[webkit-changes] [WebKit/WebKit] c65472: ASAN_BUS | Yarr::Interpreter::matchDisjunction; Ya...

[Michael Saboff]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: c654724c531ef90a5676f0b5dbcfede89ae40189
      https://github.com/WebKit/WebKit/commit/c654724c531ef90a5676f0b5dbcfede89ae40189
  Author: Michael Saboff <msaboff at apple.com>
  Date:   2023-05-19 (Fri, 19 May 2023)

  Changed paths:
    A JSTests/stress/regexp-lookbehind-greedy-backreference.js
    M Source/JavaScriptCore/yarr/YarrInterpreter.cpp

  Log Message:
  -----------
  ASAN_BUS | Yarr::Interpreter::matchDisjunction; Yarr::Interpreter::backtrackParentheses; Yarr::Interpreter::matchDisjunction
https://bugs.webkit.org/show_bug.cgi?id=253466
rdar://105669717

Reviewed by Yusuke Suzuki.

When backtracking, i.e. unmatching a greedy backreference in a lookbehind, the unmatch requires moving the input pointer
forward.  THis means we need to do a checkInput() instead of a rewind() in this case.

* JSTests/stress/regexp-lookbehind-greedy-backreference.js: Added.
(arrayToString):
(dumpValue):
(compareArray):
(testRegExp):
* Source/JavaScriptCore/yarr/YarrInterpreter.cpp:
(JSC::Yarr::Interpreter::backtrackBackReference):

Originally-landed-as: 259548.378 at safari-7615-branch (3d135908241d). rdar://1056697172
Canonical link: https://commits.webkit.org/264264@main