[Webkit-unassigned] [Bug 159954] New: CrashOnOverflow in JSC::Yarr::YarrPatternConstructor::setupAlternativeOffsets

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=159954

            Bug ID: 159954
           Summary: CrashOnOverflow in
                    JSC::Yarr::YarrPatternConstructor::setupAlternativeOff
                    sets
    Classification: Unclassified
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: msaboff at apple.com

We are failing on regular expressions that exceed 2^32 characters.  For example:
  /a{2147483649,2147483650}a{2147483649,2147483650}/

Backtraces look something like:
    #0 0x10a0d2cb8 in WTFCrash (JavaScriptCore+0x2a87cb8)
    #1 0x10766291d in WTF::CrashOnOverflow::crash() (JavaScriptCore+0x1791d)
    #2 0x1076628bd in WTF::CrashOnOverflow::overflowed() (JavaScriptCore+0x178bd)
    #3 0x10a0ab684 in WTF::Checked<unsigned int, WTF::CrashOnOverflow> const WTF::Checked<unsigned int, WTF::CrashOnOverflow>::operator+=<unsigned int>(unsigned int) (JavaScriptCore+0x2a60684)
    #4 0x10a0ab0b0 in WTF::Checked<unsigned int, WTF::CrashOnOverflow> const WTF::Checked<unsigned int, WTF::CrashOnOverflow>::operator+=<unsigned int, WTF::CrashOnOverflow>(WTF::Checked<unsigned int, WTF::CrashOnOverflow>) (JavaScriptCore+0x2a600b0)
    #5 0x10a0a9f6a in JSC::Yarr::YarrPatternConstructor::setupAlternativeOffsets(JSC::Yarr::PatternAlternative*, unsigned int, unsigned int, unsigned int&) (JavaScriptCore+0x2a5ef6a)
    #6 0x10a0a8035 in JSC::Yarr::YarrPatternConstructor::setupDisjunctionOffsets(JSC::Yarr::PatternDisjunction*, unsigned int, unsigned int, unsigned int&) (JavaScriptCore+0x2a5d035)
    #7 0x10a0aa835 in JSC::Yarr::YarrPatternConstructor::setupAlternativeOffsets(JSC::Yarr::PatternAlternative*, unsigned int, unsigned int, unsigned int&) (JavaScriptCore+0x2a5f835)
    #8 0x10a0a8035 in JSC::Yarr::YarrPatternConstructor::setupDisjunctionOffsets(JSC::Yarr::PatternDisjunction*, unsigned int, unsigned int, unsigned int&) (JavaScriptCore+0x2a5d035)
    #9 0x10a09d9f2 in JSC::Yarr::YarrPatternConstructor::setupOffsets() (JavaScriptCore+0x2a529f2)
    #10 0x10a09ba89 in JSC::Yarr::YarrPattern::compile(WTF::String const&, void*) (JavaScriptCore+0x2a50a89)
    ...

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20160719/fdc18862/attachment.html>