Closed Bug 6359 Opened 25 years ago Closed 25 years ago

JavaScript regular expression crashes the system

Categories

(Core :: JavaScript Engine, defect, P3)

Product:
Core
Component:
JavaScript Engine
Type:
defect

Tracking

()

Status:
VERIFIED FIXED

People

(Reporter: waldemar, Assigned: rogerl)

Details

Executing the JavaScript regular expression below crashes the system.

/(a*)b\1+/("baaac")

    Waldemar
Assignee: norris → rogerl
Status: NEW → ASSIGNED
QA Contact: cbegle → desale
desale, can you reproduce this and get a Talkback stack trace?
QA Contact: desale → cbegle
i think this is actually a duplicate of
http://scopus/bugsplat/show_bug.cgi?id=344004, and there's a poitner to where
it's crashing there.
Component: JavaScript → Javascript Engine
moving to the "JavaScript Engine" component.
Actually it turns out not to be a duplicate of 344004, this is a bug in handling
quantified empty sub-expressions. I've fixed it in SpiderMonkey140_BRANCH and
Rhino, but the best fix for the trunk would be to wait for the next branch/tip
merge, whenever that is?
Providing Talkback stack trace.
Incident ID: 9597999

Trigger Type:  Program Crash

Trigger Reason:  Stack overflow


Call Stack:    (Signature = JS3250.DLL + 0x26ec5 (0x00506ec5) 80ac8ee3)

   JS3250.DLL + 0x26ec5 (0x00506ec5)



Registers:
EAX: 038f5fe2 EBX: 00000000 ECX: 00000006 EDX: 00000006
ESI: 00000000 EDI: 038f5ee2 ESP: 00672000 EBP: 038f5fe5
EIP: 00506ec5cf pf af zf sf of IF df nt RF vm   IOPL: 0
CS: 016f DS: 0177 SS: 0177 ES: 0177 FS: 10e7 GS: 0000

