Title: [245939] branches/safari-607-branch/Source/_javascript_Core
- Revision
- 245939
- Author
- [email protected]
- Date
- 2019-05-30 17:33:42 -0700 (Thu, 30 May 2019)
Log Message
Cherry-pick r243237. rdar://problem/51264876
JSC test crash: stress/dont-strength-reduce-regexp-with-compile-error.js.default
https://bugs.webkit.org/show_bug.cgi?id=195906
Reviewed by Mark Lam.
The problem here as that we may successfully parsed a RegExp without running out of stack,
but later run out of stack when trying to JIT compile the same _expression_.
Added a check for available stack space when we call into one of the parenthesis compilation
functions that recurse. When we don't have enough stack space to recurse, we fail the JIT
compilation and let the interpreter handle the _expression_.
From code inspection of the YARR interpreter it has the same issue, but I couldn't cause a failure.
Filed a new bug and added a FIXME comment for the Interpreter to have similar checks.
Given that we can reproduce a failure, this is sufficient for now.
This change is covered by the previously added failing test,
JSTests/stress/dont-strength-reduce-regexp-with-compile-error.js.
* yarr/YarrInterpreter.cpp:
(JSC::Yarr::Interpreter::interpret):
* yarr/YarrJIT.cpp:
(JSC::Yarr::YarrGenerator::opCompileParenthesesSubpattern):
(JSC::Yarr::YarrGenerator::opCompileParentheticalAssertion):
(JSC::Yarr::YarrGenerator::opCompileBody):
(JSC::Yarr::dumpCompileFailure):
* yarr/YarrJIT.h:
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243237 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Modified Paths
Diff
Modified: branches/safari-607-branch/Source/_javascript_Core/ChangeLog (245938 => 245939)
--- branches/safari-607-branch/Source/_javascript_Core/ChangeLog 2019-05-31 00:33:42 UTC (rev 245938)
+++ branches/safari-607-branch/Source/_javascript_Core/ChangeLog 2019-05-31 00:33:42 UTC (rev 245939)
@@ -1,3 +1,68 @@
+2019-05-30 Alan Coon <[email protected]>
+
+ Cherry-pick r243237. rdar://problem/51264876
+
+ JSC test crash: stress/dont-strength-reduce-regexp-with-compile-error.js.default
+ https://bugs.webkit.org/show_bug.cgi?id=195906
+
+ Reviewed by Mark Lam.
+
+ The problem here as that we may successfully parsed a RegExp without running out of stack,
+ but later run out of stack when trying to JIT compile the same _expression_.
+
+ Added a check for available stack space when we call into one of the parenthesis compilation
+ functions that recurse. When we don't have enough stack space to recurse, we fail the JIT
+ compilation and let the interpreter handle the _expression_.
+
+ From code inspection of the YARR interpreter it has the same issue, but I couldn't cause a failure.
+ Filed a new bug and added a FIXME comment for the Interpreter to have similar checks.
+ Given that we can reproduce a failure, this is sufficient for now.
+
+ This change is covered by the previously added failing test,
+ JSTests/stress/dont-strength-reduce-regexp-with-compile-error.js.
+
+ * yarr/YarrInterpreter.cpp:
+ (JSC::Yarr::Interpreter::interpret):
+ * yarr/YarrJIT.cpp:
+ (JSC::Yarr::YarrGenerator::opCompileParenthesesSubpattern):
+ (JSC::Yarr::YarrGenerator::opCompileParentheticalAssertion):
+ (JSC::Yarr::YarrGenerator::opCompileBody):
+ (JSC::Yarr::dumpCompileFailure):
+ * yarr/YarrJIT.h:
+
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243237 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2019-03-20 Michael Saboff <[email protected]>
+
+ JSC test crash: stress/dont-strength-reduce-regexp-with-compile-error.js.default
+ https://bugs.webkit.org/show_bug.cgi?id=195906
+
+ Reviewed by Mark Lam.
+
+ The problem here as that we may successfully parsed a RegExp without running out of stack,
+ but later run out of stack when trying to JIT compile the same _expression_.
+
+ Added a check for available stack space when we call into one of the parenthesis compilation
+ functions that recurse. When we don't have enough stack space to recurse, we fail the JIT
+ compilation and let the interpreter handle the _expression_.
+
+ From code inspection of the YARR interpreter it has the same issue, but I couldn't cause a failure.
+ Filed a new bug and added a FIXME comment for the Interpreter to have similar checks.
+ Given that we can reproduce a failure, this is sufficient for now.
+
+ This change is covered by the previously added failing test,
+ JSTests/stress/dont-strength-reduce-regexp-with-compile-error.js.
