Changeset 40522 in webkit for trunk/JavaScriptCore/wrec/WRECGenerator.cpp

Timestamp:

Feb 2, 2009, 10:08:53 PM (16 years ago)

Author:

[email protected]

Message:

<​https://bugs.webkit.org/show_bug.cgi?id=21414> REGRESSION: Regular Expressions and character classes, shorthands and ranges
<rdar://problem/6543487>

Reviewed by Gavin Barraclough.

In certain circumstances when WREC::Generator::generateCharacterClassInvertedRange invokes
itself recursively, it will incorrectly emit (and thus consume) the next single character
match in the current character class. As WREC uses a binary search this out of sequence
codegen could result in a character match being missed and so cause the regex to produce
incorrect results.

File:

• trunk/JavaScriptCore/wrec/WRECGenerator.cpp (modified) (1 diff)

trunk/JavaScriptCore/wrec/WRECGenerator.cpp

@@ -364 +364 @@
                 generateCharacterClassInvertedRange(failures, matchDest, ranges, which, matchIndex, matches, matchCount);
             
-            do {
+            while ((*matchIndex < matchCount) && (matches[*matchIndex] < lo)) {
                 matchDest.append(je32(character, Imm32((unsigned short)matches[*matchIndex])));
                 ++*matchIndex;
-            } while ((*matchIndex < matchCount) && (matches[*matchIndex] < lo));
+            }
             failures.append(jump());