46411 2010-09-23 15:00:17 -0700 REGRESSION(r67643-r67838): Crash (reproducible): JSC::RegExp::match: with flick.com 2010-09-23 16:21:13 -0700 1 1 1 Unclassified WebKit New Bugs 528+ (Nightly build) Mac (Intel) OS X 10.6 RESOLVED DUPLICATE 46189 http://www.flickr.com/photos/tambako/5004503919/ P1 Critical --- 0 maccinema webkit-unassigned barraclough msaboff oldest_to_newest 283986 0 maccinema 2010-09-23 15:00:17 -0700 Starting with WebKit r67838 a reproducible crash can be seen with: visit http://www.flickr.com/photos/tambako/5004503919/ and then click the Zoom (+) icon which should result in a crash. The problem started in nightly build r67838 and still exists in current nightly (r68077). Running Max OS 10.6.4 Top stack trace from r68077: Thread 0 Crashed: Dispatch queue: com.apple.main-thread 0 ??? 0x00002570a91fe5ee 0 + 41165804004846 1 com.apple.JavaScriptCore 0x00000001008dfedc JSC::RegExp::match(JSC::UString const&, int, WTF::Vector<int, 32ul>*) + 764 2 ??? 0x00000001ffffffff 0 + 8589934591 283991 1 maccinema 2010-09-23 15:04:02 -0700 Additional version info: Version 5.0.2 (6533.18.5, r67838) 284063 2 maccinema 2010-09-23 16:05:33 -0700 The following bugfix (applied during this nightly release when the bug first appeared) looks like a possible suspect for this problem: Bug 45787 - Yarr JIT code checks BOL (^) each time through loop when in subexpression 284070 3 msaboff 2010-09-23 16:21:13 -0700 Believe this is a duplicate of https://bugs.webkit.org/show_bug.cgi?id=46189 which was fixed in http://trac.webkit.org/changeset/68100. The current top of trunk build works fine with flikr.com. *** This bug has been marked as a duplicate of bug 46189 ***