[Webkit-unassigned] [Bug 15245] New: Browser crash in String.replace() with Japanese characters and RegExp containing "\s"

[bugzilla-daemon at webkit.org]

http://bugs.webkit.org/show_bug.cgi?id=15245

           Summary: Browser crash in String.replace() with Japanese
                    characters and RegExp containing "\s"
           Product: WebKit
           Version: 522+ (nightly)
          Platform: S60 Hardware
        OS/Version: S60 3rd edition
            Status: UNCONFIRMED
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: marcus.groeber at nuance.com
                CC: marcus.groeber at nuance.com


I found that a webpage with the following code will reliably crash the browser
with a KERN-EXEC 3 on my Nokia E90 (FW 07.24.0.3) and probably the N95 with
latest firmware as well:

<script> 
  var str = "\u65e5\u672c\u8a9e";
  document.write(str.replace(/\s/, ''));
</script>

This was not an issue in older browsers, and I can't reproduce it on the
emulator (with the outdated S60WebKit revision that can still be compiled), so
it seems like a fairly recent regression, perhaps related to changes in Unicode
support for regexps?

This sounds rather obscure, but is not quite as strange if you consider that
this type of regexp is often used in "trim" functions to remove extra
whitespace from all sorts of strings that might be thrown at it...


-- 
Configure bugmail: http://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.