Changeset 294411 in webkit

Timestamp:

May 18, 2022, 11:33:44 AM (3 years ago)

Author:

msaboff@apple.com

Message:

WTF::CrashOnOverflow::crash() with /((a{100000000})*b{2100000000})+/.test();
​https://bugs.webkit.org/show_bug.cgi?id=240552

Reviewed by Yusuke Suzuki and Alex Christensen.

Replaced a crashing checked add in the YARR JIT code generator with a reporting add so we can
catch the overflow. When we do overflow, we terminate the JIT genration with an error.
We'll fallback to the YARR interpreter, which already exits with an error on a similar overflow.

• JSTests/stress/regexp-large-quantifier.js:

(testRegExp):

• Source/JavaScriptCore/yarr/YarrJIT.cpp:

(JSC::Yarr::dumpCompileFailure):

• Source/JavaScriptCore/yarr/YarrJIT.h:

Canonical link: ​https://commits.webkit.org/250703@main

Location:

trunk

Files:

• JSTests/stress/regexp-large-quantifier.js (modified) (2 diffs)
• Source/JavaScriptCore/yarr/YarrJIT.cpp (modified) (2 diffs)
• Source/JavaScriptCore/yarr/YarrJIT.h (modified) (1 diff)

trunk/JSTests/stress/regexp-large-quantifier.js

@@ -1 @@
-function testRegExp(pattern, string, expectedMatch) {
+function testRegExp(pattern, string, expectedParseError, expectedMatch) {
     const r = new RegExp(pattern);
-    const actualResult = r.exec(string);
+    let actualResult = null;
+    let actualParseError = null;
+    try {
+        actualResult = r.exec(string);
+    } catch(e) {
+        actualParseError = e;
+    }
+
+    if (expectedParseError && expectedParseError != actualParseError)
+        throw("Expected \"" + expectedParseError + "\", but got \"" + actualParseError + "\"");
+
     if (expectedMatch === undefined) {
         if (actualResult !== null)
@@ -11 +21 @@
 }
 
-testRegExp("a{0,4294967295}", "a", "a");
-testRegExp("a{0,4294967296}", "a", "a");
-testRegExp("^a{0,4294967296}$", "a{0,4294967296}", undefined);
-testRegExp("(?:a{0,340282366920}?){0,1}a", "aa", "aa");
+testRegExp("a{0,4294967295}", "a", undefined, "a");
+testRegExp("a{0,4294967296}", "a", undefined, "a");
+testRegExp("^a{0,4294967296}$", "a{0,4294967296}", undefined, undefined);
+testRegExp("(?:a{0,340282366920}?){0,1}a", "aa", undefined, "aa");
+testRegExp("((.{100000000})*.{2100000000})+", "x", "SyntaxError: Invalid regular expression: pattern exceeds string length limits", undefined);

trunk/Source/JavaScriptCore/yarr/YarrJIT.cpp

@@ -3597 +3597 @@
                 if ((term->quantityType == QuantifierType::FixedCount) && (term->type != PatternTerm::Type::ParentheticalAssertion))
                     lastOp.m_checkAdjust -= disjunction->m_minimumSize;
-                lastOp.m_checkedOffset = checkedOffset + lastOp.m_checkAdjust;
+
+                Checked<unsigned, RecordOverflow> checkedOffsetResult(checkedOffset);
+                checkedOffsetResult += lastOp.m_checkAdjust;
+
+                if (UNLIKELY(checkedOffsetResult.hasOverflowed())) {
+                    m_failureReason = JITFailureReason::OffsetTooLarge;
+                    return;
+                }
+
+                lastOp.m_checkedOffset = checkedOffsetResult;
             }
             opCompileAlternative(m_ops[lastOpIndex].m_checkedOffset, nestedAlternative);
@@ -4722 +4731 @@
         dataLog("Can't JIT because of failure of allocation of executable memory\n");
         break;
+    case JITFailureReason::OffsetTooLarge:
+        dataLog("Can't JIT because pattern exceeds string length limits\n");
+        break;
     }
 }

trunk/Source/JavaScriptCore/yarr/YarrJIT.h

@@ -63 +63 @@
     ParenthesisNestedTooDeep,
     ExecutableMemoryAllocationFailure,
+    OffsetTooLarge,
 };