28353 2009-08-16 02:19:54 -0700 yarr/RegexInterpreter.cpp crashes on ./ecma_2/RegExp/exec-002.js 2009-08-16 06:16:17 -0700 1 1 1 Unclassified WebKit JavaScriptCore 528+ (Nightly build) PC OS X 10.5 RESOLVED FIXED P2 Normal --- 1 zecke webkit-unassigned oldest_to_newest 140547 0 zecke 2009-08-16 02:19:54 -0700 Valgrind is showing a invalid read in popParenthesesDisjunctionContext. 140548 1 34923 zecke 2009-08-16 02:27:05 -0700 Created attachment 34923 2009-08-16 Holger Hans Peter Freyther <zecke@selfish.org> Reviewed by NOBODY (OOPS!). Fix crash on ./ecma_2/RegExp/exec-002.js. https://bugs.webkit.org/show_bug.cgi?id=28353 Change the order of freeParenthesesDisjunctionContext and popParenthesesDisjunctionContext on all call sites as the pop method is accessing backTrack->lastContext which is the context that is about to be freed. * yarr/RegexInterpreter.cpp: (JSC::Yarr::Interpreter::parenthesesDoBacktrack): (JSC::Yarr::Interpreter::backtrackParentheses): --- 2 files changed, 19 insertions(+), 3 deletions(-) 140550 2 34923 mrowe 2009-08-16 02:43:09 -0700 Comment on attachment 34923 2009-08-16 Holger Hans Peter Freyther <zecke@selfish.org> r=me 140556 3 zecke 2009-08-16 06:16:17 -0700 Landed in r47338. 34923 2009-08-16 02:27:05 -0700 2009-08-16 02:43:09 -0700 2009-08-16 Holger Hans Peter Freyther <zecke@selfish.org> bug-28353-20090816112635.patch text/plain 2201 zecke ZGlmZiAtLWdpdCBhL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZyBiL0phdmFTY3JpcHRDb3JlL0No YW5nZUxvZwppbmRleCBjOTEzN2MzLi4wMWU4ZDk2IDEwMDY0NAotLS0gYS9KYXZhU2NyaXB0Q29y ZS9DaGFuZ2VMb2cKKysrIGIvSmF2YVNjcmlwdENvcmUvQ2hhbmdlTG9nCkBAIC0yLDYgKzIsMjIg QEAKIAogICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KIAorICAgICAgICBGaXgg Y3Jhc2ggb24gLi9lY21hXzIvUmVnRXhwL2V4ZWMtMDAyLmpzLgorICAgICAgICBodHRwczovL2J1 Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjgzNTIKKworICAgICAgICBDaGFuZ2UgdGhl IG9yZGVyIG9mIGZyZWVQYXJlbnRoZXNlc0Rpc2p1bmN0aW9uQ29udGV4dCBhbmQKKyAgICAgICAg cG9wUGFyZW50aGVzZXNEaXNqdW5jdGlvbkNvbnRleHQgb24gYWxsIGNhbGwgc2l0ZXMgYXMgdGhl IHBvcAorICAgICAgICBtZXRob2QgaXMgYWNjZXNzaW5nIGJhY2tUcmFjay0+bGFzdENvbnRleHQg d2hpY2ggaXMgdGhlIGNvbnRleHQKKyAgICAgICAgdGhhdCBpcyBhYm91dCB0byBiZSBmcmVlZC4K