Last modified: 2014-09-01 20:23:02 UTC

Wikimedia Bugzilla is closed!

Wikimedia migrated from Bugzilla to Phabricator. Bug reports are handled in Wikimedia Phabricator.
This static website is read-only and for historical purposes. It is not possible to log in and except for displaying bug reports and their history, links might be broken. See T71835, the corresponding Phabricator task for complete and up-to-date bug report information.
Bug 69835 - mediawiki.language.numbers.js can trigger an endless loop
mediawiki.language.numbers.js can trigger an endless loop
Status: RESOLVED FIXED
Product: MediaWiki
Classification: Unclassified
JavaScript (Other open bugs)
1.24rc
All All
: Normal normal (vote)
: 1.24.0 release
Assigned To: Santhosh Thottingal
: i18n
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2014-08-21 08:11 UTC by Michael M.
Modified: 2014-09-01 20:23 UTC (History)
4 users (show)

See Also:
Web browser: ---
Mobile Platform: ---
Assignee Huggle Beta Tester: ---


Attachments

Description Michael M. 2014-08-21 08:11:08 UTC
The helper function replicate in mediawiki.language.numbers.js has an endless loop:

		while (num) {
			buf.push( str );
			str += str;
		}

Steps to reproduce (make sure you have no unsaved changes in your browser if you need to kill it!):

1. Open the JavaScript console
2. Load the module with
 mw.loader.load('mediawiki.language.numbers');
3. After it has loaded, execute
 mw.language.commafy(1234.567, '###0.#####');

This should return something like '1234,567' (depending on the language of the wiki), but instead triggers that endless loop, which will either freeze the browser or produce an error message like "InternalError: allocation size overflow".
Comment 1 Santhosh Thottingal 2014-08-25 04:12:09 UTC
https://gerrit.wikimedia.org/r/155890 address this bug.
Comment 2 Santhosh Thottingal 2014-08-25 04:12:10 UTC
https://gerrit.wikimedia.org/r/155890 address this bug.
Comment 3 Gerrit Notification Bot 2014-09-01 20:23:02 UTC
Change 155890 merged by jenkins-bot:
mediawiki.language: Fix infinite loop in commafy() when pattern has no grouping

https://gerrit.wikimedia.org/r/155890

Note You need to log in before you can comment on or make changes to this bug.


Navigation
Links