Bug 191731 - RegExp operations should not take fast patch if lastIndex is not numeric.
Summary: RegExp operations should not take fast patch if lastIndex is not numeric.
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Mark Lam
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2018-11-15 18:11 PST by Mark Lam
Modified: 2018-11-16 11:43 PST (History)
6 users (show)

See Also:

Attachments
proposed patch. (6.42 KB, patch)
2018-11-15 18:20 PST, Mark Lam 		no flags Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Mark Lam 2018-11-15 18:11:14 PST 
This is because if lastIndex is an object with a valueOf() method, it can execute arbitrary code and side effects not permitted by the RegExp fast paths.

<rdar://problem/46017305>
Comment 1 Mark Lam 2018-11-15 18:20:21 PST 
Created attachment 355010 [details]
proposed patch.
Comment 2 Saam Barati 2018-11-15 20:02:09 PST 
Comment on attachment 355010 [details]
proposed patch.

r=me
Comment 3 Mark Lam 2018-11-15 21:13:19 PST 
Thanks for the review.  Landed in r238267: <http://trac.webkit.org/r238267>.
Comment 4 Saam Barati 2018-11-16 11:43:46 PST 
Comment on attachment 355010 [details]
proposed patch.

View in context: https://bugs.webkit.org/attachment.cgi?id=355010&action=review

> JSTests/ChangeLog:3
> +        RegExp operations should not take fast patch if lastIndex is not numeric.

oops, this should be "path" not "patch"