e1f676ec99
Band-aid fix for infinite recursion in RegExp TFJ builtins. TFJ builtins don't contain stack checks in general, so any deep recursion involving only TFJ builtins can end up overflowing the stack and segfaulting on the red area. RegExp builtins in particular can only build such recursions using RegExp.p.exec, and (as far as I can tell) only by modifying the instance or prototype, thus hitting the slow path in all builtins. This CL adds a stack check to RegExpExec, which is the choke point for calling exec on slow-mode RegExps. Bug: v8:7239, chromium:797481 Regression test Change-Id: I78dbb5f868a775d9697606d513623f912639d7db Reviewed-on: https://chromium-review.googlesource.com/856777 Reviewed-by: Yang Guo <yangguo@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#50511}
11 lines
307 B
JavaScript
11 lines
307 B
JavaScript
// Copyright 2017 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --stack-size=100
|
|
|
|
const a = /x/;
|
|
|
|
a.exec = RegExp.prototype.test;
|
|
assertThrows(() => RegExp.prototype.test.call(a), RangeError);
|