191731 2018-11-15 18:11:14 -0800 RegExp operations should not take fast patch if lastIndex is not numeric. 2018-11-16 11:43:46 -0800 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 mark.lam mark.lam ews-watchlist joepeck keith_miller msaboff saam webkit-bug-importer oldest_to_newest 1479212 0 mark.lam 2018-11-15 18:11:14 -0800 This is because if lastIndex is an object with a valueOf() method, it can execute arbitrary code and side effects not permitted by the RegExp fast paths. <rdar://problem/46017305> 1479218 1 355010 mark.lam 2018-11-15 18:20:21 -0800 Created attachment 355010 proposed patch. 1479239 2 355010 saam 2018-11-15 20:02:09 -0800 Comment on attachment 355010 proposed patch. r=me 1479253 3 mark.lam 2018-11-15 21:13:19 -0800 Thanks for the review. Landed in r238267: <http://trac.webkit.org/r238267>. 1479531 4 355010 saam 2018-11-16 11:43:46 -0800 Comment on attachment 355010 proposed patch. View in context: https://bugs.webkit.org/attachment.cgi?id=355010&action=review > JSTests/ChangeLog:3 > + RegExp operations should not take fast patch if lastIndex is not numeric. oops, this should be "path" not "patch" 355010 2018-11-15 18:20:21 -0800 2018-11-15 18:20:21 -0800 proposed patch. bug-191731.patch text/plain 6575 mark.lam SW5kZXg6IEpTVGVzdHMvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIEpTVGVzdHMvQ2hhbmdlTG9n CShyZXZpc2lvbiAyMzgyNjQpCisrKyBKU1Rlc3RzL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpA QCAtMSwzICsxLDEzIEBACisyMDE4LTExLTE1ICBNYXJrIExhbSAgPG1hcmsubGFtQGFwcGxlLmNv bT4KKworICAgICAgICBSZWdFeHAgb3BlcmF0aW9ucyBzaG91bGQgbm90IHRha2UgZmFzdCBwYXRj aCBpZiBsYXN0SW5kZXggaXMgbm90IG51bWVyaWMuCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJr aXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xOTE3MzEKKyAgICAgICAgPHJkYXI6Ly9wcm9ibGVtLzQ2 MDE3MzA1PgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAg ICogc3RyZXNzL3JlZ3Jlc3MtMTkxNzMxLmpzOiBBZGRlZC4KKwogMjAxOC0xMS0xMyAgU2FhbSBC YXJhdGkgIDxzYmFyYXRpQGFwcGxlLmNvbT4KIAogICAgICAgICBUeXBlUHJvZmlsZUxvZzo6cHJv