nephele
/
haikuwebkit
1
0
Fork 0
Code Issues Releases Activity
haikuwebkit/LayoutTests/js/stack-overflow-regexp-expec...

34 lines
2.7 KiB
Plaintext
Raw Permalink Normal View History

[JSC] RegExp with deeply nested subexpressions overflow the stack in Yarr https://bugs.webkit.org/show_bug.cgi?id=158011 rdar://problem/25946592 Reviewed by Saam Barati. Source/JavaScriptCore: When generating the meta-data required for compilation, Yarr uses a recursive function over the various expression in the pattern. If you have many nested expressions, you can run out of stack and crash the WebProcess. This patch changes that into a soft failure. The expression is just considered invalid. * runtime/RegExp.cpp: (JSC::RegExp::finishCreation): (JSC::RegExp::compile): (JSC::RegExp::compileMatchOnly): * yarr/YarrPattern.cpp: (JSC::Yarr::YarrPatternConstructor::YarrPatternConstructor): (JSC::Yarr::YarrPatternConstructor::setupOffsets): (JSC::Yarr::YarrPatternConstructor::isSafeToRecurse): (JSC::Yarr::YarrPattern::compile): (JSC::Yarr::YarrPattern::YarrPattern): (JSC::Yarr::YarrPatternConstructor::setupAlternativeOffsets): Deleted. (JSC::Yarr::YarrPatternConstructor::setupDisjunctionOffsets): Deleted. * yarr/YarrPattern.h: LayoutTests: * js/script-tests/stack-overflow-arrity-catch.js: With the new failure, this test can fail on allocating the RegExp for a valid reason. The new expression should not have this issue. * js/script-tests/stack-overflow-regexp.js: Added. (shouldThrow.recursiveCall): (shouldThrow): (recursiveCall): * js/stack-overflow-regexp-expected.txt: Added. * js/stack-overflow-regexp.html: Added. Canonical link: https://commits.webkit.org/176215@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@201412 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2016-05-26 03:19:06 +00:00
Test that we do not overflow the stack while handling regular expressions
On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
[JSC] Make OutOfMemory error as instance of RangeError https://bugs.webkit.org/show_bug.cgi?id=211952 Reviewed by Mark Lam. JSTests: * ChakraCore/test/Error/outofmem.baseline-jsc: * es6/String.prototype_methods_String.prototype.padEnd.js: (TestMemoryLimits): * es6/String.prototype_methods_String.prototype.padStart.js: (TestMemoryLimits): * slowMicrobenchmarks/function-constructor-with-huge-strings.js: * stress/array-join-on-strings-need-overflow-checks.js: * stress/big-wasm-memory-grow-no-max.js: (test): * stress/big-wasm-memory-grow.js: (test): * stress/big-wasm-memory.js: (test): * stress/bigint-exponential-oom.js: (shouldThrow): * stress/bigint-int32-min-shift.js: (shouldThrow): * stress/check-symbol-description-oom.js: * stress/constructFunctionSkippingEvalEnabledCheck-should-throw-out-of-memory-error.js: * stress/intl-canonicalize-locale-list-error-oom.js: (shouldThrow): * stress/joined-strings-should-not-exceed-max-string-length.js: * stress/js-fixed-array-out-of-memory.js: (test): * stress/json-stringified-overflow-2.js: (catch): * stress/json-stringified-overflow.js: (catch): * stress/json-stringify-string-builder-overflow.js: * stress/missing-exception-check-in-JSValue-toWTFStringSlowCase.js: * stress/missing-exception-check-in-array-prototype-fastJoin.js: * stress/missing-exception-check-in-canonicalizeLocaleList.js: * stress/missing-exception-check-in-json-stringifier-gap.js: * stress/missing-exception-check-in-string-compare.js: * stress/missing-exception-check-in-string-greater-than-compare.js: * stress/missing-exception-check-in-string-greater-than-or-equal-compare.js: * stress/missing-exception-check-in-string-lastIndexOf.js: * stress/missing-exception-check-in-string-less-than-compare.js: * stress/missing-exception-check-in-string-less-than-or-equal-compare.js: * stress/missing-exception-check-in-string-toLower.js: * stress/missing-exception-check-in-string-toUpper.js: * stress/new_array_with_spread-should-cap-array-size-to-MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH.js: * stress/out-of-memory-while-constructing-BytecodeGenerator.js: * stress/regexp-prototype-exec-on-too-long-rope.js: * stress/regexp-prototype-match-on-too-long-rope.js: * stress/regexp-prototype-test-on-too-long-rope.js: * stress/regress-169783.js: (doTest): * stress/regress-178385.js: * stress/regress-178386.js: * stress/regress-185888.js: * stress/regress-189132.js: * stress/regress-190187.js: * stress/regress-191563.js: * stress/scoped-arguments-table-should-be-tolerant-for-oom.js: (i.canThrow): * stress/string-16bit-repeat-overflow.js: * stress/string-overflow-createError-builder.js: * stress/string-overflow-createError-fit.js: * stress/string-overflow-createError.js: * stress/string-prototype-charCodeAt-on-too-long-rope.js: * stress/string-prototype-replace-should-throw-out-of-memory-error-when-using-too-much-memory.js: * stress/switch-string-oom.js: (testLowerTiers): (testFTL): * stress/test-exception-assert-in-ExceptionHelpers-createError.js: * stress/test-out-of-memory.js: * stress/typed-array-subarray-can-throw-oom-error.js: (get bar): * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE-2.js: * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE.js: Source/JavaScriptCore: The spec sometimes requires "check parameters and throw RangeError" before allocating an object. But we are just allocating an object and throwing an out-of-memory error since wrong parameter will cause out-of-memory. If out-of-memory error is RangeError, then we can keep our current behavior while we can make us spec compliant. And note that out-of-memory error is RangeError in SpiderMonkey and V8. This patch makes out-of-memory error as RangeError instead of Error. We also fix @throwOutOfMemoryError in builtin code: the previous thrown errors are not marked as out-of-memory error. * bytecode/BytecodeList.rb: * bytecompiler/BytecodeGenerator.cpp: (JSC::BytecodeGenerator::emitThrowStaticError): (JSC::BytecodeGenerator::emitThrowReferenceError): (JSC::BytecodeGenerator::emitThrowTypeError): (JSC::BytecodeGenerator::emitThrowRangeError): (JSC::BytecodeGenerator::emitThrowOutOfMemoryError): * bytecompiler/BytecodeGenerator.h: * bytecompiler/NodesCodegen.cpp: (JSC::RegExpNode::emitBytecode): (JSC::BytecodeIntrinsicNode::emit_intrinsic_throwTypeError): (JSC::BytecodeIntrinsicNode::emit_intrinsic_throwRangeError): * dfg/DFGOperations.cpp: * runtime/CommonSlowPaths.cpp: (JSC::SLOW_PATH_DECL): * runtime/Error.cpp: (JSC::createError): (JSC::createOutOfMemoryError): * runtime/Error.h: * runtime/ErrorType.cpp: (JSC::errorTypeName): (WTF::printInternal): * runtime/ErrorType.h: We introduced ErrorTypeWithExtension separately from ErrorType to keep ErrorType one-on-one to spec-specified error types. LayoutTests: * inspector/debugger/no-pause-out-of-memory-exception-expected.txt: * js/array-join-expected.txt: * js/dom/concat-large-strings-crash-expected.txt: * js/dom/concat-large-strings-crash2-expected.txt: * js/dom/script-tests/string-replacement-outofmemory.js: * js/dom/string-concatenate-outofmemory-expected.txt: * js/dom/string-replacement-outofmemory-expected.txt: * js/large-expressions-expected.txt: * js/resources/string-concatenate-outofmemory.js: * js/script-tests/array-join.js: * js/script-tests/stack-overflow-regexp.js: (shouldThrow.recursiveCall): (shouldThrow): * js/script-tests/string-padend.js: * js/script-tests/string-padstart.js: * js/script-tests/string-repeat.js: * js/script-tests/stringimpl-to-jsstring-on-large-strings-1.js: * js/stack-overflow-regexp-expected.txt: * js/string-padend-expected.txt: * js/string-padstart-expected.txt: * js/string-repeat-expected.txt: * js/stringimpl-to-jsstring-on-large-strings-1-expected.txt: Canonical link: https://commits.webkit.org/224872@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@261780 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2020-05-16 08:24:22 +00:00
PASS new RegExp(Array(500000).join("(") + "a" + Array(500000).join(")")) threw exception RangeError: Out of memory: Invalid regular expression: too many nested disjunctions.
[JSC] RegExp with deeply nested subexpressions overflow the stack in Yarr https://bugs.webkit.org/show_bug.cgi?id=158011 rdar://problem/25946592 Reviewed by Saam Barati. Source/JavaScriptCore: When generating the meta-data required for compilation, Yarr uses a recursive function over the various expression in the pattern. If you have many nested expressions, you can run out of stack and crash the WebProcess. This patch changes that into a soft failure. The expression is just considered invalid. * runtime/RegExp.cpp: (JSC::RegExp::finishCreation): (JSC::RegExp::compile): (JSC::RegExp::compileMatchOnly): * yarr/YarrPattern.cpp: (JSC::Yarr::YarrPatternConstructor::YarrPatternConstructor): (JSC::Yarr::YarrPatternConstructor::setupOffsets): (JSC::Yarr::YarrPatternConstructor::isSafeToRecurse): (JSC::Yarr::YarrPattern::compile): (JSC::Yarr::YarrPattern::YarrPattern): (JSC::Yarr::YarrPatternConstructor::setupAlternativeOffsets): Deleted. (JSC::Yarr::YarrPatternConstructor::setupDisjunctionOffsets): Deleted. * yarr/YarrPattern.h: LayoutTests: * js/script-tests/stack-overflow-arrity-catch.js: With the new failure, this test can fail on allocating the RegExp for a valid reason. The new expression should not have this issue. * js/script-tests/stack-overflow-regexp.js: Added. (shouldThrow.recursiveCall): (shouldThrow): (recursiveCall): * js/stack-overflow-regexp-expected.txt: Added. * js/stack-overflow-regexp.html: Added. Canonical link: https://commits.webkit.org/176215@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@201412 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2016-05-26 03:19:06 +00:00
Creating RegExp at depth 0
[JSC] Make OutOfMemory error as instance of RangeError https://bugs.webkit.org/show_bug.cgi?id=211952 Reviewed by Mark Lam. JSTests: * ChakraCore/test/Error/outofmem.baseline-jsc: * es6/String.prototype_methods_String.prototype.padEnd.js: (TestMemoryLimits): * es6/String.prototype_methods_String.prototype.padStart.js: (TestMemoryLimits): * slowMicrobenchmarks/function-constructor-with-huge-strings.js: * stress/array-join-on-strings-need-overflow-checks.js: * stress/big-wasm-memory-grow-no-max.js: (test): * stress/big-wasm-memory-grow.js: (test): * stress/big-wasm-memory.js: (test): * stress/bigint-exponential-oom.js: (shouldThrow): * stress/bigint-int32-min-shift.js: (shouldThrow): * stress/check-symbol-description-oom.js: * stress/constructFunctionSkippingEvalEnabledCheck-should-throw-out-of-memory-error.js: * stress/intl-canonicalize-locale-list-error-oom.js: (shouldThrow): * stress/joined-strings-should-not-exceed-max-string-length.js: * stress/js-fixed-array-out-of-memory.js: (test): * stress/json-stringified-overflow-2.js: (catch): * stress/json-stringified-overflow.js: (catch): * stress/json-stringify-string-builder-overflow.js: * stress/missing-exception-check-in-JSValue-toWTFStringSlowCase.js: * stress/missing-exception-check-in-array-prototype-fastJoin.js: * stress/missing-exception-check-in-canonicalizeLocaleList.js: * stress/missing-exception-check-in-json-stringifier-gap.js: * stress/missing-exception-check-in-string-compare.js: * stress/missing-exception-check-in-string-greater-than-compare.js: * stress/missing-exception-check-in-string-greater-than-or-equal-compare.js: * stress/missing-exception-check-in-string-lastIndexOf.js: * stress/missing-exception-check-in-string-less-than-compare.js: * stress/missing-exception-check-in-string-less-than-or-equal-compare.js: * stress/missing-exception-check-in-string-toLower.js: * stress/missing-exception-check-in-string-toUpper.js: * stress/new_array_with_spread-should-cap-array-size-to-MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH.js: * stress/out-of-memory-while-constructing-BytecodeGenerator.js: * stress/regexp-prototype-exec-on-too-long-rope.js: * stress/regexp-prototype-match-on-too-long-rope.js: * stress/regexp-prototype-test-on-too-long-rope.js: * stress/regress-169783.js: (doTest): * stress/regress-178385.js: * stress/regress-178386.js: * stress/regress-185888.js: * stress/regress-189132.js: * stress/regress-190187.js: * stress/regress-191563.js: * stress/scoped-arguments-table-should-be-tolerant-for-oom.js: (i.canThrow): * stress/string-16bit-repeat-overflow.js: * stress/string-overflow-createError-builder.js: * stress/string-overflow-createError-fit.js: * stress/string-overflow-createError.js: * stress/string-prototype-charCodeAt-on-too-long-rope.js: * stress/string-prototype-replace-should-throw-out-of-memory-error-when-using-too-much-memory.js: * stress/switch-string-oom.js: (testLowerTiers): (testFTL): * stress/test-exception-assert-in-ExceptionHelpers-createError.js: * stress/test-out-of-memory.js: * stress/typed-array-subarray-can-throw-oom-error.js: (get bar): * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE-2.js: * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE.js: Source/JavaScriptCore: The spec sometimes requires "check parameters and throw RangeError" before allocating an object. But we are just allocating an object and throwing an out-of-memory error since wrong parameter will cause out-of-memory. If out-of-memory error is RangeError, then we can keep our current behavior while we can make us spec compliant. And note that out-of-memory error is RangeError in SpiderMonkey and V8. This patch makes out-of-memory error as RangeError instead of Error. We also fix @throwOutOfMemoryError in builtin code: the previous thrown errors are not marked as out-of-memory error. * bytecode/BytecodeList.rb: * bytecompiler/BytecodeGenerator.cpp: (JSC::BytecodeGenerator::emitThrowStaticError): (JSC::BytecodeGenerator::emitThrowReferenceError): (JSC::BytecodeGenerator::emitThrowTypeError): (JSC::BytecodeGenerator::emitThrowRangeError): (JSC::BytecodeGenerator::emitThrowOutOfMemoryError): * bytecompiler/BytecodeGenerator.h: * bytecompiler/NodesCodegen.cpp: (JSC::RegExpNode::emitBytecode): (JSC::BytecodeIntrinsicNode::emit_intrinsic_throwTypeError): (JSC::BytecodeIntrinsicNode::emit_intrinsic_throwRangeError): * dfg/DFGOperations.cpp: * runtime/CommonSlowPaths.cpp: (JSC::SLOW_PATH_DECL): * runtime/Error.cpp: (JSC::createError): (JSC::createOutOfMemoryError): * runtime/Error.h: * runtime/ErrorType.cpp: (JSC::errorTypeName): (WTF::printInternal): * runtime/ErrorType.h: We introduced ErrorTypeWithExtension separately from ErrorType to keep ErrorType one-on-one to spec-specified error types. LayoutTests: * inspector/debugger/no-pause-out-of-memory-exception-expected.txt: * js/array-join-expected.txt: * js/dom/concat-large-strings-crash-expected.txt: * js/dom/concat-large-strings-crash2-expected.txt: * js/dom/script-tests/string-replacement-outofmemory.js: * js/dom/string-concatenate-outofmemory-expected.txt: * js/dom/string-replacement-outofmemory-expected.txt: * js/large-expressions-expected.txt: * js/resources/string-concatenate-outofmemory.js: * js/script-tests/array-join.js: * js/script-tests/stack-overflow-regexp.js: (shouldThrow.recursiveCall): (shouldThrow): * js/script-tests/string-padend.js: * js/script-tests/string-padstart.js: * js/script-tests/string-repeat.js: * js/script-tests/stringimpl-to-jsstring-on-large-strings-1.js: * js/stack-overflow-regexp-expected.txt: * js/string-padend-expected.txt: * js/string-padstart-expected.txt: * js/string-repeat-expected.txt: * js/stringimpl-to-jsstring-on-large-strings-1-expected.txt: Canonical link: https://commits.webkit.org/224872@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@261780 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2020-05-16 08:24:22 +00:00
PASS new RegExp(Array(500000).join("(") + "a" + Array(500000).join(")")) threw exception RangeError: Out of memory: Invalid regular expression: too many nested disjunctions.
