Changeset 244023 in webkit
- Timestamp:
- Apr 8, 2019, 10:09:21 AM (7 years ago)
- Location:
- tags/Safari-608.1.15
- Files:
-
- 5 edited
-
LayoutTests/ChangeLog (modified) (1 diff)
-
LayoutTests/js/regexp-unicode-expected.txt (modified) (1 diff)
-
LayoutTests/js/script-tests/regexp-unicode.js (modified) (1 diff)
-
Source/JavaScriptCore/ChangeLog (modified) (1 diff)
-
Source/JavaScriptCore/yarr/YarrJIT.cpp (modified) (3 diffs)
Legend:
- Unmodified
- Added
- Removed
-
tags/Safari-608.1.15/LayoutTests/ChangeLog
r243949 r244023 1 2019-04-08 Babak Shafiei <bshafiei@apple.com> 2 3 Cherry-pick r243839. rdar://problem/49589308 4 5 REGRESSION (r243642): com.apple.JavaScriptCore crash in JSC::RegExpObject::execInline 6 https://bugs.webkit.org/show_bug.cgi?id=196477 7 8 Reviewed by Keith Miller. 9 10 Source/JavaScriptCore: 11 12 The problem here is that when we advance the index by 2 for a character class that only 13 has non-BMP characters, we might go past the end of the string. This can happen for 14 greedy counted character classes that are part of a alternative where there is one 15 character to match after the greedy non-BMP character class. 16 17 The "do we have string left to match" check at the top of the JIT loop for the counted 18 character class checks to see if index is not equal to the string length. For non-BMP 19 character classes, we need to check to see if there are at least 2 characters left. 20 Therefore we now temporarily add 1 to the current index before comparing. This checks 21 to see if there are iat least 2 characters left to match, instead of 1. 22 23 * yarr/YarrJIT.cpp: 24 (JSC::Yarr::YarrGenerator::generateCharacterClassGreedy): 25 (JSC::Yarr::YarrGenerator::backtrackCharacterClassNonGreedy): 26 27 LayoutTests: 28 29 Updated the test with a couple more test cases to test a few variants of this bug. 30 Also added a couple of non-greedy counted non-BMP character class tests that don't have 31 the bug just to be sure. 32 33 * js/regexp-unicode-expected.txt: 34 * js/script-tests/regexp-unicode.js: 35 36 37 git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243839 268f45cc-cd09-0410-ab3c-d52691b4dbfc 38 39 2019-04-03 Michael Saboff <msaboff@apple.com> 40 41 REGRESSION (r243642): com.apple.JavaScriptCore crash in JSC::RegExpObject::execInline 42 https://bugs.webkit.org/show_bug.cgi?id=196477 43 44 Reviewed by Keith Miller. 45 46 Updated the test with a couple more test cases to test a few variants of this bug. 47 Also added a couple of non-greedy counted non-BMP character class tests that don't have 48 the bug just to be sure. 49 50 * js/regexp-unicode-expected.txt: 51 * js/script-tests/regexp-unicode.js: 52 1 53 2019-04-05 Kocsen Chung <kocsen_chung@apple.com> 2 54 -
tags/Safari-608.1.15/LayoutTests/js/regexp-unicode-expected.txt
r243949 r244023 149 149 PASS "𐌑𐌐𐌑".match(/[𐌁𐌑]+a|[𐌐𐌑]+./iu)[0] is "𐌑𐌐𐌑" 150 150 PASS "𐌑𐌐𐌑".match(/[𐌁𐌑]+?a|[𐌐𐌑]+?./iu)[0] is "𐌑𐌐" 151 PASS "𐌑𐌐𐌑".match(/[𐌁𐌑]+?a$|[𐌐𐌑]+?.$/iu)[0] is "𐌑𐌐𐌑" 152 PASS "𐌑𐌐𐌑".match(/[𐌁𐌑x]+a|[𐌐𐌑x]+./iu)[0] is "𐌑𐌐𐌑" 153 PASS "𐌑𐌐𐌑".match(/[𐌁𐌑x]+?a|[𐌐𐌑x]+?./iu)[0] is "𐌑𐌐" 151 154 PASS "C83|НАЧАТЬ".match(re8)[0] is "C83|НАЧАТЬ" 152 155 PASS "This.Is.16.Chars|НАЧАТЬ".match(re8)[0] is "This.Is.16.Chars|НАЧАТЬ" -
tags/Safari-608.1.15/LayoutTests/js/script-tests/regexp-unicode.js
r243949 r244023 206 206 shouldBe('"\u{10311}\u{10310}\u{10311}".match(/[\u{10301}\u{10311}]+a|[\u{10310}\u{10311}]+./iu)[0]', '"\u{10311}\u{10310}\u{10311}"'); 207 207 shouldBe('"\u{10311}\u{10310}\u{10311}".match(/[\u{10301}\u{10311}]+?a|[\u{10310}\u{10311}]+?./iu)[0]', '"\u{10311}\u{10310}"'); 208 shouldBe('"\u{10311}\u{10310}\u{10311}".match(/[\u{10301}\u{10311}]+?a$|[\u{10310}\u{10311}]+?.$/iu)[0]', '"\u{10311}\u{10310}\u{10311}"'); 209 shouldBe('"\u{10311}\u{10310}\u{10311}".match(/[\u{10301}\u{10311}x]+a|[\u{10310}\u{10311}x]+./iu)[0]', '"\u{10311}\u{10310}\u{10311}"'); 210 shouldBe('"\u{10311}\u{10310}\u{10311}".match(/[\u{10301}\u{10311}x]+?a|[\u{10310}\u{10311}x]+?./iu)[0]', '"\u{10311}\u{10310}"'); 208 211 209 212 var re8 = new RegExp("^([0-9a-z\.]{3,16})\\|\u{041d}\u{0410}\u{0427}\u{0410}\u{0422}\u{042c}", "ui"); -
