FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

deps: V8: cherry-pick 53c4d057974a · nodejs/node@26cc160 · GitHub

/ node Public

Commit 26cc160

Browse files
targos
committed
deps: V8: cherry-pick 53c4d057974a
Original commit message: Reland "[regexp] Hard-crash on invalid offsets in AdvanceCurrentPosition" This is a reland of 164cf80bbb0a6e091300bfc4cbbe70a6e6bd3e49 The reland fixes UB (left-shift of negative integer type) with a static_cast<uint32_t>. Original change's description: > [regexp] Hard-crash on invalid offsets in AdvanceCurrentPosition > > Drive-by: Range checks in `Emit(byte, twenty_four_bits)` to ensure the > given packed bits actually fit into 24 bits. > > Bug: chromium:1166138 > Change-Id: I2e711e6466bb48d7b9897f68dfe621d12bd92508 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2625877 > Commit-Queue: Jakob Gruber <jgruber@chromium.org> > Commit-Queue: Leszek Swirski <leszeks@chromium.org> > Auto-Submit: Jakob Gruber <jgruber@chromium.org> > Reviewed-by: Leszek Swirski <leszeks@chromium.org> > Cr-Commit-Position: refs/heads/master@{#72064} (cherry picked from commit ff8d0f92d423774cf773b5b4fb48b6744971e27a) No-Try: true No-Presubmit: true No-Tree-Checks: true Tbr: leszeks@chromium.org Bug: chromium:1166138 Change-Id: I514495e14bb99dfc9588fdb4a9f35d67d8d64acb Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2626663 Reviewed-by: Jakob Gruber <jgruber@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Original-Commit-Position: refs/heads/master@{#72088} Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2742954 Reviewed-by: Jana Grill <janagrill@chromium.org> Commit-Queue: Victor-Gabriel Savu <vsavu@google.com> Cr-Commit-Position: refs/branch-heads/8.6@{#64} Cr-Branched-From: a64aed2333abf49e494d2a5ce24bbd14fff19f60-refs/heads/8.6.395@{#1} Cr-Branched-From: a626bc036236c9bf92ac7b87dc40c9e538b087e3-refs/heads/master@{#69472} Refs: v8/v8@53c4d05 PR-URL: #38275 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Jiawen Geng <technicalcute@gmail.com> Reviewed-By: Shelley Vohr <codebytere@gmail.com>
1 parent 05530e8 commit 26cc160

6 files changed

Lines changed: 23 additions & 10 deletions

File tree

‎common.gypi‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@
3636

3737
# Reset this number to 0 on major V8 upgrades.
3838
# Increment by one for each non-official patch applied to deps/v8.
39-
'v8_embedder_string': '-node.44',
39+
'v8_embedder_string': '-node.45',
4040

4141
##### V8 defaults for Node.js #####
4242

‎deps/v8/src/regexp/regexp-bytecode-generator-inl.h‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -14,13 +14,13 @@ namespace v8 {
1414
namespace internal {
1515

1616
void RegExpBytecodeGenerator::Emit(uint32_t byte, uint32_t twenty_four_bits) {
17-
uint32_t word = ((twenty_four_bits << BYTECODE_SHIFT) | byte);
18-
DCHECK(pc_ <= buffer_.length());
19-
if (pc_ + 3 >= buffer_.length()) {
20-
Expand();
21-
}
22-
*reinterpret_cast<uint32_t*>(buffer_.begin() + pc_) = word;
23-
pc_ += 4;
17+
DCHECK(is_uint24(twenty_four_bits));
18+
Emit32((twenty_four_bits << BYTECODE_SHIFT) | byte);
19+
}
20+
21+
void RegExpBytecodeGenerator::Emit(uint32_t byte, int32_t twenty_four_bits) {
22+
DCHECK(is_int24(twenty_four_bits));
23+
Emit32((static_cast<uint32_t>(twenty_four_bits) << BYTECODE_SHIFT) | byte);
2424
}
2525

2626
void RegExpBytecodeGenerator::Emit16(uint32_t word) {

‎deps/v8/src/regexp/regexp-bytecode-generator.cc‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -161,8 +161,10 @@ bool RegExpBytecodeGenerator::Succeed() {
161161
void RegExpBytecodeGenerator::Fail() { Emit(BC_FAIL, 0); }
162162

163163
void RegExpBytecodeGenerator::AdvanceCurrentPosition(int by) {
164-
DCHECK_LE(kMinCPOffset, by);
165-
DCHECK_GE(kMaxCPOffset, by);
164+
// TODO(chromium:1166138): Turn back into DCHECKs once the underlying issue
165+
// is fixed.
166+
CHECK_LE(kMinCPOffset, by);
167+
CHECK_GE(kMaxCPOffset, by);
166168
advance_current_start_ = pc_;
167169
advance_current_offset_ = by;
168170
Emit(BC_ADVANCE_CP, by);

‎deps/v8/src/regexp/regexp-bytecode-generator.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,7 @@ class V8_EXPORT_PRIVATE RegExpBytecodeGenerator : public RegExpMacroAssembler {
8585
inline void Emit16(uint32_t x);
8686
inline void Emit8(uint32_t x);
8787
inline void Emit(uint32_t bc, uint32_t arg);
88+
inline void Emit(uint32_t bc, int32_t arg);
8889
// Bytecode buffer.
8990
int length();
9091
void Copy(byte* a);

‎deps/v8/test/mjsunit/mjsunit.status‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,9 @@
7373
# Enable once multi-byte prefixed opcodes are correctly handled
7474
'regress/wasm/regress-1065599': [SKIP],
7575

76+
# https://crbug.com/1166138
77+
'regress/regress-1166138': SKIP,
78+
7679
##############################################################################
7780
# Tests where variants make no sense.
7881
'd8/enable-tracing': [PASS, NO_VARIANTS],

‎deps/v8/test/mjsunit/regress/regress-1166138.js‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
// Copyright 2020 the V8 project authors. All rights reserved.
2+
// Use of this source code is governed by a BSD-style license that can be
3+
// found in the LICENSE file.
4+
5+
let badregexp = "(?:" + " ".repeat(32768*2)+ ")*";
6+
reg = RegExp(badregexp);
7+
reg.test()

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL