Changeset 80684 in webkit for trunk/Source/JavaScriptCore/interpreter/Interpreter.cpp

Timestamp:

Mar 9, 2011, 6:22:50 PM (14 years ago)

Author:

[email protected]

Message:

Bug 56041 - RexExp constructor should only accept flags "gim"
Fix for issues introduced in r80667.

Reviewed by Sam Weinig.

Source/JavaScriptCore:

Invalid flags to a RegExp literal are a late syntax error!

• bytecode/CodeBlock.h:

(JSC::CodeBlock::addRegExp):

• Pass a PassRefPtr<RegExp>

• bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::addRegExp):
(JSC::BytecodeGenerator::emitNewRegExp):

• bytecompiler/BytecodeGenerator.h:
  • Pass a PassRefPtr<RegExp>
• bytecompiler/NodesCodegen.cpp:

(JSC::RegExpNode::emitBytecode):

• Should not be ASSERTing that the flags are valid - this is a late(er) error.

• interpreter/Interpreter.cpp:

(JSC::Interpreter::privateExecute):

• Need to check for error from RegExp constructor.

• jit/JITStubs.cpp:

(JSC::DEFINE_STUB_FUNCTION):

• Need to check for error from RegExp constructor.

• runtime/RegExp.h:

(JSC::RegExp::isValid):

• Make isValid check that the regexp was created with valid flags.

• runtime/RegExpKey.h:
  • Since we'll not create RegExp objects with invalid flags, separate out the deleted value.

LayoutTests:

• fast/regex/script-tests/parentheses.js:
• fast/regex/script-tests/pcre-test-1.js:
  • Providing invalid flags to RegExp literals is an error in ES5.

File:

• trunk/Source/JavaScriptCore/interpreter/Interpreter.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/interpreter/Interpreter.cpp

@@ -1550 +1550 @@
         */
         int dst = vPC[1].u.operand;
-        int regExp = vPC[2].u.operand;
-        callFrame->uncheckedR(dst) = JSValue(new (globalData) RegExpObject(callFrame->lexicalGlobalObject(), callFrame->scopeChain()->globalObject->regExpStructure(), codeBlock->regexp(regExp)));
+        RegExp* regExp = codeBlock->regexp(vPC[2].u.operand);
+        if (!regExp->isValid()) {
+            exceptionValue = createSyntaxError(exec, "Invalid flags supplied to RegExp constructor.");
+            goto vm_throw;
+        }
+        callFrame->uncheckedR(dst) = JSValue(new (globalData) RegExpObject(callFrame->lexicalGlobalObject(), callFrame->scopeChain()->globalObject->regExpStructure(), regExp));
 
         vPC += OPCODE_LENGTH(op_new_regexp);