Stack Dump:
0x00672000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ ................ ]
0x00672010: 00 00 00 00 00 00 00 00 00 00 00 00 A3 77 50 00 [ .............wP. ]
0x00672020: 2C F4 76 00 E2 5F 8F 03 E2 5E 8F 03 E2 5E 8F 03 [ ,.v.._...^...^.. ]
0x00672030: 00 00 00 00 E5 5F 8F 03 00 00 00 00 01 00 00 00 [ ....._.......... ]
0x00672040: 00 00 00 00 00 00 00 00 E9 5F 8F 03 E0 5E 8F 03 [ ........._...^.. ]
0x00672050: 00 00 00 00 A3 77 50 00 2C F4 76 00 03 00 00 00 [ .....wP.,.v..... ]
0x00672060: EA 5E 8F 03 E2 5E 8F 03 00 00 00 00 E5 5F 8F 03 [ .^...^......._.. ]
0x00672070: 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 [ ................ ]
0x00672080: E9 5F 8F 03 E0 5E 8F 03 00 00 00 00 A3 77 50 00 [ ._...^.......wP. ]
0x00672090: 2C F4 76 00 03 00 00 00 EA 5E 8F 03 E2 5E 8F 03 [ ,.v......^...^.. ]
0x006720a0: 00 00 00 00 E5 5F 8F 03 00 00 00 00 01 00 00 00 [ ....._.......... ]
0x006720b0: 00 00 00 00 00 00 00 00 E9 5F 8F 03 E0 5E 8F 03 [ ........._...^.. ]
0x006720c0: 00 00 00 00 A3 77 50 00 2C F4 76 00 03 00 00 00 [ .....wP.,.v..... ]
0x006720d0: EA 5E 8F 03 E2 5E 8F 03 00 00 00 00 E5 5F 8F 03 [ .^...^......._.. ]
0x006720e0: 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 [ ................ ]
0x006720f0: E9 5F 8F 03 E0 5E 8F 03 00 00 00 00 A3 77 50 00 [ ._...^.......wP. ]
0x00672100: 2C F4 76 00 03 00 00 00 EA 5E 8F 03 E2 5E 8F 03 [ ,.v......^...^.. ]
0x00672110: 00 00 00 00 E5 5F 8F 03 00 00 00 00 01 00 00 00 [ ....._.......... ]
0x00672120: 00 00 00 00 00 00 00 00 E9 5F 8F 03 E0 5E 8F 03 [ ........._...^.. ]
0x00672130: 00 00 00 00 A3 77 50 00 2C F4 76 00 03 00 00 00 [ .....wP.,.v..... ]
0x00672140: EA 5E 8F 03 E2 5E 8F 03 00 00 00 00 E5 5F 8F 03 [ .^...^......._.. ]
0x00672150: 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 [ ................ ]
0x00672160: E9 5F 8F 03 E0 5E 8F 03 00 00 00 00 A3 77 50 00 [ ._...^.......wP. ]
0x00672170: 2C F4 76 00 03 00 00 00 EA 5E 8F 03 E2 5E 8F 03 [ ,.v......^...^.. ]
0x00672180: 00 00 00 00 E5 5F 8F 03 00 00 00 00 01 00 00 00 [ ....._.......... ]
0x00672190: 00 00 00 00 00 00 00 00 E9 5F 8F 03 E0 5E 8F 03 [ ........._...^.. ]
0x006721a0: 00 00 00 00 A3 77 50 00 2C F4 76 00 03 00 00 00 [ .....wP.,.v..... ]
0x006721b0: EA 5E 8F 03 E2 5E 8F 03 00 00 00 00 E5 5F 8F 03 [ .^...^......._.. ]
0x006721c0: 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 [ ................ ]
0x006721d0: E9 5F 8F 03 E0 5E 8F 03 00 00 00 00 A3 77 50 00 [ ._...^.......wP. ]
0x006721e0: 2C F4 76 00 03 00 00 00 EA 5E 8F 03 E2 5E 8F 03 [ ,.v......^...^.. ]
0x006721f0: 00 00 00 00 E5 5F 8F 03 00 00 00 00 01 00 00 00 [ ....._.......... ]
0x00672200: 00 00 00 00 00 00 00 00 E9 5F 8F 03 E0 5E 8F 03 [ ........._...^.. ]
0x00672210: 00 00 00 00 A3 77 50 00 2C F4 76 00 03 00 00 00 [ .....wP.,.v..... ]
0x00672220: EA 5E 8F 03 E2 5E 8F 03 00 00 00 00 E5 5F 8F 03 [ .^...^......._.. ]
0x00672230: 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 [ ................ ]
0x00672240: E9 5F 8F 03 E0 5E 8F 03 00 00 00 00 A3 77 50 00 [ ._...^.......wP. ]
0x00672250: 2C F4 76 00 03 00 00 00 EA 5E 8F 03 E2 5E 8F 03 [ ,.v......^...^.. ]
0x00672260: 00 00 00 00 E5 5F 8F 03 00 00 00 00 01 00 00 00 [ ....._.......... ]
0x00672270: 00 00 00 00 00 00 00 00 E9 5F 8F 03 E0 5E 8F 03 [ ........._...^.. ]
0x00672280: 00 00 00 00 A3 77 50 00 2C F4 76 00 03 00 00 00 [ .....wP.,.v..... ]
0x00672290: EA 5E 8F 03 E2 5E 8F 03 00 00 00 00 E5 5F 8F 03 [ .^...^......._.. ]
0x006722a0: 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 [ ................ ]
0x006722b0: E9 5F 8F 03 E0 5E 8F 03 00 00 00 00 A3 77 50 00 [ ._...^.......wP. ]
0x006722c0: 2C F4 76 00 03 00 00 00 EA 5E 8F 03 E2 5E 8F 03 [ ,.v......^...^.. ]
