Changeset 28395 in webkit

Timestamp:

Dec 4, 2007, 11:08:28 AM (17 years ago)

Author:

Darin Adler

Message:

JavaScriptCore:

Reviewed by Geoff.

• fix first part of ​http://bugs.webkit.org/show_bug.cgi?id=16220 <rdar://problem/5625221> Crash opening www.news.com (CNet)

Test: fast/js/regexp-overflow.html

• pcre/pcre_compile.cpp: (calculateCompiledPatternLengthAndFlags): Add room for the additional BRA/KET that was generated in the compile code but not taken into account here.

LayoutTests:

Reviewed by Geoff.

• test for first part of ​http://bugs.webkit.org/show_bug.cgi?id=16220 <rdar://problem/5625221> Crash opening www.news.com (CNet)

• fast/js/regexp-overflow-expected.txt: Updated.
• fast/js/resources/regexp-overflow.js: Added test cases.

Location:

trunk

Files:

• JavaScriptCore/ChangeLog (modified) (1 diff)
• JavaScriptCore/pcre/pcre_compile.cpp (modified) (5 diffs)
• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/js/regexp-overflow-expected.txt (modified) (2 diffs)
• LayoutTests/fast/js/resources/regexp-overflow.js (modified) (1 diff)

trunk/JavaScriptCore/ChangeLog

@@ +1 @@
+2007-12-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff.
+
+        - fix first part of http://bugs.webkit.org/show_bug.cgi?id=16220
+          <rdar://problem/5625221> Crash opening www.news.com (CNet)
+
+        Test: fast/js/regexp-overflow.html
+
+        * pcre/pcre_compile.cpp:
+        (calculateCompiledPatternLengthAndFlags): Add room for the additional BRA/KET that
+        was generated in the compile code but not taken into account here.
+
 2007-12-03  Darin Adler  <darin@apple.com>
 

trunk/JavaScriptCore/pcre/pcre_compile.cpp

@@ -1510 +1510 @@
                          copy, which has to be moved up. The remainder can be handled by code
                          that is common with the non-zero minimum case below. We have to
-                         adjust the value or repeat_max, since one less copy is required. Once
-                         again, we may have to adjust any OP_RECURSE calls inside the group. */
+                         adjust the value of repeat_max, since one less copy is required. */
                         
                         else {
@@ -2658 +2657 @@
                     length++;
                     if (maxRepeats > 0) length += (maxRepeats - 1) * (duplength + 3 + 2 * LINK_SIZE);
+                    if (maxRepeats > 1) length += 2 + 2 * LINK_SIZE; // BRA/KET created in else case
                 }
                 
@@ -2707 +2707 @@
     return length;
 }
-
-#ifdef DEBUG
-static void printCompiledRegExp(JSRegExp* re, int length)
-{
-    printf("Length = %d top_bracket = %d top_backref = %d\n",
-           length, re->top_bracket, re->top_backref);
-    
-    if (re->options) {
-        printf("%s%s%s\n",
-               ((re->options & IsAnchoredOption) != 0)? "anchored " : "",
-               ((re->options & IgnoreCaseOption) != 0)? "ignores case " : "",
-               ((re->options & MatchAcrossMultipleLinesOption) != 0)? "multiline " : "");
-    }
-    
-    if (re->options & UseFirstByteOptimizationOption) {
-        char ch = re->first_byte & 255;
-        const char* caseless = (re->first_byte & REQ_IGNORE_CASE) ? " (ignores case)" : "";
-        if (isASCIIAlphanumeric(ch))
-            printf("First char = %c%s\n", ch, caseless);
-        else
-            printf("First char = \\x%02x%s\n", ch, caseless);
-    }
-    
-    if (re->options & UseRequiredByteOptimizationOption) {
-        char ch = re->req_byte & 255;
-        const char* caseless = (re->req_byte & REQ_IGNORE_CASE) ? " (ignores case)" : "";
-        if (isASCIIAlphanumeric(ch))
-            printf("Req char = %c%s\n", ch, caseless);
-        else
-            printf("Req char = \\x%02x%s\n", ch, caseless);
-    }
-    
-    // This debugging function has been removed from JavaScriptCore's PCRE
-    //pcre_printint(re, stdout);
-}
-#endif
 
