559,25901,25902,25904],{},[8885,25903,12010],{},[204,25905,328],{},[208,25907,988],{},[208,25909,9330],{"stretchy":9853},[9559,25911,25912,25914],{},[8885,25913,12010],{},[201,25915,25916,25918],{},[204,25917,328],{},[8885,25919,8887],{},[208,25921,8968],{"separator":222},[9559,25923,25924,25926],{},[8885,25925,12010],{},[201,25927,25928,25930],{},[204,25929,328],{},[8885,25931,8918],{},[208,25933,8699],{"stretchy":9853},[214,25935,25936],{"encoding":216},"P_1 = (P_{1x}, P_{1y})",[14,25938,25940,25995],{"className":25939,"ariaHidden":222},[221],[14,25941,25943,25946,25986,25989,25992],{"className":25942},[226],[14,25944],{"className":25945,"style":9715},[230],[14,25947,25949,25952],{"className":25948},[235],[14,25950,12010],{"className":25951,"style":13006},[235,8903],[14,25953,25955],{"className":25954},[9517],[14,25956,25958,25978],{"className":25957},[8996,8997],[14,25959,25961,25975],{"className":25960},[9001],[14,25962,25964],{"className":25963,"style":9605},[9005],[14,25965,25966,25969],{"style":13021},[14,25967],{"className":25968,"style":9533},[9013],[14,25970,25972],{"className":25971},[9018,9019,9020,9021],[14,25973,328],{"className":25974},[235,9021],[14,25976,9058],{"className":25977},[9057],[14,25979,25981],{"className":25980},[9001],[14,25982,25984],{"className":25983,"style":9630},[9005],[14,25985],{},[14,25987],{"className":25988,"style":9075},[239],[14,25990,988],{"className":25991},[9079],[14,25993],{"className":25994,"style":9075},[239],[14,25996,25998,26001,26004,26050,26053,26056,26102],{"className":25997},[226],[14,25999],{"className":26000,"style":25783},[230],[14,26002,9330],{"className":26003},[8988],[14,26005,26007,26010],{"className":26006},[235],[14,26008,12010],{"className":26009,"style":13006},[235,8903],[14,26011,26013],{"className":26012},[9517],[14,26014,26016,26042],{"className":26015},[8996,8997],[14,26017,26019,26039],{"className":26018},[9001],[14,26020,26022],{"className":26021,"style":9605},[9005],[14,26023,26024,26027],{"style":13021},[14,26025],{"className":26026,"style":9533},[9013],[14,26028,26030],{"className":26029},[9018,9019,9020,9021],[14,26031,26033,26036],{"className":26032},[235,9021],[14,26034,328],{"className":26035},[235,9021],[14,26037,8887],{"className":26038},[235,8903,9021],[14,26040,9058],{"className":26041},[9057],[14,26043,26045],{"className":26044},[9001],[14,26046,26048],{"className":26047,"style":9630},[9005],[14,26049],{},[14,26051,8968],{"className":26052},[9118],[14,26054],{"className":26055,"style":17173},[239],[14,26057,26059,26062],{"className":26058},[235],[14,26060,12010],{"className":26061,"style":13006},[235,8903],[14,26063,26065],{"className":26064},[9517],[14,26066,26068,26094],{"className":26067},[8996,8997],[14,26069,26071,26091],{"className":26070},[9001],[14,26072,26074],{"className":26073,"style":9605},[9005],[14,26075,26076,26079],{"style":13021},[14,26077],{"className":26078,"style":9533},[9013],[14,26080,26082],{"className":26081},[9018,9019,9020,9021],[14,26083,26085,26088],{"className":26084},[235,9021],[14,26086,328],{"className":26087},[235,9021],[14,26089,8918],{"className":26090,"style":8934},[235,8903,9021],[14,26092,9058],{"className":26093},[9057],[14,26095,26097],{"className":26096},[9001],[14,26098,26100],{"className":26099,"style":17697},[9005],[14,26101],{},[14,26103,8699],{"className":26104},[9071],", the screen coordinates are mapped using scale (S) and translation (T):",[14,26107,26109],{"className":26108},[9765],[14,26110,26112,26240],{"className":26111},[188],[14,26113,26115],{"className":26114},[192],[194,26116,26117],{"xmlns":196,"display":9774},[198,26118,26119,26237],{},[9778,26120,26121,26179],{"rowspacing":9780,"columnalign":11940,"columnspacing":11941},[9784,26122,26123,26141],{},[9787,26124,26125],{},[9790,26126,26127],{"scriptlevel":540,"displaystyle":222},[201,26128,26129,26135,26137,26139],{},[9559,26130,26131,26133],{},[8885,26132,12847],{},[8885,26134,8887],{},[208,26136,17458],{"stretchy":9853},[8885,26138,11274],{},[208,26140,17464],{"stretchy":9853},[9787,26142,26143],{},[9790,26144,26145],{"scriptlevel":540,"displaystyle":222},[201,26146,26147,26149,26151,26157,26159,26161,26163,26165,26167,26169,26171,26173],{},[201,26148],{},[208,26150,988],{},[9559,26152,26153,26155],{},[8885,26154,8776],{},[8885,26156,8887],{},[9562,26158,16669],{},[8885,26160,12010],{},[208,26162,17458],{"stretchy":9853},[8885,26164,11274],{},[208,26166,17464],{"stretchy":9853},[8885,26168,8476],{"mathvariant":9648},[8885,26170,8887],{},[208,26172,4432],{},[9559,26174,26175,26177],{},[8885,26176,8845],{},[8885,26178,8887],{},[9784,26180,26181,26199],{},[9787,26182,26183],{},[9790,26184,26185],{"scriptlevel":540,"displaystyle":222},[201,26186,26187,26193,26195,26197],{},[9559,26188,26189,26191],{},[8885,26190,12847],{},[8885,26192,8918],{},[208,26194,17458],{"stretchy":9853},[8885,26196,11274],{},[208,26198,17464],{"stretchy":9853},[9787,26200,26201],{},[9790,26202,26203],{"scriptlevel":540,"displaystyle":222},[201,26204,26205,26207,26209,26215,26217,26219,26221,26223,26225,26227,26229,26231],{},[201,26206],{},[208,26208,988],{},[9559,26210,26211,26213],{},[8885,26212,8776],{},[8885,26214,8918],{},[9562,26216,16669],{},[8885,26218,12010],{},[208,26220,17458],{"stretchy":9853},[8885,26222,11274],{},[208,26224,17464],{"stretchy":9853},[8885,26226,8476],{"mathvariant":9648},[8885,26228,8918],{},[208,26230,4432],{},[9559,26232,26233,26235],{},[8885,26234,8845],{},[8885,26236,8918],{},[214,26238,26239],{"encoding":216},"\\begin{aligned}\nD_x[i] &= S_x \\, P[i].x + T_x \\\\\nD_y[i] &= S_y \\, P[i].y + T_y\n\\end{aligned}",[14,26241,26243],{"className":26242,"ariaHidden":222},[221],[14,26244,26246,26249],{"className":26245},[226],[14,26247],{"className":26248,"style":19333},[230],[14,26250,26252],{"className":26251},[235],[14,26253,26255,26392],{"className":26254},[9778],[14,26256,26258],{"className":26257},[10136],[14,26259,26261,26384],{"className":26260},[8996,8997],[14,26262,26264,26381],{"className":26263},[9001],[14,26265,26267,26324],{"className":26266,"style":19352},[9005],[14,26268,26269,26272],{"style":19355},[14,26270],{"className":26271,"style":9014},[9013],[14,26273,26275,26315,26318,26321],{"className":26274},[235],[14,26276,26278,26281],{"className":26277},[235],[14,26279,12847],{"className":26280,"style":12887},[235,8903],[14,26282,26284],{"className":26283},[9517],[14,26285,26287,26307],{"className":26286},[8996,8997],[14,26288,26290,26304],{"className":26289},[9001],[14,26291,26293],{"className":26292,"style":12900},[9005],[14,26294,26295,26298],{"style":12903},[14,26296],{"className":26297,"style":9533},[9013],[14,26299,26301],{"className":26300},[9018,9019,9020,9021],[14,26302,8887],{"className":26303},[235,8903,9021],[14,26305,9058],{"className":26306},[9057],[14,26308,26310],{"className":26309},[9001],[14,26311,26313],{"className":26312,"style":9630},[9005],[14,26314],{},[14,26316,17458],{"className":26317},[8988],[14,26319,11274],{"className":26320},[235,8903],[14,26322,17464],{"className":26323},[9071],[14,26325,26326,26329],{"style":19410},[14,26327],{"className":26328,"style":9014},[9013],[14,26330,26332,26372,26375,26378],{"className":26331},[235],[14,26333,26335,26338],{"className":26334},[235],[14,26336,12847],{"className":26337,"style":12887},[235,8903],[14,26339,26341],{"className":26340},[9517],[14,26342,26344,26364],{"className":26343},[8996,8997],[14,26345,26347,26361],{"className":26346},[9001],[14,26348,26350],{"className":26349,"style":12900},[9005],[14,26351,26352,26355],{"style":12903},[14,26353],{"className":26354,"style":9533},[9013],[14,26356,26358],{"className":26357},[9018,9019,9020,9021],[14,26359,8918],{"className":26360,"style":8934},[235,8903,9021],[14,26362,9058],{"className":26363},[9057],[14,26365,26367],{"className":26366},[9001],[14,26368,26370],{"className":26369,"style":17697},[9005],[14,26371],{},[14,26373,17458],{"className":26374},[8988],[14,26376,11274],{"className":26377},[235,8903],[14,26379,17464],{"className":26380},[9071],[14,