0x006722d0: 00 00 00 00 E5 5F 8F 03 00 00 00 00 01 00 00 00 [ ....._.......... ]
0x006722e0: 00 00 00 00 00 00 00 00 E9 5F 8F 03 E0 5E 8F 03 [ ........._...^.. ]
0x006722f0: 00 00 00 00 A3 77 50 00 2C F4 76 00 03 00 00 00 [ .....wP.,.v..... ]
0x00672300: EA 5E 8F 03 E2 5E 8F 03 00 00 00 00 E5 5F 8F 03 [ .^...^......._.. ]
0x00672310: 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 [ ................ ]
0x00672320: E9 5F 8F 03 E0 5E 8F 03 00 00 00 00 A3 77 50 00 [ ._...^.......wP. ]
0x00672330: 2C F4 76 00 03 00 00 00 EA 5E 8F 03 E2 5E 8F 03 [ ,.v......^...^.. ]
0x00672340: 00 00 00 00 E5 5F 8F 03 00 00 00 00 01 00 00 00 [ ....._.......... ]
0x00672350: 00 00 00 00 00 00 00 00 E9 5F 8F 03 E0 5E 8F 03 [ ........._...^.. ]
0x00672360: 00 00 00 00 A3 77 50 00 2C F4 76 00 03 00 00 00 [ .....wP.,.v..... ]
0x00672370: EA 5E 8F 03 E2 5E 8F 03 00 00 00 00 E5 5F 8F 03 [ .^...^......._.. ]
0x00672380: 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 [ ................ ]
0x00672390: E9 5F 8F 03 E0 5E 8F 03 00 00 00 00 A3 77 50 00 [ ._...^.......wP. ]
0x006723a0: 2C F4 76 00 03 00 00 00 EA 5E 8F 03 E2 5E 8F 03 [ ,.v......^...^.. ]
0x006723b0: 00 00 00 00 E5 5F 8F 03 00 00 00 00 01 00 00 00 [ ....._.......... ]
0x006723c0: 00 00 00 00 00 00 00 00 E9 5F 8F 03 E0 5E 8F 03 [ ........._...^.. ]
0x006723d0: 00 00 00 00 A3 77 50 00 2C F4 76 00 03 00 00 00 [ .....wP.,.v..... ]
0x006723e0: EA 5E 8F 03 E2 5E 8F 03 00 00 00 00 E5 5F 8F 03 [ .^...^......._.. ]
0x006723f0: 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 [ ................ ]
0x00672400: E9 5F 8F 03 E0 5E 8F 03 00 00 00 00 A3 77 50 00 [ ._...^.......wP. ]
0x00672410: 2C F4 76 00 03 00 00 00 EA 5E 8F 03 E2 5E 8F 03 [ ,.v......^...^.. ]
0x00672420: 00 00 00 00 E5 5F 8F 03 00 00 00 00 01 00 00 00 [ ....._.......... ]
0x00672430: 00 00 00 00 00 00 00 00 E9 5F 8F 03 E0 5E 8F 03 [ ........._...^.. ]
0x00672440: 00 00 00 00 A3 77 50 00 2C F4 76 00 03 00 00 00 [ .....wP.,.v..... ]
0x00672450: EA 5E 8F 03 E2 5E 8F 03 00 00 00 00 E5 5F 8F 03 [ .^...^......._.. ]
0x00672460: 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 [ ................ ]
0x00672470: E9 5F 8F 03 E0 5E 8F 03 00 00 00 00 A3 77 50 00 [ ._...^.......wP. ]
0x00672480: 2C F4 76 00 03 00 00 00 EA 5E 8F 03 E2 5E 8F 03 [ ,.v......^...^.. ]
0x00672490: 00 00 00 00 E5 5F 8F 03 00 00 00 00 01 00 00 00 [ ....._.......... ]
0x006724a0: 00 00 00 00 00 00 00 00 E9 5F 8F 03 E0 5E 8F 03 [ ........._...^.. ]
0x006724b0: 00 00 00 00 A3 77 50 00 2C F4 76 00 03 00 00 00 [ .....wP.,.v..... ]
0x006724c0: EA 5E 8F 03 E2 5E 8F 03 00 00 00 00 E5 5F 8F 03 [ .^...^......._.. ]
0x006724d0: 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 [ ................ ]
0x006724e0: E9 5F 8F 03 E0 5E 8F 03 00 00 00 00 A3 77 50 00 [ ._...^.......wP. ]
0x006724f0: 2C F4 76 00 03 00 00 00 EA 5E 8F 03 E2 5E 8F 03 [ ,.v......^...^.. ]
0x00672500: 00 00 00 00 E5 5F 8F 03 00 00 00 00 01 00 00 00 [ ....._.......... ]
0x00672510: 00 00 00 00 00 00 00 00 E9 5F 8F 03 E0 5E 8F 03 [ ........._...^.. ]
0x00672520: 00 00 00 00 A3 77 50 00 2C F4 76 00 03 00 00 00 [ .....wP.,.v..... ]
0x00672530: EA 5E 8F 03 E2 5E 8F 03 00 00 00 00 E5 5F 8F 03 [ .^...^......._.. ]
0x00672540: 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 [ ................ ]
0x00672550: E9 5F 8F 03 E0 5E 8F 03 00 00 00 00 A3 77 50 00 [ ._...^.......wP. ]
0x00672560: 2C F4 76 00 03 00 00 00 EA 5E 8F 03 E2 5E 8F 03 [ ,.v......^...^.. ]
0x00672570: 00 00 00 00 E5 5F 8F 03 00 00 00 00 01 00 00 00 [ ....._.......... ]
0x00672580: 00 00 00 00 00 00 00 00 E9 5F 8F 03 E0 5E 8F 03 [ ........._...^.. ]
0x00672590: 00 00 00 00 A3 77 50 00 2C F4 76 00 03 00 00 00 [ .....wP.,.v..... ]
