irregexp: hang without slow script dialog while executing regular expression

RESOLVED FIXED in mozilla32



JavaScript Engine
3 years ago
3 years ago


(Reporter: Alice0775 White, Assigned: bhackett)


({hang, regression})

32 Branch
hang, regression
Dependency tree / graph

Firefox Tracking Flags

(firefox29 unaffected, firefox30 unaffected, firefox31 unaffected, firefox32- affected, firefox-esr24 unaffected)



(1 attachment)



3 years ago
+++ This bug was initially created as a clone of Bug #998785 +++

Browser hang up when evaluete the following regular expression.

/<([\w\:]+)((?:[\s\w:=]+|'[^']*'|"[^"]*")*)(?:\/>|>([\d,]*)<\/[^>]+>)/g.test("<rdf:Description rdf:about=\"\"            xmlns:test=\"\">2,<t>3,</t></rdf:Description>")

Steps To Reproduce:
1. Open "Error Console" (devtools.errorconsole.enabled = true), OR "Browser Console"
2. Evaluate the above code.

Actual Results:
Browser hang up

Expected Results:
Browser should not hang up.
This isn't related to the Yarr issues: it only happens in builds from after the switch to V8's irregexp engine.

Additionally, executing the same code in the Chrome devtools also causes a hang of the content process, so it seems to happen inside irregexp itself.

Reported upstream at
Blocks: 976446
No longer depends on: 998785
Flags: needinfo?(bhackett1024)
Summary: Hang up while executing regular expression → irregexp: hang without slow script dialog while executing regular expression

Comment 2

3 years ago
Created attachment 8428766 [details] [diff] [review]
check interrupts during backtrack

I guess the ilooping here is an irregexp bug but we shouldn't be hanging.  The attached patch checks the interrupt flag on the runtime when backtracking in irregexp, as is done by v8.
Assignee: nobody → bhackett1024
Attachment #8428766 - Flags: review?(jdemooij)
Flags: needinfo?(bhackett1024)


3 years ago
Attachment #8428766 - Flags: review?(jdemooij) → review+

Comment 3

3 years ago
Last Resolved: 3 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla32
I'm guessing this would impact a small segment of users had this not been fixed. I'm comfortable not tracking this.
tracking-firefox32: ? → -
FWIW, dougt actually hit this problem in the wild, albeit on a site somebody posted as an example of browsers taking up a ridiculous amount of CPU.
QA Whiteboard: [good first verify]


3 years ago
Depends on: 1077514


3 years ago
Depends on: 1084280
You need to log in before you can comment on or make changes to this bug.