Title: [245815] trunk
- Revision
- 245815
- Author
- [email protected]
- Date
- 2019-05-28 10:19:09 -0700 (Tue, 28 May 2019)
Log Message
[YARR] Properly handle RegExp's that require large ParenContext space
https://bugs.webkit.org/show_bug.cgi?id=198065
Reviewed by Keith Miller.
JSTests:
New test.
* stress/regexp-large-paren-context.js: Added.
(testLargeRegExp):
Source/_javascript_Core:
Changed what happens when we exceed VM::patternContextBufferSize when compiling a RegExp
that needs ParenCOntextSpace to fail the RegExp JIT compilation and fall back to the YARR
interpreter. This can save large amounts of JIT memory for a
JIT'ed function that cannot ever succeed.
* yarr/YarrJIT.cpp:
(JSC::Yarr::YarrGenerator::initParenContextFreeList):
(JSC::Yarr::YarrGenerator::compile):
Modified Paths
Added Paths
Diff
Modified: trunk/JSTests/ChangeLog (245814 => 245815)
--- trunk/JSTests/ChangeLog 2019-05-28 17:09:01 UTC (rev 245814)
+++ trunk/JSTests/ChangeLog 2019-05-28 17:19:09 UTC (rev 245815)
@@ -1,3 +1,15 @@
+2019-05-28 Michael Saboff <[email protected]>
+
+ [YARR] Properly handle RegExp's that require large ParenContext space
+ https://bugs.webkit.org/show_bug.cgi?id=198065
+
+ Reviewed by Keith Miller.
+
+ New test.
+
+ * stress/regexp-large-paren-context.js: Added.
+ (testLargeRegExp):
+
2019-05-28 Tadeu Zagallo <[email protected]>
JITOperations putByVal should mark negative array indices as out-of-bounds
Added: trunk/JSTests/stress/regexp-large-paren-context.js (0 => 245815)
--- trunk/JSTests/stress/regexp-large-paren-context.js (rev 0)
+++ trunk/JSTests/stress/regexp-large-paren-context.js 2019-05-28 17:19:09 UTC (rev 245815)
@@ -0,0 +1,22 @@
+// Test the regular expresions that need lots of parenthesis context space work.
+// This includes falling back to the interpreter.
+
+function testLargeRegExp(terms)
+{
+ let s = '';
+ for (let i = 0; i < terms; i++) {
+ s += '(?:a){0,2}';
+ }
+
+ let r = new RegExp(s);
+ for (let i = 0; i < 10; i++)
+ ''.match(r);
+}
+
+testLargeRegExp(127);
+testLargeRegExp(128);
+testLargeRegExp(255);
+testLargeRegExp(256);
+testLargeRegExp(1000);
+
+
Modified: trunk/Source/_javascript_Core/ChangeLog (245814 => 245815)
--- trunk/Source/_javascript_Core/ChangeLog 2019-05-28 17:09:01 UTC (rev 245814)
+++ trunk/Source/_javascript_Core/ChangeLog 2019-05-28 17:19:09 UTC (rev 245815)
@@ -1,3 +1,19 @@
+2019-05-28 Michael Saboff <[email protected]>
+
+ [YARR] Properly handle RegExp's that require large ParenContext space
+ https://bugs.webkit.org/show_bug.cgi?id=198065
+
+ Reviewed by Keith Miller.
+
+ Changed what happens when we exceed VM::patternContextBufferSize when compiling a RegExp
+ that needs ParenCOntextSpace to fail the RegExp JIT compilation and fall back to the YARR
+ interpreter. This can save large amounts of JIT memory for a
+ JIT'ed function that cannot ever succeed.
+
+ * yarr/YarrJIT.cpp:
+ (JSC::Yarr::YarrGenerator::initParenContextFreeList):
+ (JSC::Yarr::YarrGenerator::compile):
+
2019-05-28 Tadeu Zagallo <[email protected]>
JITOperations putByVal should mark negative array indices as out-of-bounds
Modified: trunk/Source/_javascript_Core/yarr/YarrJIT.cpp (245814 => 245815)
--- trunk/Source/_javascript_Core/yarr/YarrJIT.cpp 2019-05-28 17:09:01 UTC (rev 245814)
+++ trunk/Source/_javascript_Core/yarr/YarrJIT.cpp 2019-05-28 17:19:09 UTC (rev 245815)
@@ -228,9 +228,10 @@
parenContextSize = WTF::roundUpToMultipleOf<sizeof(uintptr_t)>(parenContextSize);
- // Check that the paren context is a reasonable size.
- if (parenContextSize > VM::patternContextBufferSize)
- m_abortExecution.append(jump());
+ if (parenContextSize > VM::patternContextBufferSize) {
+ m_failureReason = JITFailureReason::ParenthesisNestedTooDeep;
+ return;
+ }
Jump emptyFreeList = branchTestPtr(Zero, freelistRegister);
move(freelistRegister, parenContextPointer);
@@ -3935,8 +3936,13 @@
initCallFrame();
#if ENABLE(YARR_JIT_ALL_PARENS_EXPRESSIONS)
- if (m_containsNestedSubpatterns)
+ if (m_containsNestedSubpatterns) {
initParenContextFreeList();
+ if (m_failureReason) {
+ codeBlock.setFallBackWithFailureReason(*m_failureReason);
+ return;
+ }
+ }
#endif
if (m_pattern.m_saveInitialStartValue) {
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