Y2Vzc0xvZ0VudHJpZXMgc2hvdWxkIHN0YXNoIGF3YXkgYW55IHBlbmRpbmcgZXhjZXB0aW9ucyBh bmQgcmUtYXBwbHkgdGhlbSB0byB0aGUgVk0KSW5kZXg6IEpTVGVzdHMvc3RyZXNzL3JlZ3Jlc3Mt MTkxNzMxLmpzCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT0KLS0tIEpTVGVzdHMvc3RyZXNzL3JlZ3Jlc3MtMTkxNzMxLmpz CShub25leGlzdGVudCkKKysrIEpTVGVzdHMvc3RyZXNzL3JlZ3Jlc3MtMTkxNzMxLmpzCSh3b3Jr aW5nIGNvcHkpCkBAIC0wLDAgKzEsMjcgQEAKK2Z1bmN0aW9uIGFzc2VydEVxKGFjdHVhbCwgZXhw ZWN0ZWQpIHsKKyAgICBpZiAoYWN0dWFsICE9IGV4cGVjdGVkKQorICAgICAgICB0aHJvdyAoIkV4 cGVjdGVkOiAiICsgZXhwZWN0ZWQgKyAiLCBhY3R1YWw6ICIgKyBhY3R1YWwpOworfQorCitmdW5j dGlvbiBmb28oYXJyLCByZWdleHAsIHN0cikgeworICAgIHJlZ2V4cFtTeW1ib2wubWF0Y2hdKHN0 cik7CisgICAgYXJyWzFdID0gMy41NDQ4NDgwNTg4OTYyNmUtMzEwOworICAgIHJldHVybiBhcnJb MF07Cit9CisKK2xldCBhcnIgPSBbMS4xLCAyLjIsIDMuM107CitsZXQgcmVnZXhwID0gL2EveTsK KworZm9yIChsZXQgaSA9IDA7IGkgPCAxMDAwMDsgaSsrKQorICAgIGZvbyhhcnIsIHJlZ2V4cCwg ImFiY2QiKTsKKworcmVnZXhwLmxhc3RJbmRleCA9IHsKKyAgICB2YWx1ZU9mOiAoKSA9PiB7Cisg ICAgICAgIGFyclswXSA9IGFycjsKKyAgICAgICAgcmV0dXJuIDA7CisgICAgfQorfTsKK2xldCBy ZXN1bHQgPSBmb28oYXJyLCByZWdleHAsICJhYmNkIik7CisKK2Fzc2VydEVxKGFyclsxXSwgIjMu NTQ0ODQ4MDU4ODk2MjZlLTMxMCIpOworYXNzZXJ0RXEocmVzdWx0LCAiLDMuNTQ0ODQ4MDU4ODk2 MjZlLTMxMCwzLjMiKTsKSW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PQotLS0gU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMjM4 MTkxKQorKysgU291cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpA QCAtMSwzICsxLDIzIEBACisyMDE4LTExLTE1ICBNYXJrIExhbSAgPG1hcmsubGFtQGFwcGxlLmNv bT4KKworICAgICAgICBSZWdFeHAgb3BlcmF0aW9ucyBzaG91bGQgbm90IHRha2UgZmFzdCBwYXRj aCBpZiBsYXN0SW5kZXggaXMgbm90IG51bWVyaWMuCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJr aXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xOTE3MzEKKyAgICAgICAgPHJkYXI6Ly9wcm9ibGVtLzQ2 MDE3MzA1PgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAg IFRoaXMgaXMgYmVjYXVzZSBpZiBsYXN0SW5kZXggaXMgYW4gb2JqZWN0IHdpdGggYSB2YWx1ZU9m KCkgbWV0aG9kLCBpdCBjYW4gZXhlY3V0ZQorICAgICAgICBhcmJpdHJhcnkgY29kZSB3aGljaCBt