26382,9058],{"className":26383},[9057],[14,26385,26387],{"className":26386},[9001],[14,26388,26390],{"className":26389,"style":19426},[9005],[14,26391],{},[14,26393,26395],{"className":26394},[10229],[14,26396,26398,26667],{"className":26397},[8996,8997],[14,26399,26401,26664],{"className":26400},[9001],[14,26402,26404,26534],{"className":26403,"style":19352},[9005],[14,26405,26406,26409],{"style":19355},[14,26407],{"className":26408,"style":9014},[9013],[14,26410,26412,26415,26418,26421,26424,26464,26467,26470,26473,26476,26479,26482,26485,26488,26491,26494],{"className":26411},[235],[14,26413],{"className":26414},[235],[14,26416],{"className":26417,"style":9075},[239],[14,26419,988],{"className":26420},[9079],[14,26422],{"className":26423,"style":9075},[239],[14,26425,26427,26430],{"className":26426},[235],[14,26428,8776],{"className":26429,"style":12945},[235,8903],[14,26431,26433],{"className":26432},[9517],[14,26434,26436,26456],{"className":26435},[8996,8997],[14,26437,26439,26453],{"className":26438},[9001],[14,26440,26442],{"className":26441,"style":12900},[9005],[14,26443,26444,26447],{"style":12960},[14,26445],{"className":26446,"style":9533},[9013],[14,26448,26450],{"className":26449},[9018,9019,9020,9021],[14,26451,8887],{"className":26452},[235,8903,9021],[14,26454,9058],{"className":26455},[9057],[14,26457,26459],{"className":26458},[9001],[14,26460,26462],{"className":26461,"style":9630},[9005],[14,26463],{},[14,26465],{"className":26466,"style":17173},[239],[14,26468,12010],{"className":26469,"style":13006},[235,8903],[14,26471,17458],{"className":26472},[8988],[14,26474,11274],{"className":26475},[235,8903],[14,26477,17464],{"className":26478},[9071],[14,26480,8476],{"className":26481},[235],[14,26483,8887],{"className":26484},[235,8903],[14,26486],{"className":26487,"style":240},[239],[14,26489,4432],{"className":26490},[244],[14,26492],{"className":26493,"style":240},[239],[14,26495,26497,26500],{"className":26496},[235],[14,26498,8845],{"className":26499,"style":13006},[235,8903],[14,26501,26503],{"className":26502},[9517],[14,26504,26506,26526],{"className":26505},[8996,8997],[14,26507,26509,26523],{"className":26508},[9001],[14,26510,26512],{"className":26511,"style":12900},[9005],[14,26513,26514,26517],{"style":13021},[14,26515],{"className":26516,"style":9533},[9013],[14,26518,26520],{"className":26519},[9018,9019,9020,9021],[14,26521,8887],{"className":26522},[235,8903,9021],[14,26524,9058],{"className":26525},[9057],[14,26527,26529],{"className":26528},[9001],[14,26530,26532],{"className":26531,"style":9630},[9005],[14,26533],{},[14,26535,26536,26539],{"style":19410},[14,26537],{"className":26538,"style":9014},[9013],[14,26540,26542,26545,26548,26551,26554,26594,26597,26600,26603,26606,26609,26612,26615,26618,26621,26624],{"className":26541},[235],[14,26543],{"className":26544},[235],[14,26546],{"className":26547,"style":9075},[239],[14,26549,988],{"className":26550},[9079],[14,26552],{"className":26553,"style":9075},[239],[14,26555,26557,26560],{"className":26556},[235],[14,26558,8776],{"className":26559,"style":12945},[235,8903],[14,26561,26563],{"className":26562},[9517],[14,26564,26566,26586],{"className":26565},[8996,8997],[14,26567,26569,26583],{"className":26568},[9001],[14,26570,26572],{"className":26571,"style":12900},[9005],[14,26573,26574,26577],{"style":12960},[14,26575],{"className":26576,"style":9533},[9013],[14,26578,26580],{"className":26579},[9018,9019,9020,9021],[14,26581,8918],{"className":26582,"style":8934},[235,8903,9021],[14,26584,9058],{"className":26585},[9057],[14,26587,26589],{"className":26588},[9001],[14,26590,26592],{"className":26591,"style":17697},[9005],[14,26593],{},[14,26595],{"className":26596,"style":17173},[239],[14,26598,12010],{"className":26599,"style":13006},[235,8903],[14,26601,17458],{"className":26602},[8988],[14,26604,11274],{"className":26605},[235,8903],[14,26607,17464],{"className":26608},[9071],[14,26610,8476],{"className":26611},[235],[14,26613,8918],{"className":26614,"style":8934},[235,8903],[14,26616],{"className":26617,"style":240},[239],[14,26619,4432],{"className":26620},[244],[14,26622],{"className":26623,"style":240},[239],[14,26625,26627,26630],{"className":26626},[235],[14,26628,8845],{"className":26629,"style":13006},[235,8903],[14,26631,26633],{"className":26632},[9517],[14,26634,26636,26656],{"className":26635},[8996,8997],[14,26637,26639,26653],{"className":26638},[9001],[14,26640,26642],{"className":26641,"style":12900},[9005],[14,26643,26644,26647],{"style":13021},[14,26645],{"className":26646,"style":9533},[9013],[14,26648,26650],{"className":26649},[9018,9019,9020,9021],[14,26651,8918],{"className":26652,"style":8934},[235,8903,9021],[14,26654,9058],{"className":26655},[9057],[14,26657,26659],{"className":26658},[9001],[14,26660,26662],{"className":26661,"style":17697},[9005],[14,26663],{},[14,26665,9058],{"className":26666},[9057],[14,26668,26670],{"className":26669},[9001],[14,26671,26673],{"className":26672,"style":19426},[9005],[14,26674],{},[11,26676,26677],{},"If we point our forged path fPoints to T directly, the X and Y coordinates of the line will read unrelated heap values, tilting the line. This diagonal tilt leaks coordinates into both axes, destroying our measurement.",[11,26679,26680],{},"Our solution is to align the other coordinates with zero bytes in memory. By sliding our read window W, we force the non-target coordinates to read as zero, which simplifies the math:",[8442,26682,26683,27407],{},[302,26684,26685,26688,26689,8498,26791,26893,26894,26897],{},[129,26686,26687],{},"Horizontal alignment (s1)",": we force ",[14,26690,26692,26718],{"className":26691},[188],[14,26693,26695],{"className":26694},[192],[194,26696,26697],{"xmlns":196},[198,26698,26699,26715],{},[201,26700,26701,26711,26713],{},[9559,26702,26703,26705],{},[8885,26704,12010],{},[201,26706,26707,26709],{},[204,26708,540],{},[8885,26710,8918],{},[208,26712,988],{},[204,26714,540],{},[214,26716,26717],{"encoding":216},"P_{0y} = 0",[14,26719,26721,26782],{"className":26720,"ariaHidden":222},[221],[14,26722,26724,26727,26773,26776,26779],{"className":26723},[226],[14,26725],{"className":26726,"style":17652},[230],[14,26728,26730,26733],{"className":26729},[235],[14,26731,12010],{"className":26732,"style":13006},[235,8903],[14,26734,26736],{"className":26735},[9517],[14,26737,26739,26765],{"className":26738},[8996,8997],[14,26740,26742,26762],{"className":26741},[9001],[14,26743,26745],{"className":26744,"style":9605},[9005],[14,26746,26747,26750],{"style":13021},[14,26748],{"className":26749,"style":9533},[9013],[14,26751,26753],{"className":26752},[9018,9019,9020,9021],[14,26754,26756,26759],{"className":26755},[235,9021],[14,26757,540],{"className":26758},[235,9021],[14,26760,8918],{"className":26761,"style":8934},[235,8903,9021],[14,26763,9058],{"className":26764},[9057],[14,26766,26768],{"className":26767},[9001],[14,26769,26771],{"className":26770,"style":17697},[9005],[14,26772],{},[14,26774],{"className":26775,"style":9075},[239],[14,26777,988],{"className":26778},[9079],[14,26780],{"className":26781,"style":9075},[239],[14,26783,26785,26788],{"className":26784},[226],[14,26786],{"className":26787,"style":254},[230],[14,26789,540],{"className":26790},[235],[14,26792,26794,26820],{"className":26793},[188],[14,26795,26797],{"className":26796},[192],[194,26798,26799],{"xmlns":196},[198,26800,26801,26817],{},[201,26802,26803,26813,26815],{},[9559,26804,26805,26807],{},[8885,26806,12010],{},[201,26808,26809,26811],{},[204,26810,328],{},[8885,26812,8918],{},[208,26814,988],{},[204,26816,540],{},[214,26818,26819],{"encoding":216},"P_{1y} = 