[JSC] RegExp with deeply nested subexpressions overflow the stack in Yarr https://bugs.webkit.org/show_bug.cgi?id=158011 rdar://problem/25946592 Reviewed by Saam Barati. Source/JavaScriptCore: When generating the meta-data required for compilation, Yarr uses a recursive function over the various expression in the pattern. If you have many nested expressions, you can run out of stack and crash the WebProcess. This patch changes that into a soft failure. The expression is just considered invalid. * runtime/RegExp.cpp: (JSC::RegExp::finishCreation): (JSC::RegExp::compile): (JSC::RegExp::compileMatchOnly): * yarr/YarrPattern.cpp: (JSC::Yarr::YarrPatternConstructor::YarrPatternConstructor): (JSC::Yarr::YarrPatternConstructor::setupOffsets): (JSC::Yarr::YarrPatternConstructor::isSafeToRecurse): (JSC::Yarr::YarrPattern::compile): (JSC::Yarr::YarrPattern::YarrPattern): (JSC::Yarr::YarrPatternConstructor::setupAlternativeOffsets): Deleted. (JSC::Yarr::YarrPatternConstructor::setupDisjunctionOffsets): Deleted. * yarr/YarrPattern.h: LayoutTests: * js/script-tests/stack-overflow-arrity-catch.js: With the new failure, this test can fail on allocating the RegExp for a valid reason. The new expression should not have this issue. * js/script-tests/stack-overflow-regexp.js: Added. (shouldThrow.recursiveCall): (shouldThrow): (recursiveCall): * js/stack-overflow-regexp-expected.txt: Added. * js/stack-overflow-regexp.html: Added. Canonical link: https://commits.webkit.org/176215@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@201412 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2016-05-26 03:19:06 +00:00
Creating RegExp at depth 10
[JSC] Make OutOfMemory error as instance of RangeError https://bugs.webkit.org/show_bug.cgi?id=211952 Reviewed by Mark Lam. JSTests: * ChakraCore/test/Error/outofmem.baseline-jsc: * es6/String.prototype_methods_String.prototype.padEnd.js: (TestMemoryLimits): * es6/String.prototype_methods_String.prototype.padStart.js: (TestMemoryLimits): * slowMicrobenchmarks/function-constructor-with-huge-strings.js: * stress/array-join-on-strings-need-overflow-checks.js: * stress/big-wasm-memory-grow-no-max.js: (test): * stress/big-wasm-memory-grow.js: (test): * stress/big-wasm-memory.js: (test): * stress/bigint-exponential-oom.js: (shouldThrow): * stress/bigint-int32-min-shift.js: (shouldThrow): * stress/check-symbol-description-oom.js: * stress/constructFunctionSkippingEvalEnabledCheck-should-throw-out-of-memory-error.js: * stress/intl-canonicalize-locale-list-error-oom.js: (shouldThrow): * stress/joined-strings-should-not-exceed-max-string-length.js: * stress/js-fixed-array-out-of-memory.js: (test): * stress/json-stringified-overflow-2.js: (catch): * stress/json-stringified-overflow.js: (catch): * stress/json-stringify-string-builder-overflow.js: * stress/missing-exception-check-in-JSValue-toWTFStringSlowCase.js: * stress/missing-exception-check-in-array-prototype-fastJoin.js: * stress/missing-exception-check-in-canonicalizeLocaleList.js: * stress/missing-exception-check-in-json-stringifier-gap.js: * stress/missing-exception-check-in-string-compare.js: * stress/missing-exception-check-in-string-greater-than-compare.js: * stress/missing-exception-check-in-string-greater-than-or-equal-compare.js: * stress/missing-exception-check-in-string-lastIndexOf.js: * stress/missing-exception-check-in-string-less-than-compare.js: * stress/missing-exception-check-in-string-less-than-or-equal-compare.js: * stress/missing-exception-check-in-string-toLower.js: * stress/missing-exception-check-in-string-toUpper.js: * stress/new_array_with_spread-should-cap-array-size-to-MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH.js: * stress/out-of-memory-while-constructing-BytecodeGenerator.js: * stress/regexp-prototype-exec-on-too-long-rope.js: * stress/regexp-prototype-match-on-too-long-rope.js: * stress/regexp-prototype-test-on-too-long-rope.js: * stress/regress-169783.js: (doTest): * stress/regress-178385.js: * stress/regress-178386.js: * stress/regress-185888.js: * stress/regress-189132.js: * stress/regress-190187.js: * stress/regress-191563.js: * stress/scoped-arguments-table-should-be-tolerant-for-oom.js: (i.canThrow): * stress/string-16bit-repeat-overflow.js: * stress/string-overflow-createError-builder.js: * stress/string-overflow-createError-fit.js: * stress/string-overflow-createError.js: * stress/string-prototype-charCodeAt-on-too-long-rope.js: * stress/string-prototype-replace-should-throw-out-of-memory-error-when-using-too-much-memory.js: * stress/switch-string-oom.js: (testLowerTiers): (testFTL): * stress/test-exception-assert-in-ExceptionHelpers-createError.js: * stress/test-out-of-memory.js: * stress/typed-array-subarray-can-throw-oom-error.js: (get bar): * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE-2.js: * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE.js: Source/JavaScriptCore: The spec sometimes requires "check parameters and throw RangeError" before allocating an object. But we are just allocating an object and throwing an out-of-memory error since wrong parameter will cause out-of-memory. If out-of-memory error is RangeError, then we can keep our current behavior while we can make us spec compliant. And note that out-of-memory error is RangeError in SpiderMonkey and V8. This patch makes out-of-memory error as RangeError instead of Error. We also fix @throwOutOfMemoryError in builtin code: the previous thrown errors are not marked as out-of-memory error. * bytecode/BytecodeList.rb: * bytecompiler/BytecodeGenerator.cpp: (JSC::BytecodeGenerator::emitThrowStaticError): (JSC::BytecodeGenerator::emitThrowReferenceError): (JSC::BytecodeGenerator::emitThrowTypeError): (JSC::BytecodeGenerator::emitThrowRangeError): (JSC::BytecodeGenerator::emitThrowOutOfMemoryError): * bytecompiler/BytecodeGenerator.h: * bytecompiler/NodesCodegen.cpp: (JSC::RegExpNode::emitBytecode): (JSC::BytecodeIntrinsicNode::emit_intrinsic_throwTypeError): (JSC::BytecodeIntrinsicNode::emit_intrinsic_throwRangeError): * dfg/DFGOperations.cpp: * runtime/CommonSlowPaths.cpp: (JSC::SLOW_PATH_DECL): * runtime/Error.cpp: (JSC::createError): (JSC::createOutOfMemoryError): * runtime/Error.h: * runtime/ErrorType.cpp: (JSC::errorTypeName): (WTF::printInternal): * runtime/ErrorType.h: We introduced ErrorTypeWithExtension separately from ErrorType to keep ErrorType one-on-one to spec-specified error types. LayoutTests: * inspector/debugger/no-pause-out-of-memory-exception-expected.txt: * js/array-join-expected.txt: * js/dom/concat-large-strings-crash-expected.txt: * js/dom/concat-large-strings-crash2-expected.txt: * js/dom/script-tests/string-replacement-outofmemory.js: * js/dom/string-concatenate-outofmemory-expected.txt: * js/dom/string-replacement-outofmemory-expected.txt: * js/large-expressions-expected.txt: * js/resources/string-concatenate-outofmemory.js: * js/script-tests/array-join.js: * js/script-tests/stack-overflow-regexp.js: (shouldThrow.recursiveCall): (shouldThrow): * js/script-tests/string-padend.js: * js/script-tests/string-padstart.js: * js/script-tests/string-repeat.js: * js/script-tests/stringimpl-to-jsstring-on-large-strings-1.js: * js/stack-overflow-regexp-expected.txt: * js/string-padend-expected.txt: * js/string-padstart-expected.txt: * js/string-repeat-expected.txt: * js/stringimpl-to-jsstring-on-large-strings-1-expected.txt: Canonical link: https://commits.webkit.org/224872@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@261780 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2020-05-16 08:24:22 +00:00
PASS new RegExp(Array(500000).join("(") + "a" + Array(500000).join(")")) threw exception RangeError: Out of memory: Invalid regular expression: too many nested disjunctions.
