Patch forthcoming.
Created attachment 279936 [details] it does something The intuition is that the individual regexp matches are not really observable, so if we detect trouble, we can just do a dry run to see how bad things get before we start allocating tons of memory. On my test case (from jsfunfuzz), this reduces the runtime by >10x and reduces memory usage by ~8x and eliminates swapping. Hooray.
Created attachment 279943 [details] the patch
Attachment 279943 [details] did not pass style-queue: ERROR: Source/JavaScriptCore/runtime/RegExpObject.cpp:183: Place brace on its own line for function definitions. [whitespace/braces] [4] ERROR: Source/JavaScriptCore/runtime/RegExpObject.cpp:220: Semicolon defining empty statement for this loop. Use { } instead. [whitespace/semicolon] [5] Total errors found: 2 in 8 files If any of these errors are false positives, please file a bug against check-webkit-style.
Created attachment 279958 [details] performance Looks neutral on the major benchmarks.
Comment on attachment 279943 [details] the patch r=me Please add a test that goes into the dry run code but still succeeds.
Landed in http://trac.webkit.org/changeset/201451