[regexp] Don't check for excess zone allocations

The regexp parser historically has tried to gracefully detect and bail
out from excess zone allocations, where 'excess' was determined to be
an arbitrary limit of 256MB.

This leads to issues now that the regexp parser may run from within
the JS parser - the JS parser doesn't observe this arbitrary limit and
happily keeps allocating until the underlying allocator actually runs
out of memory; this way, the JS parser can handle very large JS files,
and it's now counterproductive if the regexp parser (which reuses the
JS parser zone) bails out on excess allocations.

This CL simply removes the excess_allocation mechanism.

Bug: chromium:1264014
Change-Id: I8d93a1e52aa65bb0ea6c2aab3b68b479ce79a1f6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3401580Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78991}

src/regexp/regexp-parser.cc

@@ -428,11 +428,6 @@ void RegExpParserImpl<CharT>::Advance() {
         FATAL("Aborting on stack overflow");
       }
       ReportError(RegExpError::kStackOverflow);
-    } else if (zone()->excess_allocation()) {
-      if (FLAG_correctness_fuzzer_suppressions) {
-        FATAL("Aborting on excess zone allocation");
-      }
-      ReportError(RegExpError::kTooLarge);
     } else {
       current_ = ReadNext<true>();
     }

src/zone/zone.h

@@ -139,12 +139,6 @@ class V8_EXPORT_PRIVATE Zone final {
   // accounting allocator.
   void Reset();
 
-  // Returns true if more memory has been allocated in zones than
-  // the limit allows.
-  bool excess_allocation() const {
-    return segment_bytes_allocated_ > kExcessLimit;
-  }
-
   size_t segment_bytes_allocated() const { return segment_bytes_allocated_; }
 
   const char* name() const { return name_; }
@@ -203,9 +197,6 @@ class V8_EXPORT_PRIVATE Zone final {
   // Never allocate segments larger than this size in bytes.
   static const size_t kMaximumSegmentSize = 32 * KB;
 
-  // Report zone excess when allocation exceeds this limit.
-  static const size_t kExcessLimit = 256 * MB;
-
   // The number of bytes allocated in this zone so far.
   size_t allocation_size_ = 0;
 

test/mjsunit/mjsunit.status

@@ -262,7 +262,6 @@
   'regress/regress-500980': [PASS, HEAVY],
   'regress/regress-599414-array-concat-fast-path': [PASS, HEAVY],
   'regress/regress-678917': [PASS, HEAVY],
-  'regress/regress-752764': [PASS, HEAVY],
   'regress/regress-779407': [PASS, HEAVY],
   'regress/regress-852258': [PASS, HEAVY],
   'regress/regress-862433': [PASS, HEAVY],
@@ -307,8 +306,6 @@
 
   # worker creation/shutdown is very slow in debug mode
   'd8/d8-worker-shutdown*': [SLOW],
-  # Allocates a huge string and then flattens it.
-  'regress/regress-752764': [SLOW],
 
   # BUG(v8:11745) The test allocates too much memory, making it slow on debug.
   'compiler/regress-crbug-11564': [SKIP],
@@ -703,7 +700,6 @@
   # BUG(v8:6924). The test uses a lot of memory.
   'regress/wasm/regress-694433': [SKIP],
   'es6/typedarray': [PASS, NO_VARIANTS],
-  'regress/regress-752764': [PASS, SLOW, NO_VARIANTS],
 
   # BUG(v8:9242). Uses a lot of memory.
   'regress/regress-599414-array-concat-fast-path': [PASS, SLOW],
@@ -829,7 +825,6 @@
   'math-floor-of-div-minus-zero': [SKIP],
 
   # Requires too much memory on MIPS.
-  'regress/regress-752764': [SKIP],
   'regress/regress-779407': [SKIP],
   'harmony/bigint/regressions': [SKIP],
 
@@ -886,7 +881,6 @@
   'math-floor-of-div-minus-zero': [SKIP],
 
   # Requires too much memory on MIPS.
-  'regress/regress-752764': [SKIP],
   'regress/regress-779407': [SKIP],
 }],  # 'arch == mips64el or arch == mips64'
 
@@ -929,7 +923,6 @@
   'math-floor-of-div-minus-zero': [SKIP],
 
   # Requires too much memory on RISC-V.
-  'regress/regress-752764': [SKIP],
   'regress/regress-779407': [SKIP],
   'harmony/bigint/regressions': [SKIP],
 
@@ -1012,8 +1005,6 @@
   'tzoffset-transition-new-york-noi18n': [SKIP],
   'tzoffset-seoul': [SKIP],
   'tzoffset-seoul-noi18n': [SKIP],
-  # OOM:
-  'regress/regress-752764': [FAIL],
   # Flaky OOM:
   'regress/regress-748069': [SKIP],
   'regress/regress-779407': [SKIP],
@@ -1310,12 +1301,6 @@
   'regress/wasm/regress-7785': [SKIP],
 }],  # variant == nooptimization
 
-##############################################################################
-['(arch == arm or arch == arm64)', {
-  # Flaky tests: https://crbug.com/v8/8090
-  'regress/regress-752764': [SKIP],
-}],  # (arch == arm or arch == arm64)
-
 ##############################################################################
 ['gcov_coverage', {
   # Tests taking too long.

test/mjsunit/regress/regress-752764.js

-// Copyright 2017 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --allow-natives-syntax --nostress-incremental-marking
-// Stress-testing this test is very slow and provides no useful coverage.
-// Flags: --nostress-opt --noalways-opt
-
-// This test uses a lot of memory and fails with flaky OOM when run
-// with --stress-incremental-marking on TSAN.
-
-a = "a".repeat(%StringMaxLength() - 3);
-assertThrows(() => new RegExp("a" + a), SyntaxError);