[JSC] RegExp with deeply nested subexpressions overflow the stack in Yarr https://bugs.webkit.org/show_bug.cgi?id=158011 rdar://problem/25946592 Reviewed by Saam Barati. Source/JavaScriptCore: When generating the meta-data required for compilation, Yarr uses a recursive function over the various expression in the pattern. If you have many nested expressions, you can run out of stack and crash the WebProcess. This patch changes that into a soft failure. The expression is just considered invalid. * runtime/RegExp.cpp: (JSC::RegExp::finishCreation): (JSC::RegExp::compile): (JSC::RegExp::compileMatchOnly): * yarr/YarrPattern.cpp: (JSC::Yarr::YarrPatternConstructor::YarrPatternConstructor): (JSC::Yarr::YarrPatternConstructor::setupOffsets): (JSC::Yarr::YarrPatternConstructor::isSafeToRecurse): (JSC::Yarr::YarrPattern::compile): (JSC::Yarr::YarrPattern::YarrPattern): (JSC::Yarr::YarrPatternConstructor::setupAlternativeOffsets): Deleted. (JSC::Yarr::YarrPatternConstructor::setupDisjunctionOffsets): Deleted. * yarr/YarrPattern.h: LayoutTests: * js/script-tests/stack-overflow-arrity-catch.js: With the new failure, this test can fail on allocating the RegExp for a valid reason. The new expression should not have this issue. * js/script-tests/stack-overflow-regexp.js: Added. (shouldThrow.recursiveCall): (shouldThrow): (recursiveCall): * js/stack-overflow-regexp-expected.txt: Added. * js/stack-overflow-regexp.html: Added. Canonical link: https://commits.webkit.org/176215@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@201412 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2016-05-26 03:19:06 +00:00
Creating RegExp at depth 20
[JSC] Make OutOfMemory error as instance of RangeError https://bugs.webkit.org/show_bug.cgi?id=211952 Reviewed by Mark Lam. JSTests: * ChakraCore/test/Error/outofmem.baseline-jsc: * es6/String.prototype_methods_String.prototype.padEnd.js: (TestMemoryLimits): * es6/String.prototype_methods_String.prototype.padStart.js: (TestMemoryLimits): * slowMicrobenchmarks/function-constructor-with-huge-strings.js: * stress/array-join-on-strings-need-overflow-checks.js: * stress/big-wasm-memory-grow-no-max.js: (test): * stress/big-wasm-memory-grow.js: (test): * stress/big-wasm-memory.js: (test): * stress/bigint-exponential-oom.js: (shouldThrow): * stress/bigint-int32-min-shift.js: (shouldThrow): * stress/check-symbol-description-oom.js: * stress/constructFunctionSkippingEvalEnabledCheck-should-throw-out-of-memory-error.js: * stress/intl-canonicalize-locale-list-error-oom.js: (shouldThrow): * stress/joined-strings-should-not-exceed-max-string-length.js: * stress/js-fixed-array-out-of-memory.js: (test): * stress/json-stringified-overflow-2.js: (catch): * stress/json-stringified-overflow.js: (catch): * stress/json-stringify-string-builder-overflow.js: * stress/missing-exception-check-in-JSValue-toWTFStringSlowCase.js: * stress/missing-exception-check-in-array-prototype-fastJoin.js: * stress/missing-exception-check-in-canonicalizeLocaleList.js: * stress/missing-exception-check-in-json-stringifier-gap.js: * stress/missing-exception-check-in-string-compare.js: * stress/missing-exception-check-in-string-greater-than-compare.js: * stress/missing-exception-check-in-string-greater-than-or-equal-compare.js: * stress/missing-exception-check-in-string-lastIndexOf.js: * stress/missing-exception-check-in-string-less-than-compare.js: * stress/missing-exception-check-in-string-less-than-or-equal-compare.js: * stress/missing-exception-check-in-string-toLower.js: * stress/missing-exception-check-in-string-toUpper.js: * stress/new_array_with_spread-should-cap-array-size-to-MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH.js: * stress/out-of-memory-while-constructing-BytecodeGenerator.js: * stress/regexp-prototype-exec-on-too-long-rope.js: * stress/regexp-prototype-match-on-too-long-rope.js: * stress/regexp-prototype-test-on-too-long-rope.js: * stress/regress-169783.js: (doTest): * stress/regress-178385.js: * stress/regress-178386.js: * stress/regress-185888.js: * stress/regress-189132.js: * stress/regress-190187.js: * stress/regress-191563.js: * stress/scoped-arguments-table-should-be-tolerant-for-oom.js: (i.canThrow): * stress/string-16bit-repeat-overflow.js: * stress/string-overflow-createError-builder.js: * stress/string-overflow-createError-fit.js: * stress/string-overflow-createError.js: * stress/string-prototype-charCodeAt-on-too-long-rope.js: * stress/string-prototype-replace-should-throw-out-of-memory-error-when-using-too-much-memory.js: * stress/switch-string-oom.js: (testLowerTiers): (testFTL): * stress/test-exception-assert-in-ExceptionHelpers-createError.js: * stress/test-out-of-memory.js: * stress/typed-array-subarray-can-throw-oom-error.js: (get bar): * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE-2.js: * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE.js: Source/JavaScriptCore: The spec sometimes requires "check parameters and throw RangeError" before allocating an object. But we are just allocating an object and throwing an out-of-memory error since wrong parameter will cause out-of-memory. If out-of-memory error is RangeError, then we can keep our current behavior while we can make us spec compliant. And note that out-of-memory error is RangeError in SpiderMonkey and V8. This patch makes out-of-memory error as RangeError instead of Error. We also fix @throwOutOfMemoryError in builtin code: the previous thrown errors are not marked as out-of-memory error. * bytecode/BytecodeList.rb: * bytecompiler/BytecodeGenerator.cpp: (JSC::BytecodeGenerator::emitThrowStaticError): (JSC::BytecodeGenerator::emitThrowReferenceError): (JSC::BytecodeGenerator::emitThrowTypeError): (JSC::BytecodeGenerator::emitThrowRangeError): (JSC::BytecodeGenerator::emitThrowOutOfMemoryError): * bytecompiler/BytecodeGenerator.h: * bytecompiler/NodesCodegen.cpp: (JSC::RegExpNode::emitBytecode): (JSC::BytecodeIntrinsicNode::emit_intrinsic_throwTypeError): (JSC::BytecodeIntrinsicNode::emit_intrinsic_throwRangeError): * dfg/DFGOperations.cpp: * runtime/CommonSlowPaths.cpp: (JSC::SLOW_PATH_DECL): * runtime/Error.cpp: (JSC::createError): (JSC::createOutOfMemoryError): * runtime/Error.h: * runtime/ErrorType.cpp: (JSC::errorTypeName): (WTF::printInternal): * runtime/ErrorType.h: We introduced ErrorTypeWithExtension separately from ErrorType to keep ErrorType one-on-one to spec-specified error types. LayoutTests: * inspector/debugger/no-pause-out-of-memory-exception-expected.txt: * js/array-join-expected.txt: * js/dom/concat-large-strings-crash-expected.txt: * js/dom/concat-large-strings-crash2-expected.txt: * js/dom/script-tests/string-replacement-outofmemory.js: * js/dom/string-concatenate-outofmemory-expected.txt: * js/dom/string-replacement-outofmemory-expected.txt: * js/large-expressions-expected.txt: * js/resources/string-concatenate-outofmemory.js: * js/script-tests/array-join.js: * js/script-tests/stack-overflow-regexp.js: (shouldThrow.recursiveCall): (shouldThrow): * js/script-tests/string-padend.js: * js/script-tests/string-padstart.js: * js/script-tests/string-repeat.js: * js/script-tests/stringimpl-to-jsstring-on-large-strings-1.js: * js/stack-overflow-regexp-expected.txt: * js/string-padend-expected.txt: * js/string-padstart-expected.txt: * js/string-repeat-expected.txt: * js/stringimpl-to-jsstring-on-large-strings-1-expected.txt: Canonical link: https://commits.webkit.org/224872@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@261780 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2020-05-16 08:24:22 +00:00
PASS new RegExp(Array(500000).join("(") + "a" + Array(500000).join(")")) threw exception RangeError: Out of memory: Invalid regular expression: too many nested disjunctions.
[JSC] RegExp with deeply nested subexpressions overflow the stack in Yarr https://bugs.webkit.org/show_bug.cgi?id=158011 rdar://problem/25946592 Reviewed by Saam Barati. Source/JavaScriptCore: When generating the meta-data required for compilation, Yarr uses a recursive function over the various expression in the pattern. If you have many nested expressions, you can run out of stack and crash the WebProcess. This patch changes that into a soft failure. The expression is just considered invalid. * runtime/RegExp.cpp: (JSC::RegExp::finishCreation): (JSC::RegExp::compile): (JSC::RegExp::compileMatchOnly): * yarr/YarrPattern.cpp: (JSC::Yarr::YarrPatternConstructor::YarrPatternConstructor): (JSC::Yarr::YarrPatternConstructor::setupOffsets): (JSC::Yarr::YarrPatternConstructor::isSafeToRecurse): (JSC::Yarr::YarrPattern::compile): (JSC::Yarr::YarrPattern::YarrPattern): (JSC::Yarr::YarrPatternConstructor::setupAlternativeOffsets): Deleted. (JSC::Yarr::YarrPatternConstructor::setupDisjunctionOffsets): Deleted. * yarr/YarrPattern.h: LayoutTests: * js/script-tests/stack-overflow-arrity-catch.js: With the new failure, this test can fail on allocating the RegExp for a valid reason. The new expression should not have this issue. * js/script-tests/stack-overflow-regexp.js: Added. (shouldThrow.recursiveCall): (shouldThrow): (recursiveCall): * js/stack-overflow-regexp-expected.txt: Added. * js/stack-overflow-regexp.html: Added. Canonical link: https://commits.webkit.org/176215@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@201412 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2016-05-26 03:19:06 +00:00
Creating RegExp at depth 30
[JSC] Make OutOfMemory error as instance of RangeError https://bugs.webkit.org/show_bug.cgi?id=211952 Reviewed by Mark Lam. JSTests: * ChakraCore/test/Error/outofmem.baseline-jsc: * es6/String.prototype_methods_String.prototype.padEnd.js: (TestMemoryLimits): * es6/String.prototype_methods_String.prototype.padStart.js: (TestMemoryLimits): * slowMicrobenchmarks/function-constructor-with-huge-strings.js: * stress/array-join-on-strings-need-overflow-checks.js: * stress/big-wasm-memory-grow-no-max.js: (test): * stress/big-wasm-memory-grow.js: (test): * stress/big-wasm-memory.js: (test): * stress/bigint-exponential-oom.js: (shouldThrow): * stress/bigint-int32-min-shift.js: (shouldThrow): * stress/check-symbol-description-oom.js: * stress/constructFunctionSkippingEvalEnabledCheck-should-throw-out-of-memory-error.js: * stress/intl-canonicalize-locale-list-error-oom.js: (shouldThrow): * stress/joined-strings-should-not-exceed-max-string-length.js: * stress/js-fixed-array-out-of-memory.js: (test): * stress/json-stringified-overflow-2.js: (catch): * stress/json-stringified-overflow.js: (catch): * stress/json-stringify-string-builder-overflow.js: * stress/missing-exception-check-in-JSValue-toWTFStringSlowCase.js: * stress/missing-exception-check-in-array-prototype-fastJoin.js: * stress/missing-exception-check-in-canonicalizeLocaleList.js: * stress/missing-exception-check-in-json-stringifier-gap.js: * stress/missing-exception-check-in-string-compare.js: * stress/missing-exception-check-in-string-greater-than-compare.js: * stress/missing-exception-check-in-string-greater-than-or-equal-compare.js: * stress/missing-exception-check-in-string-lastIndexOf.js: * stress/missing-exception-check-in-string-less-than-compare.js: * stress/missing-exception-check-in-string-less-than-or-equal-compare.js: * stress/missing-exception-check-in-string-toLower.js: * stress/missing-exception-check-in-string-toUpper.js: * stress/new_array_with_spread-should-cap-array-size-to-MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH.js: * stress/out-of-memory-while-constructing-BytecodeGenerator.js: * stress/regexp-prototype-exec-on-too-long-rope.js: * stress/regexp-prototype-match-on-too-long-rope.js: * stress/regexp-prototype-test-on-too-long-rope.js: * stress/regress-169783.js: (doTest): * stress/regress-178385.js: * stress/regress-178386.js: * stress/regress-185888.js: * stress/regress-189132.js: * stress/regress-190187.js: * stress/regress-191563.js: * stress/scoped-arguments-table-should-be-tolerant-for-oom.js: (i.canThrow): * stress/string-16bit-repeat-overflow.js: * stress/string-overflow-createError-builder.js: * stress/string-overflow-createError-fit.js: * stress/string-overflow-createError.js: * stress/string-prototype-charCodeAt-on-too-long-rope.js: * stress/string-prototype-replace-should-throw-out-of-memory-error-when-using-too-much-memory.js: * stress/switch-string-oom.js: (testLowerTiers): (testFTL): * stress/test-exception-assert-in-ExceptionHelpers-createError.js: * stress/test-out-of-memory.js: * stress/typed-array-subarray-can-throw-oom-error.js: (get bar): * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE-2.js: * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE.js: Source/JavaScriptCore: The spec sometimes requires "check parameters and throw RangeError" before allocating an object. But we are just allocating an object and throwing an out-of-memory error since wrong parameter will cause out-of-memory. If out-of-memory error is RangeError, then we can keep our current behavior while we can make us spec compliant. And note that out-of-memory error is RangeError in SpiderMonkey and V8. This patch makes out-of-memory error as RangeError instead of Error. We also fix @throwOutOfMemoryError in builtin code: the previous thrown errors are not marked as out-of-memory error. * bytecode/BytecodeList.rb: * bytecompiler/BytecodeGenerator.cpp: (JSC::BytecodeGenerator::emitThrowStaticError): (JSC::BytecodeGenerator::emitThrowReferenceError): (JSC::BytecodeGenerator::emitThrowTypeError): (JSC::BytecodeGenerator::emitThrowRangeError): (JSC::BytecodeGenerator::emitThrowOutOfMemoryError): * bytecompiler/BytecodeGenerator.h: * bytecompiler/NodesCodegen.cpp: (JSC::RegExpNode::emitBytecode): (JSC::BytecodeIntrinsicNode::emit_intrinsic_throwTypeError): (JSC::BytecodeIntrinsicNode::emit_intrinsic_throwRangeError): * dfg/DFGOperations.cpp: * runtime/CommonSlowPaths.cpp: (JSC::SLOW_PATH_DECL): * runtime/Error.cpp: (JSC::createError): (JSC::createOutOfMemoryError): * runtime/Error.h: * runtime/ErrorType.cpp: (JSC::errorTypeName): (WTF::printInternal): * runtime/ErrorType.h: We introduced ErrorTypeWithExtension separately from ErrorType to keep ErrorType one-on-one to spec-specified error types. LayoutTests: * inspector/debugger/no-pause-out-of-memory-exception-expected.txt: * js/array-join-expected.txt: * js/dom/concat-large-strings-crash-expected.txt: * js/dom/concat-large-strings-crash2-expected.txt: * js/dom/script-tests/string-replacement-outofmemory.js: * js/dom/string-concatenate-outofmemory-expected.txt: * js/dom/string-replacement-outofmemory-expected.txt: * js/large-expressions-expected.txt: * js/resources/string-concatenate-outofmemory.js: * js/script-tests/array-join.js: * js/script-tests/stack-overflow-regexp.js: (shouldThrow.recursiveCall): (shouldThrow): * js/script-tests/string-padend.js: * js/script-tests/string-padstart.js: * js/script-tests/string-repeat.js: * js/script-tests/stringimpl-to-jsstring-on-large-strings-1.js: * js/stack-overflow-regexp-expected.txt: * js/string-padend-expected.txt: * js/string-padstart-expected.txt: * js/string-repeat-expected.txt: * js/stringimpl-to-jsstring-on-large-strings-1-expected.txt: Canonical link: https://commits.webkit.org/224872@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@261780 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2020-05-16 08:24:22 +00:00
PASS new RegExp(Array(500000).join("(") + "a" + Array(500000).join(")")) threw exception RangeError: Out of memory: Invalid regular expression: too many nested disjunctions.
