Changeset 221111 in webkit for trunk/Source/JavaScriptCore/yarr/YarrJIT.cpp

Timestamp:

Aug 23, 2017, 3:24:30 PM (8 years ago)

Author:

[email protected]

Message:

REGRESSION (r221052): DumpRenderTree crashed in com.apple.JavaScriptCore: JSC::Yarr::YarrCodeBlock::execute + 137
​https://bugs.webkit.org/show_bug.cgi?id=175903

Reviewed by Saam Barati.

Source/JavaScriptCore:

In generateCharacterClassGreedy we were incrementing the "count" register before checking
for the end of the input string. The at-end-of-input check is the final check before
knowing that the current character matched. In this case, the end of input check
indicates that we ran out of prechecked characters and therefore should fail the match of
the current character. The backtracking code uses the value in the "count" register as
the number of character that successfully matched, which shouldn't include the current
character. Therefore we need to move the incrementing of "count" to after the
at end of input check.

Through code inspection of the expectations of other backtracking code, I determined that
the non greedy character class matching code had a similar issue. I fixed that as well
and added a new test case.

• yarr/YarrJIT.cpp:

(JSC::Yarr::YarrGenerator::generateCharacterClassGreedy):
(JSC::Yarr::YarrGenerator::backtrackCharacterClassNonGreedy):

LayoutTests:

New regression test case.

• js/regexp-unicode-expected.txt:
• js/script-tests/regexp-unicode.js:

File:

• trunk/Source/JavaScriptCore/yarr/YarrJIT.cpp (modified) (4 diffs)

trunk/Source/JavaScriptCore/yarr/YarrJIT.cpp

@@ -1269 +1269 @@
         }
 
-        add32(TrustedImm32(1), countRegister);
         add32(TrustedImm32(1), index);
 #ifdef JIT_UNICODE_EXPRESSIONS
@@ -1279 +1278 @@
         }
 #endif
+        add32(TrustedImm32(1), countRegister);
 
         if (term->quantityMaxCount != quantifyInfinite) {
@@ -1375 +1375 @@
         }
 
-        add32(TrustedImm32(1), countRegister);
         add32(TrustedImm32(1), index);
 #ifdef JIT_UNICODE_EXPRESSIONS
         if (m_decodeSurrogatePairs) {
+            nonGreedyFailures.append(atEndOfInput());
             Jump isBMPChar = branch32(LessThan, character, supplementaryPlanesBase);
             add32(TrustedImm32(1), index);
@@ -1384 +1384 @@
         }
 #endif
+        add32(TrustedImm32(1), countRegister);
 
         jump(op.m_reentry);