Changeset 221111 in webkit

Timestamp:

Aug 23, 2017 3:24:30 PM (7 years ago)

Author:

msaboff@apple.com

Message:

REGRESSION (r221052): DumpRenderTree crashed in com.apple.JavaScriptCore: JSC::Yarr::YarrCodeBlock::execute + 137
​https://bugs.webkit.org/show_bug.cgi?id=175903

Reviewed by Saam Barati.

Source/JavaScriptCore:

In generateCharacterClassGreedy we were incrementing the "count" register before checking
for the end of the input string. The at-end-of-input check is the final check before
knowing that the current character matched. In this case, the end of input check
indicates that we ran out of prechecked characters and therefore should fail the match of
the current character. The backtracking code uses the value in the "count" register as
the number of character that successfully matched, which shouldn't include the current
character. Therefore we need to move the incrementing of "count" to after the
at end of input check.

Through code inspection of the expectations of other backtracking code, I determined that
the non greedy character class matching code had a similar issue. I fixed that as well
and added a new test case.

• yarr/YarrJIT.cpp:

(JSC::Yarr::YarrGenerator::generateCharacterClassGreedy):
(JSC::Yarr::YarrGenerator::backtrackCharacterClassNonGreedy):

LayoutTests:

New regression test case.

• js/regexp-unicode-expected.txt:
• js/script-tests/regexp-unicode.js:

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/js/regexp-unicode-expected.txt (modified) (1 diff)
• LayoutTests/js/script-tests/regexp-unicode.js (modified) (1 diff)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/yarr/YarrJIT.cpp (modified) (4 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2017-08-23  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION (r221052): DumpRenderTree crashed in com.apple.JavaScriptCore: JSC::Yarr::YarrCodeBlock::execute + 137
+        https://bugs.webkit.org/show_bug.cgi?id=175903
+
+        Reviewed by Saam Barati.
+
+        New regression test case.
+
+        * js/regexp-unicode-expected.txt:
+        * js/script-tests/regexp-unicode.js:
+
 2017-08-23  Matt Lewis  <jlewis3@apple.com>
 

trunk/LayoutTests/js/regexp-unicode-expected.txt

@@ -120 +120 @@
 PASS "12X3𐐀4".match(/\d{0,1}/ug) is ["1", "2", "", "3", "", "4", ""]
 PASS "𐐂𐐅𐐅𐐂𐐅𐐅𐐅".match(/𐐅{3}/u)[0] is "𐐅𐐅𐐅"
+PASS "a𐐐𐐐b".match(/a(𐐐*?)bc|a(𐐐*?)b/ui)[0] is "a𐐐𐐐b"
 PASS match3[0] is "a𐐐𐐐b"
 PASS match3[1] is undefined.

trunk/LayoutTests/js/script-tests/regexp-unicode.js

@@ -158 +158 @@
 shouldBe('"12X3\u{10400}4".match(/\\d{0,1}/ug)', '["1", "2", "", "3", "", "4", ""]');
 shouldBe('"\u{10402}\u{10405}\u{10405}\u{10402}\u{10405}\u{10405}\u{10405}".match(/\u{10405}{3}/u)[0]', '"\u{10405}\u{10405}\u{10405}"');
+shouldBe('"a\u{10410}\u{10410}b".match(/a(\u{10410}*?)bc|a(\u{10410}*?)b/ui)[0]', '"a\u{10410}\u{10410}b"');
 
 var re3 = new RegExp("(a\u{10410}*bc)|(a\u{10410}*b)", "u");

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2017-08-23  Michael Saboff  <msaboff@apple.com>
+
+        REGRESSION (r221052): DumpRenderTree crashed in com.apple.JavaScriptCore: JSC::Yarr::YarrCodeBlock::execute + 137
+        https://bugs.webkit.org/show_bug.cgi?id=175903
+
+        Reviewed by Saam Barati.
+
+        In generateCharacterClassGreedy we were incrementing the "count" register before checking
+        for the end of the input string.  The at-end-of-input check is the final check before
+        knowing that the current character matched.  In this case, the end of input check
+        indicates that we ran out of prechecked characters and therefore should fail the match of
+        the current character.  The backtracking code uses the value in the "count" register as
+        the number of character that successfully matched, which shouldn't include the current
+        character.  Therefore we need to move the incrementing of "count" to after the
+        at end of input check.
+
+        Through code inspection of the expectations of other backtracking code, I determined that 
+        the non greedy character class matching code had a similar issue.  I fixed that as well
+        and added a new test case.
+
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::generateCharacterClassGreedy):
+        (JSC::Yarr::YarrGenerator::backtrackCharacterClassNonGreedy):
+
 2017-08-23  Yusuke Suzuki  <utatane.tea@gmail.com>
 

trunk/Source/JavaScriptCore/yarr/YarrJIT.cpp

@@ -1269 +1269 @@
         }
 
-        add32(TrustedImm32(1), countRegister);
         add32(TrustedImm32(1), index);
 #ifdef JIT_UNICODE_EXPRESSIONS
@@ -1279 +1278 @@
         }
 #endif
+        add32(TrustedImm32(1), countRegister);
 
         if (term->quantityMaxCount != quantifyInfinite) {
@@ -1375 +1375 @@
         }
 
-        add32(TrustedImm32(1), countRegister);
         add32(TrustedImm32(1), index);
 #ifdef JIT_UNICODE_EXPRESSIONS
         if (m_decodeSurrogatePairs) {
+            nonGreedyFailures.append(atEndOfInput());
             Jump isBMPChar = branch32(LessThan, character, supplementaryPlanesBase);
             add32(TrustedImm32(1), index);
@@ -1384 +1384 @@
         }
 #endif
+        add32(TrustedImm32(1), countRegister);
 
         jump(op.m_reentry);