+
+ * yarr/YarrInterpreter.cpp:
+ (JSC::Yarr::Interpreter::interpret):
+ * yarr/YarrJIT.cpp:
+ (JSC::Yarr::YarrGenerator::opCompileParenthesesSubpattern):
+ (JSC::Yarr::YarrGenerator::opCompileParentheticalAssertion):
+ (JSC::Yarr::YarrGenerator::opCompileBody):
+ (JSC::Yarr::dumpCompileFailure):
+ * yarr/YarrJIT.h:
+
2019-05-30 Kocsen Chung <[email protected]>
Cherry-pick r245593. rdar://problem/51264876
Modified: branches/safari-607-branch/Source/_javascript_Core/yarr/YarrInterpreter.cpp (245938 => 245939)
--- branches/safari-607-branch/Source/_javascript_Core/yarr/YarrInterpreter.cpp 2019-05-31 00:33:42 UTC (rev 245938)
+++ branches/safari-607-branch/Source/_javascript_Core/yarr/YarrInterpreter.cpp 2019-05-31 00:33:42 UTC (rev 245939)
@@ -1608,6 +1608,8 @@
unsigned interpret()
{
+ // FIXME: https://bugs.webkit.org/show_bug.cgi?id=195970
+ // [Yarr Interpreter] The interpreter doesn't have checks for stack overflow due to deep recursion
if (!input.isAvailableInput(0))
return offsetNoMatch;
Modified: branches/safari-607-branch/Source/_javascript_Core/yarr/YarrJIT.cpp (245938 => 245939)
--- branches/safari-607-branch/Source/_javascript_Core/yarr/YarrJIT.cpp 2019-05-31 00:33:42 UTC (rev 245938)
+++ branches/safari-607-branch/Source/_javascript_Core/yarr/YarrJIT.cpp 2019-05-31 00:33:42 UTC (rev 245939)
@@ -3389,6 +3389,11 @@
YarrOpCode alternativeNextOpCode = OpSimpleNestedAlternativeNext;
YarrOpCode alternativeEndOpCode = OpSimpleNestedAlternativeEnd;
+ if (UNLIKELY(!m_vm->isSafeToRecurse())) {
+ m_failureReason = JITFailureReason::ParenthesisNestedTooDeep;
+ return;
+ }
+
// We can currently only compile quantity 1 subpatterns that are
// not copies. We generate a copy in the case of a range quantifier,
// e.g. /(?:x){3,9}/, or /(?:x)+/ (These are effectively expanded to
@@ -3495,6 +3500,11 @@
// once, and will never backtrack back into the assertion.
void opCompileParentheticalAssertion(PatternTerm* term)
{
+ if (UNLIKELY(!m_vm->isSafeToRecurse())) {
+ m_failureReason = JITFailureReason::ParenthesisNestedTooDeep;
+ return;
+ }
+
size_t parenBegin = m_ops.size();
m_ops.append(OpParentheticalAssertionBegin);
@@ -3575,6 +3585,11 @@
// to return the failing result.
void opCompileBody(PatternDisjunction* disjunction)
{
+ if (UNLIKELY(!m_vm->isSafeToRecurse())) {
+ m_failureReason = JITFailureReason::ParenthesisNestedTooDeep;
+ return;
+ }
+
Vector<std::unique_ptr<PatternAlternative>>& alternatives = disjunction->m_alternatives;
size_t currentAlternativeIndex = 0;
@@ -4208,6 +4223,9 @@
case JITFailureReason::FixedCountParenthesizedSubpattern:
dataLog("Can't JIT a pattern containing fixed count parenthesized subpatterns\n");
break;
+ case JITFailureReason::ParenthesisNestedTooDeep:
+ dataLog("Can't JIT pattern due to parentheses nested too deeply\n");
+ break;
case JITFailureReason::ExecutableMemoryAllocationFailure:
dataLog("Can't JIT because of failure of allocation of executable memory\n");
break;
Modified: branches/safari-607-branch/Source/_javascript_Core/yarr/YarrJIT.h (245938 => 245939)
--- branches/safari-607-branch/Source/_javascript_Core/yarr/YarrJIT.h 2019-05-31 00:33:42 UTC (rev 245938)
+++ branches/safari-607-branch/Source/_javascript_Core/yarr/YarrJIT.h 2019-05-31 00:33:42 UTC (rev 245939)
@@ -52,6 +52,7 @@
VariableCountedParenthesisWithNonZeroMinimum,
ParenthesizedSubpattern,
FixedCountParenthesizedSubpattern,
+ ParenthesisNestedTooDeep,
ExecutableMemoryAllocationFailure,
};
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
