Page MenuHomePhabricator

mediawiki.language.numbers.js can trigger an endless loop
Closed, ResolvedPublic

Description

The helper function replicate in mediawiki.language.numbers.js has an endless loop:

		while (num) {
			buf.push( str );
			str += str;
		}

Steps to reproduce (make sure you have no unsaved changes in your browser if you need to kill it!):

  1. Open the JavaScript console
  2. Load the module with mw.loader.load('mediawiki.language.numbers');
  3. After it has loaded, execute mw.language.commafy(1234.567, '#0.###');

This should return something like '1234,567' (depending on the language of the wiki), but instead triggers that endless loop, which will either freeze the browser or produce an error message like "InternalError: allocation size overflow".


Version: 1.24rc
Severity: normal

Details

Reference
bz69835

Event Timeline

bzimport raised the priority of this task from to Medium.Nov 22 2014, 3:31 AM
bzimport set Reference to bz69835.
Schnark created this task.Aug 21 2014, 8:11 AM

Change 155890 merged by jenkins-bot:
mediawiki.language: Fix infinite loop in commafy() when pattern has no grouping

https://gerrit.wikimedia.org/r/155890