Changeset 43110 in webkit

Timestamp:

Apr 30, 2009 9:10:25 PM (15 years ago)

Author:

barraclough@apple.com

Message:

JavaScriptCore:

2009-04-30 Gavin Barraclough <​barraclough@apple.com>

Reviewed by Geoff Garen.

Bug fix for rdar:/68455379. If a case-insensitive regex contains
a character class containing a range with an upper bound of \uFFFF
the parser will infinite-loop whist adding other-case characters
for characters in the range that do have another case.

• yarr/RegexCompiler.cpp: (JSC::Yarr::CharacterClassConstructor::putRange):

LayoutTests:

2009-04-30 Gavin Barraclough <​barraclough@apple.com>

Reviewed by Geoff Garen.

Add layout test for rdar:/68455379.

• fast/js/regexp-range-bound-ffff-expected.txt: Added.
• fast/js/regexp-range-bound-ffff.html: Added.
• fast/js/resources/regexp-range-bound-ffff.js: Added.

Location:

trunk

Files:

• JavaScriptCore/ChangeLog (modified) (1 diff)
• JavaScriptCore/yarr/RegexCompiler.cpp (modified) (1 diff)
• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/js/regexp-range-bound-ffff-expected.txt (added)
• LayoutTests/fast/js/regexp-range-bound-ffff.html (added)
• LayoutTests/fast/js/resources/regexp-range-bound-ffff.js (added)

trunk/JavaScriptCore/ChangeLog

@@ +1 @@
+2009-04-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug fix for rdar:/68455379.  If a case-insensitive regex contains
+        a character class containing a range with an upper bound of \uFFFF
+        the parser will infinite-loop whist adding other-case characters
+        for characters in the range that do have another case.
+
+        * yarr/RegexCompiler.cpp:
+        (JSC::Yarr::CharacterClassConstructor::putRange):
+
 2009-04-30  Gavin Barraclough  <barraclough@apple.com>
 

trunk/JavaScriptCore/yarr/RegexCompiler.cpp

@@ -109 +109 @@
         }
         if (hi >= 0x80) {
-            UChar unicodeCurr = std::max(lo, (UChar)0x80);
+            uint32_t unicodeCurr = std::max(lo, (UChar)0x80);
             addSortedRange(m_rangesUnicode, unicodeCurr, hi);
             
             if (m_isCaseInsensitive) {
                 while (unicodeCurr <= hi) {
+                    // If the upper bound of the range (hi) is 0xffff, the increments to
+                    // unicodeCurr in this loop may take it to 0x10000.  This is fine
+                    // (if so we won't re-enter the loop, since the loop condition above
+                    // will definitely fail) - but this does mean we cannot use a UChar
+                    // to represent unicodeCurr, we must use a 32-bit value instead.
+                    ASSERT(unicodeCurr <= 0xffff);
+
                     if (isUnicodeUpper(unicodeCurr)) {
                         UChar lowerCaseRangeBegin = Unicode::toLower(unicodeCurr);

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2009-04-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Add layout test for rdar:/68455379.
+
+        * fast/js/regexp-range-bound-ffff-expected.txt: Added.
+        * fast/js/regexp-range-bound-ffff.html: Added.
+        * fast/js/resources/regexp-range-bound-ffff.js: Added.
+
 2009-04-30  Eric Carlson  <eric.carlson@apple.com>