Bug 8870 - Crash typing in Yahoo auto-complete widget.
Summary: Crash typing in Yahoo auto-complete widget.
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 420+
Hardware: Mac OS X 10.4
: P1 Normal
Assignee: Alexey Proskuryakov
URL: http://developer.yahoo.com/yui/exampl...
Keywords:
Depends on:
Blocks:
 
Reported: 2006-05-12 05:54 PDT by Alexey Proskuryakov
Modified: 2006-05-17 10:21 PDT (History)
0 users

See Also:


Attachments
test case (will crash!) (96.90 KB, text/html)
2006-05-13 01:46 PDT, Alexey Proskuryakov
no flags Details
proposed fix (98.99 KB, patch)
2006-05-13 06:20 PDT, Alexey Proskuryakov
darin: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Alexey Proskuryakov 2006-05-12 05:54:04 PDT
Nightly r14317 crashes when typing in the Yahoo auto-complete widget. Stock 10.4.6 Safari seems to be more stable, but unless I'm mistaken, it has frozen with the same stack trace for me once. Probably, just a matter of chance.

Thread 0 Crashed:
0   com.apple.JavaScriptCore 	0x0016d664 match + 4
1   com.apple.JavaScriptCore 	0x0016e3a0 match + 3392
2   com.apple.JavaScriptCore 	0x0016d7cc match + 364
3   com.apple.JavaScriptCore 	0x0016e3a0 match + 3392
4   com.apple.JavaScriptCore 	0x0016f0ac match + 6732
5   com.apple.JavaScriptCore 	0x0016d7cc match + 364
6   com.apple.JavaScriptCore 	0x0016e148 match + 2792
7   com.apple.JavaScriptCore 	0x0016d7cc match + 364
8   com.apple.JavaScriptCore 	0x0016e3a0 match + 3392
9   com.apple.JavaScriptCore 	0x0016d7cc match + 364
10  com.apple.JavaScriptCore 	0x0016e3a0 match + 3392
11  com.apple.JavaScriptCore 	0x0016e3c8 match + 3432
12  com.apple.JavaScriptCore 	0x0016f0ac match + 6732
...
Comment 1 Alexey Proskuryakov 2006-05-13 01:46:52 PDT
Created attachment 8277 [details]
test case (will crash!)
Comment 2 Alexey Proskuryakov 2006-05-13 06:20:23 PDT
Created attachment 8281 [details]
proposed fix

This is a stack overflow, and it has nothing to do with how WebKit invokes PCRE - it's also reproducible with pcretest, versions 6.1 (used in WebKit) and 6.6 (latest).

PCRE has a mode for systems with limited stack, where it no longer uses recursion (at the cost of some performance, reportedly). There are also some limits that can make deep recursion fail with an error, but I don't see how we could use them, as long as we want to work with Yahoo widgets.

This patch just defines NO_RECURSE. There is no noticeable delay when opening the test.
Comment 3 Darin Adler 2006-05-13 08:41:03 PDT
Comment on attachment 8281 [details]
proposed fix

r=me
Comment 4 Alexey Proskuryakov 2006-05-17 10:21:08 PDT
Committed revision 14435.