tags/Safari-608.1.15/Source/JavaScriptCore/ChangeLog
r244022 r244023 1 2019-04-08 Babak Shafiei <bshafiei@apple.com> 2 3 Cherry-pick r243839. rdar://problem/49589308 4 5 REGRESSION (r243642): com.apple.JavaScriptCore crash in JSC::RegExpObject::execInline 6 https://bugs.webkit.org/show_bug.cgi?id=196477 7 8 Reviewed by Keith Miller. 9 10 Source/JavaScriptCore: 11 12 The problem here is that when we advance the index by 2 for a character class that only 13 has non-BMP characters, we might go past the end of the string. This can happen for 14 greedy counted character classes that are part of a alternative where there is one 15 character to match after the greedy non-BMP character class. 16 17 The "do we have string left to match" check at the top of the JIT loop for the counted 18 character class checks to see if index is not equal to the string length. For non-BMP 19 character classes, we need to check to see if there are at least 2 characters left. 20 Therefore we now temporarily add 1 to the current index before comparing. This checks 21 to see if there are iat least 2 characters left to match, instead of 1. 22 23 * yarr/YarrJIT.cpp: 24 (JSC::Yarr::YarrGenerator::generateCharacterClassGreedy): 25 (JSC::Yarr::YarrGenerator::backtrackCharacterClassNonGreedy): 26 27 LayoutTests: 28 29 Updated the test with a couple more test cases to test a few variants of this bug. 30 Also added a couple of non-greedy counted non-BMP character class tests that don't have 31 the bug just to be sure. 32 33 * js/regexp-unicode-expected.txt: 34 * js/script-tests/regexp-unicode.js: 35 36 37 git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243839 268f45cc-cd09-0410-ab3c-d52691b4dbfc 38 39 2019-04-03 Michael Saboff <msaboff@apple.com> 40 41 REGRESSION (r243642): com.apple.JavaScriptCore crash in JSC::RegExpObject::execInline 42 https://bugs.webkit.org/show_bug.cgi?id=196477 43 44 Reviewed by Keith Miller. 45 46 The problem here is that when we advance the index by 2 for a character class that only 47 has non-BMP characters, we might go past the end of the string. This can happen for 48 greedy counted character classes that are part of a alternative where there is one 49 character to match after the greedy non-BMP character class. 50 51 The "do we have string left to match" check at the top of the JIT loop for the counted 52 character class checks to see if index is not equal to the string length. For non-BMP 53 character classes, we need to check to see if there are at least 2 characters left. 54 Therefore we now temporarily add 1 to the current index before comparing. This checks 55 to see if there are iat least 2 characters left to match, instead of 1. 56 57 * yarr/YarrJIT.cpp: 58 (JSC::Yarr::YarrGenerator::generateCharacterClassGreedy): 59 (JSC::Yarr::YarrGenerator::backtrackCharacterClassNonGreedy): 60 1 61 2019-04-08 Babak Shafiei <bshafiei@apple.com> 2 62 -
tags/Safari-608.1.15/Source/JavaScriptCore/yarr/YarrJIT.cpp
r244022 r244023 1850 1850 JumpList failures; 1851 1851 Label loop(this); 1852 failures.append(atEndOfInput()); 1852 #ifdef JIT_UNICODE_EXPRESSIONS 1853 if (term->characterClass->hasOneCharacterSize() && !term->invert() && term->characterClass->hasNonBMPCharacters()) { 1854 move(TrustedImm32(1), character); 1855 failures.append(checkNotEnoughInput(character)); 1856 } else 1857 #endif 1858 failures.append(atEndOfInput()); 1853 1859 1854 1860 if (term->invert()) { … … 1957 1963 m_backtrackingState.link(this); 1958 1964 1965 #ifdef JIT_UNICODE_EXPRESSIONS 1959 1966 if (m_decodeSurrogatePairs) { 1960 1967 if (!term->characterClass->hasOneCharacterSize() || term->invert()) … … 1962 1969 loadFromFrame(term->frameLocation + BackTrackInfoCharacterClass::matchAmountIndex(), countRegister); 1963 1970 } 1971 #endif 1964 1972 1965 1973 nonGreedyFailures.append(atEndOfInput());
Note:
See TracChangeset
for help on using the changeset viewer.