[JSC] RegExp with deeply nested subexpressions overflow the stack in Yarr https://bugs.webkit.org/show_bug.cgi?id=158011 rdar://problem/25946592 Reviewed by Saam Barati. Source/JavaScriptCore: When generating the meta-data required for compilation, Yarr uses a recursive function over the various expression in the pattern. If you have many nested expressions, you can run out of stack and crash the WebProcess. This patch changes that into a soft failure. The expression is just considered invalid. * runtime/RegExp.cpp: (JSC::RegExp::finishCreation): (JSC::RegExp::compile): (JSC::RegExp::compileMatchOnly): * yarr/YarrPattern.cpp: (JSC::Yarr::YarrPatternConstructor::YarrPatternConstructor): (JSC::Yarr::YarrPatternConstructor::setupOffsets): (JSC::Yarr::YarrPatternConstructor::isSafeToRecurse): (JSC::Yarr::YarrPattern::compile): (JSC::Yarr::YarrPattern::YarrPattern): (JSC::Yarr::YarrPatternConstructor::setupAlternativeOffsets): Deleted. (JSC::Yarr::YarrPatternConstructor::setupDisjunctionOffsets): Deleted. * yarr/YarrPattern.h: LayoutTests: * js/script-tests/stack-overflow-arrity-catch.js: With the new failure, this test can fail on allocating the RegExp for a valid reason. The new expression should not have this issue. * js/script-tests/stack-overflow-regexp.js: Added. (shouldThrow.recursiveCall): (shouldThrow): (recursiveCall): * js/stack-overflow-regexp-expected.txt: Added. * js/stack-overflow-regexp.html: Added. Canonical link: https://commits.webkit.org/176215@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@201412 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2016-05-26 03:19:06 +00:00
Creating RegExp at depth 40
[JSC] Make OutOfMemory error as instance of RangeError https://bugs.webkit.org/show_bug.cgi?id=211952 Reviewed by Mark Lam. JSTests: * ChakraCore/test/Error/outofmem.baseline-jsc: * es6/String.prototype_methods_String.prototype.padEnd.js: (TestMemoryLimits): * es6/String.prototype_methods_String.prototype.padStart.js: (TestMemoryLimits): * slowMicrobenchmarks/function-constructor-with-huge-strings.js: * stress/array-join-on-strings-need-overflow-checks.js: * stress/big-wasm-memory-grow-no-max.js: (test): * stress/big-wasm-memory-grow.js: (test): * stress/big-wasm-memory.js: (test): * stress/bigint-exponential-oom.js: (shouldThrow): * stress/bigint-int32-min-shift.js: (shouldThrow): * stress/check-symbol-description-oom.js: * stress/constructFunctionSkippingEvalEnabledCheck-should-throw-out-of-memory-error.js: * stress/intl-canonicalize-locale-list-error-oom.js: (shouldThrow): * stress/joined-strings-should-not-exceed-max-string-length.js: * stress/js-fixed-array-out-of-memory.js: (test): * stress/json-stringified-overflow-2.js: (catch): * stress/json-stringified-overflow.js: (catch): * stress/json-stringify-string-builder-overflow.js: * stress/missing-exception-check-in-JSValue-toWTFStringSlowCase.js: * stress/missing-exception-check-in-array-prototype-fastJoin.js: * stress/missing-exception-check-in-canonicalizeLocaleList.js: * stress/missing-exception-check-in-json-stringifier-gap.js: * stress/missing-exception-check-in-string-compare.js: * stress/missing-exception-check-in-string-greater-than-compare.js: * stress/missing-exception-check-in-string-greater-than-or-equal-compare.js: * stress/missing-exception-check-in-string-lastIndexOf.js: * stress/missing-exception-check-in-string-less-than-compare.js: * stress/missing-exception-check-in-string-less-than-or-equal-compare.js: * stress/missing-exception-check-in-string-toLower.js: * stress/missing-exception-check-in-string-toUpper.js: * stress/new_array_with_spread-should-cap-array-size-to-MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH.js: * stress/out-of-memory-while-constructing-BytecodeGenerator.js: * stress/regexp-prototype-exec-on-too-long-rope.js: * stress/regexp-prototype-match-on-too-long-rope.js: * stress/regexp-prototype-test-on-too-long-rope.js: * stress/regress-169783.js: (doTest): * stress/regress-178385.js: * stress/regress-178386.js: * stress/regress-185888.js: * stress/regress-189132.js: * stress/regress-190187.js: * stress/regress-191563.js: * stress/scoped-arguments-table-should-be-tolerant-for-oom.js: (i.canThrow): * stress/string-16bit-repeat-overflow.js: * stress/string-overflow-createError-builder.js: * stress/string-overflow-createError-fit.js: * stress/string-overflow-createError.js: * stress/string-prototype-charCodeAt-on-too-long-rope.js: * stress/string-prototype-replace-should-throw-out-of-memory-error-when-using-too-much-memory.js: * stress/switch-string-oom.js: (testLowerTiers): (testFTL): * stress/test-exception-assert-in-ExceptionHelpers-createError.js: * stress/test-out-of-memory.js: * stress/typed-array-subarray-can-throw-oom-error.js: (get bar): * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE-2.js: * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE.js: Source/JavaScriptCore: The spec sometimes requires "check parameters and throw RangeError" before allocating an object. But we are just allocating an object and throwing an out-of-memory error since wrong parameter will cause out-of-memory. If out-of-memory error is RangeError, then we can keep our current behavior while we can make us spec compliant. And note that out-of-memory error is RangeError in SpiderMonkey and V8. This patch makes out-of-memory error as RangeError instead of Error. We also fix @throwOutOfMemoryError in builtin code: the previous thrown errors are not marked as out-of-memory error. * bytecode/BytecodeList.rb: * bytecompiler/BytecodeGenerator.cpp: (JSC::BytecodeGenerator::emitThrowStaticError): (JSC::BytecodeGenerator::emitThrowReferenceError): (JSC::BytecodeGenerator::emitThrowTypeError): (JSC::BytecodeGenerator::emitThrowRangeError): (JSC::BytecodeGenerator::emitThrowOutOfMemoryError): * bytecompiler/BytecodeGenerator.h: * bytecompiler/NodesCodegen.cpp: (JSC::RegExpNode::emitBytecode): (JSC::BytecodeIntrinsicNode::emit_intrinsic_throwTypeError): (JSC::BytecodeIntrinsicNode::emit_intrinsic_throwRangeError): * dfg/DFGOperations.cpp: * runtime/CommonSlowPaths.cpp: (JSC::SLOW_PATH_DECL): * runtime/Error.cpp: (JSC::createError): (JSC::createOutOfMemoryError): * runtime/Error.h: * runtime/ErrorType.cpp: (JSC::errorTypeName): (WTF::printInternal): * runtime/ErrorType.h: We introduced ErrorTypeWithExtension separately from ErrorType to keep ErrorType one-on-one to spec-specified error types. LayoutTests: * inspector/debugger/no-pause-out-of-memory-exception-expected.txt: * js/array-join-expected.txt: * js/dom/concat-large-strings-crash-expected.txt: * js/dom/concat-large-strings-crash2-expected.txt: * js/dom/script-tests/string-replacement-outofmemory.js: * js/dom/string-concatenate-outofmemory-expected.txt: * js/dom/string-replacement-outofmemory-expected.txt: * js/large-expressions-expected.txt: * js/resources/string-concatenate-outofmemory.js: * js/script-tests/array-join.js: * js/script-tests/stack-overflow-regexp.js: (shouldThrow.recursiveCall): (shouldThrow): * js/script-tests/string-padend.js: * js/script-tests/string-padstart.js: * js/script-tests/string-repeat.js: * js/script-tests/stringimpl-to-jsstring-on-large-strings-1.js: * js/stack-overflow-regexp-expected.txt: * js/string-padend-expected.txt: * js/string-padstart-expected.txt: * js/string-repeat-expected.txt: * js/stringimpl-to-jsstring-on-large-strings-1-expected.txt: Canonical link: https://commits.webkit.org/224872@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@261780 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2020-05-16 08:24:22 +00:00
PASS new RegExp(Array(500000).join("(") + "a" + Array(500000).join(")")) threw exception RangeError: Out of memory: Invalid regular expression: too many nested disjunctions.
