Attachment 340668 Details for Bug 185755 – Patch

[patch] Patch

185755.patch (text/plain), 8.61 KB, created by Michael Saboff on 2018-05-17 17:13:33 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Michael Saboff

Created: 2018-05-17 17:13:33 PDT

Size: 8.61 KB

patch

obsolete

>Index: JSTests/ChangeLog
>===================================================================
>--- JSTests/ChangeLog	(revision 231931)
>+++ JSTests/ChangeLog	(working copy)
>@@ -1,3 +1,21 @@
>+2018-05-17  Michael Saboff  <msaboff@apple.com>
>+
>+        We don't throw SyntaxErrors for runtime generated regular expressions with errors
>+        https://bugs.webkit.org/show_bug.cgi?id=185755
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        New regression test.
>+
>+        * stress/regexp-with-runtime-syntax-errors.js: Added.
>+        (testThrowsSyntaxtError):
>+        (fromExecWithBadUnicodeEscape):
>+        (fromTestWithBadUnicodeProperty):
>+        (fromSplitWithBadUnicodeIdentity):
>+        (fromMatchWithBadUnicodeBackReference):
>+        (fromReplaceWithBadUnicodeEscape):
>+        (fromSearchWithBadUnicodeEscape):
>+
> 2018-05-16  Caio Lima  <ticaiolima@gmail.com>
> 
>         [ESNext][BigInt] Implement support for "/" operation
>Index: JSTests/stress/regexp-with-runtime-syntax-errors.js
>===================================================================
>--- JSTests/stress/regexp-with-runtime-syntax-errors.js	(nonexistent)
>+++ JSTests/stress/regexp-with-runtime-syntax-errors.js	(working copy)
>@@ -0,0 +1,66 @@
>+// This test checks that malformed regular expressions compiled at runtime throw SyntaxErrors
>+
>+function testThrowsSyntaxtError(f)
>+{
>+    try {
>+        f();
>+    } catch (e) {
>+        if (!e instanceof SyntaxError)
>+            throw "Expected SynteaxError, but got: " + e;
>+    }
>+}
>+
>+function fromExecWithBadUnicodeEscape()
>+{
>+    let baseRE = /\u{123x}/;
>+    let line = "abc";
>+
>+    (new RegExp(baseRE, "u")).exec(line);
>+}
>+
>+function fromTestWithBadUnicodeProperty()
>+{
>+    let baseRE = /a|\p{Blah}/;
>+    let line = "abc";
>+
>+    (new RegExp(baseRE, "u")).test(line);
>+}
>+
>+function fromSplitWithBadUnicodeIdentity()
>+{
>+    let baseRE = /,|:|\-/;
>+    let line = "abc:def-ghi";
>+
>+    let fields = line.split(new RegExp(baseRE, "u"));
>+}
>+
>+function fromMatchWithBadUnicodeBackReference()
>+{
>+    let baseRE = /\123/;
>+    let line = "xyz";
>+
>+    let fields = line.match(new RegExp(baseRE, "u"));
>+}
>+
>+function fromReplaceWithBadUnicodeEscape()
>+{
>+    let baseRE = /\%/;
>+    let line = "xyz";
>+
>+    let fields = line.replace(new RegExp(baseRE, "u"), "x");
>+}
>+
>+function fromSearchWithBadUnicodeEscape()
>+{
>+    let baseRE = /\=/;
>+    let line = "xyz";
>+
>+    let fields = line.search(new RegExp(baseRE, "u"));
>+}
>+
>+testThrowsSyntaxtError(fromExecWithBadUnicodeEscape);
>+testThrowsSyntaxtError(fromTestWithBadUnicodeProperty);
>+testThrowsSyntaxtError(fromSplitWithBadUnicodeIdentity);
>+testThrowsSyntaxtError(fromMatchWithBadUnicodeBackReference);
>+testThrowsSyntaxtError(fromReplaceWithBadUnicodeEscape);
>+testThrowsSyntaxtError(fromSearchWithBadUnicodeEscape);
>Index: Source/JavaScriptCore/ChangeLog
>===================================================================
>--- Source/JavaScriptCore/ChangeLog	(revision 231872)
>+++ Source/JavaScriptCore/ChangeLog	(working copy)
>@@ -1,3 +1,25 @@
>+2018-05-17  Michael Saboff  <msaboff@apple.com>
>+
>+        We don't throw SyntaxErrors for runtime generated regular expressions with errors
>+        https://bugs.webkit.org/show_bug.cgi?id=185755
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Added a new helper that creates the correct exception to throw for each type of error when
>+        compiling a RegExp.  Using that new helper, added missing checks for RegExp for the cases
>+        where we create a new RegExp from an existing one.  Also refactored other places that we
>+        throw SyntaxErrors after a failed RegExp compile to use the new helper.
>+
>+        * runtime/RegExp.h:
>+        * runtime/RegExpConstructor.cpp:
>+        (JSC::regExpCreate):
>+        (JSC::constructRegExp):
>+        * runtime/RegExpPrototype.cpp:
>+        (JSC::regExpProtoFuncCompile):
>+        * yarr/YarrErrorCode.cpp:
>+        (JSC::Yarr::errorToThrow):
>+        * yarr/YarrErrorCode.h:
>+
> 2018-05-16  Filip Pizlo  <fpizlo@apple.com>
> 
>         DFG models InstanceOf incorrectly
>Index: Source/JavaScriptCore/runtime/RegExp.h
>===================================================================
>--- Source/JavaScriptCore/runtime/RegExp.h	(revision 231872)
>+++ Source/JavaScriptCore/runtime/RegExp.h	(working copy)
