[Webkit-unassigned] [Bug 50579] Regular expression methods crashing browser (buffer overflow?)

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=50579


Peter Varga <pvarga at inf.u-szeged.hu> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |pvarga at inf.u-szeged.hu




--- Comment #3 from Peter Varga <pvarga at inf.u-szeged.hu>  2010-12-07 02:34:01 PST ---
I have analyzed the mentioned regex pattern. It didn't cause a crash on jsc for me, but the matching seems to run into an infinite loop.
The pattern isn't a fallback case and the YARR Interpreter works well with this pattern so it seems there is a bug in the YARR JIT.

The problem exists since http://trac.webkit.org/changeset/73307 (https://bugs.webkit.org/show_bug.cgi?id=50295).

The problem surely isn't the length of pattern.
I have created a more simple test case to reproduce this regression:
/(a(b|c)(.*))|xxx/.test('aaa');

I haven't checked the generated JIT code yet.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.