Changeset 241634 in webkit for trunk/Source/JavaScriptCore/yarr/YarrJIT.cpp

Timestamp:

Feb 15, 2019, 5:13:57 PM (6 years ago)

Author:

[email protected]

Message:

RELEASE_ASSERT at com.apple.JavaScriptCore: JSC::jsSubstringOfResolved
​https://bugs.webkit.org/show_bug.cgi?id=194558

Reviewed by Saam Barati.

JSTests:

New regression test.

• stress/regexp-unicode-within-string.js: Added.

Source/JavaScriptCore:

Added an in bounds check before the read of the next character for Unicode regular expressions
for pattern generation that didn't already have such checks.

• yarr/YarrJIT.cpp:

(JSC::Yarr::YarrGenerator::generatePatternCharacterOnce):
(JSC::Yarr::YarrGenerator::generatePatternCharacterFixed):
(JSC::Yarr::YarrGenerator::generateCharacterClassOnce):
(JSC::Yarr::YarrGenerator::generateCharacterClassFixed):

File:

• trunk/Source/JavaScriptCore/yarr/YarrJIT.cpp (modified) (4 diffs)

trunk/Source/JavaScriptCore/yarr/YarrJIT.cpp

@@ -1429 +1429 @@
         }
 
+        if (m_decodeSurrogatePairs)
+            op.m_jumps.append(jumpIfNoAvailableInput());
+
         if (m_charSize == Char8) {
             auto check1 = [&] (Checked<unsigned> offset, UChar32 characters) {
@@ -1561 +1564 @@
         const RegisterID countRegister = regT1;
 
+        if (m_decodeSurrogatePairs)
+            op.m_jumps.append(jumpIfNoAvailableInput());
+
         move(index, countRegister);
         Checked<unsigned> scaledMaxCount = term->quantityMaxCount;
@@ -1714 +1720 @@
         const RegisterID character = regT0;
 
-        if (m_decodeSurrogatePairs)
+        if (m_decodeSurrogatePairs) {
+            op.m_jumps.append(jumpIfNoAvailableInput());
             storeToFrame(index, term->frameLocation + BackTrackInfoCharacterClass::beginIndex());
+        }
 
         JumpList matchDest;
@@ -1761 +1769 @@
         const RegisterID character = regT0;
         const RegisterID countRegister = regT1;
+
+        if (m_decodeSurrogatePairs)
+            op.m_jumps.append(jumpIfNoAvailableInput());
 
         move(index, countRegister);