Bug 52675 - [RegexFuzz] Crash in generated code
Summary: [RegexFuzz] Crash in generated code
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: PC OS X 10.5
: P2 Normal
Assignee: Michael Saboff
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2011-01-18 15:52 PST by Oliver Hunt
Modified: 2011-01-19 09:58 PST (History)
5 users (show)

See Also:


Attachments
Regression: Simple nested backtrack hangs (4.91 KB, patch)
2011-01-19 09:46 PST, Michael Saboff
darin: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Oliver Hunt 2011-01-18 15:52:35 PST
testRegexp("(?!(?:\\3+(s+?)))", "gy", ["==","SSS","","","","","","11","=","11SSS"])

Reduced to
/(?!(?:\1+s))/.test('SSS')
Comment 1 Geoffrey Garen 2011-01-18 18:08:46 PST
<rdar://problem/8882994>
Comment 2 Michael Saboff 2011-01-19 09:46:53 PST
Created attachment 79436 [details]
Regression: Simple nested backtrack hangs

The changeset (r76076) for https://bugs.webkit.org/show_bug.cgi?id=52540 broke simple backtracking in some cases.  Reworked that change to link both jumps and labels.
Comment 3 Michael Saboff 2011-01-19 09:58:45 PST
Committed r76133: <http://trac.webkit.org/changeset/76133>