www/caddy: fix authentik forward-auth Host header for #5712
Both the outpost passthrough (reverse_proxy) and forward_auth
directives sent the auth backend's own address as Host instead of
the original request's Host. authentik's shared outpost dispatches
by Host, so it could not tell which Provider/App a forward-auth
check was for and returned 404 instead of redirecting into the
login flow.
Hardcode header_up Host {http.request.host} on both directives,
unconditional of AuthToTls, since the original Host is always what
authentik needs regardless of how the auth backend itself is
reached.
Co-Authored-By: Claude Sonnet 5 <noreply at anthropic.com>
[analyzer] Resolve lambda captures for explicit object parameters (#219726)
Currently explicit object parameters are not modeled in the
`VisitCommonDeclRefExpr` function in `ExprEngine`. Because of this when
a lambda has an explicit object parameter and a possible division by
zero the `core.DivideZero` checker does not emit warning. This PR solves
that issue by deciding if the lambda has an explicit object parameter
and then records the binding (if the parameter has the reference type)
between the parameter and the argument's expression otherwise it returns
the captured field's lvalue.
This PR fixes #218708
[SLP]Booleanize logical and/or nodes in the wide leaf type
i1 and/or tree nodes with booleanized wide leaves (one-use truncs of
wide values, zero-tests of values from [0, 1]) are registered in MinBWs
and emitted in the wide type; bit 0 of the result is the final value.
Reviewers: bababuck
Pull Request: https://github.com/llvm/llvm-project/pull/223250
[dfsan] Fix big-endian origin mask (#223247)
Fix the mask used when loading wide shadows on big-endian targets.
The previous expression used a 32-bit integer for the shift, producing
an incorrect zero mask for 64-bit wide shadows. Changed the expression
to use 1ULL so that a 64-bit mask is constructed correctly. The
resulting mask keeps the upper 32 bits and clears the lower 32 bits.
Previously, the big-endian path generated:
```ll
%10 = load i64, ptr %6, align 1
%11 = and i64 %10, 0
```
With this change, it generates:
```ll
[5 lines not shown]
snd_emu10kx: Make sure the block count and size cover the whole buffer
The playback voices always loop over the whole EMU_PLAY_BUFSZ buffer,
but emupchan_setblocksize() only recorded the new block size and left
the block count as it was set up by emu_vinit(). The blocks then no
longer covered the whole buffer, and the part they left out was played
without ever being written to, which became audible as distortion once
playback started going through a virtual channel.
Resize the buffer, so that the block count and size always cover it.
Fixes: 02d4eeabfd73 ("sound: Allocate vchans on-demand")
PR: 287687
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D59444
(cherry picked from commit a7258157e1a20957af23332814197ea723f5778d)
[AMDGPU] Mark `SI_WATERFALL_LOOP` as divergent in `hasDivergentBranch` (#218969)
When a vector instruction takes an SGPR source operand, sinking it out
of a loop with divergent exit would cause the vector instruction to only
get the value from the last iteration in the SGPR. However, in a
divergent loop the value of the SGPR operand may vary across iterations,
so the instruction cannot be sink out of the loop as only using the last
value is incorrect. Before this change `SI_LOOP` was marked as divergent
but `SI_WATERFALL_LOOP` was not, allowing such incorrect sinking for
waterfall loops.
Assisted-by: Claude Code
[lldb] Memory cache: no overlap and read across cache entries (#222688)
The memory cache keeps two collections of cached bytes, L1 and L2, which
are named confusingly. L2 holds cache lines at aligned addresses, but
each line size is less than or equal to the fixed line size. L1 holds
pieces from arbitrary addresses with arbitrary lengths. This caused two
problems:
1. A lookup had to find every byte it wanted inside a *single*
entry. A range that spanned two adjacent entries missed even when the
two collections together already held every byte of it. The lookup
rejected such a read rather than take part of it from each entry.
2. The pieces could also overlap each other, which made the lookup
incomplete as well as ambiguous. It examined only the piece starting at
or below the address, so a short piece hid a longer one that covered the
whole read. The read missed with the bytes resident.
