240552 2022-05-17 17:04:13 -0700 WTF::CrashOnOverflow::crash() with /((a{100000000})*b{2100000000})+/.test(); 2022-11-29 11:06:04 -0800 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 msaboff msaboff mark.lam saam tmos4orced webkit-bug-importer oldest_to_newest 1869868 0 msaboff 2022-05-17 17:04:13 -0700 Steps To Reproduce: jsc -e '/((a{100000000})*b{2100000000})+/.test();' Results: 1 0x110094b49 WTFCrash 2 0x1109e2009 WTF::CrashOnOverflow::crash() 3 0x111bf47c9 WTF::CrashOnOverflow::overflowed() 4 0x11065eade WTF::Checked<unsigned int, WTF::CrashOnOverflow>::Checked(WTF::ResultOverflowedTag) 5 0x11065ea3b WTF::Checked<unsigned int, WTF::CrashOnOverflow>::Checked(WTF::ResultOverflowedTag) 6 0x112289fb3 WTF::Checked<WTF::Result<unsigned int, unsigned int>::ResultType, WTF::CrashOnOverflow> WTF::operator+<unsigned int, unsigned int, WTF::CrashOnOverflow>(WTF::Checked<unsigned int, WTF::CrashOnOverflow>, WTF::Checked<unsigned int, WTF::CrashOnOverflow>) 7 0x11228919c JSC::Yarr::YarrGenerator<JSC::Yarr::YarrJITDefaultRegisters>::opCompileParenthesesSubpattern(WTF::Checked<unsigned int, WTF::CrashOnOverflow>, JSC::Yarr::PatternTerm*) 8 0x112287992 JSC::Yarr::YarrGenerator<JSC::Yarr::YarrJITDefaultRegisters>::opCompileAlternative(WTF::Checked<unsigned int, WTF::CrashOnOverflow>, JSC::Yarr::PatternAlternative*) 9 0x1122891ee JSC::Yarr::YarrGenerator<JSC::Yarr::YarrJITDefaultRegisters>::opCompileParenthesesSubpattern(WTF::Checked<unsigned int, WTF::CrashOnOverflow>, JSC::Yarr::PatternTerm*) 10 0x112287992 JSC::Yarr::YarrGenerator<JSC::Yarr::YarrJITDefaultRegisters>::opCompileAlternative(WTF::Checked<unsigned int, WTF::CrashOnOverflow>, JSC::Yarr::PatternAlternative*) 11 0x112281739 JSC::Yarr::YarrGenerator<JSC::Yarr::YarrJITDefaultRegisters>::opCompileBody(JSC::Yarr::PatternDisjunction*) 12 0x11225fb54 JSC::Yarr::YarrGenerator<JSC::Yarr::YarrJITDefaultRegisters>::compile(JSC::Yarr::YarrCodeBlock&) 13 0x11225f936 JSC::Yarr::jitCompile(JSC::Yarr::YarrPattern&, WTF::StringView, JSC::Yarr::CharSize, JSC::VM*, JSC::Yarr::YarrCodeBlock&, JSC::Yarr::JITCompileMode) 14 0x111e505ca JSC::RegExp::compileMatchOnly(JSC::VM*, JSC::Yarr::CharSize) 15 0x111e657ef JSC::RegExp::compileIfNecessaryMatchOnly(JSC::VM&, JSC::Yarr::CharSize) 16 0x111e507e1 JSC::MatchResult JSC::RegExp::matchInline<(JSC::Yarr::MatchFrom)0>(JSC::JSGlobalObject*, JSC::VM&, WTF::String const&, unsigned int) 17 0x111e50744 JSC::RegExp::match(JSC::JSGlobalObject*, WTF::String const&, unsigned int) 18 0x1112c1f3d JSC::RegExpGlobalData::performMatch(JSC::JSGlobalObject*, JSC::RegExp*, JSC::JSString*, WTF::String const&, int) 19 0x1112c1ac4 JSC::RegExpObject::matchInline(JSC::JSGlobalObject*, JSC::JSString*) 20 0x111e59295 JSC::RegExpObject::match(JSC::JSGlobalObject*, JSC::JSString*) 21 0x111288635 JSC::RegExpObject::test(JSC::JSGlobalObject*, JSC::JSString*) 22 0x111e5daf9 JSC::regExpProtoFuncTestFast(JSC::JSGlobalObject*, JSC::CallFrame*) 23 0x5db5c2208038 24 0x110763427 llint_entry 25 0x11073ef0e vmEntryToJavaScript 26 0x1116c2bd2 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) 27 0x1116c22b9 JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::JSGlobalObject*, JSC::JSObject*) 28 0x111aec835 JSC::evaluate(JSC::JSGlobalObject*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) 29 0x10077d1bf runWithOptions(GlobalObject*, CommandLine&, bool&) 30 0x10072d872 jscmain(int, char**)::$_9::operator()(JSC::VM&, GlobalObject*, bool&) const 31 0x1006fb1e6 int runJSC<jscmain(int, char**)::$_9>(CommandLine const&, bool, jscmain(int, char**)::$_9 const&) Regression: I am seeing this on WebKit svn rev 294218 Both Debug and Release builds crash 1869869 1 msaboff 2022-05-17 17:04:23 -0700 <rdar://93347568> 1870055 2 msaboff 2022-05-18 10:18:10 -0700 Pull request: https://github.com/WebKit/WebKit/pull/733 1870080 3 ews-feeder 2022-05-18 11:34:39 -0700 Committed r294411 (250703@main): <https://commits.webkit.org/250703@main> Reviewed commits have been landed. Closing PR #733 and removing active labels.