|
| 1 | +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 |
| 2 | +From: Jakob Gruber <jgruber@chromium.org> |
| 3 | +Date: Mon, 6 Apr 2020 15:48:53 +0200 |
| 4 | +Subject: Merged: [regexp] Reserve space for all registers in interpreter |
| 5 | + |
| 6 | +This is a minimal version of https://crrev.com/c/2135642 intended for |
| 7 | +backmerges. |
| 8 | + |
| 9 | +Ensure that the interpreter has space for all required registers. |
| 10 | + |
| 11 | +(cherry picked from commit 30658b6b1b672e535e6046fa84674882e29b2279) |
| 12 | + |
| 13 | +Tbr: leszeks@chromium.org |
| 14 | +No-Try: true |
| 15 | +No-Presubmit: true |
| 16 | +No-Treechecks: true |
| 17 | +Bug: chromium:1067270 |
| 18 | +Change-Id: Iefd016b4845fb8698d1e0ef5f6a03df0e66aa576 |
| 19 | +Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2137403 |
| 20 | +Commit-Queue: Jakob Gruber <jgruber@chromium.org> |
| 21 | +Reviewed-by: Leszek Swirski <leszeks@chromium.org> |
| 22 | +Cr-Original-Commit-Position: refs/heads/master@{#67013} |
| 23 | +Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2144052 |
| 24 | +Reviewed-by: Jakob Gruber <jgruber@chromium.org> |
| 25 | +Cr-Commit-Position: refs/branch-heads/8.1@{#61} |
| 26 | +Cr-Branched-From: a4dcd39d521d14c4b1cac020812e44ee04a7f244-refs/heads/8.1.307@{#1} |
| 27 | +Cr-Branched-From: f22c213304ec3542df87019aed0909b7dafeaa93-refs/heads/master@{#66031} |
| 28 | + |
| 29 | +diff --git a/src/regexp/regexp-interpreter.cc b/src/regexp/regexp-interpreter.cc |
| 30 | +index cf2fb55e4a861ce4916f9c27ac0fde1c3085f84f..42f477543b675fbf478587242e34ddcb801e35a3 100644 |
| 31 | +--- a/src/regexp/regexp-interpreter.cc |
| 32 | ++++ b/src/regexp/regexp-interpreter.cc |
| 33 | +@@ -869,8 +869,29 @@ IrregexpInterpreter::Result IrregexpInterpreter::MatchForCallFromJs( |
| 34 | + String subject_string = String::cast(Object(subject)); |
| 35 | + JSRegExp regexp_obj = JSRegExp::cast(Object(regexp)); |
| 36 | + |
| 37 | +- return Match(isolate, regexp_obj, subject_string, registers, registers_length, |
| 38 | +- start_position, call_origin); |
| 39 | ++ // In generated code, registers are allocated on the stack. The given |
| 40 | ++ // `registers` argument is only guaranteed to hold enough space for permanent |
| 41 | ++ // registers (i.e. for captures), and not for temporary registers used only |
| 42 | ++ // during matcher execution. We match that behavior in the interpreter by |
| 43 | ++ // using a SmallVector as internal register storage. |
| 44 | ++ static constexpr int kBaseRegisterArraySize = 64; // Arbitrary. |
| 45 | ++ const int internal_register_count = |
| 46 | ++ Smi::ToInt(regexp_obj.DataAt(JSRegExp::kIrregexpMaxRegisterCountIndex)); |
| 47 | ++ base::SmallVector<int, kBaseRegisterArraySize> internal_registers( |
| 48 | ++ internal_register_count); |
| 49 | ++ |
| 50 | ++ Result result = |
| 51 | ++ Match(isolate, regexp_obj, subject_string, internal_registers.data(), |
| 52 | ++ internal_register_count, start_position, call_origin); |
| 53 | ++ |
| 54 | ++ // Copy capture registers to the output array. |
| 55 | ++ if (result == IrregexpInterpreter::SUCCESS) { |
| 56 | ++ CHECK_GE(internal_registers.size(), registers_length); |
| 57 | ++ MemCopy(registers, internal_registers.data(), |
| 58 | ++ registers_length * sizeof(registers[0])); |
| 59 | ++ } |
| 60 | ++ |
| 61 | ++ return result; |
| 62 | + } |
| 63 | + |
| 64 | + IrregexpInterpreter::Result IrregexpInterpreter::MatchForCallFromRuntime( |
| 65 | +diff --git a/test/mjsunit/regress/regress-1067270.js b/test/mjsunit/regress/regress-1067270.js |
| 66 | +new file mode 100644 |
| 67 | +index 0000000000000000000000000000000000000000..1c6eddf505aa55e622df9d7116ea7fbb2f516713 |
| 68 | +--- /dev/null |
| 69 | ++++ b/test/mjsunit/regress/regress-1067270.js |
| 70 | +@@ -0,0 +1,11 @@ |
| 71 | ++// Copyright 2020 the V8 project authors. All rights reserved. |
| 72 | ++// Use of this source code is governed by a BSD-style license that can be |
| 73 | ++// found in the LICENSE file. |
| 74 | ++// |
| 75 | ++// Flags: --allow-natives-syntax |
| 76 | ++ |
| 77 | ++const needle = Array(1802).join(" +") + Array(16884).join("A"); |
| 78 | ++const string = "A"; |
| 79 | ++ |
| 80 | ++assertEquals(string.search(needle), -1); |
| 81 | ++assertEquals(string.search(needle), -1); |
0 commit comments