This change fixes these problems by introducing these properties to the
[43 lines not shown]
Stop docker.socket before docker.service
## Problem
`DockerService.stop()` stopped `docker.service` first and `docker.socket` second, leaving the socket armed for the whole service teardown — around 11.5 seconds on a box with a couple of dozen containers. Anything connecting to `/var/run/docker.sock` in that window socket-activates the very service we are stopping. With the `StartLimitBurst=1` drop-in that phantom start gets refused, the unit latches `failed`, and `CollectMode=inactive` never garbage-collects a failed unit — so the rate-limit counter stays pinned and nothing short of a reboot recovers. That is what leaves an apps-pool migration reporting "Migration completed successfully" at 100% and `Docker service is not running` in the same job.
## Solution
Enqueue the stop on `docker.socket` first. This is not really a reordering of the teardown: systemd builds a two-job transaction and still takes the service down first per `After=`. What changes is that a stop job is pending on the socket, and systemd suppresses activation requests while that is true, so nothing can resurrect the service mid-teardown.
`super().stop()` moves into a `finally` so the service is still stopped if the socket stop raises. It becomes a near no-op in practice, since `docker.service` requires the socket and is already on its way down, but it is worth keeping as a defensive call in case that dependency ever changes upstream. One consequence for anyone reading a trace: the teardown wait now sits on the socket stop rather than on `super().stop()`.
[EXPERIMENT] Implicitly attribute ALLOCATABLE/POINTER components as managed
Extend the implicit managed attribution in resolve-names to derived-type components, instead of selecting the allocator index at the ALLOCATE site.
[ORC] Resolve JITLoaderGDB alloc actions via lookupAndApply (#223325)
ELFDebugObjectPlugin resolved its RegisterJITLoaderGDB alloc-action
address with EPC.getBootstrapSymbols. For consistency, switch to
lookupAndApply/recordAddr on the bootstrap JITDylib instead.
NAS-143607 / 27.0.0-BETA.1 / Stop docker.socket before docker.service (#19697)
## Problem
`DockerService.stop()` stopped `docker.service` first and
`docker.socket` second, leaving the socket armed for the whole service
teardown — around 11.5 seconds on a box with a couple of dozen
containers. Anything connecting to `/var/run/docker.sock` in that window
socket-activates the very service we are stopping. With the
`StartLimitBurst=1` drop-in that phantom start gets refused, the unit
latches `failed`, and `CollectMode=inactive` never garbage-collects a
failed unit — so the rate-limit counter stays pinned and nothing short
of a reboot recovers. That is what leaves an apps-pool migration
reporting "Migration completed successfully" at 100% and `Docker service
is not running` in the same job.
## Solution
Enqueue the stop on `docker.socket` first. This is not really a
reordering of the teardown: systemd builds a two-job transaction and
still takes the service down first per `After=`. What changes is that a
[10 lines not shown]
[X86] Fix `"Cannot select"` for `bf16` vector selects on a scalar condition under `AVX10.2` (#222854)
Fixes #222673
A `select i1 %c, <8 x bfloat> %a, <8 x bfloat> %b` failed instruction
selection with `+avx10.2-512` on a `v8bf16 X86ISD::CMOV`. Selects on a
scalar condition are lowered to the `CMOV_VR*` pseudos and expanded to a
branch, but those pseudos only have patterns for integer and f16
vectors. Before #101603 bf16 vectors were treated as "soft" everywhere,
so `LowerSELECT` bitcast them to `v8i16` first and never produced a bf16
CMOV. That PR made bf16 non-soft under AVX10.2 to enable native
arithmetic, which silently removed the only bf16-aware path in
`LowerSELECT` without adding a replacement. `v16bf16` and `v32bf16` hit
the same thing.
`LowerSELECT` now takes the integer-bitcast path for every bf16 vector,
using the existing `isBF16orSoftF16` helper, so the select is lowered
exactly as it is on every other bf16 target and as `v8f16` is on FP16
targets. Scalar `bf16` is soft-promoted to `f32` before lowering, so it
[2 lines not shown]
[libc++] Move _LIBCPP_HAS_COND_CLOCKWAIT into condition_variable.h (#222904)
`_LIBCPP_HAS_COND_CLOCKWAIT` is only used inside
`<__condition_variable/condition_variable.h>`, so we might as well move
it there.
[libc++] Optimize string copy construction (#222021)
We know that the string size provided to `__init_copy_ctor_external` is
less than or equal to `max_size()`, so we don't need to do that check
again. Removing that check allows the compiler to ShrinkWrap the small
size path and also removes some unnecessary work in the allocating path.
