274888 - Negative lookahead does not match at positions > approx. 64k

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Sjoerd Visscher]

This is probably a known limitation of the current implementation. I just
couldn't find it documented anywhere. 

If it is not a limitation but a bug I will create a test case.

Comment 1

[Brendan Eich [:brendan]]

This is related to bug 280769.  The bytecoded NFA rogerl implemented to get back
the perf lost when the old 4.x-era NFA was replaced with a tree-walker for
ECMA-262 Edition 3 uses only two-byte immediate offsets in its bytecode.  Jumps
therefore go from -32768 to +32767, but I'm guessing that certain assertions
have unsigned offsets.

Cc'ing some folks who might take this bug (mrbkap, I hope -- I'll advise).

/be

Comment 2

[Blake Kaplan (:mrbkap) (inactive)]

Taking, but a testcase would be nice.

Comment 3

[Bob Clary [:bc] (inactive)]

js/tests/js1_5/Regress/regress-274888.js checked in.

Comment 4

[Blake Kaplan (:mrbkap) (inactive)]

Unless someone has an issue with it, I'm going to make a patch that has
REProgState hold a pointer to the buffer instead of an index (which can
overflow) sometime tomorrow. Brendan, is there a reason this wasn't done from
the start?

Comment 5

[Brendan Eich [:brendan]]

mrbkap: don't use a pointer, or you'll have to recompute it on every realloc or
moral equivalent (JS_ARENA_GROW*).  Just fix the type of REProgState::index to
be ptrdiff_t, ok?  Thanks for figuring this out, it's nice and easy.

/be

Comment 6

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Use the correct types for indices

Comment 7

[Brendan Eich [:brendan]]

Comment on attachment 175695 [details] [diff] [review]
Use the correct types for indices

r=me, thanks again!

/be

Comment 8

[Blake Kaplan (:mrbkap) (inactive)]

Fix checked in.

Comment 9

[Bob Clary [:bc] (inactive)]

verified fixed.