RESOLVED DUPLICATE of bug 4618946411
REGRESSION(r67643-r67838): Crash (reproducible): JSC::RegExp::match: with flick.com 
https://bugs.webkit.org/show_bug.cgi?id=46411
Summary REGRESSION(r67643-r67838): Crash (reproducible): JSC::RegExp::match: with fli...
Joe Strzemp
Reported 2010-09-23 15:00:17 PDT
Starting with WebKit r67838 a reproducible crash can be seen with: visit http://www.flickr.com/photos/tambako/5004503919/ and then click the Zoom (+) icon which should result in a crash. The problem started in nightly build r67838 and still exists in current nightly (r68077). Running Max OS 10.6.4 Top stack trace from r68077: Thread 0 Crashed: Dispatch queue: com.apple.main-thread 0 ??? 0x00002570a91fe5ee 0 + 41165804004846 1 com.apple.JavaScriptCore 0x00000001008dfedc JSC::RegExp::match(JSC::UString const&, int, WTF::Vector<int, 32ul>*) + 764 2 ??? 0x00000001ffffffff 0 + 8589934591
Attachments
Add attachment proposed patch, testcase, etc.
Joe Strzemp
Comment 1 2010-09-23 15:04:02 PDT
Additional version info: Version 5.0.2 (6533.18.5, r67838)
Joe Strzemp
Comment 2 2010-09-23 16:05:33 PDT
The following bugfix (applied during this nightly release when the bug first appeared) looks like a possible suspect for this problem: Bug 45787 - Yarr JIT code checks BOL (^) each time through loop when in subexpression
Michael Saboff
Comment 3 2010-09-23 16:21:13 PDT
Believe this is a duplicate of https://bugs.webkit.org/show_bug.cgi?id=46189 which was fixed in http://trac.webkit.org/changeset/68100. The current top of trunk build works fine with flikr.com. *** This bug has been marked as a duplicate of bug 46189 ***
Note You need to log in before you can comment on or make changes to this bug.