Changeset 43110 in webkit for trunk/JavaScriptCore/yarr/RegexCompiler.cpp

Timestamp:

Apr 30, 2009, 9:10:25 PM (16 years ago)

Author:

[email protected]

Message:

JavaScriptCore:

2009-04-30 Gavin Barraclough <​[email protected]>

Reviewed by Geoff Garen.

Bug fix for rdar:/68455379. If a case-insensitive regex contains
a character class containing a range with an upper bound of \uFFFF
the parser will infinite-loop whist adding other-case characters
for characters in the range that do have another case.

• yarr/RegexCompiler.cpp: (JSC::Yarr::CharacterClassConstructor::putRange):

LayoutTests:

2009-04-30 Gavin Barraclough <​[email protected]>

Reviewed by Geoff Garen.

Add layout test for rdar:/68455379.

• fast/js/regexp-range-bound-ffff-expected.txt: Added.
• fast/js/regexp-range-bound-ffff.html: Added.
• fast/js/resources/regexp-range-bound-ffff.js: Added.

File:

• trunk/JavaScriptCore/yarr/RegexCompiler.cpp (modified) (1 diff)

trunk/JavaScriptCore/yarr/RegexCompiler.cpp

@@ -109 +109 @@
         }
         if (hi >= 0x80) {
-            UChar unicodeCurr = std::max(lo, (UChar)0x80);
+            uint32_t unicodeCurr = std::max(lo, (UChar)0x80);
             addSortedRange(m_rangesUnicode, unicodeCurr, hi);
             
             if (m_isCaseInsensitive) {
                 while (unicodeCurr <= hi) {
+                    // If the upper bound of the range (hi) is 0xffff, the increments to
+                    // unicodeCurr in this loop may take it to 0x10000.  This is fine
+                    // (if so we won't re-enter the loop, since the loop condition above
+                    // will definitely fail) - but this does mean we cannot use a UChar
+                    // to represent unicodeCurr, we must use a 32-bit value instead.
+                    ASSERT(unicodeCurr <= 0xffff);
+
                     if (isUnicodeUpper(unicodeCurr)) {
                         UChar lowerCaseRangeBegin = Unicode::toLower(unicodeCurr);