>@@ -62,6 +62,7 @@ public:
> 
>     bool isValid() const { return !Yarr::hasError(m_constructionErrorCode) && m_flags != InvalidFlags; }
>     const char* errorMessage() const { return Yarr::errorMessage(m_constructionErrorCode); }
>+    JSObject* errorToThrow(ExecState* exec) { return Yarr::errorToThrow(exec, m_constructionErrorCode); }
> 
>     JS_EXPORT_PRIVATE int match(VM&, const String&, unsigned startOffset, Vector<int>& ovector);
> 
>Index: Source/JavaScriptCore/runtime/RegExpConstructor.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/RegExpConstructor.cpp	(revision 231872)
>+++ Source/JavaScriptCore/runtime/RegExpConstructor.cpp	(working copy)
>@@ -243,7 +243,7 @@ static JSObject* regExpCreate(ExecState*
> 
>     RegExp* regExp = RegExp::create(vm, pattern, flags);
>     if (!regExp->isValid())
>-        return throwException(exec, scope, createSyntaxError(exec, regExp->errorMessage()));
>+        return throwException(exec, scope, regExp->errorToThrow(exec));
> 
>     Structure* structure = getRegExpStructure(exec, globalObject, newTarget);
>     RETURN_IF_EXCEPTION(scope, nullptr);
>@@ -281,6 +281,9 @@ JSObject* constructRegExp(ExecState* exe
>             if (flags == InvalidFlags)
>                 return nullptr;
>             regExp = RegExp::create(vm, regExp->pattern(), flags);
>+
>+            if (!regExp->isValid())
>+                throwException(exec, scope, regExp->errorToThrow(exec));
>         }
> 
>         return RegExpObject::create(vm, structure, regExp);
>Index: Source/JavaScriptCore/runtime/RegExpPrototype.cpp
>===================================================================
>--- Source/JavaScriptCore/runtime/RegExpPrototype.cpp	(revision 231872)
>+++ Source/JavaScriptCore/runtime/RegExpPrototype.cpp	(working copy)
>@@ -174,7 +174,7 @@ EncodedJSValue JSC_HOST_CALL regExpProto
>     }
> 
>     if (!regExp->isValid())
>-        return throwVMError(exec, scope, createSyntaxError(exec, regExp->errorMessage()));
>+        return throwVMError(exec, scope, regExp->errorToThrow(exec));
> 
>     thisRegExp->setRegExp(vm, regExp);
>     scope.release();
>Index: Source/JavaScriptCore/yarr/YarrErrorCode.cpp
>===================================================================
>--- Source/JavaScriptCore/yarr/YarrErrorCode.cpp	(revision 231872)
>+++ Source/JavaScriptCore/yarr/YarrErrorCode.cpp	(working copy)
>@@ -26,6 +26,8 @@
> #include "config.h"
> #include "YarrErrorCode.h"
> 
>+#include "Error.h"
>+
> namespace JSC { namespace Yarr {
> 
> const char* errorMessage(ErrorCode error)
>@@ -58,4 +60,37 @@ const char* errorMessage(ErrorCode error
>     return errorMessages[static_cast<unsigned>(error)];
> }
> 
>+JSObject* errorToThrow(ExecState* exec, ErrorCode error)
>+{
>+    switch (error) {
>+    case ErrorCode::NoError:
>+        ASSERT_NOT_REACHED();
>+        return nullptr;
>+    case ErrorCode::PatternTooLarge:
>+    case ErrorCode::QuantifierOutOfOrder:
>+    case ErrorCode::QuantifierWithoutAtom:
>+    case ErrorCode::QuantifierTooLarge:
>+    case ErrorCode::MissingParentheses:
>+    case ErrorCode::ParenthesesUnmatched:
>+    case ErrorCode::ParenthesesTypeInvalid:
>+    case ErrorCode::InvalidGroupName:
>+    case ErrorCode::DuplicateGroupName:
>+    case ErrorCode::CharacterClassUnmatched:
>+    case ErrorCode::CharacterClassOutOfOrder:
>+    case ErrorCode::EscapeUnterminated:
>+    case ErrorCode::InvalidUnicodeEscape:
>+    case ErrorCode::InvalidBackreference:
>+    case ErrorCode::InvalidIdentityEscape:
>+    case ErrorCode::InvalidUnicodePropertyExpression:
>+    case ErrorCode::OffsetTooLarge:
>+    case ErrorCode::InvalidRegularExpressionFlags:
>+        return createSyntaxError(exec, errorMessage(error));
>+    case ErrorCode::TooManyDisjunctions:
>+        return createOutOfMemoryError(exec);
>+    }
>+
>+    ASSERT_NOT_REACHED();
>+    return nullptr;
>+}
>+
> } } // namespace JSC::Yarr
>Index: Source/JavaScriptCore/yarr/YarrErrorCode.h
>===================================================================
>--- Source/JavaScriptCore/yarr/YarrErrorCode.h	(revision 231872)
>+++ Source/JavaScriptCore/yarr/YarrErrorCode.h	(working copy)
>@@ -25,7 +25,12 @@
> 
> #pragma once
> 
>-namespace JSC { namespace Yarr {
>+namespace JSC {
>+
>+class ExecState;
>+class JSObject;
>+
>+namespace Yarr {
> 
> enum class ErrorCode : unsigned {
>     NoError = 0,
>@@ -55,5 +60,6 @@ inline bool hasError(ErrorCode errorCode
> {
>     return errorCode != ErrorCode::NoError;
> }
>+JS_EXPORT_PRIVATE JSObject* errorToThrow(ExecState*, ErrorCode);
> 
> } } // namespace JSC::Yarr

Flags:

keith_miller: review+
ews-watchlist: commit-queue-

Actions: View | Formatted Diff | Diff

Attachments on bug 185755: 340668 | 340669 | 340670