Changeset 41849 in webkit

Timestamp:

Mar 19, 2009 5:52:04 PM (15 years ago)

Author:

ggaren@apple.com

Message:

JavaScriptCore:

2009-03-19 Cameron Zwarich <​cwzwarich@uwaterloo.ca>

Reviewed by Geoff Garen.

Bug 23771: REGRESSION (r36016): JSObjectHasProperty freezes on global class without kJSClassAttributeNoAutomaticPrototype
<​https://bugs.webkit.org/show_bug.cgi?id=23771>
<rdar://problem/6561016>

• API/tests/testapi.c: (main): Add a test for this bug.
• runtime/JSGlobalObject.cpp: (JSC::JSGlobalObject::resetPrototype): Don't set the prototype of the last object in the prototype chain to the object prototype when the object prototype is already the last object in the prototype chain.

LayoutTests:

2009-03-19 Geoffrey Garen <​ggaren@apple.com>

Reviewed by Oliver Hunt.

Fixed <rdar://problem/6279213> Regular expression run-time complexity
limit too low for long inputs (21485)

Added a test for a complex regexp match that should succeed, and one
that should fail.

• fast/js/regexp-overflow-expected.txt:
• fast/js/resources/regexp-overflow.js:

Location:

trunk

Files:

• JavaScriptCore/ChangeLog (modified) (1 diff)
• JavaScriptCore/pcre/pcre_exec.cpp (modified) (1 diff)
• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/js/regexp-overflow-expected.txt (modified) (1 diff)
• LayoutTests/fast/js/resources/regexp-overflow.js (modified) (1 diff)

trunk/JavaScriptCore/ChangeLog

@@ -21 +21 @@
 
         * wtf/Platform.h: Added HAVE_RUNLOOP_TIMER for PLATFORM(MAC).
+
+2009-03-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Fixed <rdar://problem/6279213> Regular expression run-time complexity
+        limit too low for long inputs (21485)
+        
+        I raised PCRE's "matchLimit" (limit on backtracking) by an order of
+        magnitude. This fixes all the reported examples of timing out on legitimate
+        regular expression matches.
+        
+        In my testing on a Core Duo MacBook Pro, the longest you can get stuck
+        trying to match a string is still under 1s, so this seems like a safe change.
+        
+        I can think of a number of better solutions that are more complicated,
+        but this is a good improvement for now.
+
+        * pcre/pcre_exec.cpp:
 
 2009-03-19  Geoffrey Garen  <ggaren@apple.com>

trunk/JavaScriptCore/pcre/pcre_exec.cpp

@@ -176 +176 @@
 avoid spending exponential time on complex regular expressions. */
 
-static const unsigned matchLimit = 100000;
+static const unsigned matchLimit = 1000000;
 
 #ifdef DEBUG

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2009-03-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Fixed <rdar://problem/6279213> Regular expression run-time complexity
+        limit too low for long inputs (21485)
+        
+        Added a test for a complex regexp match that should succeed, and one
+        that should fail.
+
+        * fast/js/regexp-overflow-expected.txt:
+        * fast/js/resources/regexp-overflow.js:
+
 2009-03-19  Mark Rowe  <mrowe@apple.com>
 

trunk/LayoutTests/fast/js/regexp-overflow-expected.txt

@@ -13 +13 @@
 PASS /{([\D-\ca]]„£µ+?)}|[[\B-\u00d4]√π- ]]]{0,3}/i.exec("B√π- ]]").toString() is "B√π- ]],"
 PASS /|[x\B-\u00b5]/i.exec("").toString() is ""
+PASS new RegExp(complexPattern).exec(complexInput)[0] is complexInput
+PASS new RegExp(complexPattern + complexPattern).exec(complexInput + complexInput) is null
 PASS new RegExp(s); threw exception SyntaxError: Invalid regular expression: regular expression too large.
 PASS /(([ab]){30}){3360}/ threw exception SyntaxError: Invalid regular expression: regular expression too large.

trunk/LayoutTests/fast/js/resources/regexp-overflow.js

@@ -21 +21 @@
 shouldBe('/|[x\\B-\\u00b5]/i.exec("").toString()', '""');
 
+var complexPattern = "";
+for (var i = 0; i < 18; ++i)
+    complexPattern += "a?";
+for (var i = 0; i < 18; ++i)
+    complexPattern += "a";
+complexPattern = "(" + complexPattern + ")";
+
+var complexInput = "";
+for (var i = 0; i < 18; ++i)
+    complexInput += "a";
+
+shouldBe('new RegExp(complexPattern).exec(complexInput)[0]', 'complexInput'); // Big but OK
+shouldBe('new RegExp(complexPattern + complexPattern).exec(complexInput + complexInput)', 'null'); // Too big
+
 var s = "a";
 for (var i = 0; i < 21; i++)