Bug 175903

Summary:

REGRESSION (r221052): DumpRenderTree crashed in com.apple.JavaScriptCore: JSC::Yarr::YarrCodeBlock::execute + 137

Product:

WebKit

Reporter:

Michael Saboff <msaboff>

Component:

JavaScriptCore

Assignee:

Michael Saboff <msaboff>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

buildbot, commit-queue, keith_miller, mark.lam, saam, webkit-bug-importer

Priority:

Keywords:

InRadar

Version:

Other

Hardware:

Unspecified

OS:

Unspecified

Attachments:

Description	Flags
Patch	none

Description Michael Saboff 2017-08-23 13:26:23 PDT

Crashing in code generated by generateCharacterClassGreedy() with something like "a\u{10410}\u{10410}b".match(/a(\u{10410}*)bc|a(\u{10410}*)b/ui).

Looks like we increment "count" before checking is we are at the end of the string.

Comment 1 Michael Saboff 2017-08-23 13:26:46 PDT

<rdar://problem/34035972>

Comment 2 Michael Saboff 2017-08-23 14:04:48 PDT

Created attachment 318914 [details]
Patch

Comment 3 Saam Barati 2017-08-23 14:55:03 PDT

Comment on attachment 318914 [details]
Patch

r=me

Comment 4 WebKit Commit Bot 2017-08-23 15:24:34 PDT

Comment on attachment 318914 [details]
Patch

Clearing flags on attachment: 318914

Committed r221111: <http://trac.webkit.org/changeset/221111>

Comment 5 WebKit Commit Bot 2017-08-23 15:24:35 PDT

All reviewed patches have been landed.  Closing bug.