Bug 28353 – yarr/RegexInterpreter.cpp crashes on ./ecma_2/RegExp/exec-002.js

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Holger Freyther]

Valgrind is showing a invalid read in popParenthesesDisjunctionContext.

[Holger Freyther]

Created attachment 34923 [details]
2009-08-16  Holger Hans Peter Freyther  <[e-mail]>

Reviewed by NOBODY (OOPS!).

Fix crash on ./ecma_2/RegExp/exec-002.js.
https://bugs.webkit.org/show_bug.cgi?id=28353

Change the order of freeParenthesesDisjunctionContext and
popParenthesesDisjunctionContext on all call sites as the pop
method is accessing backTrack->lastContext which is the context
that is about to be freed.

* yarr/RegexInterpreter.cpp:
(JSC::Yarr::Interpreter::parenthesesDoBacktrack):
(JSC::Yarr::Interpreter::backtrackParentheses):
---
 2 files changed, 19 insertions(+), 3 deletions(-)

[Mark Rowe (bdash)]

Comment on attachment 34923 [details]
2009-08-16  Holger Hans Peter Freyther  <[e-mail]>

r=me

[Holger Freyther]

Landed in r47338.