57631 - RegExp with invalid pattern or invalid flag causes segfault

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P3)

Description

[Robert Ginda]

js> /()/
5: unterminated parenthetical (:
5: /()/
5: ^
js> new RegExp("()")
Segmentation fault (core dumped)
[rginda@rg2 Linux_All_DBG.OBJ]$ 

As useless as this regex may be, I think it's legal.  At least, it probably
shouldn't crash.

Comment 1

[Phil Schwartau]

Attachment: WinNT stack trace

Comment 2

[rogerl (gone)]

We're crashing in an ASSERT because the tokenstream is NULL but fields in it are 
being validated; it should only be happening in debug versions. 

Here's a patch:

Index: jsscan.c
===================================================================
RCS file: /m/pub/mozilla/js/src/jsscan.c,v
retrieving revision 3.34
diff -u -r3.34 jsscan.c
--- jsscan.c    2000/09/09 05:53:00     3.34
+++ jsscan.c    2000/10/24 19:41:47
@@ -513,7 +513,7 @@

     js_AddRoot(cx, &linestr, "error line buffer");

-    JS_ASSERT(ts->linebuf.limit < ts->linebuf.base + JS_LINE_LIMIT);
+    JS_ASSERT(ts && ts->linebuf.limit < ts->linebuf.base + JS_LINE_LIMIT);
     onError = cx->errorReporter;
     if (onError) {
         /*

Comment 3

[Robert Ginda]

I'll buy that.  How about the bogus "unterminated parenthetical" error?

Comment 4

[rogerl (gone)]

Oh yeah, that.  It's caused by the regexp parser being too greedy and assuming 
it's got an atom when it doesn't. I'll attach a combined patch...

Comment 5

[rogerl (gone)]

Attachment: Fix jsscan.c & jsregxp.c

Comment 6

[rogerl (gone)]

*** Bug 60923 has been marked as a duplicate of this bug. ***

Comment 7

[Phil Schwartau]

NOTE: We are also getting a segfault by using an invalid flag, e.g. 'a'.

EXAMPLE

js> var re = new RegExp('matchthis','a');   
js> --->  SEGFAULT

Comment 8

[rogerl (gone)]

Turns out to be the same bug and should be fixed by the same patch.

Comment 9

[Phil Schwartau]

Testcase added to JS test suite:

                js/tests/ecma_3/RegExp/regress-57631.js

Comment 10

[rogerl (gone)]

Attachment: new mega patch fixes all RE bugs

Comment 11

[rogerl (gone)]

Generated a meta bug to capture all current R.E. bugs.

Comment 12

[rogerl (gone)]

Fix checked in.

Comment 13

[Phil Schwartau]

Verified Fixed - ran this test suite directory on Linux, WinNT, and Mac

                    js/tests/ecma_3/RegExp/ 

with both debug and optimized versions of the JS shell, and got 0 errors.