Bug 8870

Summary:

Crash typing in Yahoo auto-complete widget.

Product:

WebKit

Reporter:

Alexey Proskuryakov <ap>

Component:

JavaScriptCore

Assignee:

Alexey Proskuryakov <ap>

Status:

RESOLVED FIXED

Severity:

Normal

Priority:

Version:

420+

Hardware:

Mac

OS:

OS X 10.4

URL:

http://developer.yahoo.com/yui/examples/autocomplete/ysearch_json.html

Attachments:

Description	Flags
test case (will crash!)	none
proposed fix	darin: review+

Alexey Proskuryakov

Reported 2006-05-12 05:54:04 PDT

Nightly r14317 crashes when typing in the Yahoo auto-complete widget. Stock 10.4.6 Safari seems to be more stable, but unless I'm mistaken, it has frozen with the same stack trace for me once. Probably, just a matter of chance. Thread 0 Crashed: 0 com.apple.JavaScriptCore 0x0016d664 match + 4 1 com.apple.JavaScriptCore 0x0016e3a0 match + 3392 2 com.apple.JavaScriptCore 0x0016d7cc match + 364 3 com.apple.JavaScriptCore 0x0016e3a0 match + 3392 4 com.apple.JavaScriptCore 0x0016f0ac match + 6732 5 com.apple.JavaScriptCore 0x0016d7cc match + 364 6 com.apple.JavaScriptCore 0x0016e148 match + 2792 7 com.apple.JavaScriptCore 0x0016d7cc match + 364 8 com.apple.JavaScriptCore 0x0016e3a0 match + 3392 9 com.apple.JavaScriptCore 0x0016d7cc match + 364 10 com.apple.JavaScriptCore 0x0016e3a0 match + 3392 11 com.apple.JavaScriptCore 0x0016e3c8 match + 3432 12 com.apple.JavaScriptCore 0x0016f0ac match + 6732 ...

Attachments
test case (will crash!) (96.90 KB, text/html) 2006-05-13 01:46 PDT, Alexey Proskuryakov	no flags	Details
proposed fix (98.99 KB, patch) 2006-05-13 06:20 PDT, Alexey Proskuryakov	darin: review+	Details Formatted Diff Diff
View All Add attachment proposed patch, testcase, etc.

Alexey Proskuryakov

Comment 1 2006-05-13 01:46:52 PDT

Created attachment 8277 [details] test case (will crash!)

Alexey Proskuryakov

Comment 2 2006-05-13 06:20:23 PDT

Created attachment 8281 [details] proposed fix This is a stack overflow, and it has nothing to do with how WebKit invokes PCRE - it's also reproducible with pcretest, versions 6.1 (used in WebKit) and 6.6 (latest). PCRE has a mode for systems with limited stack, where it no longer uses recursion (at the cost of some performance, reportedly). There are also some limits that can make deep recursion fail with an error, but I don't see how we could use them, as long as we want to work with Yahoo widgets. This patch just defines NO_RECURSE. There is no noticeable delay when opening the test.

Darin Adler

Comment 3 2006-05-13 08:41:03 PDT

Comment on attachment 8281 [details] proposed fix r=me

Alexey Proskuryakov

Comment 4 2006-05-17 10:21:08 PDT

Committed revision 14435.

Note You need to log in before you can comment on or make changes to this bug.