[JSC] RegExp with deeply nested subexpressions overflow the stack in Yarr https://bugs.webkit.org/show_bug.cgi?id=158011 rdar://problem/25946592 Reviewed by Saam Barati. Source/JavaScriptCore: When generating the meta-data required for compilation, Yarr uses a recursive function over the various expression in the pattern. If you have many nested expressions, you can run out of stack and crash the WebProcess. This patch changes that into a soft failure. The expression is just considered invalid. * runtime/RegExp.cpp: (JSC::RegExp::finishCreation): (JSC::RegExp::compile): (JSC::RegExp::compileMatchOnly): * yarr/YarrPattern.cpp: (JSC::Yarr::YarrPatternConstructor::YarrPatternConstructor): (JSC::Yarr::YarrPatternConstructor::setupOffsets): (JSC::Yarr::YarrPatternConstructor::isSafeToRecurse): (JSC::Yarr::YarrPattern::compile): (JSC::Yarr::YarrPattern::YarrPattern): (JSC::Yarr::YarrPatternConstructor::setupAlternativeOffsets): Deleted. (JSC::Yarr::YarrPatternConstructor::setupDisjunctionOffsets): Deleted. * yarr/YarrPattern.h: LayoutTests: * js/script-tests/stack-overflow-arrity-catch.js: With the new failure, this test can fail on allocating the RegExp for a valid reason. The new expression should not have this issue. * js/script-tests/stack-overflow-regexp.js: Added. (shouldThrow.recursiveCall): (shouldThrow): (recursiveCall): * js/stack-overflow-regexp-expected.txt: Added. * js/stack-overflow-regexp.html: Added. Canonical link: https://commits.webkit.org/176215@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@201412 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2016-05-26 03:19:06 +00:00
Creating RegExp at depth 50
[JSC] Make OutOfMemory error as instance of RangeError https://bugs.webkit.org/show_bug.cgi?id=211952 Reviewed by Mark Lam. JSTests: * ChakraCore/test/Error/outofmem.baseline-jsc: * es6/String.prototype_methods_String.prototype.padEnd.js: (TestMemoryLimits): * es6/String.prototype_methods_String.prototype.padStart.js: (TestMemoryLimits): * slowMicrobenchmarks/function-constructor-with-huge-strings.js: * stress/array-join-on-strings-need-overflow-checks.js: * stress/big-wasm-memory-grow-no-max.js: (test): * stress/big-wasm-memory-grow.js: (test): * stress/big-wasm-memory.js: (test): * stress/bigint-exponential-oom.js: (shouldThrow): * stress/bigint-int32-min-shift.js: (shouldThrow): * stress/check-symbol-description-oom.js: * stress/constructFunctionSkippingEvalEnabledCheck-should-throw-out-of-memory-error.js: * stress/intl-canonicalize-locale-list-error-oom.js: (shouldThrow): * stress/joined-strings-should-not-exceed-max-string-length.js: * stress/js-fixed-array-out-of-memory.js: (test): * stress/json-stringified-overflow-2.js: (catch): * stress/json-stringified-overflow.js: (catch): * stress/json-stringify-string-builder-overflow.js: * stress/missing-exception-check-in-JSValue-toWTFStringSlowCase.js: * stress/missing-exception-check-in-array-prototype-fastJoin.js: * stress/missing-exception-check-in-canonicalizeLocaleList.js: * stress/missing-exception-check-in-json-stringifier-gap.js: * stress/missing-exception-check-in-string-compare.js: * stress/missing-exception-check-in-string-greater-than-compare.js: * stress/missing-exception-check-in-string-greater-than-or-equal-compare.js: * stress/missing-exception-check-in-string-lastIndexOf.js: * stress/missing-exception-check-in-string-less-than-compare.js: * stress/missing-exception-check-in-string-less-than-or-equal-compare.js: * stress/missing-exception-check-in-string-toLower.js: * stress/missing-exception-check-in-string-toUpper.js: * stress/new_array_with_spread-should-cap-array-size-to-MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH.js: * stress/out-of-memory-while-constructing-BytecodeGenerator.js: * stress/regexp-prototype-exec-on-too-long-rope.js: * stress/regexp-prototype-match-on-too-long-rope.js: * stress/regexp-prototype-test-on-too-long-rope.js: * stress/regress-169783.js: (doTest): * stress/regress-178385.js: * stress/regress-178386.js: * stress/regress-185888.js: * stress/regress-189132.js: * stress/regress-190187.js: * stress/regress-191563.js: * stress/scoped-arguments-table-should-be-tolerant-for-oom.js: (i.canThrow): * stress/string-16bit-repeat-overflow.js: * stress/string-overflow-createError-builder.js: * stress/string-overflow-createError-fit.js: * stress/string-overflow-createError.js: * stress/string-prototype-charCodeAt-on-too-long-rope.js: * stress/string-prototype-replace-should-throw-out-of-memory-error-when-using-too-much-memory.js: * stress/switch-string-oom.js: (testLowerTiers): (testFTL): * stress/test-exception-assert-in-ExceptionHelpers-createError.js: * stress/test-out-of-memory.js: * stress/typed-array-subarray-can-throw-oom-error.js: (get bar): * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE-2.js: * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE.js: Source/JavaScriptCore: The spec sometimes requires "check parameters and throw RangeError" before allocating an object. But we are just allocating an object and throwing an out-of-memory error since wrong parameter will cause out-of-memory. If out-of-memory error is RangeError, then we can keep our current behavior while we can make us spec compliant. And note that out-of-memory error is RangeError in SpiderMonkey and V8. This patch makes out-of-memory error as RangeError instead of Error. We also fix @throwOutOfMemoryError in builtin code: the previous thrown errors are not marked as out-of-memory error. * bytecode/BytecodeList.rb: * bytecompiler/BytecodeGenerator.cpp: (JSC::BytecodeGenerator::emitThrowStaticError): (JSC::BytecodeGenerator::emitThrowReferenceError): (JSC::BytecodeGenerator::emitThrowTypeError): (JSC::BytecodeGenerator::emitThrowRangeError): (JSC::BytecodeGenerator::emitThrowOutOfMemoryError): * bytecompiler/BytecodeGenerator.h: * bytecompiler/NodesCodegen.cpp: (JSC::RegExpNode::emitBytecode): (JSC::BytecodeIntrinsicNode::emit_intrinsic_throwTypeError): (JSC::BytecodeIntrinsicNode::emit_intrinsic_throwRangeError): * dfg/DFGOperations.cpp: * runtime/CommonSlowPaths.cpp: (JSC::SLOW_PATH_DECL): * runtime/Error.cpp: (JSC::createError): (JSC::createOutOfMemoryError): * runtime/Error.h: * runtime/ErrorType.cpp: (JSC::errorTypeName): (WTF::printInternal): * runtime/ErrorType.h: We introduced ErrorTypeWithExtension separately from ErrorType to keep ErrorType one-on-one to spec-specified error types. LayoutTests: * inspector/debugger/no-pause-out-of-memory-exception-expected.txt: * js/array-join-expected.txt: * js/dom/concat-large-strings-crash-expected.txt: * js/dom/concat-large-strings-crash2-expected.txt: * js/dom/script-tests/string-replacement-outofmemory.js: * js/dom/string-concatenate-outofmemory-expected.txt: * js/dom/string-replacement-outofmemory-expected.txt: * js/large-expressions-expected.txt: * js/resources/string-concatenate-outofmemory.js: * js/script-tests/array-join.js: * js/script-tests/stack-overflow-regexp.js: (shouldThrow.recursiveCall): (shouldThrow): * js/script-tests/string-padend.js: * js/script-tests/string-padstart.js: * js/script-tests/string-repeat.js: * js/script-tests/stringimpl-to-jsstring-on-large-strings-1.js: * js/stack-overflow-regexp-expected.txt: * js/string-padend-expected.txt: * js/string-padstart-expected.txt: * js/string-repeat-expected.txt: * js/stringimpl-to-jsstring-on-large-strings-1-expected.txt: Canonical link: https://commits.webkit.org/224872@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@261780 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2020-05-16 08:24:22 +00:00
PASS new RegExp(Array(500000).join("(") + "a" + Array(500000).join(")")) threw exception RangeError: Out of memory: Invalid regular expression: too many nested disjunctions.
[JSC] RegExp with deeply nested subexpressions overflow the stack in Yarr https://bugs.webkit.org/show_bug.cgi?id=158011 rdar://problem/25946592 Reviewed by Saam Barati. Source/JavaScriptCore: When generating the meta-data required for compilation, Yarr uses a recursive function over the various expression in the pattern. If you have many nested expressions, you can run out of stack and crash the WebProcess. This patch changes that into a soft failure. The expression is just considered invalid. * runtime/RegExp.cpp: (JSC::RegExp::finishCreation): (JSC::RegExp::compile): (JSC::RegExp::compileMatchOnly): * yarr/YarrPattern.cpp: (JSC::Yarr::YarrPatternConstructor::YarrPatternConstructor): (JSC::Yarr::YarrPatternConstructor::setupOffsets): (JSC::Yarr::YarrPatternConstructor::isSafeToRecurse): (JSC::Yarr::YarrPattern::compile): (JSC::Yarr::YarrPattern::YarrPattern): (JSC::Yarr::YarrPatternConstructor::setupAlternativeOffsets): Deleted. (JSC::Yarr::YarrPatternConstructor::setupDisjunctionOffsets): Deleted. * yarr/YarrPattern.h: LayoutTests: * js/script-tests/stack-overflow-arrity-catch.js: With the new failure, this test can fail on allocating the RegExp for a valid reason. The new expression should not have this issue. * js/script-tests/stack-overflow-regexp.js: Added. (shouldThrow.recursiveCall): (shouldThrow): (recursiveCall): * js/stack-overflow-regexp-expected.txt: Added. * js/stack-overflow-regexp.html: Added. Canonical link: https://commits.webkit.org/176215@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@201412 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2016-05-26 03:19:06 +00:00
Creating RegExp at depth 60
[JSC] Make OutOfMemory error as instance of RangeError https://bugs.webkit.org/show_bug.cgi?id=211952 Reviewed by Mark Lam. JSTests: * ChakraCore/test/Error/outofmem.baseline-jsc: * es6/String.prototype_methods_String.prototype.padEnd.js: (TestMemoryLimits): * es6/String.prototype_methods_String.prototype.padStart.js: (TestMemoryLimits): * slowMicrobenchmarks/function-constructor-with-huge-strings.js: * stress/array-join-on-strings-need-overflow-checks.js: * stress/big-wasm-memory-grow-no-max.js: (test): * stress/big-wasm-memory-grow.js: (test): * stress/big-wasm-memory.js: (test): * stress/bigint-exponential-oom.js: (shouldThrow): * stress/bigint-int32-min-shift.js: (shouldThrow): * stress/check-symbol-description-oom.js: * stress/constructFunctionSkippingEvalEnabledCheck-should-throw-out-of-memory-error.js: * stress/intl-canonicalize-locale-list-error-oom.js: (shouldThrow): * stress/joined-strings-should-not-exceed-max-string-length.js: * stress/js-fixed-array-out-of-memory.js: (test): * stress/json-stringified-overflow-2.js: (catch): * stress/json-stringified-overflow.js: (catch): * stress/json-stringify-string-builder-overflow.js: * stress/missing-exception-check-in-JSValue-toWTFStringSlowCase.js: * stress/missing-exception-check-in-array-prototype-fastJoin.js: * stress/missing-exception-check-in-canonicalizeLocaleList.js: * stress/missing-exception-check-in-json-stringifier-gap.js: * stress/missing-exception-check-in-string-compare.js: * stress/missing-exception-check-in-string-greater-than-compare.js: * stress/missing-exception-check-in-string-greater-than-or-equal-compare.js: * stress/missing-exception-check-in-string-lastIndexOf.js: * stress/missing-exception-check-in-string-less-than-compare.js: * stress/missing-exception-check-in-string-less-than-or-equal-compare.js: * stress/missing-exception-check-in-string-toLower.js: * stress/missing-exception-check-in-string-toUpper.js: * stress/new_array_with_spread-should-cap-array-size-to-MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH.js: * stress/out-of-memory-while-constructing-BytecodeGenerator.js: * stress/regexp-prototype-exec-on-too-long-rope.js: * stress/regexp-prototype-match-on-too-long-rope.js: * stress/regexp-prototype-test-on-too-long-rope.js: * stress/regress-169783.js: (doTest): * stress/regress-178385.js: * stress/regress-178386.js: * stress/regress-185888.js: * stress/regress-189132.js: * stress/regress-190187.js: * stress/regress-191563.js: * stress/scoped-arguments-table-should-be-tolerant-for-oom.js: (i.canThrow): * stress/string-16bit-repeat-overflow.js: * stress/string-overflow-createError-builder.js: * stress/string-overflow-createError-fit.js: * stress/string-overflow-createError.js: * stress/string-prototype-charCodeAt-on-too-long-rope.js: * stress/string-prototype-replace-should-throw-out-of-memory-error-when-using-too-much-memory.js: * stress/switch-string-oom.js: (testLowerTiers): (testFTL): * stress/test-exception-assert-in-ExceptionHelpers-createError.js: * stress/test-out-of-memory.js: * stress/typed-array-subarray-can-throw-oom-error.js: (get bar): * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE-2.js: * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE.js: Source/JavaScriptCore: The spec sometimes requires "check parameters and throw RangeError" before allocating an object. But we are just allocating an object and throwing an out-of-memory error since wrong parameter will cause out-of-memory. If out-of-memory error is RangeError, then we can keep our current behavior while we can make us spec compliant. And note that out-of-memory error is RangeError in SpiderMonkey and V8. This patch makes out-of-memory error as RangeError instead of Error. We also fix @throwOutOfMemoryError in builtin code: the previous thrown errors are not marked as out-of-memory error. * bytecode/BytecodeList.rb: * bytecompiler/BytecodeGenerator.cpp: (JSC::BytecodeGenerator::emitThrowStaticError): (JSC::BytecodeGenerator::emitThrowReferenceError): (JSC::BytecodeGenerator::emitThrowTypeError): (JSC::BytecodeGenerator::emitThrowRangeError): (JSC::BytecodeGenerator::emitThrowOutOfMemoryError): * bytecompiler/BytecodeGenerator.h: * bytecompiler/NodesCodegen.cpp: (JSC::RegExpNode::emitBytecode): (JSC::BytecodeIntrinsicNode::emit_intrinsic_throwTypeError): (JSC::BytecodeIntrinsicNode::emit_intrinsic_throwRangeError): * dfg/DFGOperations.cpp: * runtime/CommonSlowPaths.cpp: (JSC::SLOW_PATH_DECL): * runtime/Error.cpp: (JSC::createError): (JSC::createOutOfMemoryError): * runtime/Error.h: * runtime/ErrorType.cpp: (JSC::errorTypeName): (WTF::printInternal): * runtime/ErrorType.h: We introduced ErrorTypeWithExtension separately from ErrorType to keep ErrorType one-on-one to spec-specified error types. LayoutTests: * inspector/debugger/no-pause-out-of-memory-exception-expected.txt: * js/array-join-expected.txt: * js/dom/concat-large-strings-crash-expected.txt: * js/dom/concat-large-strings-crash2-expected.txt: * js/dom/script-tests/string-replacement-outofmemory.js: * js/dom/string-concatenate-outofmemory-expected.txt: * js/dom/string-replacement-outofmemory-expected.txt: * js/large-expressions-expected.txt: * js/resources/string-concatenate-outofmemory.js: * js/script-tests/array-join.js: * js/script-tests/stack-overflow-regexp.js: (shouldThrow.recursiveCall): (shouldThrow): * js/script-tests/string-padend.js: * js/script-tests/string-padstart.js: * js/script-tests/string-repeat.js: * js/script-tests/stringimpl-to-jsstring-on-large-strings-1.js: * js/stack-overflow-regexp-expected.txt: * js/string-padend-expected.txt: * js/string-padstart-expected.txt: * js/string-repeat-expected.txt: * js/stringimpl-to-jsstring-on-large-strings-1-expected.txt: Canonical link: https://commits.webkit.org/224872@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@261780 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2020-05-16 08:24:22 +00:00
PASS new RegExp(Array(500000).join("(") + "a" + Array(500000).join(")")) threw exception RangeError: Out of memory: Invalid regular expression: too many nested disjunctions.
