v8/test/mjsunit/regress/regress-1166138.js

// Copyright 2020 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

let badregexp =  "(?:" +  " ".repeat(32768*2)+  ")*";
reg = RegExp(badregexp);
assertThrows(() => reg.test(), SyntaxError);
Reland "[regexp] Hard-crash on invalid offsets in AdvanceCurrentPosition" This is a reland of 164cf80bbb0a6e091300bfc4cbbe70a6e6bd3e49 The reland fixes UB (left-shift of negative integer type) with a static_cast<uint32_t>. Original change's description: > [regexp] Hard-crash on invalid offsets in AdvanceCurrentPosition > > Drive-by: Range checks in `Emit(byte, twenty_four_bits)` to ensure the > given packed bits actually fit into 24 bits. > > Bug: chromium:1166138 > Change-Id: I2e711e6466bb48d7b9897f68dfe621d12bd92508 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2625877 > Commit-Queue: Jakob Gruber <jgruber@chromium.org> > Commit-Queue: Leszek Swirski <leszeks@chromium.org> > Auto-Submit: Jakob Gruber <jgruber@chromium.org> > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Cr-Commit-Position: refs/heads/master@{#72064} Tbr: leszeks@chromium.org Bug: chromium:1166138 Change-Id: I514495e14bb99dfc9588fdb4a9f35d67d8d64acb Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2626663 Reviewed-by: Jakob Gruber <jgruber@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#72088} 2021-01-14 06:55:05 +00:00			`// Copyright 2020 the V8 project authors. All rights reserved.`
			`// Use of this source code is governed by a BSD-style license that can be`
			`// found in the LICENSE file.`

			`let badregexp = "(?:" + " ".repeat(327682)+ ")";`
			`reg = RegExp(badregexp);`
[regexp] Throw when length of text nodes in alternatives is too large. Offsets in regular expressions are limited to 16 bits. It was possible to exceed this limit when emitting greedy loops where the length of text nodes exceeded 16 bits, resulting in overflowing offsets. With this CL we throw a SyntaxError "Regular expression too large" to prevent this overflow. Bug: chromium:1166138 Change-Id: Ica624a243bf9827083ff883d9a976f13c8da02e5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2629286 Commit-Queue: Patrick Thier <pthier@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#72095} 2021-01-14 14:15:09 +00:00			`assertThrows(() => reg.test(), SyntaxError);`