Bug 52540 – Regression: Some text-only e-mails causes 100% cpu load

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Alexander Zautke]

Created attachment 79105 [details]
Screenshot of a top command in terminal

1. I opened a text-only,not a html-email, in MobileMe.
2. WebKit locks down completly (100% cpu).
3. If you try it in the MiniBrowser for WebKit2,WebProcess caues the 100% cpu load (see attachment).

[Alexey Proskuryakov]

Could you please attach a sample of both MiniBrowser and WebProcess processes, taken with Activity Monitor application?

Without a reproducible case or at least samples, there is nothing we can do here.

[Alexander Zautke]

Created attachment 79156 [details]
Sample of MiniBrowser taken with Activity Monitor

[Alexander Zautke]

Created attachment 79157 [details]
Sample of WebProcess taken with Activity Monitor

[Alexey Proskuryakov]

In JSC::RegExp::match(). It's strange if this doesn't happen in WebKit nightlies, there shouldn't be any difference in  JavaScriptCore behavior in WebKit2.

[Alexander Zautke]

Created attachment 79181 [details]
Sample of WebKit taken with Activity Monitor

[Geoffrey Garen]

<rdar://problem/8875432>

[Michael Saboff]

I am unable to reproduce with either ToT or nightly build with Safari.  Please provide a sample email that will cause the problem.

[Alexander Zautke]

For example, I can not open the e-mail you get from bugzilla, if someone comment on this bug.

[Alexey Proskuryakov]

Confirmed with r75891! I forwarded this e-mail to my MobileMe account with Mail.app's Message->Redirect menu item.

[Michael Saboff]

Got it!.  The problem RE is /(([\w\-]+:\/\/?|www[.])[^\s()<>]+(?:([\w\d]+)|([^\[:punct:\]\s()<>\W]|\/)))/.

I have reduced it to: /([^\s]+(?:([\w]+)|([^\W])))/ with the input of:
    "https://bugs.webkit.org/show_bug.cgi?id=52540\n"

The trailing 'n' is needed for the hang.

Debugging now.....

[Michael Saboff]

Created attachment 79342 [details]
Patch to attach nested sub parens to outer non-capturing parens

Directly use backtrack label with parentheses nested under a non-capturing parentheses.  Also linked current parentheses tail code object for possible parens nested within a non-capturing parentheses.

[Oliver Hunt]

*** Bug 52662 has been marked as a duplicate of this bug. ***

[Michael Saboff]

Committed r76076: <http://trac.webkit.org/changeset/76076>