2 Commits

Author	SHA1	Message	Date
jgruber	71b9018c47	[regexp] Avoid integer overflow in callable @@replace ... The integer value denoting the number of captures (and thus the size of the list of captures created in @@replace [0]) can be controlled by the user. This CL ensures we don't overflow and respect Code::kMaxArguments, but note that it is still possible to trigger OOMs through large lists. Bug: chromium:786573 Change-Id: I19c88908c594487818d083b2ba423764ef91eae0 Reviewed-on: https://chromium-review.googlesource.com/779001 Reviewed-by: Yang Guo <yangguo@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#49530}	2017-11-21 12:09:13 +00:00
jgruber	686c37839c	[regexp] Revert to ZoneList usage in @@replace ... Fixes a crash found by clusterfuzz caused by a call to std::vector::reserve with a huge capacity, and reverts to ZoneList handling as a tentative fix for performance regressions on the slow @@replace path. BUG=chromium:707187,chromium:706748,v8:5437 Review-Url: https://codereview.chromium.org/2787343002 Cr-Commit-Position: refs/heads/master@{#44311}	2017-03-31 14:38:36 +00:00