[Webkit-unassigned] [Bug 180761] New: REGRESSION (r225695): Repro crash on yahoo login page

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=180761

            Bug ID: 180761
           Summary: REGRESSION (r225695): Repro crash on yahoo login page
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: msaboff at apple.com

The crashing RegExp is:
  /([-!#$%&'*+\/=?^`{|}~]|\w)(([-!#$%&'*+\/=?^`{|}~]|\w)|(\.([-!#$%&'*+\/=?^`{|}~]|\w)))*@\w(\w|([-.]\w))*\.\w{2,4}/.exec(”https://mail.yahoo.com/);

A reduced test case is:
  /(?:(?: |a)|\.a)* a*/.exec("/a.aaa”);

The issue is that we are trying to backtrack in a nested alternative after the containing saved parenthesis context has been released.  The backtracking of normal alternatives is done by jumping to an address stored on the stack.  At this point my guess is that we are doing extra backtracking.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20171213/cd406c6e/attachment.html>