YXkgaGF2ZSBzaWRlIGVmZmVjdHMsIGFuZCBzaWRlIGVmZmVjdHMgbm90IHBlcm1pdHRlZCBieSB0 aGUKKyAgICAgICAgUmVnRXhwIGZhc3QgcGF0aHMuCisKKyAgICAgICAgKiBidWlsdGlucy9SZWdF eHBQcm90b3R5cGUuanM6CisgICAgICAgIChnbG9iYWxQcml2YXRlLmhhc09ic2VydmFibGVTaWRl RWZmZWN0c0ZvclJlZ0V4cE1hdGNoKToKKyAgICAgICAgKG92ZXJyaWRkZW5OYW1lLnN0cmluZ19h cHBlYXJlZF9oZXJlLnNlYXJjaCk6CisgICAgICAgIChnbG9iYWxQcml2YXRlLmhhc09ic2VydmFi bGVTaWRlRWZmZWN0c0ZvclJlZ0V4cFNwbGl0KToKKyAgICAgICAgKGludHJpbnNpYy5SZWdFeHBU ZXN0SW50cmluc2ljLnRlc3QpOgorICAgICAgICAqIGJ1aWx0aW5zL1N0cmluZ1Byb3RvdHlwZS5q czoKKyAgICAgICAgKGdsb2JhbFByaXZhdGUuaGFzT2JzZXJ2YWJsZVNpZGVFZmZlY3RzRm9yU3Ry aW5nUmVwbGFjZSk6CisKIDIwMTgtMTEtMTQgIFl1c3VrZSBTdXp1a2kgIDx5dXN1a2VzdXp1a2lA c2xvd3N0YXJ0Lm9yZz4KIAogICAgICAgICBVbnJldmlld2VkLCByb2xsaW5nIGluIENvZGVDYWNo ZSBpbiByMjM3MjU0CkluZGV4OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUvYnVpbHRpbnMvUmVnRXhw UHJvdG90eXBlLmpzCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9idWlsdGlu cy9SZWdFeHBQcm90b3R5cGUuanMJKHJldmlzaW9uIDIzODE5MSkKKysrIFNvdXJjZS9KYXZhU2Ny aXB0Q29yZS9idWlsdGlucy9SZWdFeHBQcm90b3R5cGUuanMJKHdvcmtpbmcgY29weSkKQEAgLTEs NSArMSw1IEBACiAvKgotICogQ29weXJpZ2h0IChDKSAyMDE2IEFwcGxlIEluYy4gQWxsIHJpZ2h0 cyByZXNlcnZlZC4KKyAqIENvcHlyaWdodCAoQykgMjAxNi0yMDE4IEFwcGxlIEluYy4gQWxsIHJp Z2h0cyByZXNlcnZlZC4KICAqCiAgKiBSZWRpc3RyaWJ1dGlvbiBhbmQgdXNlIGluIHNvdXJjZSBh bmQgYmluYXJ5IGZvcm1zLCB3aXRoIG9yIHdpdGhvdXQKICAqIG1vZGlmaWNhdGlvbiwgYXJlIHBl cm1pdHRlZCBwcm92aWRlZCB0aGF0IHRoZSBmb2xsb3dpbmcgY29uZGl0aW9ucwpAQCAtNjcsNiAr NjcsOSBAQCBmdW5jdGlvbiBoYXNPYnNlcnZhYmxlU2lkZUVmZmVjdHNGb3JSZWdFCiB7CiAgICAg InVzZSBzdHJpY3QiOwogCisgICAgaWYgKCFAaXNSZWdFeHBPYmplY3QocmVnZXhwKSkKKyAgICAg ICAgcmV0dXJuIHRydWU7CisKICAgICAvLyBUaGlzIGlzIGFjY2Vzc2VkIGJ5IHRoZSBSZWdFeHBF eGVjIGludGVybmFsIGZ1bmN0aW9uLgogICAgIGxldCByZWdleHBFeGVjID0gQHRyeUdldEJ5SWQo cmVnZXhwLCAiZXhlYyIpOwogICAgIGlmIChyZWdleHBFeGVjICE9PSBAcmVnRXhwQnVpbHRpbkV4 ZWMpCkBAIC03OSw3ICs4Miw3IEBAIGZ1bmN0aW9uIGhhc09ic2VydmFibGVTaWRlRWZmZWN0c0Zv clJlZ0UKICAgICBpZiAocmVnZXhwVW5pY29kZSAhPT0gQHJlZ0V4cFByb3RvVW5pY29kZUdldHRl