Changeset 276529 in webkit

Timestamp:

Apr 23, 2021, 4:38:34 PM (5 years ago)

Author:

Russell Epstein

Message:

Cherry-pick r276527. rdar://problem/77091667

[YARR Interpreter] Improper backtrack of parentheses with non-zero based greedy quantifiers
​https://bugs.webkit.org/show_bug.cgi?id=224983

Reviewed by Mark Lam.

When we backtrack a parentheses with a greedy non zero based quantifier,
we don't properly restore for the case where we hadn't reached the minimum count.
We now save the input position on entry and restore it when we backtrack for
this case. We also properly release the allocated ParenthesesDisjunctionContext's.

• yarr/YarrInterpreter.cpp: (JSC::Yarr::Interpreter::matchParentheses): (JSC::Yarr::Interpreter::backtrackParentheses):

git-svn-id: ​https://svn.webkit.org/repository/webkit/trunk@276527 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Location:

branches/safari-611-branch/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• yarr/YarrInterpreter.cpp (modified) (3 diffs)

branches/safari-611-branch/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2021-04-23  Ruben Turcios  <rubent_22@apple.com>
+
+        Cherry-pick r276527. rdar://problem/77091667
+
+    [YARR Interpreter] Improper backtrack of parentheses with non-zero based greedy quantifiers
+    https://bugs.webkit.org/show_bug.cgi?id=224983
+    
+    Reviewed by Mark Lam.
+    
+    When we backtrack a parentheses with a greedy non zero based quantifier,
+    we don't properly restore for the case where we hadn't reached the minimum count.
+    We now save the input position on entry and restore it when we backtrack for
+    this case.  We also properly release the allocated ParenthesesDisjunctionContext's.
+    
+    * yarr/YarrInterpreter.cpp:
+    (JSC::Yarr::Interpreter::matchParentheses):
+    (JSC::Yarr::Interpreter::backtrackParentheses):
+    
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@276527 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2021-04-23  Michael Saboff  <msaboff@apple.com>
+
+            [YARR Interpreter] Improper backtrack of parentheses with non-zero based greedy quantifiers
+            https://bugs.webkit.org/show_bug.cgi?id=224983
+
+            Reviewed by Mark Lam.
+
+            When we backtrack a parentheses with a greedy non zero based quantifier,
+            we don't properly restore for the case where we hadn't reached the minimum count.
+            We now save the input position on entry and restore it when we backtrack for
+            this case.  We also properly release the allocated ParenthesesDisjunctionContext's.
+
+            * yarr/YarrInterpreter.cpp:
+            (JSC::Yarr::Interpreter::matchParentheses):
+            (JSC::Yarr::Interpreter::backtrackParentheses):
+
 2021-04-23  Ruben Turcios  <rubent_22@apple.com>
 

branches/safari-611-branch/Source/JavaScriptCore/yarr/YarrInterpreter.cpp

@@ -46 +46 @@
 
     struct BackTrackInfoParentheses {
+        uintptr_t begin;
         uintptr_t matchAmount;
         ParenthesesDisjunctionContext* lastContext;
@@ -1016 +1017 @@
         ByteDisjunction* disjunctionBody = term.atom.parenthesesDisjunction;
 
+        backTrack->begin = input.getPos();
         backTrack->matchAmount = 0;
         backTrack->lastContext = nullptr;
@@ -1169 +1171 @@
                 freeParenthesesDisjunctionContext(context);
 
-                if (result != JSRegExpNoMatch || backTrack->matchAmount < term.atom.quantityMinCount)
+                if (backTrack->matchAmount < term.atom.quantityMinCount) {
+                    while (backTrack->matchAmount) {
+                        context = backTrack->lastContext;
+                        resetMatches(term, context);
+                        popParenthesesDisjunctionContext(backTrack);
+                        freeParenthesesDisjunctionContext(context);
+                    }
+
+                    input.setPos(backTrack->begin);
+                    return result;
+                }
+
+                if (result != JSRegExpNoMatch)
                     return result;
             }