0",[14,26821,26823,26884],{"className":26822,"ariaHidden":222},[221],[14,26824,26826,26829,26875,26878,26881],{"className":26825},[226],[14,26827],{"className":26828,"style":17652},[230],[14,26830,26832,26835],{"className":26831},[235],[14,26833,12010],{"className":26834,"style":13006},[235,8903],[14,26836,26838],{"className":26837},[9517],[14,26839,26841,26867],{"className":26840},[8996,8997],[14,26842,26844,26864],{"className":26843},[9001],[14,26845,26847],{"className":26846,"style":9605},[9005],[14,26848,26849,26852],{"style":13021},[14,26850],{"className":26851,"style":9533},[9013],[14,26853,26855],{"className":26854},[9018,9019,9020,9021],[14,26856,26858,26861],{"className":26857},[235,9021],[14,26859,328],{"className":26860},[235,9021],[14,26862,8918],{"className":26863,"style":8934},[235,8903,9021],[14,26865,9058],{"className":26866},[9057],[14,26868,26870],{"className":26869},[9001],[14,26871,26873],{"className":26872,"style":17697},[9005],[14,26874],{},[14,26876],{"className":26877,"style":9075},[239],[14,26879,988],{"className":26880},[9079],[14,26882],{"className":26883,"style":9075},[239],[14,26885,26887,26890],{"className":26886},[226],[14,26888],{"className":26889,"style":254},[230],[14,26891,540],{"className":26892},[235],". The line segment collapses to:",[26895,26896],"br",{},[14,26898,26900,26991],{"className":26899},[188],[14,26901,26903],{"className":26902},[192],[194,26904,26905],{"xmlns":196},[198,26906,26907,26988],{},[201,26908,26909,26911,26917,26927,26929,26935,26937,26939,26945,26947,26950,26952,26958,26968,26970,26976,26978,26980,26986],{},[208,26910,9330],{"stretchy":9853},[9559,26912,26913,26915],{},[8885,26914,8776],{},[8885,26916,8887],{},[9559,26918,26919,26921],{},[8885,26920,12010],{},[201,26922,26923,26925],{},[204,26924,540],{},[8885,26926,8887],{},[208,26928,4432],{},[9559,26930,26931,26933],{},[8885,26932,8845],{},[8885,26934,8887],{},[208,26936,8968],{"separator":222},[9562,26938,12016],{},[9559,26940,26941,26943],{},[8885,26942,8845],{},[8885,26944,8918],{},[208,26946,8699],{"stretchy":9853},[208,26948,26949],{},"⟶",[208,26951,9330],{"stretchy":9853},[9559,26953,26954,26956],{},[8885,26955,8776],{},[8885,26957,8887],{},[9559,26959,26960,26962],{},[8885,26961,12010],{},[201,26963,26964,26966],{},[204,26965,328],{},[8885,26967,8887],{},[208,26969,4432],{},[9559,26971,26972,26974],{},[8885,26973,8845],{},[8885,26975,8887],{},[208,26977,8968],{"separator":222},[9562,26979,12016],{},[9559,26981,26982,26984],{},[8885,26983,8845],{},[8885,26985,8918],{},[208,26987,8699],{"stretchy":9853},[214,26989,26990],{"encoding":216},"(S_x P_{0x} + T_x,\\ T_y) \\longrightarrow (S_x P_{1x} + T_x,\\ T_y)",[14,26992,26994,27098,27205,27309],{"className":26993,"ariaHidden":222},[221],[14,26995,26997,27000,27003,27043,27089,27092,27095],{"className":26996},[226],[14,26998],{"className":26999,"style":14909},[230],[14,27001,9330],{"className":27002},[8988],[14,27004,27006,27009],{"className":27005},[235],[14,27007,8776],{"className":27008,"style":12945},[235,8903],[14,27010,27012],{"className":27011},[9517],[14,27013,27015,27035],{"className":27014},[8996,8997],[14,27016,27018,27032],{"className":27017},[9001],[14,27019,27021],{"className":27020,"style":12900},[9005],[14,27022,27023,27026],{"style":12960},[14,27024],{"className":27025,"style":9533},[9013],[14,27027,27029],{"className":27028},[9018,9019,9020,9021],[14,27030,8887],{"className":27031},[235,8903,9021],[14,27033,9058],{"className":27034},[9057],[14,27036,27038],{"className":27037},[9001],[14,27039,27041],{"className":27040,"style":9630},[9005],[14,27042],{},[14,27044,27046,27049],{"className":27045},[235],[14,27047,12010],{"className":27048,"style":13006},[235,8903],[14,27050,27052],{"className":27051},[9517],[14,27053,27055,27081],{"className":27054},[8996,8997],[14,27056,27058,27078],{"className":27057},[9001],[14,27059,27061],{"className":27060,"style":9605},[9005],[14,27062,27063,27066],{"style":13021},[14,27064],{"className":27065,"style":9533},[9013],[14,27067,27069],{"className":27068},[9018,9019,9020,9021],[14,27070,27072,27075],{"className":27071},[235,9021],[14,27073,540],{"className":27074},[235,9021],[14,27076,8887],{"className":27077},[235,8903,9021],[14,27079,9058],{"className":27080},[9057],[14,27082,27084],{"className":27083},[9001],[14,27085,27087],{"className":27086,"style":9630},[9005],[14,27088],{},[14,27090],{"className":27091,"style":240},[239],[14,27093,4432],{"className":27094},[244],[14,27096],{"className":27097,"style":240},[239],[14,27099,27101,27104,27144,27147,27150,27153,27193,27196,27199,27202],{"className":27100},[226],[14,27102],{"className":27103,"style":25783},[230],[14,27105,27107,27110],{"className":27106},[235],[14,27108,8845],{"className":27109,"style":13006},[235,8903],[14,27111,27113],{"className":27112},[9517],[14,27114,27116,27136],{"className":27115},[8996,8997],[14,27117,27119,27133],{"className":27118},[9001],[14,27120,27122],{"className":27121,"style":12900},[9005],[14,27123,27124,27127],{"style":13021},[14,27125],{"className":27126,"style":9533},[9013],[14,27128,27130],{"className":27129},[9018,9019,9020,9021],[14,27131,8887],{"className":27132},[235,8903,9021],[14,27134,9058],{"className":27135},[9057],[14,27137,27139],{"className":27138},[9001],[14,27140,27142],{"className":27141,"style":9630},[9005],[14,27143],{},[14,27145,8968],{"className":27146},[9118],[14,27148,12016],{"className":27149},[239],[14,27151],{"className":27152,"style":17173},[239],[14,27154,27156,27159],{"className":27155},[235],[14,27157,8845],{"className":27158,"style":13006},[235,8903],[14,27160,27162],{"className":27161},[9517],[14,27163,27165,27185],{"className":27164},[8996,8997],[14,27166,27168,27182],{"className":27167},[9001],[14,27169,27171],{"className":27170,"style":12900},[9005],[14,27172,27173,27176],{"style":13021},[14,27174],{"className":27175,"style":9533},[9013],[14,27177,27179],{"className":27178},[9018,9019,9020,9021],[14,27180,8918],{"className":27181,"style":8934},[235,8903,9021],[14,27183,9058],{"className":27184},[9057],[14,27186,27188],{"className":27187},[9001],[14,27189,27191],{"className":27190,"style":17697},[9005],[14,27192],{},[14,27194,8699],{"className":27195},[9071],[14,27197],{"className":27198,"style":9075},[239],[14,27200,26949],{"className":27201},[9079],[14,27203],{"className":27204,"style":9075},[239],[14,27206,27208,27211,27214,27254,27300,27303,27306],{"className":27207},[226],[14,27209],{"className":27210,"style":14909},[230],[14,27212,9330],{"className":27213},[8988],[14,27215,27217,27220],{"className":27216},[235],[14,27218,8776],{"className":27219,"style":12945},[235,8903],[14,27221,27223],{"className":27222},[9517],[14,27224,27226,27246],{"className":27225},[8996,8997],[14,27227,27229,27243],{"className":27228},[9001],[14,27230,27232],{"className":27231,"style":12900},[9005],[14,27233,27234,27237],{"style":12960},[14,27235],{"className":27236,"style":9533},[9013],[14,27238,27240],{"className":27239},[9018,9019,9020,9021],[14,27241,8887],{"className":27242},[235,8903,9021],[14,27244,9058],{"className":27245},[9057],[14,27247,27249],{"className":27248},[9001],[14,27250,27252],{"className":27251,"style":9630},[9005],[14,27253],{},[14,27255,27257,27260],{"className":27256},[235],[14,27258,12010],{"className":27259,"style":13006},[235,8903],[14,27261,27263],{"className":27262},[9517],[14,27264,27266,27292],{"className":27265},[8996,8997],[14,27267,27269,27289],{"className":27268},[9001],[14,27270,27272],{"className":27271,"style":9605},[9005],[14,27273,27274,27277],{"style":13021},[14,27275],{"className":27276,"style":9533},[9013],[14,27278,27280],{"className":27279},[9018,9019,9020,9021],[14,27281,27283,27286],{"className":27282},[235,9021],[14,27284,328],{"className":27285},[235,9021],[14,27287,8887],{"className":27288},[235,8903,9021],[14,27290,9058],{"className":27291},[9057],[14,27293,27295],{"className":27294},[9001],[14,27296,27298],{"className":27297,"style":9630},[9005],[14,27299],{},[14,27301],{"className":27302,"style":240},[239],[14,27304,4432],{"className":27305},[244],[14,27307],{"className":27308,"style":240},[239],[14,27310,27312,27315,27355,27358,27361,27364,27404],{"className":27311},[226],[14,27313],{"className":27314,"style":25783},[230],[14,27316,27318,27321],{"className":27317},[235],[14,27319,8845],{"className":27320,"style":13006},[235,8903],[14,27322,27324],{"className