[JSC] RegExp with deeply nested subexpressions overflow the stack in Yarr https://bugs.webkit.org/show_bug.cgi?id=158011 rdar://problem/25946592 Reviewed by Saam Barati. Source/JavaScriptCore: When generating the meta-data required for compilation, Yarr uses a recursive function over the various expression in the pattern. If you have many nested expressions, you can run out of stack and crash the WebProcess. This patch changes that into a soft failure. The expression is just considered invalid. * runtime/RegExp.cpp: (JSC::RegExp::finishCreation): (JSC::RegExp::compile): (JSC::RegExp::compileMatchOnly): * yarr/YarrPattern.cpp: (JSC::Yarr::YarrPatternConstructor::YarrPatternConstructor): (JSC::Yarr::YarrPatternConstructor::setupOffsets): (JSC::Yarr::YarrPatternConstructor::isSafeToRecurse): (JSC::Yarr::YarrPattern::compile): (JSC::Yarr::YarrPattern::YarrPattern): (JSC::Yarr::YarrPatternConstructor::setupAlternativeOffsets): Deleted. (JSC::Yarr::YarrPatternConstructor::setupDisjunctionOffsets): Deleted. * yarr/YarrPattern.h: LayoutTests: * js/script-tests/stack-overflow-arrity-catch.js: With the new failure, this test can fail on allocating the RegExp for a valid reason. The new expression should not have this issue. * js/script-tests/stack-overflow-regexp.js: Added. (shouldThrow.recursiveCall): (shouldThrow): (recursiveCall): * js/stack-overflow-regexp-expected.txt: Added. * js/stack-overflow-regexp.html: Added. Canonical link: https://commits.webkit.org/176215@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@201412 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2016-05-26 03:19:06 +00:00
Creating RegExp at depth 70
[JSC] Make OutOfMemory error as instance of RangeError https://bugs.webkit.org/show_bug.cgi?id=211952 Reviewed by Mark Lam. JSTests: * ChakraCore/test/Error/outofmem.baseline-jsc: * es6/String.prototype_methods_String.prototype.padEnd.js: (TestMemoryLimits): * es6/String.prototype_methods_String.prototype.padStart.js: (TestMemoryLimits): * slowMicrobenchmarks/function-constructor-with-huge-strings.js: * stress/array-join-on-strings-need-overflow-checks.js: * stress/big-wasm-memory-grow-no-max.js: (test): * stress/big-wasm-memory-grow.js: (test): * stress/big-wasm-memory.js: (test): * stress/bigint-exponential-oom.js: (shouldThrow): * stress/bigint-int32-min-shift.js: (shouldThrow): * stress/check-symbol-description-oom.js: * stress/constructFunctionSkippingEvalEnabledCheck-should-throw-out-of-memory-error.js: * stress/intl-canonicalize-locale-list-error-oom.js: (shouldThrow): * stress/joined-strings-should-not-exceed-max-string-length.js: * stress/js-fixed-array-out-of-memory.js: (test): * stress/json-stringified-overflow-2.js: (catch): * stress/json-stringified-overflow.js: (catch): * stress/json-stringify-string-builder-overflow.js: * stress/missing-exception-check-in-JSValue-toWTFStringSlowCase.js: * stress/missing-exception-check-in-array-prototype-fastJoin.js: * stress/missing-exception-check-in-canonicalizeLocaleList.js: * stress/missing-exception-check-in-json-stringifier-gap.js: * stress/missing-exception-check-in-string-compare.js: * stress/missing-exception-check-in-string-greater-than-compare.js: * stress/missing-exception-check-in-string-greater-than-or-equal-compare.js: * stress/missing-exception-check-in-string-lastIndexOf.js: * stress/missing-exception-check-in-string-less-than-compare.js: * stress/missing-exception-check-in-string-less-than-or-equal-compare.js: * stress/missing-exception-check-in-string-toLower.js: * stress/missing-exception-check-in-string-toUpper.js: * stress/new_array_with_spread-should-cap-array-size-to-MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH.js: * stress/out-of-memory-while-constructing-BytecodeGenerator.js: * stress/regexp-prototype-exec-on-too-long-rope.js: * stress/regexp-prototype-match-on-too-long-rope.js: * stress/regexp-prototype-test-on-too-long-rope.js: * stress/regress-169783.js: (doTest): * stress/regress-178385.js: * stress/regress-178386.js: * stress/regress-185888.js: * stress/regress-189132.js: * stress/regress-190187.js: * stress/regress-191563.js: * stress/scoped-arguments-table-should-be-tolerant-for-oom.js: (i.canThrow): * stress/string-16bit-repeat-overflow.js: * stress/string-overflow-createError-builder.js: * stress/string-overflow-createError-fit.js: * stress/string-overflow-createError.js: * stress/string-prototype-charCodeAt-on-too-long-rope.js: * stress/string-prototype-replace-should-throw-out-of-memory-error-when-using-too-much-memory.js: * stress/switch-string-oom.js: (testLowerTiers): (testFTL): * stress/test-exception-assert-in-ExceptionHelpers-createError.js: * stress/test-out-of-memory.js: * stress/typed-array-subarray-can-throw-oom-error.js: (get bar): * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE-2.js: * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE.js: Source/JavaScriptCore: The spec sometimes requires "check parameters and throw RangeError" before allocating an object. But we are just allocating an object and throwing an out-of-memory error since wrong parameter will cause out-of-memory. If out-of-memory error is RangeError, then we can keep our current behavior while we can make us spec compliant. And note that out-of-memory error is RangeError in SpiderMonkey and V8. This patch makes out-of-memory error as RangeError instead of Error. We also fix @throwOutOfMemoryError in builtin code: the previous thrown errors are not marked as out-of-memory error. * bytecode/BytecodeList.rb: * bytecompiler/BytecodeGenerator.cpp: (JSC::BytecodeGenerator::emitThrowStaticError): (JSC::BytecodeGenerator::emitThrowReferenceError): (JSC::BytecodeGenerator::emitThrowTypeError): (JSC::BytecodeGenerator::emitThrowRangeError): (JSC::BytecodeGenerator::emitThrowOutOfMemoryError): * bytecompiler/BytecodeGenerator.h: * bytecompiler/NodesCodegen.cpp: (JSC::RegExpNode::emitBytecode): (JSC::BytecodeIntrinsicNode::emit_intrinsic_throwTypeError): (JSC::BytecodeIntrinsicNode::emit_intrinsic_throwRangeError): * dfg/DFGOperations.cpp: * runtime/CommonSlowPaths.cpp: (JSC::SLOW_PATH_DECL): * runtime/Error.cpp: (JSC::createError): (JSC::createOutOfMemoryError): * runtime/Error.h: * runtime/ErrorType.cpp: (JSC::errorTypeName): (WTF::printInternal): * runtime/ErrorType.h: We introduced ErrorTypeWithExtension separately from ErrorType to keep ErrorType one-on-one to spec-specified error types. LayoutTests: * inspector/debugger/no-pause-out-of-memory-exception-expected.txt: * js/array-join-expected.txt: * js/dom/concat-large-strings-crash-expected.txt: * js/dom/concat-large-strings-crash2-expected.txt: * js/dom/script-tests/string-replacement-outofmemory.js: * js/dom/string-concatenate-outofmemory-expected.txt: * js/dom/string-replacement-outofmemory-expected.txt: * js/large-expressions-expected.txt: * js/resources/string-concatenate-outofmemory.js: * js/script-tests/array-join.js: * js/script-tests/stack-overflow-regexp.js: (shouldThrow.recursiveCall): (shouldThrow): * js/script-tests/string-padend.js: * js/script-tests/string-padstart.js: * js/script-tests/string-repeat.js: * js/script-tests/stringimpl-to-jsstring-on-large-strings-1.js: * js/stack-overflow-regexp-expected.txt: * js/string-padend-expected.txt: * js/string-padstart-expected.txt: * js/string-repeat-expected.txt: * js/stringimpl-to-jsstring-on-large-strings-1-expected.txt: Canonical link: https://commits.webkit.org/224872@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@261780 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2020-05-16 08:24:22 +00:00
PASS new RegExp(Array(500000).join("(") + "a" + Array(500000).join(")")) threw exception RangeError: Out of memory: Invalid regular expression: too many nested disjunctions.
[JSC] RegExp with deeply nested subexpressions overflow the stack in Yarr https://bugs.webkit.org/show_bug.cgi?id=158011 rdar://problem/25946592 Reviewed by Saam Barati. Source/JavaScriptCore: When generating the meta-data required for compilation, Yarr uses a recursive function over the various expression in the pattern. If you have many nested expressions, you can run out of stack and crash the WebProcess. This patch changes that into a soft failure. The expression is just considered invalid. * runtime/RegExp.cpp: (JSC::RegExp::finishCreation): (JSC::RegExp::compile): (JSC::RegExp::compileMatchOnly): * yarr/YarrPattern.cpp: (JSC::Yarr::YarrPatternConstructor::YarrPatternConstructor): (JSC::Yarr::YarrPatternConstructor::setupOffsets): (JSC::Yarr::YarrPatternConstructor::isSafeToRecurse): (JSC::Yarr::YarrPattern::compile): (JSC::Yarr::YarrPattern::YarrPattern): (JSC::Yarr::YarrPatternConstructor::setupAlternativeOffsets): Deleted. (JSC::Yarr::YarrPatternConstructor::setupDisjunctionOffsets): Deleted. * yarr/YarrPattern.h: LayoutTests: * js/script-tests/stack-overflow-arrity-catch.js: With the new failure, this test can fail on allocating the RegExp for a valid reason. The new expression should not have this issue. * js/script-tests/stack-overflow-regexp.js: Added. (shouldThrow.recursiveCall): (shouldThrow): (recursiveCall): * js/stack-overflow-regexp-expected.txt: Added. * js/stack-overflow-regexp.html: Added. Canonical link: https://commits.webkit.org/176215@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@201412 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2016-05-26 03:19:06 +00:00
Creating RegExp at depth 80
[JSC] Make OutOfMemory error as instance of RangeError https://bugs.webkit.org/show_bug.cgi?id=211952 Reviewed by Mark Lam. JSTests: * ChakraCore/test/Error/outofmem.baseline-jsc: * es6/String.prototype_methods_String.prototype.padEnd.js: (TestMemoryLimits): * es6/String.prototype_methods_String.prototype.padStart.js: (TestMemoryLimits): * slowMicrobenchmarks/function-constructor-with-huge-strings.js: * stress/array-join-on-strings-need-overflow-checks.js: * stress/big-wasm-memory-grow-no-max.js: (test): * stress/big-wasm-memory-grow.js: (test): * stress/big-wasm-memory.js: (test): * stress/bigint-exponential-oom.js: (shouldThrow): * stress/bigint-int32-min-shift.js: (shouldThrow): * stress/check-symbol-description-oom.js: * stress/constructFunctionSkippingEvalEnabledCheck-should-throw-out-of-memory-error.js: * stress/intl-canonicalize-locale-list-error-oom.js: (shouldThrow): * stress/joined-strings-should-not-exceed-max-string-length.js: * stress/js-fixed-array-out-of-memory.js: (test): * stress/json-stringified-overflow-2.js: (catch): * stress/json-stringified-overflow.js: (catch): * stress/json-stringify-string-builder-overflow.js: * stress/missing-exception-check-in-JSValue-toWTFStringSlowCase.js: * stress/missing-exception-check-in-array-prototype-fastJoin.js: * stress/missing-exception-check-in-canonicalizeLocaleList.js: * stress/missing-exception-check-in-json-stringifier-gap.js: * stress/missing-exception-check-in-string-compare.js: * stress/missing-exception-check-in-string-greater-than-compare.js: * stress/missing-exception-check-in-string-greater-than-or-equal-compare.js: * stress/missing-exception-check-in-string-lastIndexOf.js: * stress/missing-exception-check-in-string-less-than-compare.js: * stress/missing-exception-check-in-string-less-than-or-equal-compare.js: * stress/missing-exception-check-in-string-toLower.js: * stress/missing-exception-check-in-string-toUpper.js: * stress/new_array_with_spread-should-cap-array-size-to-MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH.js: * stress/out-of-memory-while-constructing-BytecodeGenerator.js: * stress/regexp-prototype-exec-on-too-long-rope.js: * stress/regexp-prototype-match-on-too-long-rope.js: * stress/regexp-prototype-test-on-too-long-rope.js: * stress/regress-169783.js: (doTest): * stress/regress-178385.js: * stress/regress-178386.js: * stress/regress-185888.js: * stress/regress-189132.js: * stress/regress-190187.js: * stress/regress-191563.js: * stress/scoped-arguments-table-should-be-tolerant-for-oom.js: (i.canThrow): * stress/string-16bit-repeat-overflow.js: * stress/string-overflow-createError-builder.js: * stress/string-overflow-createError-fit.js: * stress/string-overflow-createError.js: * stress/string-prototype-charCodeAt-on-too-long-rope.js: * stress/string-prototype-replace-should-throw-out-of-memory-error-when-using-too-much-memory.js: * stress/switch-string-oom.js: (testLowerTiers): (testFTL): * stress/test-exception-assert-in-ExceptionHelpers-createError.js: * stress/test-out-of-memory.js: * stress/typed-array-subarray-can-throw-oom-error.js: (get bar): * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE-2.js: * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE.js: Source/JavaScriptCore: The spec sometimes requires "check parameters and throw RangeError" before allocating an object. But we are just allocating an object and throwing an out-of-memory error since wrong parameter will cause out-of-memory. If out-of-memory error is RangeError, then we can keep our current behavior while we can make us spec compliant. And note that out-of-memory error is RangeError in SpiderMonkey and V8. This patch makes out-of-memory error as RangeError instead of Error. We also fix @throwOutOfMemoryError in builtin code: the previous thrown errors are not marked as out-of-memory error. * bytecode/BytecodeList.rb: * bytecompiler/BytecodeGenerator.cpp: (JSC::BytecodeGenerator::emitThrowStaticError): (JSC::BytecodeGenerator::emitThrowReferenceError): (JSC::BytecodeGenerator::emitThrowTypeError): (JSC::BytecodeGenerator::emitThrowRangeError): (JSC::BytecodeGenerator::emitThrowOutOfMemoryError): * bytecompiler/BytecodeGenerator.h: * bytecompiler/NodesCodegen.cpp: (JSC::RegExpNode::emitBytecode): (JSC::BytecodeIntrinsicNode::emit_intrinsic_throwTypeError): (JSC::BytecodeIntrinsicNode::emit_intrinsic_throwRangeError): * dfg/DFGOperations.cpp: * runtime/CommonSlowPaths.cpp: (JSC::SLOW_PATH_DECL): * runtime/Error.cpp: (JSC::createError): (JSC::createOutOfMemoryError): * runtime/Error.h: * runtime/ErrorType.cpp: (JSC::errorTypeName): (WTF::printInternal): * runtime/ErrorType.h: We introduced ErrorTypeWithExtension separately from ErrorType to keep ErrorType one-on-one to spec-specified error types. LayoutTests: * inspector/debugger/no-pause-out-of-memory-exception-expected.txt: * js/array-join-expected.txt: * js/dom/concat-large-strings-crash-expected.txt: * js/dom/concat-large-strings-crash2-expected.txt: * js/dom/script-tests/string-replacement-outofmemory.js: * js/dom/string-concatenate-outofmemory-expected.txt: * js/dom/string-replacement-outofmemory-expected.txt: * js/large-expressions-expected.txt: * js/resources/string-concatenate-outofmemory.js: * js/script-tests/array-join.js: * js/script-tests/stack-overflow-regexp.js: (shouldThrow.recursiveCall): (shouldThrow): * js/script-tests/string-padend.js: * js/script-tests/string-padstart.js: * js/script-tests/string-repeat.js: * js/script-tests/stringimpl-to-jsstring-on-large-strings-1.js: * js/stack-overflow-regexp-expected.txt: * js/string-padend-expected.txt: * js/string-padstart-expected.txt: * js/string-repeat-expected.txt: * js/stringimpl-to-jsstring-on-large-strings-1-expected.txt: Canonical link: https://commits.webkit.org/224872@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@261780 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2020-05-16 08:24:22 +00:00
PASS new RegExp(Array(500000).join("(") + "a" + Array(500000).join(")")) threw exception RangeError: Out of memory: Invalid regular expression: too many nested disjunctions.
[JSC] RegExp with deeply nested subexpressions overflow the stack in Yarr https://bugs.webkit.org/show_bug.cgi?id=158011 rdar://problem/25946592 Reviewed by Saam Barati. Source/JavaScriptCore: When generating the meta-data required for compilation, Yarr uses a recursive function over the various expression in the pattern. If you have many nested expressions, you can run out of stack and crash the WebProcess. This patch changes that into a soft failure. The expression is just considered invalid. * runtime/RegExp.cpp: (JSC::RegExp::finishCreation): (JSC::RegExp::compile): (JSC::RegExp::compileMatchOnly): * yarr/YarrPattern.cpp: (JSC::Yarr::YarrPatternConstructor::YarrPatternConstructor): (JSC::Yarr::YarrPatternConstructor::setupOffsets): (JSC::Yarr::YarrPatternConstructor::isSafeToRecurse): (JSC::Yarr::YarrPattern::compile): (JSC::Yarr::YarrPattern::YarrPattern): (JSC::Yarr::YarrPatternConstructor::setupAlternativeOffsets): Deleted. (JSC::Yarr::YarrPatternConstructor::setupDisjunctionOffsets): Deleted. * yarr/YarrPattern.h: LayoutTests: * js/script-tests/stack-overflow-arrity-catch.js: With the new failure, this test can fail on allocating the RegExp for a valid reason. The new expression should not have this issue. * js/script-tests/stack-overflow-regexp.js: Added. (shouldThrow.recursiveCall): (shouldThrow): (recursiveCall): * js/stack-overflow-regexp-expected.txt: Added. * js/stack-overflow-regexp.html: Added. Canonical link: https://commits.webkit.org/176215@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@201412 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2016-05-26 03:19:06 +00:00
Creating RegExp at depth 90
[JSC] Make OutOfMemory error as instance of RangeError https://bugs.webkit.org/show_bug.cgi?id=211952 Reviewed by Mark Lam. JSTests: * ChakraCore/test/Error/outofmem.baseline-jsc: * es6/String.prototype_methods_String.prototype.padEnd.js: (TestMemoryLimits): * es6/String.prototype_methods_String.prototype.padStart.js: (TestMemoryLimits): * slowMicrobenchmarks/function-constructor-with-huge-strings.js: * stress/array-join-on-strings-need-overflow-checks.js: * stress/big-wasm-memory-grow-no-max.js: (test): * stress/big-wasm-memory-grow.js: (test): * stress/big-wasm-memory.js: (test): * stress/bigint-exponential-oom.js: (shouldThrow): * stress/bigint-int32-min-shift.js: (shouldThrow): * stress/check-symbol-description-oom.js: * stress/constructFunctionSkippingEvalEnabledCheck-should-throw-out-of-memory-error.js: * stress/intl-canonicalize-locale-list-error-oom.js: (shouldThrow): * stress/joined-strings-should-not-exceed-max-string-length.js: * stress/js-fixed-array-out-of-memory.js: (test): * stress/json-stringified-overflow-2.js: (catch): * stress/json-stringified-overflow.js: (catch): * stress/json-stringify-string-builder-overflow.js: * stress/missing-exception-check-in-JSValue-toWTFStringSlowCase.js: * stress/missing-exception-check-in-array-prototype-fastJoin.js: * stress/missing-exception-check-in-canonicalizeLocaleList.js: * stress/missing-exception-check-in-json-stringifier-gap.js: * stress/missing-exception-check-in-string-compare.js: * stress/missing-exception-check-in-string-greater-than-compare.js: * stress/missing-exception-check-in-string-greater-than-or-equal-compare.js: * stress/missing-exception-check-in-string-lastIndexOf.js: * stress/missing-exception-check-in-string-less-than-compare.js: * stress/missing-exception-check-in-string-less-than-or-equal-compare.js: * stress/missing-exception-check-in-string-toLower.js: * stress/missing-exception-check-in-string-toUpper.js: * stress/new_array_with_spread-should-cap-array-size-to-MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH.js: * stress/out-of-memory-while-constructing-BytecodeGenerator.js: * stress/regexp-prototype-exec-on-too-long-rope.js: * stress/regexp-prototype-match-on-too-long-rope.js: * stress/regexp-prototype-test-on-too-long-rope.js: * stress/regress-169783.js: (doTest): * stress/regress-178385.js: * stress/regress-178386.js: * stress/regress-185888.js: * stress/regress-189132.js: * stress/regress-190187.js: * stress/regress-191563.js: * stress/scoped-arguments-table-should-be-tolerant-for-oom.js: (i.canThrow): * stress/string-16bit-repeat-overflow.js: * stress/string-overflow-createError-builder.js: * stress/string-overflow-createError-fit.js: * stress/string-overflow-createError.js: * stress/string-prototype-charCodeAt-on-too-long-rope.js: * stress/string-prototype-replace-should-throw-out-of-memory-error-when-using-too-much-memory.js: * stress/switch-string-oom.js: (testLowerTiers): (testFTL): * stress/test-exception-assert-in-ExceptionHelpers-createError.js: * stress/test-out-of-memory.js: * stress/typed-array-subarray-can-throw-oom-error.js: (get bar): * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE-2.js: * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE.js: Source/JavaScriptCore: The spec sometimes requires "check parameters and throw RangeError" before allocating an object. But we are just allocating an object and throwing an out-of-memory error since wrong parameter will cause out-of-memory. If out-of-memory error is RangeError, then we can keep our current behavior while we can make us spec compliant. And note that out-of-memory error is RangeError in SpiderMonkey and V8. This patch makes out-of-memory error as RangeError instead of Error. We also fix @throwOutOfMemoryError in builtin code: the previous thrown errors are not marked as out-of-memory error. * bytecode/BytecodeList.rb: * bytecompiler/BytecodeGenerator.cpp: (JSC::BytecodeGenerator::emitThrowStaticError): (JSC::BytecodeGenerator::emitThrowReferenceError): (JSC::BytecodeGenerator::emitThrowTypeError): (JSC::BytecodeGenerator::emitThrowRangeError): (JSC::BytecodeGenerator::emitThrowOutOfMemoryError): * bytecompiler/BytecodeGenerator.h: * bytecompiler/NodesCodegen.cpp: (JSC::RegExpNode::emitBytecode): (JSC::BytecodeIntrinsicNode::emit_intrinsic_throwTypeError): (JSC::BytecodeIntrinsicNode::emit_intrinsic_throwRangeError): * dfg/DFGOperations.cpp: * runtime/CommonSlowPaths.cpp: (JSC::SLOW_PATH_DECL): * runtime/Error.cpp: (JSC::createError): (JSC::createOutOfMemoryError): * runtime/Error.h: * runtime/ErrorType.cpp: (JSC::errorTypeName): (WTF::printInternal): * runtime/ErrorType.h: We introduced ErrorTypeWithExtension separately from ErrorType to keep ErrorType one-on-one to spec-specified error types. LayoutTests: * inspector/debugger/no-pause-out-of-memory-exception-expected.txt: * js/array-join-expected.txt: * js/dom/concat-large-strings-crash-expected.txt: * js/dom/concat-large-strings-crash2-expected.txt: * js/dom/script-tests/string-replacement-outofmemory.js: * js/dom/string-concatenate-outofmemory-expected.txt: * js/dom/string-replacement-outofmemory-expected.txt: * js/large-expressions-expected.txt: * js/resources/string-concatenate-outofmemory.js: * js/script-tests/array-join.js: * js/script-tests/stack-overflow-regexp.js: (shouldThrow.recursiveCall): (shouldThrow): * js/script-tests/string-padend.js: * js/script-tests/string-padstart.js: * js/script-tests/string-repeat.js: * js/script-tests/stringimpl-to-jsstring-on-large-strings-1.js: * js/stack-overflow-regexp-expected.txt: * js/string-padend-expected.txt: * js/string-padstart-expected.txt: * js/string-repeat-expected.txt: * js/stringimpl-to-jsstring-on-large-strings-1-expected.txt: Canonical link: https://commits.webkit.org/224872@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@261780 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2020-05-16 08:24:22 +00:00
PASS new RegExp(Array(500000).join("(") + "a" + Array(500000).join(")")) threw exception RangeError: Out of memory: Invalid regular expression: too many nested disjunctions.