0x006725a0: EA 5E 8F 03 E2 5E 8F 03 00 00 00 00 E5 5F 8F 03 [ .^...^......._.. ]
0x006725b0: 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 [ ................ ]
0x006725c0: E9 5F 8F 03 E0 5E 8F 03 00 00 00 00 A3 77 50 00 [ ._...^.......wP. ]
0x006725d0: 2C F4 76 00 03 00 00 00 EA 5E 8F 03 E2 5E 8F 03 [ ,.v......^...^.. ]
0x006725e0: 00 00 00 00 E5 5F 8F 03 00 00 00 00 01 00 00 00 [ ....._.......... ]
0x006725f0: 00 00 00 00 00 00 00 00 E9 5F 8F 03 E0 5E 8F 03 [ ........._...^.. ]
0x00672600: 00 00 00 00 A3 77 50 00 2C F4 76 00 03 00 00 00 [ .....wP.,.v..... ]
0x00672610: EA 5E 8F 03 E2 5E 8F 03 00 00 00 00 E5 5F 8F 03 [ .^...^......._.. ]
0x00672620: 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 [ ................ ]
0x00672630: E9 5F 8F 03 E0 5E 8F 03 00 00 00 00 A3 77 50 00 [ ._...^.......wP. ]
0x00672640: 2C F4 76 00 03 00 00 00 EA 5E 8F 03 E2 5E 8F 03 [ ,.v......^...^.. ]
0x00672650: 00 00 00 00 E5 5F 8F 03 00 00 00 00 01 00 00 00 [ ....._.......... ]
0x00672660: 00 00 00 00 00 00 00 00 E9 5F 8F 03 E0 5E 8F 03 [ ........._...^.. ]
0x00672670: 00 00 00 00 A3 77 50 00 2C F4 76 00 03 00 00 00 [ .....wP.,.v..... ]
0x00672680: EA 5E 8F 03 E2 5E 8F 03 00 00 00 00 E5 5F 8F 03 [ .^...^......._.. ]
0x00672690: 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 [ ................ ]
0x006726a0: E9 5F 8F 03 E0 5E 8F 03 00 00 00 00 A3 77 50 00 [ ._...^.......wP. ]
0x006726b0: 2C F4 76 00 03 00 00 00 EA 5E 8F 03 E2 5E 8F 03 [ ,.v......^...^.. ]
0x006726c0: 00 00 00 00 E5 5F 8F 03 00 00 00 00 01 00 00 00 [ ....._.......... ]
0x006726d0: 00 00 00 00 00 00 00 00 E9 5F 8F 03 E0 5E 8F 03 [ ........._...^.. ]
0x006726e0: 00 00 00 00 A3 77 50 00 2C F4 76 00 03 00 00 00 [ .....wP.,.v..... ]
0x006726f0: EA 5E 8F 03 E2 5E 8F 03 00 00 00 00 E5 5F 8F 03 [ .^...^......._.. ]
0x00672700: 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 [ ................ ]
0x00672710: E9 5F 8F 03 E0 5E 8F 03 00 00 00 00 A3 77 50 00 [ ._...^.......wP. ]
0x00672720: 2C F4 76 00 03 00 00 00 EA 5E 8F 03 E2 5E 8F 03 [ ,.v......^...^.. ]
0x00672730: 00 00 00 00 E5 5F 8F 03 00 00 00 00 01 00 00 00 [ ....._.......... ]
0x00672740: 00 00 00 00 00 00 00 00 E9 5F 8F 03 E0 5E 8F 03 [ ........._...^.. ]
0x00672750: 00 00 00 00 A3 77 50 00 2C F4 76 00 03 00 00 00 [ .....wP.,.v..... ]
0x00672760: EA 5E 8F 03 E2 5E 8F 03 00 00 00 00 E5 5F 8F 03 [ .^...^......._.. ]
0x00672770: 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 [ ................ ]
0x00672780: E9 5F 8F 03 E0 5E 8F 03 00 00 00 00 A3 77 50 00 [ ._...^.......wP. ]
0x00672790: 2C F4 76 00 03 00 00 00 EA 5E 8F 03 E2 5E 8F 03 [ ,.v......^...^.. ]
0x006727a0: 00 00 00 00 E5 5F 8F 03 00 00 00 00 01 00 00 00 [ ....._.......... ]
0x006727b0: 00 00 00 00 00 00 00 00 E9 5F 8F 03 E0 5E 8F 03 [ ........._...^.. ]
0x006727c0: 00 00 00 00 A3 77 50 00 2C F4 76 00 03 00 00 00 [ .....wP.,.v..... ]
0x006727d0: EA 5E 8F 03 E2 5E 8F 03 00 00 00 00 E5 5F 8F 03 [ .^...^......._.. ]
0x006727e0: 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 [ ................ ]
0x006727f0: E9 5F 8F 03 E0 5E 8F 03 00 00 00 00 A3 77 50 00 [ ._...^.......wP. ]


Operating System:  Windows 95 4.0 build 67306684

Service Pack:   C

Processor:  Pentium

Processor Speed:  Not Available

Physical Memory:  128 MB
Status: ASSIGNED → RESOLVED
Closed: 25 years ago
Resolution: --- → FIXED
Merge from branch took place, so this is fixed for Monkey now, too.
okay, this is fixed, but i won't mark it verified until i've added a testcase.
Status: RESOLVED → VERIFIED
test is mozilla/js/tests/regexp/regress-6359.js
You need to log in before you can comment on or make changes to this bug.