":27323},[9517],[14,27325,27327,27347],{"className":27326},[8996,8997],[14,27328,27330,27344],{"className":27329},[9001],[14,27331,27333],{"className":27332,"style":12900},[9005],[14,27334,27335,27338],{"style":13021},[14,27336],{"className":27337,"style":9533},[9013],[14,27339,27341],{"className":27340},[9018,9019,9020,9021],[14,27342,8887],{"className":27343},[235,8903,9021],[14,27345,9058],{"className":27346},[9057],[14,27348,27350],{"className":27349},[9001],[14,27351,27353],{"className":27352,"style":9630},[9005],[14,27354],{},[14,27356,8968],{"className":27357},[9118],[14,27359,12016],{"className":27360},[239],[14,27362],{"className":27363,"style":17173},[239],[14,27365,27367,27370],{"className":27366},[235],[14,27368,8845],{"className":27369,"style":13006},[235,8903],[14,27371,27373],{"className":27372},[9517],[14,27374,27376,27396],{"className":27375},[8996,8997],[14,27377,27379,27393],{"className":27378},[9001],[14,27380,27382],{"className":27381,"style":12900},[9005],[14,27383,27384,27387],{"style":13021},[14,27385],{"className":27386,"style":9533},[9013],[14,27388,27390],{"className":27389},[9018,9019,9020,9021],[14,27391,8918],{"className":27392,"style":8934},[235,8903,9021],[14,27394,9058],{"className":27395},[9057],[14,27397,27399],{"className":27398},[9001],[14,27400,27402],{"className":27401,"style":17697},[9005],[14,27403],{},[14,27405,8699],{"className":27406},[9071],[302,27408,27409,26688,27412,8498,27514,26893,27616,27618],{},[129,27410,27411],{},"Vertical alignment (s4)",[14,27413,27415,27441],{"className":27414},[188],[14,27416,27418],{"className":27417},[192],[194,27419,27420],{"xmlns":196},[198,27421,27422,27438],{},[201,27423,27424,27434,27436],{},[9559,27425,27426,27428],{},[8885,27427,12010],{},[201,27429,27430,27432],{},[204,27431,540],{},[8885,27433,8887],{},[208,27435,988],{},[204,27437,540],{},[214,27439,27440],{"encoding":216},"P_{0x} = 0",[14,27442,27444,27505],{"className":27443,"ariaHidden":222},[221],[14,27445,27447,27450,27496,27499,27502],{"className":27446},[226],[14,27448],{"className":27449,"style":9715},[230],[14,27451,27453,27456],{"className":27452},[235],[14,27454,12010],{"className":27455,"style":13006},[235,8903],[14,27457,27459],{"className":27458},[9517],[14,27460,27462,27488],{"className":27461},[8996,8997],[14,27463,27465,27485],{"className":27464},[9001],[14,27466,27468],{"className":27467,"style":9605},[9005],[14,27469,27470,27473],{"style":13021},[14,27471],{"className":27472,"style":9533},[9013],[14,27474,27476],{"className":27475},[9018,9019,9020,9021],[14,27477,27479,27482],{"className":27478},[235,9021],[14,27480,540],{"className":27481},[235,9021],[14,27483,8887],{"className":27484},[235,8903,9021],[14,27486,9058],{"className":27487},[9057],[14,27489,27491],{"className":27490},[9001],[14,27492,27494],{"className":27493,"style":9630},[9005],[14,27495],{},[14,27497],{"className":27498,"style":9075},[239],[14,27500,988],{"className":27501},[9079],[14,27503],{"className":27504,"style":9075},[239],[14,27506,27508,27511],{"className":27507},[226],[14,27509],{"className":27510,"style":254},[230],[14,27512,540],{"className":27513},[235],[14,27515,27517,27543],{"className":27516},[188],[14,27518,27520],{"className":27519},[192],[194,27521,27522],{"xmlns":196},[198,27523,27524,27540],{},[201,27525,27526,27536,27538],{},[9559,27527,27528,27530],{},[8885,27529,12010],{},[201,27531,27532,27534],{},[204,27533,328],{},[8885,27535,8887],{},[208,27537,988],{},[204,27539,540],{},[214,27541,27542],{"encoding":216},"P_{1x} = 0",[14,27544,27546,27607],{"className":27545,"ariaHidden":222},[221],[14,27547,27549,27552,27598,27601,27604],{"className":27548},[226],[14,27550],{"className":27551,"style":9715},[230],[14,27553,27555,27558],{"className":27554},[235],[14,27556,12010],{"className":27557,"style":13006},[235,8903],[14,27559,27561],{"className":27560},[9517],[14,27562,27564,27590],{"className":27563},[8996,8997],[14,27565,27567,27587],{"className":27566},[9001],[14,27568,27570],{"className":27569,"style":9605},[9005],[14,27571,27572,27575],{"style":13021},[14,27573],{"className":27574,"style":9533},[9013],[14,27576,27578],{"className":27577},[9018,9019,9020,9021],[14,27579,27581,27584],{"className":27580},[235,9021],[14,27582,328],{"className":27583},[235,9021],[14,27585,8887],{"className":27586},[235,8903,9021],[14,27588,9058],{"className":27589},[9057],[14,27591,27593],{"className":27592},[9001],[14,27594,27596],{"className":27595,"style":9630},[9005],[14,27597],{},[14,27599],{"className":27600,"style":9075},[239],[14,27602,988],{"className":27603},[9079],[14,27605],{"className":27606,"style":9075},[239],[14,27608,27610,27613],{"className":27609},[226],[14,27611],{"className":27612,"style":254},[230],[14,27614,540],{"className":27615},[235],[26895,27617],{},[14,27619,27621,27711],{"className":27620},[188],[14,27622,27624],{"className":27623},[192],[194,27625,27626],{"xmlns":196},[198,27627,27628,27708],{},[201,27629,27630,27632,27638,27640,27642,27648,27658,27660,27666,27668,27670,27672,27678,27680,27682,27688,27698,27700,27706],{},[208,27631,9330],{"stretchy":9853},[9559,27633,27634,27636],{},[8885,27635,8845],{},[8885,27637,8887],{},[208,27639,8968],{"separator":222},[9562,27641,12016],{},[9559,27643,27644,27646],{},[8885,27645,8776],{},[8885,27647,8918],{},[9559,27649,27650,27652],{},[8885,27651,12010],{},[201,27653,27654,27656],{},[204,27655,540],{},[8885,27657,8918],{},[208,27659,4432],{},[9559,27661,27662,27664],{},[8885,27663,8845],{},[8885,27665,8918],{},[208,27667,8699],{"stretchy":9853},[208,27669,26949],{},[208,27671,9330],{"stretchy":9853},[9559,27673,27674,27676],{},[8885,27675,8845],{},[8885,27677,8887],{},[208,27679,8968],{"separator":222},[9562,27681,12016],{},[9559,27683,27684,27686],{},[8885,27685,8776],{},[8885,27687,8918],{},[9559,27689,27690,27692],{},[8885,27691,12010],{},[201,27693,27694,27696],{},[204,27695,328],{},[8885,27697,8918],{},[208,27699,4432],{},[9559,27701,27702,27704],{},[8885,27703,8845],{},[8885,27705,8918],{},[208,27707,8699],{"stretchy":9853},[214,27709,27710],{"encoding":216},"(T_x,\\ S_y P_{0y} + T_y) \\longrightarrow (T_x,\\ S_y P_{1y} + T_y)",[14,27712,27714,27867,27925,28078],{"className":27713,"ariaHidden":222},[221],[14,27715,27717,27720,27723,27763,27766,27769,27772,27812,27858,27861,27864],{"className":27716},[226],[14,27718],{"className":27719,"style":25783},[230],[14,27721,9330],{"className":27722},[8988],[14,27724,27726,27729],{"className":27725},[235],[14,27727,8845],{"className":27728,"style":13006},[235,8903],[14,27730,27732],{"className":27731},[9517],[14,27733,27735,27755],{"className":27734},[8996,8997],[14,27736,27738,27752],{"className":27737},[9001],[14,27739,27741],{"className":27740,"style":12900},[9005],[14,27742,27743,27746],{"style":13021},[14,27744],{"className":27745,"style":9533},[9013],[14,27747,27749],{"className":27748},[9018,9019,9020,9021],[14,27750,8887],{"className":27751},[235,8903,9021],[14,27753,9058],{"className":27754},[9057],[14,27756,27758],{"className":27757},[9001],[14,27759,27761],{"className":27760,"style":9630},[9005],[14,27762],{},[14,27764,8968],{"className":27765},[9118],[14,27767,12016],{"className":27768},[239],[14,27770],{"className":27771,"style":17173},[239],[14,27773,27775,27778],{"className":27774},[235],[14,27776,8776],{"className":27777,"style":12945},[235,8903],[14,27779,27781],{"className":27780},[9517],[14,27782,27784,27804],{"className":27783},[8996,8997],[14,27785,27787,27801],{"className":27786},[9001],[14,27788,27790],{"className":27789,"style":12900},[9005],[14,27791,27792,27795],{"style":12960},[14,27793],{"className":27794,"style":9533},[9013],[14,27796,27798],{"className":27797},[9018,9019,9020,9021],[14,27799,8918],{"className":27800,"style":8934},[235,8903,9021],[14,27802,9058],{"className":27803},[9057],[14,27805,27807],{"className":27806},[9001],[14,27808,27810],{"className":27809,"style":17697},[9005],[14,27811],{},[14,27813,27815,27818],{"className":27814},[235],[14,27816,12010],{"className":27817,"style":13006