[JSC] RegExp with deeply nested subexpressions overflow the stack in Yarr https://bugs.webkit.org/show_bug.cgi?id=158011 rdar://problem/25946592 Reviewed by Saam Barati. Source/JavaScriptCore: When generating the meta-data required for compilation, Yarr uses a recursive function over the various expression in the pattern. If you have many nested expressions, you can run out of stack and crash the WebProcess. This patch changes that into a soft failure. The expression is just considered invalid. * runtime/RegExp.cpp: (JSC::RegExp::finishCreation): (JSC::RegExp::compile): (JSC::RegExp::compileMatchOnly): * yarr/YarrPattern.cpp: (JSC::Yarr::YarrPatternConstructor::YarrPatternConstructor): (JSC::Yarr::YarrPatternConstructor::setupOffsets): (JSC::Yarr::YarrPatternConstructor::isSafeToRecurse): (JSC::Yarr::YarrPattern::compile): (JSC::Yarr::YarrPattern::YarrPattern): (JSC::Yarr::YarrPatternConstructor::setupAlternativeOffsets): Deleted. (JSC::Yarr::YarrPatternConstructor::setupDisjunctionOffsets): Deleted. * yarr/YarrPattern.h: LayoutTests: * js/script-tests/stack-overflow-arrity-catch.js: With the new failure, this test can fail on allocating the RegExp for a valid reason. The new expression should not have this issue. * js/script-tests/stack-overflow-regexp.js: Added. (shouldThrow.recursiveCall): (shouldThrow): (recursiveCall): * js/stack-overflow-regexp-expected.txt: Added. * js/stack-overflow-regexp.html: Added. Canonical link: https://commits.webkit.org/176215@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@201412 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2016-05-26 03:19:06 +00:00
Creating RegExp at depth 100
[JSC] Make OutOfMemory error as instance of RangeError https://bugs.webkit.org/show_bug.cgi?id=211952 Reviewed by Mark Lam. JSTests: * ChakraCore/test/Error/outofmem.baseline-jsc: * es6/String.prototype_methods_String.prototype.padEnd.js: (TestMemoryLimits): * es6/String.prototype_methods_String.prototype.padStart.js: (TestMemoryLimits): * slowMicrobenchmarks/function-constructor-with-huge-strings.js: * stress/array-join-on-strings-need-overflow-checks.js: * stress/big-wasm-memory-grow-no-max.js: (test): * stress/big-wasm-memory-grow.js: (test): * stress/big-wasm-memory.js: (test): * stress/bigint-exponential-oom.js: (shouldThrow): * stress/bigint-int32-min-shift.js: (shouldThrow): * stress/check-symbol-description-oom.js: * stress/constructFunctionSkippingEvalEnabledCheck-should-throw-out-of-memory-error.js: * stress/intl-canonicalize-locale-list-error-oom.js: (shouldThrow): * stress/joined-strings-should-not-exceed-max-string-length.js: * stress/js-fixed-array-out-of-memory.js: (test): * stress/json-stringified-overflow-2.js: (catch): * stress/json-stringified-overflow.js: (catch): * stress/json-stringify-string-builder-overflow.js: * stress/missing-exception-check-in-JSValue-toWTFStringSlowCase.js: * stress/missing-exception-check-in-array-prototype-fastJoin.js: * stress/missing-exception-check-in-canonicalizeLocaleList.js: * stress/missing-exception-check-in-json-stringifier-gap.js: * stress/missing-exception-check-in-string-compare.js: * stress/missing-exception-check-in-string-greater-than-compare.js: * stress/missing-exception-check-in-string-greater-than-or-equal-compare.js: * stress/missing-exception-check-in-string-lastIndexOf.js: * stress/missing-exception-check-in-string-less-than-compare.js: * stress/missing-exception-check-in-string-less-than-or-equal-compare.js: * stress/missing-exception-check-in-string-toLower.js: * stress/missing-exception-check-in-string-toUpper.js: * stress/new_array_with_spread-should-cap-array-size-to-MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH.js: * stress/out-of-memory-while-constructing-BytecodeGenerator.js: * stress/regexp-prototype-exec-on-too-long-rope.js: * stress/regexp-prototype-match-on-too-long-rope.js: * stress/regexp-prototype-test-on-too-long-rope.js: * stress/regress-169783.js: (doTest): * stress/regress-178385.js: * stress/regress-178386.js: * stress/regress-185888.js: * stress/regress-189132.js: * stress/regress-190187.js: * stress/regress-191563.js: * stress/scoped-arguments-table-should-be-tolerant-for-oom.js: (i.canThrow): * stress/string-16bit-repeat-overflow.js: * stress/string-overflow-createError-builder.js: * stress/string-overflow-createError-fit.js: * stress/string-overflow-createError.js: * stress/string-prototype-charCodeAt-on-too-long-rope.js: * stress/string-prototype-replace-should-throw-out-of-memory-error-when-using-too-much-memory.js: * stress/switch-string-oom.js: (testLowerTiers): (testFTL): * stress/test-exception-assert-in-ExceptionHelpers-createError.js: * stress/test-out-of-memory.js: * stress/typed-array-subarray-can-throw-oom-error.js: (get bar): * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE-2.js: * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE.js: Source/JavaScriptCore: The spec sometimes requires "check parameters and throw RangeError" before allocating an object. But we are just allocating an object and throwing an out-of-memory error since wrong parameter will cause out-of-memory. If out-of-memory error is RangeError, then we can keep our current behavior while we can make us spec compliant. And note that out-of-memory error is RangeError in SpiderMonkey and V8. This patch makes out-of-memory error as RangeError instead of Error. We also fix @throwOutOfMemoryError in builtin code: the previous thrown errors are not marked as out-of-memory error. * bytecode/BytecodeList.rb: * bytecompiler/BytecodeGenerator.cpp: (JSC::BytecodeGenerator::emitThrowStaticError): (JSC::BytecodeGenerator::emitThrowReferenceError): (JSC::BytecodeGenerator::emitThrowTypeError): (JSC::BytecodeGenerator::emitThrowRangeError): (JSC::BytecodeGenerator::emitThrowOutOfMemoryError): * bytecompiler/BytecodeGenerator.h: * bytecompiler/NodesCodegen.cpp: (JSC::RegExpNode::emitBytecode): (JSC::BytecodeIntrinsicNode::emit_intrinsic_throwTypeError): (JSC::BytecodeIntrinsicNode::emit_intrinsic_throwRangeError): * dfg/DFGOperations.cpp: * runtime/CommonSlowPaths.cpp: (JSC::SLOW_PATH_DECL): * runtime/Error.cpp: (JSC::createError): (JSC::createOutOfMemoryError): * runtime/Error.h: * runtime/ErrorType.cpp: (JSC::errorTypeName): (WTF::printInternal): * runtime/ErrorType.h: We introduced ErrorTypeWithExtension separately from ErrorType to keep ErrorType one-on-one to spec-specified error types. LayoutTests: * inspector/debugger/no-pause-out-of-memory-exception-expected.txt: * js/array-join-expected.txt: * js/dom/concat-large-strings-crash-expected.txt: * js/dom/concat-large-strings-crash2-expected.txt: * js/dom/script-tests/string-replacement-outofmemory.js: * js/dom/string-concatenate-outofmemory-expected.txt: * js/dom/string-replacement-outofmemory-expected.txt: * js/large-expressions-expected.txt: * js/resources/string-concatenate-outofmemory.js: * js/script-tests/array-join.js: * js/script-tests/stack-overflow-regexp.js: (shouldThrow.recursiveCall): (shouldThrow): * js/script-tests/string-padend.js: * js/script-tests/string-padstart.js: * js/script-tests/string-repeat.js: * js/script-tests/stringimpl-to-jsstring-on-large-strings-1.js: * js/stack-overflow-regexp-expected.txt: * js/string-padend-expected.txt: * js/string-padstart-expected.txt: * js/string-repeat-expected.txt: * js/stringimpl-to-jsstring-on-large-strings-1-expected.txt: Canonical link: https://commits.webkit.org/224872@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@261780 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2020-05-16 08:24:22 +00:00
PASS new RegExp(Array(500000).join("(") + "a" + Array(500000).join(")")) threw exception RangeError: Out of memory: Invalid regular expression: too many nested disjunctions.
Refactor YARR Stack Overflow Checks https://bugs.webkit.org/show_bug.cgi?id=209435 rdar://problem/58988252 Reviewed by Mark Lam. JSTests: Added a new test and removed a now obsolete test. * stress/regexp-compile-oom.js: Removed because the test is no longer valid. Previously when therer where different stack check mechanisims we failed different. This test was based on the different failure modes. With these changes, most of the contain subtests no longer throw as this test expects. * stress/regexp-huge-oom.js: Added. (shouldBe): (shouldThrow): Source/JavaScriptCore: Refactored stack checks in YARR code including adding a stack check to the YARR JIT'ed code. The C++ code including the parser, byte code compiler and interpreter now all use StackCheck. The JIT'ed code needs a stack limit passed via a parameter since the JIT'ed code can be called from the compiler thread when compiling DFG / FTL code. Instead of adding a new parameter, consolidated the two pattern context buffer values, buffer pointer and size, with the new stack limit into a new MatchingContextHolder, an RAII object. The MatchingContextHolder constructor uses either the VM stack limit or the current thread's stack limit depending on how it is called. * runtime/RegExp.cpp: (JSC::RegExp::finishCreation): (JSC::RegExp::byteCodeCompileIfNecessary): (JSC::RegExp::compile): (JSC::RegExp::matchConcurrently): (JSC::RegExp::compileMatchOnly): * runtime/RegExp.h: * runtime/RegExpInlines.h: (JSC::RegExp::matchInline): (JSC::PatternContextBufferHolder::PatternContextBufferHolder): Deleted. (JSC::PatternContextBufferHolder::~PatternContextBufferHolder): Deleted. (JSC::PatternContextBufferHolder::buffer): Deleted. (JSC::PatternContextBufferHolder::size): Deleted. (): Deleted. * yarr/Yarr.h: * yarr/YarrInterpreter.cpp: (JSC::Yarr::Interpreter::matchDisjunction): (JSC::Yarr::Interpreter::isSafeToRecurse): * yarr/YarrJIT.cpp: (JSC::Yarr::MatchingContextHolder::MatchingContextHolder): (JSC::Yarr::MatchingContextHolder::~MatchingContextHolder): (JSC::Yarr::YarrGenerator::initParenContextFreeList): (JSC::Yarr::YarrGenerator::alignCallFrameSizeInBytes): (JSC::Yarr::YarrGenerator::compile): (JSC::Yarr::YarrGenerator::initCallFrame): Deleted. * yarr/YarrJIT.h: (JSC::Yarr::MatchingContextHolder::offsetOfStackLimit): (JSC::Yarr::MatchingContextHolder::offsetOfPatternContextBuffer): (JSC::Yarr::MatchingContextHolder::offsetOfPatternContextBufferSize): (JSC::Yarr::YarrCodeBlock::execute): * yarr/YarrPattern.cpp: (JSC::Yarr::YarrPatternConstructor::YarrPatternConstructor): (JSC::Yarr::YarrPatternConstructor::isSafeToRecurse): (JSC::Yarr::YarrPattern::compile): (JSC::Yarr::YarrPattern::YarrPattern): (JSC::Yarr::YarrPatternConstructor::isSafeToRecurse const): Deleted. * yarr/YarrPattern.h: LayoutTests: Updated test for improved stack overflow checking. * js/script-tests/stack-overflow-regexp.js: (shouldThrow.recursiveCall): (shouldThrow): (recursiveCall): * js/stack-overflow-regexp-expected.txt: Canonical link: https://commits.webkit.org/222563@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@259092 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2020-03-26 23:27:57 +00:00
PASS new RegExp(expression) threw exception SyntaxError: Invalid regular expression: regular expression too large.
[JSC] RegExp with deeply nested subexpressions overflow the stack in Yarr https://bugs.webkit.org/show_bug.cgi?id=158011 rdar://problem/25946592 Reviewed by Saam Barati. Source/JavaScriptCore: When generating the meta-data required for compilation, Yarr uses a recursive function over the various expression in the pattern. If you have many nested expressions, you can run out of stack and crash the WebProcess. This patch changes that into a soft failure. The expression is just considered invalid. * runtime/RegExp.cpp: (JSC::RegExp::finishCreation): (JSC::RegExp::compile): (JSC::RegExp::compileMatchOnly): * yarr/YarrPattern.cpp: (JSC::Yarr::YarrPatternConstructor::YarrPatternConstructor): (JSC::Yarr::YarrPatternConstructor::setupOffsets): (JSC::Yarr::YarrPatternConstructor::isSafeToRecurse): (JSC::Yarr::YarrPattern::compile): (JSC::Yarr::YarrPattern::YarrPattern): (JSC::Yarr::YarrPatternConstructor::setupAlternativeOffsets): Deleted. (JSC::Yarr::YarrPatternConstructor::setupDisjunctionOffsets): Deleted. * yarr/YarrPattern.h: LayoutTests: * js/script-tests/stack-overflow-arrity-catch.js: With the new failure, this test can fail on allocating the RegExp for a valid reason. The new expression should not have this issue. * js/script-tests/stack-overflow-regexp.js: Added. (shouldThrow.recursiveCall): (shouldThrow): (recursiveCall): * js/stack-overflow-regexp-expected.txt: Added. * js/stack-overflow-regexp.html: Added. Canonical link: https://commits.webkit.org/176215@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@201412 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2016-05-26 03:19:06 +00:00
PASS successfullyParsed is true
TEST COMPLETE