irregexp: hang without slow script dialog while executing regular expression

RESOLVED FIXED in mozilla32

Status

()

Core
JavaScript Engine
RESOLVED FIXED
3 years ago
3 years ago

People

(Reporter: Alice0775 White, Assigned: bhackett)

Tracking

({hang, regression})

32 Branch
mozilla32
hang, regression
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(firefox29 unaffected, firefox30 unaffected, firefox31 unaffected, firefox32- affected, firefox-esr24 unaffected)

Details

Attachments

(1 attachment)

(Reporter)

Description

3 years ago
+++ This bug was initially created as a clone of Bug #998785 +++

Browser hang up when evaluete the following regular expression.

/<([\w\:]+)((?:[\s\w:=]+|'[^']*'|"[^"]*")*)(?:\/>|>([\d,]*)<\/[^>]+>)/g.test("<rdf:Description rdf:about=\"\"            xmlns:test=\"http://test.com/pdf/1.3/\">2,<t>3,</t></rdf:Description>")

Steps To Reproduce:
1. Open "Error Console" (devtools.errorconsole.enabled = true), OR "Browser Console"
2. Evaluate the above code.

Actual Results:
Browser hang up

Expected Results:
Browser should not hang up.
This isn't related to the Yarr issues: it only happens in builds from after the switch to V8's irregexp engine.

Additionally, executing the same code in the Chrome devtools also causes a hang of the content process, so it seems to happen inside irregexp itself.

Reported upstream at https://code.google.com/p/v8/issues/detail?id=3349.
Blocks: 976446
No longer depends on: 998785
Flags: needinfo?(bhackett1024)
Summary: Hang up while executing regular expression → irregexp: hang without slow script dialog while executing regular expression
(Assignee)

Comment 2

3 years ago
Created attachment 8428766 [details] [diff] [review]
check interrupts during backtrack

I guess the ilooping here is an irregexp bug but we shouldn't be hanging.  The attached patch checks the interrupt flag on the runtime when backtracking in irregexp, as is done by v8.
Assignee: nobody → bhackett1024
Attachment #8428766 - Flags: review?(jdemooij)
Flags: needinfo?(bhackett1024)

Updated

3 years ago
Attachment #8428766 - Flags: review?(jdemooij) → review+
(Assignee)

Comment 3

3 years ago
https://hg.mozilla.org/integration/mozilla-inbound/rev/9965b32f739b
https://hg.mozilla.org/mozilla-central/rev/9965b32f739b
Status: NEW → RESOLVED
Last Resolved: 3 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla32
I'm guessing this would impact a small segment of users had this not been fixed. I'm comfortable not tracking this.
tracking-firefox32: ? → -
FWIW, dougt actually hit this problem in the wild, albeit on a site somebody posted as an example of browsers taking up a ridiculous amount of CPU.
QA Whiteboard: [good first verify]

Updated

3 years ago
Depends on: 1077514

Updated

3 years ago
Depends on: 1084280
You need to log in before you can comment on or make changes to this bug.