},[235,8903],[14,27819,27821],{"className":27820},[9517],[14,27822,27824,27850],{"className":27823},[8996,8997],[14,27825,27827,27847],{"className":27826},[9001],[14,27828,27830],{"className":27829,"style":9605},[9005],[14,27831,27832,27835],{"style":13021},[14,27833],{"className":27834,"style":9533},[9013],[14,27836,27838],{"className":27837},[9018,9019,9020,9021],[14,27839,27841,27844],{"className":27840},[235,9021],[14,27842,540],{"className":27843},[235,9021],[14,27845,8918],{"className":27846,"style":8934},[235,8903,9021],[14,27848,9058],{"className":27849},[9057],[14,27851,27853],{"className":27852},[9001],[14,27854,27856],{"className":27855,"style":17697},[9005],[14,27857],{},[14,27859],{"className":27860,"style":240},[239],[14,27862,4432],{"className":27863},[244],[14,27865],{"className":27866,"style":240},[239],[14,27868,27870,27873,27913,27916,27919,27922],{"className":27869},[226],[14,27871],{"className":27872,"style":25783},[230],[14,27874,27876,27879],{"className":27875},[235],[14,27877,8845],{"className":27878,"style":13006},[235,8903],[14,27880,27882],{"className":27881},[9517],[14,27883,27885,27905],{"className":27884},[8996,8997],[14,27886,27888,27902],{"className":27887},[9001],[14,27889,27891],{"className":27890,"style":12900},[9005],[14,27892,27893,27896],{"style":13021},[14,27894],{"className":27895,"style":9533},[9013],[14,27897,27899],{"className":27898},[9018,9019,9020,9021],[14,27900,8918],{"className":27901,"style":8934},[235,8903,9021],[14,27903,9058],{"className":27904},[9057],[14,27906,27908],{"className":27907},[9001],[14,27909,27911],{"className":27910,"style":17697},[9005],[14,27912],{},[14,27914,8699],{"className":27915},[9071],[14,27917],{"className":27918,"style":9075},[239],[14,27920,26949],{"className":27921},[9079],[14,27923],{"className":27924,"style":9075},[239],[14,27926,27928,27931,27934,27974,27977,27980,27983,28023,28069,28072,28075],{"className":27927},[226],[14,27929],{"className":27930,"style":25783},[230],[14,27932,9330],{"className":27933},[8988],[14,27935,27937,27940],{"className":27936},[235],[14,27938,8845],{"className":27939,"style":13006},[235,8903],[14,27941,27943],{"className":27942},[9517],[14,27944,27946,27966],{"className":27945},[8996,8997],[14,27947,27949,27963],{"className":27948},[9001],[14,27950,27952],{"className":27951,"style":12900},[9005],[14,27953,27954,27957],{"style":13021},[14,27955],{"className":27956,"style":9533},[9013],[14,27958,27960],{"className":27959},[9018,9019,9020,9021],[14,27961,8887],{"className":27962},[235,8903,9021],[14,27964,9058],{"className":27965},[9057],[14,27967,27969],{"className":27968},[9001],[14,27970,27972],{"className":27971,"style":9630},[9005],[14,27973],{},[14,27975,8968],{"className":27976},[9118],[14,27978,12016],{"className":27979},[239],[14,27981],{"className":27982,"style":17173},[239],[14,27984,27986,27989],{"className":27985},[235],[14,27987,8776],{"className":27988,"style":12945},[235,8903],[14,27990,27992],{"className":27991},[9517],[14,27993,27995,28015],{"className":27994},[8996,8997],[14,27996,27998,28012],{"className":27997},[9001],[14,27999,28001],{"className":28000,"style":12900},[9005],[14,28002,28003,28006],{"style":12960},[14,28004],{"className":28005,"style":9533},[9013],[14,28007,28009],{"className":28008},[9018,9019,9020,9021],[14,28010,8918],{"className":28011,"style":8934},[235,8903,9021],[14,28013,9058],{"className":28014},[9057],[14,28016,28018],{"className":28017},[9001],[14,28019,28021],{"className":28020,"style":17697},[9005],[14,28022],{},[14,28024,28026,28029],{"className":28025},[235],[14,28027,12010],{"className":28028,"style":13006},[235,8903],[14,28030,28032],{"className":28031},[9517],[14,28033,28035,28061],{"className":28034},[8996,8997],[14,28036,28038,28058],{"className":28037},[9001],[14,28039,28041],{"className":28040,"style":9605},[9005],[14,28042,28043,28046],{"style":13021},[14,28044],{"className":28045,"style":9533},[9013],[14,28047,28049],{"className":28048},[9018,9019,9020,9021],[14,28050,28052,28055],{"className":28051},[235,9021],[14,28053,328],{"className":28054},[235,9021],[14,28056,8918],{"className":28057,"style":8934},[235,8903,9021],[14,28059,9058],{"className":28060},[9057],[14,28062,28064],{"className":28063},[9001],[14,28065,28067],{"className":28066,"style":17697},[9005],[14,28068],{},[14,28070],{"className":28071,"style":240},[239],[14,28073,4432],{"className":28074},[244],[14,28076],{"className":28077,"style":240},[239],[14,28079,28081,28084,28124],{"className":28080},[226],[14,28082],{"className":28083,"style":25783},[230],[14,28085,28087,28090],{"className":28086},[235],[14,28088,8845],{"className":28089,"style":13006},[235,8903],[14,28091,28093],{"className":28092},[9517],[14,28094,28096,28116],{"className":28095},[8996,8997],[14,28097,28099,28113],{"className":28098},[9001],[14,28100,28102],{"className":28101,"style":12900},[9005],[14,28103,28104,28107],{"style":13021},[14,28105],{"className":28106,"style":9533},[9013],[14,28108,28110],{"className":28109},[9018,9019,9020,9021],[14,28111,8918],{"className":28112,"style":8934},[235,8903,9021],[14,28114,9058],{"className":28115},[9057],[14,28117,28119],{"className":28118},[9001],[14,28120,28122],{"className":28121,"style":17697},[9005],[14,28123],{},[14,28125,8699],{"className":28126},[9071],[11,28128,28129],{},"We call this Zero Framing, and it comes in two flavors depending on the structure layout:",[299,28131,28132,28138],{},[302,28133,28134,28137],{},[129,28135,28136],{},"ZA (Zero Adjacent)",": the neighbor field is a 48-bit pointer. Since user-space pointers on 64-bit Linux have their top 16 bits as zero, the upper bytes of the neighbor are expected to be zero.",[302,28139,28140,28143],{},[129,28141,28142],{},"ZB (Zero Block)",": the neighbor field is padding, a null pointer, or a zeroed integer (the whole qword is zero).",[11,28145,28146],{},"By aligning W so that the companion coordinate's exponent byte lands on zero memory, we drive that coordinate to ~0 and force the line flat (s1) or vertical (s4). The ZA form uses the zero top bytes of an adjacent 48-bit pointer; the ZB form shifts W an extra 8 bytes (the T-9 and T-12 entries below) so an all-zero qword frames the companion SkPoint instead, leaving the recovered-byte positions unchanged.",[14,28148,28150],{"className":28149},[9765],[14,28151,28153,28315],{"className":28152},[188],[14,28154,28156],{"className":28155},[192],[194,28157,28158],{"xmlns":196,"display":9774},[198,28159,28160,28312],{},[9778,28161,28162,28237],{"rowspacing":9780,"columnalign":9781,"columnspacing":9782},[9784,28163,28164,28185,28201,28221],{},[9787,28165,28166],{},[9790,28167,28168],{"scriptlevel":540,"displaystyle":222},[201,28169,28170,28176,28178],{},[9559,28171,28172,28174],{},[8885,28173,9813],{},[204,28175,328],{},[9562,28177,12016],{},[201,28179,28180,28183],{},[8885,28181,28182],{"mathvariant":9648},"Z",[8885,28184,12013],{"mathvariant":9648},[9787,28186,28187],{},[9790,28188,28189],{"scriptlevel":540,"displaystyle":222},[201,28190,28191,28193,28195,28197,28199],{},[201,28192],{},[208,28194,537],{},[8885,28196,8845],{},[208,28198,9136],{},[204,28200,328],{},[9787,28202,28203],{},[9790,28204,28205],{"scriptlevel":540,"displaystyle":222},[201,28206,28207,28213,28215],{},[9559,28208,28209,28211],{},[8885,28210,9813],{},[204,28212,1711],{},[9562,28214,12016],{},[201,28216,28217,28219],{},[8885,28218,28182],{"mathvariant":9648},[8885,28220,12013],{"mathvariant":9648},[9787,28222,28223],{},[9790,28224,28225],{"scriptlevel":540,"displaystyle":222},[201,28226,28227,28229,28231,28233,28235],{},[201,28228],{},[208,28230,537],{},[8885,28232,8845],{},[208,28234,9136],{},[204,28236,1711],{},[9784,28238,28239,28260,28276,28296],{},[9787,28240,28241],{},[9790,28242,28243],{"scriptlevel":540,"displaystyle":222},[201,28244,28245,28251,28253],{},[9559,28246,28247,28249],{},[8885,28248,9813],{},[204,28250,328],{},[9562,28252,12016],{},[201,28254,28255,28257],{},[8885,28256,28182],{"mathvariant":9648},[8885,28258,28259],{"mathvariant":9648},"B",[9787,28261,28262],{},[9790,28263,28264],{"scriptlevel":540,"displaystyle":222},[201,28265,28266,28268,28270,28272,28274],{},[201,28267],{},[208,28269,537],{},[8885,28271,8845],{},[208,28273,9136],{},[204,28275,1163],{},[9787,28277,28278],{},[9790,28279,28280],{"scriptlevel":540,"displaystyle":222},[201,28281,28282,28288,28290],{},[9559,28283,28284,28286],{},[8885,28285,9813],{},[204,28287,1711],{},[9562,28289,12016],{},[201,28291,28292,28294],{},[8885,28293,28182],{"mathvariant":9648},[8885,28295,28259],{"mathvariant":9648},[9787,28297,28298],{},[9790,28299,28300],{"scriptlevel":540,"displaystyle":222},[201,28301,28302,28304,28306,28308,28310],{},[201,28303],{},[208,28305,537],{},[8885,28307,8845],{},[208,28309,9136],{},[204,28311,1168],{},[214,28313,28314],{"encoding":216},"\\begin{aligned}\ns_1\\ \\mathrm{ZA} &: T - 1 & s_4\\ \\mathrm{ZA} &: T - 4 \\\\\ns_1\\ \\mathrm{ZB} &: T - 9 & s_4\\ \\mathrm{ZB} &: T - 12\n\\end{aligned}",[14,28316,28318],{"className":28317,"ariaHidden":222},[221],[14,28319,28321,28324],{"className":28320},[226],[14,28322],{"className":28323,"style":19333},[230],[14,28325,28327],{"className":28326},[235],[14,28328,28330,28469,28562,28565,28702],{"className":28329},[9778],[14,28331,28333],{"className":28332},[10136],[14,28334,28336,28461],{"className":28335},[8996,8997],[14,28337,28339,28458],{"className":28338},[9001],[14,28340,28342,28400],{"className":28341,"style":19352},[9005],[14,28343,28344,28347],{"style":19355},[14,28345],{"className":28346,"style":9014},[9013],[14,28348,28350,28390,28393],{"className":28349},[235],[14,28351,28353,28356],{"className":28352},[235],[14,28354,9813],{"className":28355},[235,8903],[14,28357,28359],{"className":28358},[9517],[14,28360,28362,28382],{"className":28361},[8996,8997],[14,28363,28365,28379],{"className":28364},[9001],[14,28366,28368],{"className":28367,"style":9605},[9005],[14,28369,28370,28373],{"style":13774},[14,28371],{"className":28372,"style":9533},[9013],[14,28374,28376],{"className":28375},[9018,9019,9020,9021],[14,28377,328],{"className":28378},[235,9021],[14,28380,9058],{"className":28381},[9057],[14,28383,28385],{"className":28384},[9001],[14,28386,28388],{"className":28387,"style":9630},[9005],[14,28389],{},[14,28391,12016],{"className":28392},[239],[14,28394,28396],{"className":28395},[235],[14,28397,28399],{"className":28398},[235,9699],"ZA",[14,28401,28402,28405],{"style":19410},[14,28403],{"className":28404,"style":9014},[9013],[14,28406,28408,28448,28451],{"className":28407},[235],[14,28409,28411,28414],{"className":28410},[235],[14,28412,9813],{"className":28413},[235,8903],[14,28415,28417],{"className":28416},[9517],[14,28418,28420,28440],{"className":28419},[8996,8997],[14,28421,28423,28437],{"className":28422},[9001],[14,28424,28426],{"className":28425,"style":9605},[9005],[14,28427,28428,28431],{"style":13774},[14,28429],{"className":28430,"style":9533},[9013],[14,28432,28434],{"className":28433},[9018,9019,9020,9021],[14,28435,328],{"className":28436},[235,9021],[14,28438,9058],{"className":28439},[9057],[14,28441,28443],{"className":28442},[9001],[14,28444,28446],{"className":28445,"style":9630},[9005],[14,28447],{},[14,28449,12016],{"className":28450},[239],[14,28452,28454],{"className":28453},[235],[14,28455,28457],{"className":28456},[235,9699],"ZB",[14,28459,9058],{"className":28460},[9057],[14,28462,28464],{"className":28463},[9001],[14,28465,28467],{"className":28466,"style":19426},[9005],[14,28468],{},[14,28470,28472],{"className":28471},[10229],[14,28473,28475,28554],{"className":28474},[8996,8997],[14,28476,28478,28551],{"className":28477},[9001],[14,28479,28481,28516],{"className":28480,"style":19352},[9005],[14,28482,28483,28486],{"style":19355},[14,28484],{"className":28485,"style":9014},[9013],[14,28487,28489,28492,28495,28498,28501,28504,28507,28510,28513],{"className":28488},[235],[14,28490],{"className":28491},[235],[14,28493],{"className":28494,"style":9075},[239],[14,28496,537],{"className":28497},[9079],[14,28499],{"className":28500,"style":9075},[239],[14,28502,8845],{"className":28503,"style":13006},[235,8903],[14,28505],{"className":28506,"style":240},[239],[14,28508,9136],{"className":28509},[244],[14,28511],{"className":28512,"style":240},[239],[14,28514,328],{"className":28515},[235],[14,28517,28518,28521],{"style":19410},[14,28519],{"className":28520,"style":9014},[9013],[14,28522,28524,28527,28530,28533,28536,28539,28542,28545,28548],{"className":28523},[235],[14,28525],{"className":28526},[235],[14,28528],{"className":28529,"style":9075},[239],[14,28531,537],{"className":28532},[9079],[14,28534],{"className":28535,"style":9075},[239],[14,28537,8845],{"className":28538,"style":13006},[235,8903],[14,28540],{"className":28541,"style":240},[239],[14,28543,9136],{"className":28544},[244],[14,28546],{"className":28547,"style":240},[239],[14,28549,1163],{"className":28550},[235],[14,28552,9058],{"className":28553},[9057],[14,28555,28557],{"className":28556},[9001],[14,28558,28560],{"className":28559,"style":19426},[9005],[14,28561],{},[14,28563],{"className":28564,"style":10774},[10773],[14,28566,28568],{"className":28567},[10136],[14,28569,28571,28694],{"className":28570},[8996,8997],[14,28572,28574,28691],{"className":28573},[9001],[14,28575,28577,28634],{"className":28576,"style":19352},[9005],[14,28578,28579,28582],{"style":19355},[14,28580],{"className":28581,"style":9014},[9013],[14,28583,28585,28625,28628],{"className":28584},[235],[14,28586,28588,28591],{"className":28587},[235],[14,28589,9813],{"className":28590},[235,8903],[14,28592,28594],{"className":28593},[9517],[14,28595,28597,28617],{"className":28596},[8996,8997],[14,28598,28600,28614],{"className":28599},[9001],[14,28601,28603],{"className":28602,"style":9605},[9005],[14,28604,28605,28608],{"style":13774},[14,28606],{"className":28607,"style":9533},[9013],[14,28609,28611],{"className":28610},[9018,9019,9020,9021],[14,28612,1711],{"className":28613},[235,9021],[14,28615,9058],{"className":28616},[9057],[14,28618,28620],{"className":28619},[9001],[14,28621,28623],{"className":28622,"style":9630},[9005],[14,28624],{},[14,28626,12016],{"className":28627},[239],[14,28629,28631],{"className":28630},[235],[14,28632,28399],{"className":28633},[235,9699],[14,28635,28636,28639],{"style":19410},[14,28637],{"className":28638,"style":9014},[9013],[14,28640,28642,28682,28685],{"className":28641},[235],[14,28643,28645,28648],{"className":28644},[235],[14,28646,9813],{"className":28647},[235,8903],[14,28649,28651],{"className":28650},[9517],[14,28652,28654,28674],{"className":28653},[8996,8997],[14,28655,28657,28671],{"className":28656},[9001],[14,28658,28660],{"className":28659,"style":9605},[9005],[14,28661,28662,28665],{"style":13774},[14,28663],{"className":28664,"style":9533},[9013],[14,28666,28668],{"className":28667},[9018,9019,9020,9021],[14,28669,1711],{"className":28670},[235,9021],[14,28672,9058],{"className":28673},[9057],[14,28675,28677],{"className":28676},[9001],[14,28678,28680],{"className":28679,"style":9630},[9005],[14,28681],{},[14,28683,12016],{"className":28684},[239],[14,28686,28688],{"className":28687},[235],[14,28689,28457],{"className":28690},[235,9699],[14,28692,9058],{"className":28693},[9057],[14,28695,28697],{"className":28696},[9001],[14,28698,28700],{"className":28699,"style":19426},[9005],[14,28701],{},[14,28703,28705],{"className":28704},[10229],[14,28706,28708,28787],{"className":28707},[8996,8997],[14,28709,28711,28784],{"className":28710},[9001],[14,28712,28714,28749],{"className":28713,"style":19352},[9005],[14,28715,28716,28719],{"style":19355},[14,28717],{"className":28718,"style":9014},[9013],[14,28720,28722,28725,28728,28731,28734,28737,28740,28743,28746],{"className":28721},[235],[14,28723],{"className":28724},[235],[14,28726],{"className":28727,"style":9075},[239],[14,28729,537],{"className":28730},[9079],[14,28732],{"className":28733,"style":9075},[239],[14,28735,8845],{"className":28736,"style":13006},[235,8903],[14,28738],{"className":28739,"style":240},[239],[14,28741,9136],{"className":28742},[244],[14,28744],{"className":28745,"style":240},[239],[14,28747,1711],{"className":28748},[235],[14,28750,28751,28754],{"style":19410},[14,28752],{"className":28753,"style":9014},[9013],[14,28755,28757,28760,28763,28766,28769,28772,28775,28778,28781],{"className":28756},[235],[14,28758],{"className":28759},[235],[14,28761],{"className":28762,"style":9075},[239],[14,28764,537],{"className":28765},[9079],[14,28767],{"className":28768,"style":9075},[239],[14,28770,8845],{"className":28771,"style":13006},[235,8903],[14,28773],{"className":28774,"style":240},[239],[14,28776,9136],{"className":28777},[244],[14,28779],{"className":28780,"style":240},[239],[14,28782,1168],{"className":28783},[235],[14,28785,9058],{"className":28786},[9057],[14,28788,28790],{"className":28789},[9001],[14,28791,28793],{"className":28792,"style":19426},[9005],[14,28794],{},[11,28796,28797],{},"A