Bug 46411 - REGRESSION(r67643-r67838): Crash (reproducible): JSC::RegExp::match: with flick.com
Summary: REGRESSION(r67643-r67838): Crash (reproducible): JSC::RegExp::match: with fli...
Status: RESOLVED DUPLICATE of bug 46189
Alias: None
Product: WebKit
Classification: Unclassified
Component: New Bugs (show other bugs)
Version: 528+ (Nightly build)
Hardware: Mac (Intel) OS X 10.6
: P1 Critical
Assignee: Nobody
URL: http://www.flickr.com/photos/tambako/...
Keywords:
Depends on:
Blocks:
 
Reported: 2010-09-23 15:00 PDT by Joe Strzemp
Modified: 2010-09-23 16:21 PDT (History)
2 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Joe Strzemp 2010-09-23 15:00:17 PDT 
Starting with WebKit r67838 a reproducible crash can be seen with:

visit http://www.flickr.com/photos/tambako/5004503919/ 
and then click the Zoom (+) icon which should result in a crash.

The problem started in nightly build r67838 and still exists in current nightly (r68077).
Running Max OS 10.6.4

Top stack trace from r68077:

Thread 0 Crashed:  Dispatch queue: com.apple.main-thread
0   ???                           	0x00002570a91fe5ee 0 + 41165804004846
1   com.apple.JavaScriptCore      	0x00000001008dfedc JSC::RegExp::match(JSC::UString const&, int, WTF::Vector<int, 32ul>*) + 764
2   ???                           	0x00000001ffffffff 0 + 8589934591
Comment 1 Joe Strzemp 2010-09-23 15:04:02 PDT 
Additional version info:  Version 5.0.2 (6533.18.5, r67838)
Comment 2 Joe Strzemp 2010-09-23 16:05:33 PDT 
The following bugfix (applied during this nightly release when the bug first appeared)
looks like a possible suspect for this problem:

Bug 45787 - Yarr JIT code checks BOL (^) each time through loop when in subexpression
Comment 3 Michael Saboff 2010-09-23 16:21:13 PDT 
Believe this is a duplicate of https://bugs.webkit.org/show_bug.cgi?id=46189 which was fixed in http://trac.webkit.org/changeset/68100.

The current top of trunk build works fine with flikr.com.

*** This bug has been marked as a duplicate of bug 46189 ***