Skip to content

V
V8
Commit 644bade7 authored by zhengxing.li's avatar zhengxing.li Committed by Commit bot
Browse files
Options

X87: [regexp] do not assume short external strings have a minimum size. 

  port 3518e492 (r35660)

  original commit message:
  Short external strings do not cache the resource data, and may be used
  for compressible strings. The assumptions about their lengths is
  invalid and may lead to oob reads.

BUG=

Review URL: https://codereview.chromium.org/1904003003

Cr-Commit-Position: refs/heads/master@{#35681}
parent 600ddaee
Hide whitespace changes
Inline Side-by-side
Showing with 30 additions and 45 deletions
src/x87/code-stubs-x87.cc
View file @ 644bade7
......@@ -477,39 +477,37 @@ void RegExpExecStub::Generate(MacroAssembler* masm) {
__ mov(eax, Operand(esp, kSubjectOffset));
__ JumpIfSmi(eax, &runtime);
__ mov(edx, eax); // Make a copy of the original subject string.
__ mov(ebx, FieldOperand(eax, HeapObject::kMapOffset));
__ movzx_b(ebx, FieldOperand(ebx, Map::kInstanceTypeOffset));
// eax: subject string
// edx: subject string
// ebx: subject string instance type
// ecx: RegExp data (FixedArray)
// Handle subject string according to its encoding and representation:
// (1) Sequential two byte? If yes, go to (9).
// (2) Sequential one byte? If yes, go to (6).
// (3) Anything but sequential or cons? If yes, go to (7).
// (4) Cons string. If the string is flat, replace subject with first string.
// Otherwise bailout.
// (5a) Is subject sequential two byte? If yes, go to (9).
// (5b) Is subject external? If yes, go to (8).
// (6) One byte sequential. Load regexp code for one byte.
// (2) Sequential one byte? If yes, go to (5).
// (3) Sequential or cons? If not, go to (6).
// (4) Cons string. If the string is flat, replace subject with first string
// and go to (1). Otherwise bail out to runtime.
// (5) One byte sequential. Load regexp code for one byte.
// (E) Carry on.
/// [...]
// Deferred code at the end of the stub:
// (7) Not a long external string? If yes, go to (10).
// (8) External string. Make it, offset-wise, look like a sequential string.
// (8a) Is the external string one byte? If yes, go to (6).
// (9) Two byte sequential. Load regexp code for one byte. Go to (E).
// (6) Long external string? If not, go to (10).
// (7) External string. Make it, offset-wise, look like a sequential string.
// (8) Is the external string one byte? If yes, go to (5).
// (9) Two byte sequential. Load regexp code for two byte. Go to (E).
// (10) Short external string or not a string? If yes, bail out to runtime.
// (11) Sliced string. Replace subject with parent. Go to (5a).
// (11) Sliced string. Replace subject with parent. Go to (1).
Label seq_one_byte_string /* 6 */, seq_two_byte_string /* 9 */,
external_string /* 8 */, check_underlying /* 5a */,
not_seq_nor_cons /* 7 */, check_code /* E */,
not_long_external /* 10 */;
Label seq_one_byte_string /* 5 */, seq_two_byte_string /* 9 */,
external_string /* 7 */, check_underlying /* 1 */,
not_seq_nor_cons /* 6 */, check_code /* E */, not_long_external /* 10 */;
__ bind(&check_underlying);
// (1) Sequential two byte? If yes, go to (9).
__ mov(ebx, FieldOperand(eax, HeapObject::kMapOffset));
__ movzx_b(ebx, FieldOperand(ebx, Map::kInstanceTypeOffset));
__ and_(ebx, kIsNotStringMask |
kStringRepresentationMask |
kStringEncodingMask |
......@@ -517,14 +515,14 @@ void RegExpExecStub::Generate(MacroAssembler* masm) {
STATIC_ASSERT((kStringTag | kSeqStringTag | kTwoByteStringTag) == 0);
__ j(zero, &seq_two_byte_string); // Go to (9).
// (2) Sequential one byte? If yes, go to (6).
// (2) Sequential one byte? If yes, go to (5).
// Any other sequential string must be one byte.
__ and_(ebx, Immediate(kIsNotStringMask |
kStringRepresentationMask |
kShortExternalStringMask));
__ j(zero, &seq_one_byte_string, Label::kNear); // Go to (6).
__ j(zero, &seq_one_byte_string, Label::kNear); // Go to (5).
// (3) Anything but sequential or cons? If yes, go to (7).
// (3) Sequential or cons? If not, go to (6).
// We check whether the subject string is a cons, since sequential strings
// have already been covered.
