Bug 54978 – REGRESSION (r72489): TinyMCE not working in nightlies

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Alexander Romanovich]

I don't know when this started, but it seems to have broken some time ago. The attached TinyMCE example page (from their site) works in Safari release but not in WebKit.

In Safari, the content inside the box is rendered. In the nightlies, the raw HTML source is displayed. My concern of course is making sure that the breakage doesn't find its way into a Safari release.

[Alexey Proskuryakov]

<rdar://problem/9039914>

[Andy Estes]

This is due to <http://trac.webkit.org/changeset/72489>.

[Ryosuke Niwa]

Could you make a reduction for this bug?  In particular, it's not clear what javascript isn't ran properly.  It'll be much easier for us to debug if we had 10 line html/javascript that demonstrates the bug.  Also, this bug might be a duplicate of https://bugs.webkit.org/show_bug.cgi?id=52106.

[Alexander Romanovich]

This is the simplest test case I know how to make, not being associated with TinyMCE in any way:

http://www.sirensclef.com/webkit/tinymce/

It will render the contents of the textarea in Safari release, but show (broken) source in nightlies. If you need further reductions, you could contact the TinyMCE folks directly, so that they know about this bug and can help diagnose it further.

[Michael Saboff]

This bug is caused by improper handling of the regular expression /<(?:(?:!--([\w\W]*?)-->)|(?:!\[CDATA\[([\w\W]*?)\]\]>)|(?:!DOCTYPE([\w\W]*?)>)|(?:\?([^\s\/<>]+) ?([\w\W]*?)[?/]>)|(?:\/([^>]+)>)|(?:([^\s\/<>]+)\s*((?:[^"'>]+(?:(?:"[^"]*")|(?:'[^']*')|[^>]*))*)>))/

This regular expression appears to be looking for the contents inside <> HTML constructs.

The failing regular expression has been reduced to: /<((ABC>)|(\/([^>]+)>)|(([^>]+)>))/
with the (ABC>) added to make it fail.

The bug appears to be an issue with the "Beginning Characters" optimization added that seems to have a problem in the YARR interpreter.  When the beginning characters optimization is disabled, the failing page operates correctly.  The reason the (ABC>) was added to the above expression was that without that alternative, the beginning characters optimization worked correctly.  It seems that the bug has to do with how far down the alternatives the begin characters setup code analyzes when creating the data for the  optimization to use at runtime.

I will create a patch that will disable the beginning characters optimization and then create a new defect to address the beginning characters bug.

[Michael Saboff]

Created attachment 84251 [details]
Patch to temporarily disable begin characters optimization

[Darin Adler]

Comment on attachment 84251 [details]
Patch to temporarily disable begin characters optimization

OK.

[Michael Saboff]

Committed r80018: <http://trac.webkit.org/changeset/80018>

[Alexey Proskuryakov]

No regression test?

[Darin Adler]

(In reply to comment #9)
> No regression test?

I think the intent is to add the test when we turn the optimization back on, but I agree that it would be good to add the test now.

[Michael Saboff]

*** Bug 55520 has been marked as a duplicate of this bug. ***

[Ryosuke Niwa]

*** Bug 52106 has been marked as a duplicate of this bug. ***