Title: [244024] tags/Safari-608.1.15
- Revision
- 244024
- Author
- [email protected]
- Date
- 2019-04-08 10:09:24 -0700 (Mon, 08 Apr 2019)
Log Message
Cherry-pick r243967. rdar://problem/49589308
REGRESSION (r243642): Crash in reddit.com page
https://bugs.webkit.org/show_bug.cgi?id=196684
Reviewed by Geoffrey Garen.
JSTests:
New regression test.
* stress/regexp-nongreedy-charclass-backtracks.js: Added.
Source/_javascript_Core:
In r243642, the code that saves and restores the count for non-greedy character classes
was inadvertently put inside an if statement. This code should be generated for all
non-greedy character classes.
* yarr/YarrJIT.cpp:
(JSC::Yarr::YarrGenerator::generateCharacterClassNonGreedy):
(JSC::Yarr::YarrGenerator::backtrackCharacterClassNonGreedy):
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243967 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Modified Paths
Added Paths
Diff
Modified: tags/Safari-608.1.15/JSTests/ChangeLog (244023 => 244024)
--- tags/Safari-608.1.15/JSTests/ChangeLog 2019-04-08 17:09:21 UTC (rev 244023)
+++ tags/Safari-608.1.15/JSTests/ChangeLog 2019-04-08 17:09:24 UTC (rev 244024)
@@ -1,3 +1,42 @@
+2019-04-08 Babak Shafiei <[email protected]>
+
+ Cherry-pick r243967. rdar://problem/49589308
+
+ REGRESSION (r243642): Crash in reddit.com page
+ https://bugs.webkit.org/show_bug.cgi?id=196684
+
+ Reviewed by Geoffrey Garen.
+
+ JSTests:
+
+ New regression test.
+
+ * stress/regexp-nongreedy-charclass-backtracks.js: Added.
+
+ Source/_javascript_Core:
+
+ In r243642, the code that saves and restores the count for non-greedy character classes
+ was inadvertently put inside an if statement. This code should be generated for all
+ non-greedy character classes.
+
+ * yarr/YarrJIT.cpp:
+ (JSC::Yarr::YarrGenerator::generateCharacterClassNonGreedy):
+ (JSC::Yarr::YarrGenerator::backtrackCharacterClassNonGreedy):
+
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243967 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2019-04-07 Michael Saboff <[email protected]>
+
+ REGRESSION (r243642): Crash in reddit.com page
+ https://bugs.webkit.org/show_bug.cgi?id=196684
+
+ Reviewed by Geoffrey Garen.
+
+ New regression test.
+
+ * stress/regexp-nongreedy-charclass-backtracks.js: Added.
+
2019-04-03 Robin Morisset <[email protected]>
B3 should use associativity to optimize _expression_ trees
Added: tags/Safari-608.1.15/JSTests/stress/regexp-nongreedy-charclass-backtracks.js (0 => 244024)
--- tags/Safari-608.1.15/JSTests/stress/regexp-nongreedy-charclass-backtracks.js (rev 0)
+++ tags/Safari-608.1.15/JSTests/stress/regexp-nongreedy-charclass-backtracks.js 2019-04-08 17:09:24 UTC (rev 244024)
@@ -0,0 +1,15 @@
+// The regression test checks that multiple non-greedy character classes backtrack properly.
+
+let re = /[^\/]+\/xxx\/[^\/]+?\/[^\/]+?\/[^\/]+?/;
+let str;
+let match;
+
+str = "blah/xxx/blah/blah_blah_blah_blah_blah_blah_blah_blah_blah_blah/";
+match = re.exec(str);
+if (match !== null)
+ throw(re + ".exec(\"" + str + "\") Should not have matched!");
+
+str = "blah/xxx/blah/blah_blah_blah_blah/";
+match = re.exec(str);
+if (match !== null)
+ throw(re + ".exec(\"" + str + "\") Should not have matched!");
Modified: tags/Safari-608.1.15/Source/_javascript_Core/ChangeLog (244023 => 244024)
--- tags/Safari-608.1.15/Source/_javascript_Core/ChangeLog 2019-04-08 17:09:21 UTC (rev 244023)
+++ tags/Safari-608.1.15/Source/_javascript_Core/ChangeLog 2019-04-08 17:09:24 UTC (rev 244024)
@@ -1,5 +1,48 @@
2019-04-08 Babak Shafiei <[email protected]>
+ Cherry-pick r243967. rdar://problem/49589308
+
+ REGRESSION (r243642): Crash in reddit.com page
+ https://bugs.webkit.org/show_bug.cgi?id=196684
+
+ Reviewed by Geoffrey Garen.