 /*************************************************
@@ -2838 +2802 @@
     
     *code++ = OP_END;
-    
-#ifndef DEBUG
+
+    ASSERT(code - codestart <= length);
     if (code - codestart > length)
         errorcode = ERR7;
-#endif
     
     /* Give an error if there's back reference to a non-existent capturing
@@ -2896 +2859 @@
     }
     
-#ifdef DEBUG
-    printCompiledRegExp(re);
-    
-    /* This check is done here in the debugging case so that the code that
-     was compiled can be seen. */
-    if (code - codestart > length) {
-        (pcre_free)(re);
-        *errorptr = error_text(ERR7);
-        return NULL;
-    }
-    
-#endif
-    
     if (numSubpatterns)
         *numSubpatterns = re->top_bracket;

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2007-12-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff.
+
+        - test for first part of http://bugs.webkit.org/show_bug.cgi?id=16220
+          <rdar://problem/5625221> Crash opening www.news.com (CNet)
+
+        * fast/js/regexp-overflow-expected.txt: Updated.
+        * fast/js/resources/regexp-overflow.js: Added test cases.
+
 2007-12-03  Dan Bernstein  <mitz@apple.com>
 

trunk/LayoutTests/fast/js/regexp-overflow-expected.txt

@@ -1 @@
-Tests some regular expressions with braces in them that used to overflow the regular expression compilation preflight computation.
+Tests some regular expressions that used to overflow the regular expression compilation preflight computation.
 
 On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
@@ -7 +7 @@
 PASS /^(\d{1,2})([ -:\/\.]{1})(\d{1,2})(\2{1})?(\d{2,4})?$/.exec("1:1").toString() is "1:1,1,:,1,,"
 PASS /^(\d{4})([ -:\/\.]{1})(\d{1,2})(\2{1})(\d{1,2})T(\d{1,2})([ -:\/\.]{1})(\d{1,2})(\7{1})(\d{1,2})Z$/.exec("1234:5:6T7/8/9Z").toString() is "1234:5:6T7/8/9Z,1234,:,5,:,6,7,/,8,/,9"
+PASS /\[["'\s]{0,1}([\w-]*)["'\s]{0,1}([\W]{0,1}=){0,2}["'\s]{0,1}([\w-]*)["'\s]{0,1}\]$/.exec("[]").toString() is "[],,,"
+PASS /(x){0,2}/.exec("").toString() is ","
 
 PASS successfullyParsed is true

trunk/LayoutTests/fast/js/resources/regexp-overflow.js

@@ -1 +1 @@
 description(
-'Tests some regular expressions with braces in them that used to overflow the regular expression compilation preflight computation.'
+'Tests some regular expressions that used to overflow the regular expression compilation preflight computation.'
 );
 
 shouldBe('/(\\d)(\\1{1})/.exec("11").toString()', '"11,1,1"');
+
 shouldBe('/^(\\d{1,2})([ -:\\/\\.]{1})(\\d{1,2})(\\2{1})?(\\d{2,4})?$/.exec("1:1").toString()', '"1:1,1,:,1,,"');
-shouldBe('/^(\\d{4})([ -:\\/\\.]{1})(\\d{1,2})(\\2{1})(\\d{1,2})T(\\d{1,2})([ -:\\/\\.]{1})(\\d{1,2})(\\7{1})(\\d{1,2})Z$/.exec("1234:5:6T7/8/9Z").toString()', '"1234:5:6T7/8/9Z,1234,:,5,:,6,7,/,8,/,9"');
+
+shouldBe('/^(\\d{4})([ -:\\/\\.]{1})(\\d{1,2})(\\2{1})(\\d{1,2})T(\\d{1,2})([ -:\\/\\.]{1})(\\d{1,2})(\\7{1})(\\d{1,2})Z$/.exec("1234:5:6T7/8/9Z").toString()',
+    '"1234:5:6T7/8/9Z,1234,:,5,:,6,7,/,8,/,9"');
+
+shouldBe('/\\[["\'\\s]{0,1}([\\w-]*)["\'\\s]{0,1}([\\W]{0,1}=){0,2}["\'\\s]{0,1}([\\w-]*)["\'\\s]{0,1}\\]$/.exec("[]").toString()',
+    '"[],,,"');
+
+shouldBe('/(x){0,2}/.exec("").toString()', '","');
 
 debug('');