<html>
<head>
<base href="https://bugs.webkit.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - RegExp::match() should set m_state to ByteCode if compilation fails."
href="https://bugs.webkit.org/show_bug.cgi?id=147023">147023</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>RegExp::match() should set m_state to ByteCode if compilation fails.
</td>
</tr>
<tr>
<th>Classification</th>
<td>Unclassified
</td>
</tr>
<tr>
<th>Product</th>
<td>WebKit
</td>
</tr>
<tr>
<th>Version</th>
<td>528+ (Nightly build)
</td>
</tr>
<tr>
<th>Hardware</th>
<td>Unspecified
</td>
</tr>
<tr>
<th>OS</th>
<td>Unspecified
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>Normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>P2
</td>
</tr>
<tr>
<th>Component</th>
<td>JavaScriptCore
</td>
</tr>
<tr>
<th>Assignee</th>
<td>webkit-unassigned@lists.webkit.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>mark.lam@apple.com
</td>
</tr></table>
<p>
<div>
<pre>A RegExp has a YarrCodeBlock that has 4 MacroAssemblerCodeRefs for compiled code. If one of these compilations succeeds, RegExp::m_state will be set to JITCode. Subsequently, if RegExp tries to compile another one of these but fails, m_state will be left untouched i.e. it still says JITCode. As a result, when RegExp::match() later tries to execute the non-existant compiled code, it will crash. The fix is to downgrade m_state to ByteCode if RegExp ever fails to compile.
This failure should be rare. We'll do the minimal work here to fix the issue and keep an eye on the perf bots. If perf regresses, we can do some optimization work then.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>