STATIC_ASSERT(kConsStringTag < kExternalStringTag);
......@@ -532,32 +530,19 @@ void RegExpExecStub::Generate(MacroAssembler* masm) {
STATIC_ASSERT(kIsNotStringMask > kExternalStringTag);
STATIC_ASSERT(kShortExternalStringTag > kExternalStringTag);
__ cmp(ebx, Immediate(kExternalStringTag));
__ j(greater_equal, &not_seq_nor_cons); // Go to (7).
__ j(greater_equal, &not_seq_nor_cons); // Go to (6).
// (4) Cons string. Check that it's flat.
// Replace subject with first string and reload instance type.
__ cmp(FieldOperand(eax, ConsString::kSecondOffset), factory->empty_string());
__ j(not_equal, &runtime);
__ mov(eax, FieldOperand(eax, ConsString::kFirstOffset));
__ bind(&check_underlying);
__ mov(ebx, FieldOperand(eax, HeapObject::kMapOffset));
__ mov(ebx, FieldOperand(ebx, Map::kInstanceTypeOffset));
// (5a) Is subject sequential two byte? If yes, go to (9).
__ test_b(ebx, Immediate(kStringRepresentationMask | kStringEncodingMask));
STATIC_ASSERT((kSeqStringTag | kTwoByteStringTag) == 0);
__ j(zero, &seq_two_byte_string); // Go to (9).
// (5b) Is subject external? If yes, go to (8).
__ test_b(ebx, Immediate(kStringRepresentationMask));
// The underlying external string is never a short external string.
STATIC_ASSERT(ExternalString::kMaxShortLength < ConsString::kMinLength);
STATIC_ASSERT(ExternalString::kMaxShortLength < SlicedString::kMinLength);
__ j(not_zero, &external_string); // Go to (8).
__ jmp(&check_underlying);
// eax: sequential subject string (or look-alike, external string)
// edx: original subject string
// ecx: RegExp data (FixedArray)
// (6) One byte sequential. Load regexp code for one byte.
// (5) One byte sequential. Load regexp code for one byte.
__ bind(&seq_one_byte_string);
// Load previous index and check range before edx is overwritten. We have
// to use edx instead of eax here because it might have been only made to
......@@ -778,12 +763,12 @@ void RegExpExecStub::Generate(MacroAssembler* masm) {
__ TailCallRuntime(Runtime::kRegExpExec);
// Deferred code for string handling.
// (7) Not a long external string? If yes, go to (10).
// (6) Long external string? If not, go to (10).
__ bind(&not_seq_nor_cons);
// Compare flags are still set from (3).
__ j(greater, &not_long_external, Label::kNear); // Go to (10).
// (8) External string. Short external strings have been ruled out.
// (7) External string. Short external strings have been ruled out.
__ bind(&external_string);
// Reload instance type.
__ mov(ebx, FieldOperand(eax, HeapObject::kMapOffset));
......@@ -799,14 +784,14 @@ void RegExpExecStub::Generate(MacroAssembler* masm) {
STATIC_ASSERT(SeqTwoByteString::kHeaderSize == SeqOneByteString::kHeaderSize);
__ sub(eax, Immediate(SeqTwoByteString::kHeaderSize - kHeapObjectTag));
STATIC_ASSERT(kTwoByteStringTag == 0);
// (8a) Is the external string one byte? If yes, go to (6).
// (8) Is the external string one byte? If yes, go to (5).
__ test_b(ebx, Immediate(kStringEncodingMask));
__ j(not_zero, &seq_one_byte_string); // Goto (6).
__ j(not_zero, &seq_one_byte_string); // Go to (5).
// eax: sequential subject string (or look-alike, external string)
// edx: original subject string
// ecx: RegExp data (FixedArray)
// (9) Two byte sequential. Load regexp code for one byte. Go to (E).
// (9) Two byte sequential. Load regexp code for two byte. Go to (E).
__ bind(&seq_two_byte_string);
// Load previous index and check range before edx is overwritten. We have
// to use edx instead of eax here because it might have been only made to
......@@ -826,11 +811,11 @@ void RegExpExecStub::Generate(MacroAssembler* masm) {
__ test(ebx, Immediate(kIsNotStringMask | kShortExternalStringTag));
__ j(not_zero, &runtime);
// (11) Sliced string. Replace subject with parent. Go to (5a).
// (11) Sliced string. Replace subject with parent. Go to (1).
// Load offset into edi and replace subject string with parent.
__ mov(edi, FieldOperand(eax, SlicedString::kOffsetOffset));
__ mov(eax, FieldOperand(eax, SlicedString::kParentOffset));
__ jmp(&check_underlying); // Go to (5a).
__ jmp(&check_underlying); // Go to (1).
#endif // V8_INTERPRETED_REGEXP
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment