Changeset 94254 in webkit for trunk/Source/JavaScriptCore/yarr

Timestamp:

Aug 31, 2011, 5:21:20 PM (14 years ago)

Author:

[email protected]

Message:

fast/regex/overflow.html asserts in debug builds
​https://bugs.webkit.org/show_bug.cgi?id=67326

Reviewed by Gavin Barraclough.

The deliberate overflows in these expressions don't interact nicely
with Checked<32bit-type> so we just bump up to Checked<int64_t> for the
intermediate calculations.

• yarr/YarrJIT.cpp:

(JSC::Yarr::YarrGenerator::generatePatternCharacterFixed):
(JSC::Yarr::YarrGenerator::generateCharacterClassFixed):

File:

• trunk/Source/JavaScriptCore/yarr/YarrJIT.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/yarr/YarrJIT.cpp

@@ -720 +720 @@
 
         Label loop(this);
-        BaseIndex address(input, countRegister, TimesTwo, ((term->inputPosition - m_checked + Checked<int>(term->quantityCount)) * static_cast<int>(sizeof(UChar))).unsafeGet());
+        BaseIndex address(input, countRegister, TimesTwo, (Checked<int>(term->inputPosition - m_checked + Checked<int64_t>(term->quantityCount)) * static_cast<int>(sizeof(UChar))).unsafeGet());
 
         if (m_pattern.m_ignoreCase && isASCIIAlpha(ch)) {
@@ -874 +874 @@
         Label loop(this);
         JumpList matchDest;
-        load16(BaseIndex(input, countRegister, TimesTwo, ((term->inputPosition - m_checked + Checked<int>(term->quantityCount)) * static_cast<int>(sizeof(UChar))).unsafeGet()), character);
+        load16(BaseIndex(input, countRegister, TimesTwo, (Checked<int>(term->inputPosition - m_checked + Checked<int64_t>(term->quantityCount)) * static_cast<int>(sizeof(UChar))).unsafeGet()), character);
         matchCharacterClass(character, matchDest, term->characterClass);