KworICAgICAgICAqIHlhcnIvUmVnZXhJbnRlcnByZXRlci5jcHA6CisgICAgICAgIChKU0M6Ollh cnI6OkludGVycHJldGVyOjpwYXJlbnRoZXNlc0RvQmFja3RyYWNrKToKKyAgICAgICAgKEpTQzo6 WWFycjo6SW50ZXJwcmV0ZXI6OmJhY2t0cmFja1BhcmVudGhlc2VzKToKKworMjAwOS0wOC0xNiAg SG9sZ2VyIEhhbnMgUGV0ZXIgRnJleXRoZXIgIDx6ZWNrZUBzZWxmaXNoLm9yZz4KKworICAgICAg ICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKwogICAgICAgICBodHRwczovL2J1Z3Mud2Vi a2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjgzNTIKIAogICAgICAgICBGaXggY29kaW5nIHN0eWxl IHZpb2xhdGlvbnMuIFVzZSBtXyBmb3IgQysrIGNsYXNzIG1lbWJlcnMuIFJlbW92ZQpkaWZmIC0t Z2l0IGEvSmF2YVNjcmlwdENvcmUveWFyci9SZWdleEludGVycHJldGVyLmNwcCBiL0phdmFTY3Jp cHRDb3JlL3lhcnIvUmVnZXhJbnRlcnByZXRlci5jcHAKaW5kZXggZjEzODFjMy4uYWFmZWEzYyAx MDA2NDQKLS0tIGEvSmF2YVNjcmlwdENvcmUveWFyci9SZWdleEludGVycHJldGVyLmNwcAorKysg Yi9KYXZhU2NyaXB0Q29yZS95YXJyL1JlZ2V4SW50ZXJwcmV0ZXIuY3BwCkBAIC02MDgsOCArNjA4 LDggQEAgcHVibGljOgogICAgICAgICAgICAgICAgIHJldHVybiB0cnVlOwogCiAgICAgICAgICAg ICByZXNldE1hdGNoZXModGVybSwgY29udGV4dCk7Ci0gICAgICAgICAgICBmcmVlUGFyZW50aGVz ZXNEaXNqdW5jdGlvbkNvbnRleHQoY29udGV4dCk7CiAgICAgICAgICAgICBwb3BQYXJlbnRoZXNl c0Rpc2p1bmN0aW9uQ29udGV4dChiYWNrVHJhY2spOworICAgICAgICAgICAgZnJlZVBhcmVudGhl c2VzRGlzanVuY3Rpb25Db250ZXh0KGNvbnRleHQpOwogICAgICAgICB9CiAKICAgICAgICAgcmV0 dXJuIGZhbHNlOwpAQCAtOTEwLDggKzkxMCw4IEBAIHB1YmxpYzoKICAgICAgICAgICAgICAgICB9 CiAgICAgICAgICAgICB9IGVsc2UgewogICAgICAgICAgICAgICAgIHJlc2V0TWF0Y2hlcyh0ZXJt LCBjb250ZXh0KTsKLSAgICAgICAgICAgICAgICBmcmVlUGFyZW50aGVzZXNEaXNqdW5jdGlvbkNv bnRleHQoY29udGV4dCk7CiAgICAgICAgICAgICAgICAgcG9wUGFyZW50aGVzZXNEaXNqdW5jdGlv bkNvbnRleHQoYmFja1RyYWNrKTsKKyAgICAgICAgICAgICAgICBmcmVlUGFyZW50aGVzZXNEaXNq dW5jdGlvbkNvbnRleHQoY29udGV4dCk7CiAgICAgICAgICAgICB9CiAKICAgICAgICAgICAgIGlm IChiYWNrVHJhY2stPm1hdGNoQW1vdW50KSB7CkBAIC05NDksOCArOTQ5LDggQEAgcHVibGljOgog CiAgICAgICAgICAgICAgICAgLy8gcG9wIGEgbWF0Y2ggb2ZmIHRoZSBzdGFjawogICAgICAgICAg ICAgICAgIHJlc2V0TWF0Y2hlcyh0ZXJtLCBjb250ZXh0KTsKLSAgICAgICAgICAgICAgICBmcmVl UGFyZW50aGVzZXNEaXNqdW5jdGlvbkNvbnRleHQoY29udGV4dCk7CiAgICAgICAgICAgICAgICAg cG9wUGFyZW50aGVzZXNEaXNqdW5jdGlvbkNvbnRleHQoYmFja1RyYWNrKTsKKyAgICAgICAgICAg ICAgICBmcmVlUGFyZW50aGVzZXNEaXNqdW5jdGlvbkNvbnRleHQoY29udGV4dCk7CiAgICAgICAg ICAgICB9CiAKICAgICAgICAgICAgIHJldHVybiBmYWxzZTs=