single forge recovers only part of the pointer. The s1 forge reads three bytes at once (b0-b2 encoded as one target float, whose sign\u002Fexponent byte b2 pins the magnitude for the zoom search); the s4 forge reads a single byte (b3). We therefore use two separate shifted forges to reconstruct the low 32 bits:",[17335,28799],{":columns":28800,":rows":28801,"title":28802},"[\"T-1\",\"T\",\"T+1\",\"T+2\",\"T+3\",\"T+4\",\"T+5\",\"T+6\"]","[{\"fields\":[{\"label\":\"frame\",\"start\":0,\"span\":1},{\"label\":\"b0\",\"start\":1,\"span\":1},{\"label\":\"b1\",\"start\":2,\"span\":1},{\"label\":\"b2\",\"start\":3,\"span\":1},{\"label\":\"b3\",\"start\":4,\"span\":1},{\"label\":\"b4\",\"start\":5,\"span\":1},{\"label\":\"b5\",\"start\":6,\"span\":1},{\"label\":\"b6=0\",\"start\":7,\"span\":1}]},{\"fields\":[{\"label\":\"P0.x: recovers b0..b2\",\"sub\":\"(target float)\",\"start\":0,\"span\":4},{\"label\":\"P0.y: exponent b6=0\",\"sub\":\"(flat, reads ~0)\",\"start\":4,\"span\":4}]}]","s1 forge (W = T - 1)",[17335,28804],{":columns":28805,":rows":28806,"title":28807},"[\"T-4\",\"T-3\",\"T-2\",\"T-1\",\"T\",\"T+1\",\"T+2\",\"T+3\"]","[{\"fields\":[{\"label\":\"q4\",\"start\":0,\"span\":1},{\"label\":\"q5\",\"start\":1,\"span\":1},{\"label\":\"q6\",\"start\":2,\"span\":1},{\"label\":\"q7=0\",\"start\":3,\"span\":1},{\"label\":\"b0\",\"start\":4,\"span\":1},{\"label\":\"b1\",\"start\":5,\"span\":1},{\"label\":\"b2\",\"start\":6,\"span\":1},{\"label\":\"b3\",\"start\":7,\"span\":1}]},{\"fields\":[{\"label\":\"P0.x: exponent q7=0\",\"sub\":\"(vert, reads ~0)\",\"start\":0,\"span\":4},{\"label\":\"P0.y: recovers b3\",\"sub\":\"(target float)\",\"start\":4,\"span\":4}]}]","s4 forge (W = T - 4)",[11,28809,28810,28811,28813],{},"Combining s1 and s4 recovers the low four bytes (b0-b3) of ",[29,28812,25665],{},"; the top two bytes (b4, b5) come from the already-known pool tag, completing the full 48-bit pointer.",[9286,28815,28816],{"type":9288},[11,28817,28818],{},"Sliding the read window so companion coordinates land on zero bytes collapses the 2D line into a 1D axis-aligned segment, letting us reuse the zoom search for arbitrary pointer reads.",[11,28820,28821],{},"With this arbitrary read primitive, we can now traverse the GPU's internal object graph.",[8422,28823,28825],{"id":28824},"the-graph-walk","The graph walk",[11,28827,28828],{},"To walk from RasterDecoderImpl to GrGLInterface, every traversed pointer must satisfy the ZA\u002FZB framing to be readable:",[348,28830,28831,28844],{},[351,28832,28833],{},[354,28834,28835,28838,28841],{},[357,28836,28837],{},"from",[357,28839,28840],{},"field",[357,28842,28843],{},"to",[364,28845,28846,28857,28867,28877,28887,28897,28907,28917],{},[354,28847,28848,28851,28854],{},[369,28849,28850],{},"RasterDecoderImpl",[369,28852,28853],{},"query_manager_",[369,28855,28856],{},"RasterQueryManager",[354,28858,28859,28861,28864],{},[369,28860,28856],{},[369,28862,28863],{},"shared_context_state_",[369,28865,28866],{},"SharedContextState",[354,28868,28869,28871,28874],{},[369,28870,28866],{},[369,28872,28873],{},"gr_context_",[369,28875,28876],{},"GrDirectContext",[354,28878,28879,28881,28884],{},[369,28880,28876],{},[369,28882,28883],{},"fResourceProvider",[369,28885,28886],{},"GrResourceProvider",[354,28888,28889,28891,28894],{},[369,28890,28886],{},[369,28892,28893],{},"fNonAAQuadIndexBuffer",[369,28895,28896],{},"GrGpuBuffer",[354,28898,28899,28901,28904],{},[369,28900,28896],{},[369,28902,28903],{},"fGpu",[369,28905,28906],{},"GrGLGpu",[354,28908,28909,28911,28914],{},[369,28910,28906],{},[369,28912,28913],{},"fGLContext",[369,28915,28916],{},"GrGLContext",[354,28918,28919,28921,28924],{},[369,28920,28916],{},[369,28922,28923],{},"fInterface",[369,28925,25463],{},[11,28927,28928],{},"This 8-hop walk requires 16 forges and about 75 bisection probes, taking about 1 minute to dynamically resolve GrGLInterface.",[51,28930,28931],{},[11,28932,28933],{},"How did I find this path? Writing the search script is an exercise left to readers.",[11,28935,28936],{},"We can shorten the path by leveraging direct owner pointers: GrDirectContext owns GrGLGpu directly through fGpu, bypassing fResourceProvider and the buffer hops:",[117,28938,28941],{"className":28939,"code":28940,"language":122,"meta":125},[120],"full  (8 hops):  grctx -> resprov -> quadbuf -> glgpu\nshort (6 hops):  grctx -> glgpu\n",[29,28942,28940],{"__ignoreMap":125},[11,28944,28945],{},"Other shorter walks exist in the object graph, but they do not satisfy the ZA\u002FZB framing.",[37,28947,28949],{"id":28948},"putting-it-together","Putting it together",[11,28951,28952],{},"Conceptually, the exploit resolves in three main stages:",[8442,28954,28955,28961,28967],{},[302,28956,28957,28960],{},[129,28958,28959],{},"Heap shaping & forge",": spraying transfer-cache entries grooms the heap. Triggering the PathStencilCoverOp overflow corrupts the victim's pointers, establishing a reliable \"forge\" write primitive.",[302,28962,28963,28966],{},[129,28964,28965],{},"Information leak (visual oracle)",": we turn Skia's rasterization loop into a high-fidelity visual oracle to read back memory bytes, bypassing ASLR by leaking the RasterDecoderImpl address and resolving the pool tag.",[302,28968,28969,28972],{},[129,28970,28971],{},"Execution dispatch",": we trigger a UAF on GrGLInterface, reclaim the freed slot with our fake function table, and intercept the next GL call to redirect control flow to mkdir.",[11,28974,28975],{},"While the run is highly deterministic, background allocator churn can occasionally cause failure due to:",[299,28977,28978,28981,28984],{},[302,28979,28980],{},"Stolen holes or wedged objects in the groom stage.",[302,28982,28983],{},"Lost reclaim races where another thread grabs the freed interface first.",[302,28985,28986],{},"Float degeneracies where specific pointer bytes fail IEEE-754 limits.",[11,28988,28989],{},"Because a process crash simply spawns a fresh GPU process with a clean heap, the exploit simply retries until it succeeds.",[37,28991,28993],{"id":28992},"glossary","Glossary",[299,28995,28996,29002,29008,29014,29020,29025,29031,29037,29042,29048,29054,29060],{},[302,28997,28998,29001],{},[129,28999,29000],{},"PartitionAlloc (PA)",": Chromium's heap allocator, segregating allocations by size class (\"buckets\").",[302,29003,29004,29007],{},[129,29005,29006],{},"Pool tag",": the top 16 bits (here 0x1adc) carried by BRP-pool pointers. Only bits 34-47 are strictly pool-invariant; the walked init-time objects also share bits 32-33, so all 16 are reused to rebuild leaked pointers.",[302,29009,29010,29013],{},[129,29011,29012],{},"SkPath \u002F SkPathData",": Skia's path structures, used here as the OOB write victim and overflow trigger.",[302,29015,29016,29019],{},[129,29017,29018],{},"PathStencilCoverOp",": the Skia rendering operation containing the integer overflow vulnerability.",[302,29021,29022,29024],{},[129,29023,25463],{},": Skia's interface of OpenGL function pointers; the target of our arbitrary call hijacking.",[302,29026,29027,29030],{},[129,29028,29029],{},"GrGLFunction",": Skia's