[Webkit-unassigned] [Bug 159233] New: REGRESSION (r200946): Improper backtracking from last alternative in sticky patterns

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=159233

            Bug ID: 159233
           Summary: REGRESSION (r200946): Improper backtracking from last
                    alternative in sticky patterns
    Classification: Unclassified
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: msaboff at apple.com

Various sticky patterns fail in unexpected ways when the last alternative doesn't match.  It seems that we retry with an index that isn't correct.  This manifests itself in a couple different ways.

The expression 's = ”\n”.split(/.{2}|(?=$)./ym)' will crash in JIT'ed code, while the expression 'let m = ".a".match(/x(.)|[-\d]/gy")' will ASSERT in debug builds:
    #0 0x106b8ccb8 in WTFCrash (JavaScriptCore+0x2a87cb8)
    #1 0x1066e889a in JSC::JSRopeString::finishCreationSubstringOfResolved(JSC::VM&, JSC::JSString*, unsigned int, unsigned int) (JavaScriptCore+0x25e389a)
    #2 0x1066e8176 in JSC::JSRopeString::createSubstringOfResolved(JSC::VM&, JSC::JSString*, unsigned int, unsigned int) (JavaScriptCore+0x25e3176)
    #3 0x1066fa423 in JSC::JSValue JSC::collectMatches<JSC::RegExpObject::matchGlobal(JSC::ExecState*, JSC::JSGlobalObject*, JSC::JSString*)::$_1>(JSC::VM&, JSC::ExecState*, JSC::JSString*, WTF::String const&, JSC::RegExpConstructor*, JSC::RegExp*, JSC::RegExpObject::matchGlobal(JSC::ExecState*, JSC::JSGlobalObject*, JSC::JSString*)::$_1 const&)::'lambda'()::operator()() const (JavaScriptCore+0x25f5423)
    #4 0x1066f89b3 in JSC::JSValue JSC::collectMatches<JSC::RegExpObject::matchGlobal(JSC::ExecState*, JSC::JSGlobalObject*, JSC::JSString*)::$_1>(JSC::VM&, JSC::ExecState*, JSC::JSString*, WTF::String const&, JSC::RegExpConstructor*, JSC::RegExp*, JSC::RegExpObject::matchGlobal(JSC::ExecState*, JSC::JSGlobalObject*, JSC::JSString*)::$_1 const&) (JavaScriptCore+0x25f39b3)
    #5 0x1066f6c90 in JSC::RegExpObject::matchGlobal(JSC::ExecState*, JSC::JSGlobalObject*, JSC::JSString*) (JavaScriptCore+0x25f1c90)

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20160628/6268ea8c/attachment.html>