cikKICAgICAgICAgcmV0dXJuIHRydWU7CiAKLSAgICByZXR1cm4gIUBpc1JlZ0V4cE9iamVjdChy ZWdleHApOworICAgIHJldHVybiB0eXBlb2YgcmVnZXhwLmxhc3RJbmRleCAhPT0gIm51bWJlciI7 CiB9CiAKIEBnbG9iYWxQcml2YXRlCkBAIC0zMTUsNyArMzE4LDkgQEAgZnVuY3Rpb24gc2VhcmNo KHN0ckFyZykKICAgICBsZXQgcmVnZXhwID0gdGhpczsKIAogICAgIC8vIENoZWNrIGZvciBvYnNl cnZhYmxlIHNpZGUgZWZmZWN0cyBhbmQgY2FsbCB0aGUgZmFzdCBwYXRoIGlmIHRoZXJlIGFyZW4n dCBhbnkuCi0gICAgaWYgKEBpc1JlZ0V4cE9iamVjdChyZWdleHApICYmIEB0cnlHZXRCeUlkKHJl Z2V4cCwgImV4ZWMiKSA9PT0gQHJlZ0V4cEJ1aWx0aW5FeGVjKQorICAgIGlmIChAaXNSZWdFeHBP YmplY3QocmVnZXhwKQorICAgICAgICAmJiBAdHJ5R2V0QnlJZChyZWdleHAsICJleGVjIikgPT09 IEByZWdFeHBCdWlsdGluRXhlYworICAgICAgICAmJiB0eXBlb2YgcmVnZXhwLmxhc3RJbmRleCA9 PT0gIm51bWJlciIpCiAgICAgICAgIHJldHVybiBAcmVnRXhwU2VhcmNoRmFzdC5AY2FsbChyZWdl eHAsIHN0ckFyZyk7CiAKICAgICAvLyAxLiBMZXQgcnggYmUgdGhlIHRoaXMgdmFsdWUuCkBAIC0z NTgsNiArMzYzLDkgQEAgZnVuY3Rpb24gaGFzT2JzZXJ2YWJsZVNpZGVFZmZlY3RzRm9yUmVnRQog ewogICAgICJ1c2Ugc3RyaWN0IjsKIAorICAgIGlmICghQGlzUmVnRXhwT2JqZWN0KHJlZ2V4cCkp CisgICAgICAgIHJldHVybiB0cnVlOworCiAgICAgLy8gVGhpcyBpcyBhY2Nlc3NlZCBieSB0aGUg UmVnRXhwRXhlYyBpbnRlcm5hbCBmdW5jdGlvbi4KICAgICBsZXQgcmVnZXhwRXhlYyA9IEB0cnlH ZXRCeUlkKHJlZ2V4cCwgImV4ZWMiKTsKICAgICBpZiAocmVnZXhwRXhlYyAhPT0gQHJlZ0V4cEJ1 aWx0aW5FeGVjKQpAQCAtMzg5LDggKzM5Nyw4IEBAIGZ1bmN0aW9uIGhhc09ic2VydmFibGVTaWRl RWZmZWN0c0ZvclJlZ0UKICAgICBsZXQgcmVnZXhwU291cmNlID0gQHRyeUdldEJ5SWQocmVnZXhw LCAic291cmNlIik7CiAgICAgaWYgKHJlZ2V4cFNvdXJjZSAhPT0gQHJlZ0V4cFByb3RvU291cmNl R2V0dGVyKQogICAgICAgICByZXR1cm4gdHJ1ZTsKLSAgICAKLSAgICByZXR1cm4gIUBpc1JlZ0V4 cE9iamVjdChyZWdleHApOworCisgICAgcmV0dXJuIHR5cGVvZiByZWdleHAubGFzdEluZGV4ICE9 PSAibnVtYmVyIjsKIH0KIAogLy8gRVMgMjEuMi41LjExIFJlZ0V4cC5wcm90b3R5cGVbQEBzcGxp dF0oc3RyaW5nLCBsaW1pdCkKQEAgLTUzNiw3ICs1NDQsOSBAQCBmdW5jdGlvbiB0ZXN0KHN0ckFy ZykKICAgICBsZXQgcmVnZXhwID0gdGhpczsKIAogICAgIC8vIENoZWNrIGZvciBvYnNlcnZhYmxl IHNpZGUgZWZmZWN0cyBhbmQgY2FsbCB0aGUgZmFzdCBwYXRoIGlmIHRoZXJlIGFyZW4ndCBhbnku Ci0gICAgaWYgKEBpc1JlZ0V4cE9iamVjdChyZWdleHApICYmIEB0cnlHZXRCeUlkKHJlZ2V4cCwg