Changeset 62386 in webkit for trunk/JavaScriptCore/yarr/RegexInterpreter.cpp

Timestamp:

Jul 2, 2010, 9:45:41 AM (15 years ago)

Author:

[email protected]

Message:

2010-07-02 Peter Varga <​[email protected]>

Reviewed by Oliver Hunt.

The alternativeFrameLocation value is wrong in the emitDisjunction function in
case of PatternTerm::TypeParentheticalAssertion. This value needs to be
computed from term.frameLocation instead of term.inputPosition. This mistake caused glibc
memory corruption in some cases.
Layout test added for checking of TypeParentheticalAssertion case.
​https://bugs.webkit.org/show_bug.cgi?id=41458

• yarr/RegexInterpreter.cpp: (JSC::Yarr::ByteCompiler::emitDisjunction):

2010-07-02 Peter Varga <​[email protected]>

Reviewed by Oliver Hunt.

The alternativeFrameLocation value is wrong in the emitDisjunction function in
case of PatternTerm::TypeParentheticalAssertion. This value needs to be
computed from term.frameLocation instead of term.inputPosition. This mistake caused glibc
memory corruption in some cases.
Layout test added for checking of TypeParentheticalAssertion case.
​https://bugs.webkit.org/show_bug.cgi?id=41458

• fast/js/regexp-look-ahead-expected.txt: Added.
• fast/js/regexp-look-ahead.html: Added.
• fast/js/script-tests/regexp-look-ahead.js: Added.

File:

• trunk/JavaScriptCore/yarr/RegexInterpreter.cpp (modified) (1 diff)

trunk/JavaScriptCore/yarr/RegexInterpreter.cpp

@@ -1555 +1555 @@
 
                 case PatternTerm::TypeParentheticalAssertion: {
-                    unsigned alternativeFrameLocation = term.inputPosition + RegexStackSpaceForBackTrackInfoParentheticalAssertion;
+                    unsigned alternativeFrameLocation = term.frameLocation + RegexStackSpaceForBackTrackInfoParentheticalAssertion;
 
                     atomParentheticalAssertionBegin(term.parentheses.subpatternId, term.invertOrCapture, term.frameLocation, alternativeFrameLocation);