Changeset 76407 in webkit

Timestamp:

Jan 21, 2011 3:52:29 PM (13 years ago)

Author:

msaboff@apple.com

Message:

2011-01-21 Michael Saboff <​msaboff@apple.com>

Reviewed by Oliver Hunt.

[RegexFuzz] Hang with forward assertion
​https://bugs.webkit.org/show_bug.cgi?id=52825
<rdar://problem/8894332>

The backtrackTo label from the first term in a list of terms is
being overwritten by processing of subsequent terms. Changed
copyBacktrackToLabel() to check for an existing bcaktrackTo label
before copying and renamed it to propagateBacktrackToLabel() since
it no longer copies.

• yarr/YarrJIT.cpp: (JSC::Yarr::YarrGenerator::BacktrackDestination::propagateBacktrackToLabel): (JSC::Yarr::YarrGenerator::generateParenthesesSingle):

2011-01-21 Michael Saboff <​msaboff@apple.com>

Reviewed by Oliver Hunt.

[RegexFuzz] Hang with forward assertion
​https://bugs.webkit.org/show_bug.cgi?id=52825
<rdar://problem/8894332>

New tests to check for functionality and future regression.

• fast/regex/parentheses-expected.txt:
• fast/regex/script-tests/parentheses.js:

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/regex/parentheses-expected.txt (modified) (1 diff)
• LayoutTests/fast/regex/script-tests/parentheses.js (modified) (1 diff)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/yarr/YarrJIT.cpp (modified) (2 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2011-01-21  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        [RegexFuzz] Hang with forward assertion
+        https://bugs.webkit.org/show_bug.cgi?id=52825
+        <rdar://problem/8894332>
+
+        New tests to check for functionality and future regression.
+
+        * fast/regex/parentheses-expected.txt:
+        * fast/regex/script-tests/parentheses.js:
+
 2011-01-21  Maciej Stachowiak  <mjs@apple.com>
 

trunk/LayoutTests/fast/regex/parentheses-expected.txt

@@ -76 +76 @@
 PASS regexp44.exec('SSS') is ['',undefined]
 PASS regexp45.exec('vt') is null
+PASS regexp46.exec('5') is null
+PASS regexp46.exec('pk') is ['pk',undefined,undefined]
+PASS regexp46.exec('Xw555') is ['w555','w',undefined]
+PASS regexp46.exec('Xw55pk5') is ['w','w','']
 PASS 'Hi Bob'.match(/(Rob)|(Bob)|(Robert)|(Bobby)/) is ['Bob',undefined,'Bob',undefined,undefined]
 PASS successfullyParsed is true

trunk/LayoutTests/fast/regex/script-tests/parentheses.js

@@ -203 +203 @@
 shouldBeNull("regexp45.exec('vt')");
 
+var regexp46 = /(w)(?:5{3}|())|pk/;
+shouldBeNull("regexp46.exec('5')");
+shouldBe("regexp46.exec('pk')", "['pk',undefined,undefined]");
+shouldBe("regexp46.exec('Xw555')", "['w555','w',undefined]");
+shouldBe("regexp46.exec('Xw55pk5')", "['w','w','']");
+
 shouldBe("'Hi Bob'.match(/(Rob)|(Bob)|(Robert)|(Bobby)/)", "['Bob',undefined,'Bob',undefined,undefined]");
 

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2011-01-21  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        [RegexFuzz] Hang with forward assertion
+        https://bugs.webkit.org/show_bug.cgi?id=52825
+        <rdar://problem/8894332>
+
+        The backtrackTo label from the first term in a list of terms is
+        being overwritten by processing of subsequent terms.  Changed
+        copyBacktrackToLabel() to check for an existing bcaktrackTo label
+        before copying and renamed it to propagateBacktrackToLabel() since
+        it no longer copies.
+
+        * yarr/YarrJIT.cpp:
+        (JSC::Yarr::YarrGenerator::BacktrackDestination::propagateBacktrackToLabel):
+        (JSC::Yarr::YarrGenerator::generateParenthesesSingle):
+
 2011-01-21  Geoffrey Garen  <ggaren@apple.com>
 

trunk/Source/JavaScriptCore/yarr/YarrJIT.cpp

@@ -607 +607 @@
         }
 
-        void copyBacktrackToLabel(BacktrackDestination& rhs)
-        {
-            if (rhs.m_backtrackToLabel)
+        void propagateBacktrackToLabel(const BacktrackDestination& rhs)
+        {
+            if (!m_backtrackToLabel && rhs.m_backtrackToLabel)
                 m_backtrackToLabel = rhs.m_backtrackToLabel;
         }
@@ -1662 +1662 @@
 
             state.propagateBacktrackingFrom(this, parenthesesBacktrack);
-            stateBacktrack.copyBacktrackToLabel(parenthesesBacktrack);
+            stateBacktrack.propagateBacktrackToLabel(parenthesesBacktrack);
 
             m_expressionState.decrementParenNestingLevel();