GNU bug report logs - #65726
29.1.50; Crash in regexp engine

Previous Next

Package: emacs;

Reported by: martin rudalics <rudalics <at> gmx.at>

Date: Mon, 4 Sep 2023 07:48:02 UTC

Severity: normal

Found in version 29.1.50

Fixed in version 30.1

Done: Stefan Kangas <stefankangas <at> gmail.com>

Bug is archived. No further changes may be made.

Full log

Message #26 received at 65726 <at> debbugs.gnu.org (full text, mbox):

From: Mattias Engdegård <mattias.engdegard <at> gmail.com>
To: Eli Zaretskii <eliz <at> gnu.org>
Cc: rudalics <at> gmx.at, 65726 <at> debbugs.gnu.org, monnier <at> iro.umontreal.ca
Subject: Re: bug#65726: 29.1.50; Crash in regexp engine
Date: Mon, 4 Sep 2023 17:47:04 +0200

Minimised reproduction recipe:

  (string-match (rx (* "a") (* (* "b"))) "a")

(Don't worry about the nested stars; the original was more like (* (| A (* B))).)

The generated bytecode is:

    0  on-failure-jump-smart to 9
    3  exact "a"
    6  jump to 0
    9  on-failure-jump-loop to 24
   12  on-failure-jump-smart to 21
   15  exact "b"
   18  jump to 12
   21  jump to 9
   24  succeed

which suggests a mutual_exclusive_p recursion loop:

  mep(3,9)
  -> mep(3,12)
     -> mep(3,21) = {skip_noop} = mep(3,9)
        -> mep(3,12)
           ...

Maybe there is something clever we could do here but it's possible that we just can't avoid keeping track of visited nodes.
This bug report was last modified 1 year and 242 days ago.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.