ImV4ZWMiKSA9PT0gQHJlZ0V4cEJ1aWx0aW5FeGVjKQorICAgIGlmIChAaXNSZWdFeHBPYmplY3Qo cmVnZXhwKQorICAgICAgICAmJiBAdHJ5R2V0QnlJZChyZWdleHAsICJleGVjIikgPT09IEByZWdF eHBCdWlsdGluRXhlYworICAgICAgICAmJiB0eXBlb2YgcmVnZXhwLmxhc3RJbmRleCA9PT0gIm51 bWJlciIpCiAgICAgICAgIHJldHVybiBAcmVnRXhwVGVzdEZhc3QuQGNhbGwocmVnZXhwLCBzdHJB cmcpOwogCiAgICAgLy8gMS4gTGV0IFIgYmUgdGhlIHRoaXMgdmFsdWUuCkluZGV4OiBTb3VyY2Uv SmF2YVNjcmlwdENvcmUvYnVpbHRpbnMvU3RyaW5nUHJvdG90eXBlLmpzCj09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0t IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9idWlsdGlucy9TdHJpbmdQcm90b3R5cGUuanMJKHJldmlz aW9uIDIzODE5MSkKKysrIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9idWlsdGlucy9TdHJpbmdQcm90 b3R5cGUuanMJKHdvcmtpbmcgY29weSkKQEAgLTEsNyArMSw3IEBACiAvKgogICogQ29weXJpZ2h0 IChDKSAyMDE1IEFuZHkgVmFuV2Fnb25lciA8YW5keUB2YW53YWdvbmVyLmZhbWlseT4uCiAgKiBD b3B5cmlnaHQgKEMpIDIwMTYgWXVzdWtlIFN1enVraSA8dXRhdGFuZS50ZWFAZ21haWwuY29tPgot ICogQ29weXJpZ2h0IChDKSAyMDE2IEFwcGxlIEluYy4gQWxsIHJpZ2h0cyByZXNlcnZlZC4KKyAq IENvcHlyaWdodCAoQykgMjAxNi0yMDE4IEFwcGxlIEluYy4gQWxsIHJpZ2h0cyByZXNlcnZlZC4K ICAqCiAgKiBSZWRpc3RyaWJ1dGlvbiBhbmQgdXNlIGluIHNvdXJjZSBhbmQgYmluYXJ5IGZvcm1z LCB3aXRoIG9yIHdpdGhvdXQKICAqIG1vZGlmaWNhdGlvbiwgYXJlIHBlcm1pdHRlZCBwcm92aWRl ZCB0aGF0IHRoZSBmb2xsb3dpbmcgY29uZGl0aW9ucwpAQCAtMTk1LDYgKzE5NSw5IEBAIGZ1bmN0 aW9uIGhhc09ic2VydmFibGVTaWRlRWZmZWN0c0ZvclN0cmkKIHsKICAgICAidXNlIHN0cmljdCI7 CiAKKyAgICBpZiAoIUBpc1JlZ0V4cE9iamVjdChyZWdleHApKQorICAgICAgICByZXR1cm4gdHJ1 ZTsKKwogICAgIGlmIChyZXBsYWNlciAhPT0gQHJlZ0V4cFByb3RvdHlwZVN5bWJvbFJlcGxhY2Up CiAgICAgICAgIHJldHVybiB0cnVlOwogICAgIApAQCAtMjEwLDcgKzIxMyw3IEBAIGZ1bmN0aW9u IGhhc09ic2VydmFibGVTaWRlRWZmZWN0c0ZvclN0cmkKICAgICBpZiAocmVnZXhwVW5pY29kZSAh PT0gQHJlZ0V4cFByb3RvVW5pY29kZUdldHRlcikKICAgICAgICAgcmV0dXJuIHRydWU7CiAKLSAg ICByZXR1cm4gIUBpc1JlZ0V4cE9iamVjdChyZWdleHApOworICAgIHJldHVybiB0eXBlb2YgcmVn ZXhwLmxhc3RJbmRleCAhPT0gIm51bWJlciI7CiB9CiAKIEBpbnRyaW5zaWM9U3RyaW5nUHJvdG90 eXBlUmVwbGFjZUludHJpbnNpYwo=