Bug 26368 – Crashes in JSC::RegExp::match()

• Component: JavaScriptCore
• Status: RESOLVED DUPLICATE

[Enrico Tröger]

I can easily trigger crashes in Webkit when opening sites like http://validator.w3.org or http://www.linuxquestions.org/questions/.

Tested with Midori and GtkLauncher, Webkit r44649.

[Enrico Tröger]

Created attachment 31230 [details]
Backtrace of Midori and http://validator.w3.org

[Enrico Tröger]

Created attachment 31231 [details]
Backtrace of GtkLauncher with http://www.linuxquestions.org/questions/

[Dan Winship]

Backtrace of epiphany and http://www.apple.com/retail/locator/index.html

#0  0x00007ffff66c53c5 in JSC::RegExp::match (this=<value optimized out>)
   from /opt/jhbuild/lib64/libwebkit-1.0.so.2
#1  0x00007ffff66c543e in JSC::RegExpConstructor::performMatch (
    this=0x7fffe661dd40, r=0x7fffe6949dc8, s=@0x7fffffffb590, startOffset=78, 
    position=@0x7fffe66d8df8, length=@0x6, ovector=0x0)
    at JavaScriptCore/runtime/RegExpConstructor.cpp:125
#2  0x00007ffff671b918 in JSC::stringProtoFuncMatch(struct JSC::ExecState *, struct JSC::JSObject *, JSC::JSValue, const struct JSC::ArgList &) (
    exec=<value optimized out>, thisValue=<value optimized out>, 
    args=<value optimized out>)
    at JavaScriptCore/runtime/StringPrototype.cpp:481
#3  0x00007ffff75a32e4 in ?? ()
#4  0x00007fffe6a36488 in ?? ()
#5  0x0000000000000001 in ?? ()
#6  0x0000000000000000 in ?? ()

Probably the same bug as bug 26390. Maybe the same as bug 26553 and bug 26116. Possibly the same as bug 25819?

Given that the Apple Store locator triggers this bug, I am sure Apple is losing millions of dollars in revenue due to all of the people running unstable WebKit on x86_64 who are unable to locate their nearest Apple Store, so you should fix this right away. ;-)

[Jan Alonzo]

(In reply to comment #3)
> Backtrace of epiphany and http://www.apple.com/retail/locator/index.html
> 
> Probably the same bug as bug 26390. Maybe the same as bug 26553 and bug 26116.
> Possibly the same as bug 25819?
> 
> Given that the Apple Store locator triggers this bug, I am sure Apple is losing
> millions of dollars in revenue due to all of the people running unstable WebKit
> on x86_64 who are unable to locate their nearest Apple Store, so you should fix
> this right away. ;-)

When you say unstable you mean Debian unstable? Have you tried the Release build? I can't reproduce this with a release build (ToT WebKit, i.e., I can visit the Apple store locator and validator.w3.org just fine).

> 

[Dan Winship]

I meant unstable WebKit, which I guess you call ToT here. (Distro-wise I'm on Fedora 11, which means I'm using gcc 4.4, which someone suggested might be relevant in one of the other bugs.)

Also, I should have been clearer that this is x86_64 only.

[Enrico Tröger]

It seems this crasher got fixed in the meantime.
At least the sites I referenced do work fine now with a recent Webkit build (SVN r45548). The Apple Store locator also doesn't crash here anymore even though the search button doesn't work at all but that's another story.

Btw, I'm using Debian's 4.3.3-10, so at least this report is not gcc 4.4 specific but anyway, as I said it seems to be fixed.

Dan, can you confirm?

[Dan Winship]

hm. it still crashes for me in basically the same place as before with r45557

[Dan Winship]

Er... hm... no, it seems to work now. (Maybe I accidentally did a svn up after building and so was confused about what svn revision I had?)

So yeah, this seems to be fixed, presumably as an unintended side effect of bug 26957.

[Adam Miller]

https://bugzilla.redhat.com/show_bug.cgi?id=533528

It would appear this issue is being noticed in Fedora 12 x86_64 running Midori 0.2.2 using WebKitGTK version 1.1.15.4

I noticed someone mentioned that this appears to be fixed in the SVN r45548, was the code causing this issue identified so that it can be backported to current stable?

-AdamM

[Gavin Barraclough]

Marking as a dupe based on comments below; please reopen if this bugstill reproduces.

*** This bug has been marked as a duplicate of bug 26957 ***