function wrapper containing the invoker (fCall) and closure buffer (fBuf).",[302,29032,29033,29036],{},[29,29034,29035],{},"sk_sp\u003CT>",": Skia's intrusive ref-counted smart pointer, which does not acquire BackupRefPtr metadata.",[302,29038,29039,29041],{},[29,29040,9241],{},": Chromium's BackupRefPtr-protected pointer wrapper designed to prevent UAF.",[302,29043,29044,29047],{},[129,29045,29046],{},"forge",": the controlled-write primitive built on the cascade heap overflow.",[302,29049,29050,29053],{},[129,29051,29052],{},"c1read",": the controlled-read primitive consisting of two forges and pixel readback.",[302,29055,29056,29059],{},[129,29057,29058],{},"ZA \u002F ZB framing",": alignment conditions on the adjacent qword that satisfy float-to-int conversion constraints.",[302,29061,29062,29065],{},[129,29063,29064],{},"walk",": chained c1read pointer reads traversing the GPU object graph.",[37,29067,29069],{"id":29068},"references","References",[8442,29071,29072,29081,29088,29095,29102,29110,29113,29122],{},[302,29073,29074,29075,29080],{},"Chromium Authors, ",[21,29076,29079],{"href":29077,"rel":29078},"https:\u002F\u002Fchromium.googlesource.com\u002Fchromium\u002Fsrc\u002F+\u002Fmaster\u002Fbase\u002Fallocator\u002Fpartition_allocator\u002FPartitionAlloc.md",[25],"\"PartitionAlloc Design\"",", 2024.",[302,29082,29074,29083,29080],{},[21,29084,29087],{"href":29085,"rel":29086},"https:\u002F\u002Fchromium.googlesource.com\u002Fchromium\u002Fsrc\u002F+\u002Fmaster\u002Fbase\u002Fmemory\u002Fraw_ptr.md",[25],"\"BackupRefPtr (MiraclePtr)\"",[302,29089,29074,29090,29080],{},[21,29091,29094],{"href":29092,"rel":29093},"https:\u002F\u002Fchromium.googlesource.com\u002Fchromium\u002Fsrc\u002F+\u002Fmaster\u002Fdocs\u002Fcontrol_flow_integrity.md",[25],"\"Control Flow Integrity (CFI)\"",[302,29096,29074,29097,8476],{},[21,29098,29101],{"href":29099,"rel":29100},"https:\u002F\u002Fchromium.googlesource.com\u002Fchromium\u002Fsrc\u002F+\u002Fmaster\u002Ftools\u002Fcfi\u002Fignores.txt",[25],"\"CFI ignore list (tools\u002Fcfi\u002Fignores.txt)\"",[302,29103,29104,29105,8476],{},"Skia Authors, ",[21,29106,29109],{"href":29107,"rel":29108},"https:\u002F\u002Fskia.org\u002F",[25],"\"Skia Graphics Library\"",[302,29111,29112],{},"P. H. Sterbenz, \"Floating-Point Computation\", Prentice-Hall, 1974.",[302,29114,29115,29116,29121],{},"IEEE, ",[21,29117,29120],{"href":29118,"rel":29119},"https:\u002F\u002Fstandards.ieee.org\u002Fieee\u002F754\u002F6210\u002F",[25],"\"IEEE Standard for Floating-Point Arithmetic\"",", IEEE 754-2019.",[302,29123,29124,29125,29130],{},"Chromium Bug Tracker, ",[21,29126,29129],{"href":29127,"rel":29128},"https:\u002F\u002Fcrbug.com\u002F242999",[25],"crbug.com\u002F242999"," (referenced in Logger::Logger hex-encode path).",[37,29132,29134],{"id":29133},"shouts","Shouts",[299,29136,29137,29140,29143,29146,29149,29152,29155,29158,29161,29164],{},[302,29138,29139],{},"the chrome-security team, for paying out the bounties that funded our local caffeine supply.",[302,29141,29142],{},"the skia and v8 engineers, for providing such a beautifully complex, yet groomable canvas so we can express our art.",[302,29144,29145],{},"PartitionAlloc's LIFO freelist, for popping our reclaimed slot first.",[302,29147,29148],{},"all fellow heap-sprayers, pointer-chasers, and float-bisectors.",[302,29150,29151],{},"Pat H. Sterbenz, the real OG whose lemma keeps our oracle honest.",[302,29153,29154],{},"zero bytes everywhere, for staying null when we needed you most.",[302,29156,29157],{},"our GPU, for not melting during the 1.43B verb cascade prepare loop.",[302,29159,29160],{},"the phrack staff and community, past, present, and root.",[302,29162,29163],{},"Calif.IO, for paying our researcher's salary.",[302,29165,29166],{},"Anthropic's Claude, who hallucinated at least three wrong exploits before casually generating real creative math ideas like a boss.",[37,29168,29170],{"id":29169},"exploit-source","Exploit source",[11,29172,29173],{},"The complete runnable PoC, targeting Google Chrome Stable 146.0.7680.164 on Linux x64:",[11,29175,29176,29180],{},[21,29177,29179],{"href":29178},"\u002Fdownloads\u002Freading-memory-poc.tar.xz","Download reading-memory-poc.tar.xz"," (76.5 KB)",[117,29182,29186],{"className":29183,"code":29184,"language":29185,"meta":125,"style":125},"language-bash shiki shiki-themes github-light github-dark","tar xJf reading-memory-poc.tar.xz\nCHROME=\u002Fpath\u002Fto\u002Fchrome-146 .\u002Fmojojs_exploit\u002Frun_mojojs.sh\n","bash",[29,29187,29188,29199],{"__ignoreMap":125},[14,29189,29190,29193,29196],{"class":475,"line":476},[14,29191,29192],{"class":483},"tar",[14,29194,29195],{"class":9378}," xJf",[14,29197,29198],{"class":9378}," reading-memory-poc.tar.xz\n",[14,29200,29201,29204,29206,29209],{"class":475,"line":491},[14,29202,29203],{"class":487},"CHROME",[14,29205,988],{"class":479},[14,29207,29208],{"class":9378},"\u002Fpath\u002Fto\u002Fchrome-146",[14,29210,29211],{"class":483}," .\u002Fmojojs_exploit\u002Frun_mojojs.sh\n",[8807,29213,29214],{},"html pre.shiki code .sJ8bj, html code.shiki .sJ8bj{--shiki-default:#6A737D;--shiki-dark:#6A737D}html pre.shiki code .sScJk, html code.shiki .sScJk{--shiki-default:#6F42C1;--shiki-dark:#B392F0}html pre.shiki code .sVt8B, html code.shiki .sVt8B{--shiki-default:#24292E;--shiki-dark:#E1E4E8}html pre.shiki code .szBVR, html code.shiki .szBVR{--shiki-default:#D73A49;--shiki-dark:#F97583}html pre.shiki code .sj4cs, html code.shiki .sj4cs{--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .sZZnC, html code.shiki .sZZnC{--shiki-default:#032F62;--shiki-dark:#9ECBFF}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .s4XuR, html code.shiki .s4XuR{--shiki-default:#E36209;--shiki-dark:#FFAB70}",{"title":125,"searchDepth":500,"depth":500,"links":29216},[29217,29218,29219,29220,29223,29227,29231,29236,29241,29245,29249,29256,29260,29261,29262,29263,29264],{"id":8858,"depth":491,"text":8859},{"id":9182,"depth":491,"text":9183},{"id":9193,"depth":491,"text":9194},{"id":9209,"depth":491,"text":9210,"children":29221},[29222],{"id":9251,"depth":500,"text":9252},{"id":9297,"depth":491,"text":9298,"children":29224},[29225,29226],{"id":9304,"depth":500,"text":9305},{"id":9470,"depth":500,"text":9471},{"id":10911,"depth":491,"text":10912,"children":29228},[29229,29230],{"id":10918,"depth":500,"text":10919},{"id":10933,"depth":500,"text":10934},{"id":10984,"depth":491,"text":10985,"children":29232},[29233,29234,29235],{"id":10988,"depth":500,"text":10989},{"id":11236,"depth":500,"text":11237},{"id":12458,"depth":500,"text":12459},{"id":12482,"depth":491,"text":12483,"children":29237},[29238,29239,29240],{"id":12512,"depth":500,"text":12513},{"id":12528,"depth":500,"text":12529},{"id":12659,"depth":500,"text":12660},{"id":12677,"depth":491,"text":12678,"children":29242},[29243,29244],{"id":12707,"depth":500,"text":12708},{"id":12771,"depth":500,"text":12772},{"id":12807,"depth":491,"text":12808,"children":29246},[29247,29248],{"id":13192,"depth":500,"text":13193},{"id":17320,"depth":500,"text":17321},{"id":25286,"depth":491,"text":25287,"children":29250},[29251,29252,29253,29254,29255],{"id":25293,"depth":500,"text":25294},{"id":25329,"depth":500,"text":25330},{"id":25357,"depth":500,"text":25358},{"id":25558,"depth":500,"text":25559},{"id":25577,"depth":500,"text":25578},{"id":25643,"depth":491,"text":25644,"children":29257},[29258,29259],{"id":25658,"depth":500,"text":25659},{"id":28824,"depth":500,"text":28825},{"id":28948,"depth":491,"text":28949},{"id":28992,"depth":491,"text":28993},{"id":29068,"depth":491,"text":29069},{"id":29133,"depth":491,"text":29134},{"id":29169,"depth":491,"text":29170},"2026-08-06","A short note on the ideas behind a Chromium renderer-to-GPU sandbox escape via Skia.",{},"\u002Fblog\u002Freading-memory-by-painting-it",{"title":8837,"description":29266},"blog\u002Freading-memory-by-painting-it","ZLLtsYZoyBGC_jGOWsDn3_HdKiw7-o7W0qJwH2O3sMo",1786604865221]