[Webkit-unassigned] [Bug 195970] New: [Yarr Interpreter] The interpreter doesn't have check for stack overflow due to deep recursion

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=195970

            Bug ID: 195970
           Summary: [Yarr Interpreter] The interpreter doesn't have check
                    for stack overflow due to deep recursion
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: msaboff at apple.com

RegExp patterns can be nested deep via parentheses, e.g. (((((((((((x))))))))))).  The parsing and compiling of such a pattern as well as the processing by the JIT and interpreter uses recursion.  For deeply nested pattern or patterns that as process when called from an already deep stack, we can exceed the available stack space.  The pattern parse / compilation paths are already handled.  The JIT compilation paths are being tracked in <https://bugs.webkit.org/show_bug.cgi?id=195906> "JSC test crash: stress/dont-strength-reduce-regexp-with-compile-error.js.default".  This bug is for the interpreter, specifically recursion of Yarr::Interpreter::matchDisjunction().  There currently isn't a test case that produces a crash from the interpreter, but code inspection shows that there aren't any "is it safe to recurse?" checks.  It could be the case that it takes a deeper stack to pasrse / compile a  pattern than it does to interpret it.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20190319/a2572516/attachment-0001.html>