Bug 46411
| Summary: | REGRESSION(r67643-r67838): Crash (reproducible): JSC::RegExp::match: with flick.com | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Joe Strzemp <maccinema> |
| Component: | New Bugs | Assignee: | Nobody <webkit-unassigned> |
| Status: | RESOLVED DUPLICATE | ||
| Severity: | Critical | CC: | barraclough, msaboff |
| Priority: | P1 | ||
| Version: | 528+ (Nightly build) | ||
| Hardware: | Mac (Intel) | ||
| OS: | OS X 10.6 | ||
| URL: | http://www.flickr.com/photos/tambako/5004503919/ | ||
Joe Strzemp
Starting with WebKit r67838 a reproducible crash can be seen with:
visit http://www.flickr.com/photos/tambako/5004503919/
and then click the Zoom (+) icon which should result in a crash.
The problem started in nightly build r67838 and still exists in current nightly (r68077).
Running Max OS 10.6.4
Top stack trace from r68077:
Thread 0 Crashed: Dispatch queue: com.apple.main-thread
0 ??? 0x00002570a91fe5ee 0 + 41165804004846
1 com.apple.JavaScriptCore 0x00000001008dfedc JSC::RegExp::match(JSC::UString const&, int, WTF::Vector<int, 32ul>*) + 764
2 ??? 0x00000001ffffffff 0 + 8589934591
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Joe Strzemp
Additional version info: Version 5.0.2 (6533.18.5, r67838)
Joe Strzemp
The following bugfix (applied during this nightly release when the bug first appeared)
looks like a possible suspect for this problem:
Bug 45787 - Yarr JIT code checks BOL (^) each time through loop when in subexpression
Michael Saboff
Believe this is a duplicate of https://bugs.webkit.org/show_bug.cgi?id=46189 which was fixed in http://trac.webkit.org/changeset/68100.
The current top of trunk build works fine with flikr.com.
*** This bug has been marked as a duplicate of bug 46189 ***