+
+ JSTests:
+
+ New regression test.
+
+ * stress/regexp-nongreedy-charclass-backtracks.js: Added.
+
+ Source/_javascript_Core:
+
+ In r243642, the code that saves and restores the count for non-greedy character classes
+ was inadvertently put inside an if statement. This code should be generated for all
+ non-greedy character classes.
+
+ * yarr/YarrJIT.cpp:
+ (JSC::Yarr::YarrGenerator::generateCharacterClassNonGreedy):
+ (JSC::Yarr::YarrGenerator::backtrackCharacterClassNonGreedy):
+
+
+ git-svn-id: https://svn.webkit.org/repository/webkit/trunk@243967 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+ 2019-04-07 Michael Saboff <[email protected]>
+
+ REGRESSION (r243642): Crash in reddit.com page
+ https://bugs.webkit.org/show_bug.cgi?id=196684
+
+ Reviewed by Geoffrey Garen.
+
+ In r243642, the code that saves and restores the count for non-greedy character classes
+ was inadvertently put inside an if statement. This code should be generated for all
+ non-greedy character classes.
+
+ * yarr/YarrJIT.cpp:
+ (JSC::Yarr::YarrGenerator::generateCharacterClassNonGreedy):
+ (JSC::Yarr::YarrGenerator::backtrackCharacterClassNonGreedy):
+
+2019-04-08 Babak Shafiei <[email protected]>
+
Cherry-pick r243839. rdar://problem/49589308
REGRESSION (r243642): com.apple._javascript_Core crash in JSC::RegExpObject::execInline
Modified: tags/Safari-608.1.15/Source/_javascript_Core/yarr/YarrJIT.cpp (244023 => 244024)
--- tags/Safari-608.1.15/Source/_javascript_Core/yarr/YarrJIT.cpp 2019-04-08 17:09:21 UTC (rev 244023)
+++ tags/Safari-608.1.15/Source/_javascript_Core/yarr/YarrJIT.cpp 2019-04-08 17:09:24 UTC (rev 244024)
@@ -1943,11 +1943,15 @@
move(TrustedImm32(0), countRegister);
op.m_reentry = label();
+
+#ifdef JIT_UNICODE_EXPRESSIONS
if (m_decodeSurrogatePairs) {
if (!term->characterClass->hasOneCharacterSize() || term->invert())
storeToFrame(index, term->frameLocation + BackTrackInfoCharacterClass::beginIndex());
- storeToFrame(countRegister, term->frameLocation + BackTrackInfoCharacterClass::matchAmountIndex());
}
+#endif
+
+ storeToFrame(countRegister, term->frameLocation + BackTrackInfoCharacterClass::matchAmountIndex());
}
void backtrackCharacterClassNonGreedy(size_t opIndex)
@@ -1966,10 +1970,11 @@
if (m_decodeSurrogatePairs) {
if (!term->characterClass->hasOneCharacterSize() || term->invert())
loadFromFrame(term->frameLocation + BackTrackInfoCharacterClass::beginIndex(), index);
- loadFromFrame(term->frameLocation + BackTrackInfoCharacterClass::matchAmountIndex(), countRegister);
}
#endif
+ loadFromFrame(term->frameLocation + BackTrackInfoCharacterClass::matchAmountIndex(), countRegister);
+
nonGreedyFailures.append(atEndOfInput());
nonGreedyFailures.append(branch32(Equal, countRegister, Imm32(term->quantityMaxCount.unsafeGet())));
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
