Title: [243967] trunk
- Revision
- 243967
- Author
- [email protected]
- Date
- 2019-04-07 16:24:45 -0700 (Sun, 07 Apr 2019)
Log Message
REGRESSION (r243642): Crash in reddit.com page
https://bugs.webkit.org/show_bug.cgi?id=196684
Reviewed by Geoffrey Garen.
JSTests:
New regression test.
* stress/regexp-nongreedy-charclass-backtracks.js: Added.
Source/_javascript_Core:
In r243642, the code that saves and restores the count for non-greedy character classes
was inadvertently put inside an if statement. This code should be generated for all
non-greedy character classes.
* yarr/YarrJIT.cpp:
(JSC::Yarr::YarrGenerator::generateCharacterClassNonGreedy):
(JSC::Yarr::YarrGenerator::backtrackCharacterClassNonGreedy):
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (243966 => 243967)
--- trunk/JSTests/ChangeLog 2019-04-07 19:25:59 UTC (rev 243966)
+++ trunk/JSTests/ChangeLog 2019-04-07 23:24:45 UTC (rev 243967)
@@ -1,3 +1,14 @@
+2019-04-07 Michael Saboff <[email protected]>
+
+ REGRESSION (r243642): Crash in reddit.com page
+ https://bugs.webkit.org/show_bug.cgi?id=196684
+
+ Reviewed by Geoffrey Garen.
+
+ New regression test.
+
+ * stress/regexp-nongreedy-charclass-backtracks.js: Added.
+
2019-04-07 Yusuke Suzuki <[email protected]>
[JSC] CallLinkInfo should clear Callee or CodeBlock even if it is unlinked by jettison
Added: trunk/JSTests/stress/regexp-nongreedy-charclass-backtracks.js (0 => 243967)
--- trunk/JSTests/stress/regexp-nongreedy-charclass-backtracks.js (rev 0)
+++ trunk/JSTests/stress/regexp-nongreedy-charclass-backtracks.js 2019-04-07 23:24:45 UTC (rev 243967)
@@ -0,0 +1,15 @@
+// The regression test checks that multiple non-greedy character classes backtrack properly.
+
+let re = /[^\/]+\/xxx\/[^\/]+?\/[^\/]+?\/[^\/]+?/;
+let str;
+let match;
+
+str = "blah/xxx/blah/blah_blah_blah_blah_blah_blah_blah_blah_blah_blah/";
+match = re.exec(str);
+if (match !== null)
+ throw(re + ".exec(\"" + str + "\") Should not have matched!");
+
+str = "blah/xxx/blah/blah_blah_blah_blah/";
+match = re.exec(str);
+if (match !== null)
+ throw(re + ".exec(\"" + str + "\") Should not have matched!");
Modified: trunk/Source/_javascript_Core/ChangeLog (243966 => 243967)
--- trunk/Source/_javascript_Core/ChangeLog 2019-04-07 19:25:59 UTC (rev 243966)
+++ trunk/Source/_javascript_Core/ChangeLog 2019-04-07 23:24:45 UTC (rev 243967)
@@ -1,3 +1,18 @@
+2019-04-07 Michael Saboff <[email protected]>
+
+ REGRESSION (r243642): Crash in reddit.com page
+ https://bugs.webkit.org/show_bug.cgi?id=196684
+
+ Reviewed by Geoffrey Garen.
+
+ In r243642, the code that saves and restores the count for non-greedy character classes
+ was inadvertently put inside an if statement. This code should be generated for all
+ non-greedy character classes.
+
+ * yarr/YarrJIT.cpp:
+ (JSC::Yarr::YarrGenerator::generateCharacterClassNonGreedy):
+ (JSC::Yarr::YarrGenerator::backtrackCharacterClassNonGreedy):
+
2019-04-07 Yusuke Suzuki <[email protected]>
[JSC] CallLinkInfo should clear Callee or CodeBlock even if it is unlinked by jettison
Modified: trunk/Source/_javascript_Core/yarr/YarrJIT.cpp (243966 => 243967)
--- trunk/Source/_javascript_Core/yarr/YarrJIT.cpp 2019-04-07 19:25:59 UTC (rev 243966)
+++ trunk/Source/_javascript_Core/yarr/YarrJIT.cpp 2019-04-07 23:24:45 UTC (rev 243967)
@@ -1943,11 +1943,15 @@
move(TrustedImm32(0), countRegister);
op.m_reentry = label();
+
+#ifdef JIT_UNICODE_EXPRESSIONS
if (m_decodeSurrogatePairs) {
if (!term->characterClass->hasOneCharacterSize() || term->invert())
storeToFrame(index, term->frameLocation + BackTrackInfoCharacterClass::beginIndex());
- storeToFrame(countRegister, term->frameLocation + BackTrackInfoCharacterClass::matchAmountIndex());
}
+#endif
+
+ storeToFrame(countRegister, term->frameLocation + BackTrackInfoCharacterClass::matchAmountIndex());
}
void backtrackCharacterClassNonGreedy(size_t opIndex)
@@ -1966,10 +1970,11 @@
if (m_decodeSurrogatePairs) {
if (!term->characterClass->hasOneCharacterSize() || term->invert())
loadFromFrame(term->frameLocation + BackTrackInfoCharacterClass::beginIndex(), index);
- loadFromFrame(term->frameLocation + BackTrackInfoCharacterClass::matchAmountIndex(), countRegister);
}
#endif
+ loadFromFrame(term->frameLocation + BackTrackInfoCharacterClass::matchAmountIndex(), countRegister);
+
nonGreedyFailures.append(atEndOfInput());
nonGreedyFailures.append(branch32(Equal, countRegister, Imm32(term->quantityMaxCount.unsafeGet())));
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
