877462 - YARR Crash [@ JSC::Yarr::Parser<JSC::Yarr::YarrPatternConstructor, unsigned short>::parseCharacterClass] with OOM

Status: RESOLVED DUPLICATE of bug 990096

(Core :: JavaScript Engine, defect)

Description

[Christian Holler (:decoder)]

The following testcase crashes on mozilla-central revision 8d85de779506 (no options required):


oomAfterAllocations(10);
actual = /\c[a/]/.test( "\x1ba/]" );

Comment 1

[Christian Holler (:decoder)]

Attachment: [crash-signature] Machine-readable crash signature

Comment 2

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: stack

Still occurs with 64-bit debug threadsafe shell on Mac m-c rev 9afe2a1145bd.

Comment 3

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Jan, how should we move this forward?

Comment 4

[Jan de Mooij [:jandem]]

There's now a CrashAtUnhandlableOOM in Vector::append in wtfbridge.h