Changeset 245928 in webkit

Timestamp:

May 30, 2019, 5:30:23 PM (7 years ago)

Author:

Alan Coon

Message:

Cherry-pick r245815. rdar://problem/51264876

[YARR] Properly handle RegExp's that require large ParenContext space
​https://bugs.webkit.org/show_bug.cgi?id=198065

Reviewed by Keith Miller.

JSTests:

New test.

• stress/regexp-large-paren-context.js: Added. (testLargeRegExp):

Source/JavaScriptCore:

Changed what happens when we exceed VM::patternContextBufferSize when compiling a RegExp
that needs ParenCOntextSpace to fail the RegExp JIT compilation and fall back to the YARR
interpreter. This can save large amounts of JIT memory for a
JIT'ed function that cannot ever succeed.

• yarr/YarrJIT.cpp: (JSC::Yarr::YarrGenerator::initParenContextFreeList): (JSC::Yarr::YarrGenerator::compile):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@245815 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:

branches/safari-607-branch

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/regexp-large-paren-context.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/yarr/YarrJIT.cpp (modified) (2 diffs)

branches/safari-607-branch/JSTests/ChangeLog

@@ +1 @@
+2019-05-30  Kocsen Chung  <kocsen_chung@apple.com>
+
+        Cherry-pick r245815. rdar://problem/51264876
+
+    [YARR] Properly handle RegExp's that require large ParenContext space
+    https://bugs.webkit.org/show_bug.cgi?id=198065
+    
+    Reviewed by Keith Miller.
+    
+    JSTests:
+    
+    New test.
+    
+    * stress/regexp-large-paren-context.js: Added.
+    (testLargeRegExp):
+    
+    Source/JavaScriptCore:
+    
+    Changed what happens when we exceed VM::patternContextBufferSize when compiling a RegExp
+    that needs ParenCOntextSpace to fail the RegExp JIT compilation and fall back to the YARR
+    interpreter.  This can save large amounts of JIT memory for a
+    JIT'ed function that cannot ever succeed.
+    
+    * yarr/YarrJIT.cpp:
+    (JSC::Yarr::YarrGenerator::initParenContextFreeList):
+    (JSC::Yarr::YarrGenerator::compile):
+    
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@245815 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2019-05-28  Michael Saboff  <msaboff@apple.com>
+
+            [YARR] Properly handle RegExp's that require large ParenContext space
+            https://bugs.webkit.org/show_bug.cgi?id=198065
+
+            Reviewed by Keith Miller.
+
+            New test.
+
+            * stress/regexp-large-paren-context.js: Added.
+            (testLargeRegExp):
+
 2019-05-30  Kocsen Chung  <kocsen_chung@apple.com>
 

branches/safari-607-branch/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2019-05-30  Kocsen Chung  <kocsen_chung@apple.com>
+
+        Cherry-pick r245815. rdar://problem/51264876
+
+    [YARR] Properly handle RegExp's that require large ParenContext space
+    https://bugs.webkit.org/show_bug.cgi?id=198065
+    
+    Reviewed by Keith Miller.
+    
+    JSTests:
+    
+    New test.
+    
+    * stress/regexp-large-paren-context.js: Added.
+    (testLargeRegExp):
+    
+    Source/JavaScriptCore:
+    
+    Changed what happens when we exceed VM::patternContextBufferSize when compiling a RegExp
+    that needs ParenCOntextSpace to fail the RegExp JIT compilation and fall back to the YARR
+    interpreter.  This can save large amounts of JIT memory for a
+    JIT'ed function that cannot ever succeed.
+    
+    * yarr/YarrJIT.cpp:
+    (JSC::Yarr::YarrGenerator::initParenContextFreeList):
+    (JSC::Yarr::YarrGenerator::compile):
+    
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@245815 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2019-05-28  Michael Saboff  <msaboff@apple.com>
+
+            [YARR] Properly handle RegExp's that require large ParenContext space
+            https://bugs.webkit.org/show_bug.cgi?id=198065
+
+            Reviewed by Keith Miller.
+
+            Changed what happens when we exceed VM::patternContextBufferSize when compiling a RegExp
+            that needs ParenCOntextSpace to fail the RegExp JIT compilation and fall back to the YARR
+            interpreter.  This can save large amounts of JIT memory for a
+            JIT'ed function that cannot ever succeed.
+
+            * yarr/YarrJIT.cpp:
+            (JSC::Yarr::YarrGenerator::initParenContextFreeList):
+            (JSC::Yarr::YarrGenerator::compile):
+
 2019-05-30  Kocsen Chung  <kocsen_chung@apple.com>
 

branches/safari-607-branch/Source/JavaScriptCore/yarr/YarrJIT.cpp

@@ -229 +229 @@
         parenContextSize = WTF::roundUpToMultipleOf<sizeof(uintptr_t)>(parenContextSize);
 
-        // Check that the paren context is a reasonable size.
-        if (parenContextSize > VM::patternContextBufferSize)
-            m_abortExecution.append(jump());
+        if (parenContextSize > VM::patternContextBufferSize) {
+            m_failureReason = JITFailureReason::ParenthesisNestedTooDeep;
+            return;
+        }
 
         Jump emptyFreeList = branchTestPtr(Zero, freelistRegister);
@@ -3873 +3874 @@
 
 #if ENABLE(YARR_JIT_ALL_PARENS_EXPRESSIONS)
-        if (m_containsNestedSubpatterns)
+        if (m_containsNestedSubpatterns) {
             initParenContextFreeList();
+            if (m_failureReason) {
+                codeBlock.setFallBackWithFailureReason(*m_failureReason);
+                return;
+            }
+        }
 #endif