Cherry-pick 265870.381@safari-7616-branch (b5b70c4). https://bugs.web…

…kit.org/show_bug.cgi?id=260173

    CrashOnOverflow in CharacterClassConstructor::compareUTF32Strings
    https://bugs.webkit.org/show_bug.cgi?id=260173
    rdar://113872060

    Reviewed by Ryosuke Niwa.

    Fixed and simplified the the sort comparison function compareUTF32Strings() to properly handle
    zero length strings.

    Added relevant tests.

    * JSTests/stress/regexp-vflag-property-of-strings.js:
    * Source/JavaScriptCore/yarr/YarrPattern.cpp:
    (JSC::Yarr::CharacterClassConstructor::compareUTF32Strings):

    Canonical link: https://commits.webkit.org/265870.381@safari-7616-branch

JSTests/stress/regexp-vflag-property-of-strings.js

@@ -506,3 +506,11 @@ testRegExp(/[a&&[\q{a|ab}]]/v, "ab", ["a"]);
 testRegExp(/[a--[\q{ab}]]/v, "ab", ["a"]);
 testRegExp(/[[\q{a|ab}]&&a]/v, "ab", ["a"]);
 testRegExp(/[[\q{a|ab}]--a]/v, "ab", ["ab"]);
+testRegExp(/[\q{}]/v, "", [""]);
+
+// Test 251
+testRegExp(/[\q{}]*/v, "", [""]);
+testRegExp(/[\q{}]+/v, "", [""]);
+testRegExp(/[\q{}]*/v, "1234", [""]);
+testRegExp(/[\q{|34||12}]*/v, "1234", ["1234"]);
+testRegExp(/[\q{|34||12}]*/v, "3412", ["3412"]);

Source/JavaScriptCore/yarr/YarrPattern.cpp

@@ -423,11 +423,11 @@ class CharacterClassConstructor {
 
         // Lexically sort for same length strings.
         for (unsigned i = 0; i < a.size(); ++i) {
-            if (a[i] < b[i])
-                return -1;
+            if (a[i] != b[i])
+                return (a[i] < b[i]) ? -1 : 1;
         }
 
-        return a[a.size() - 1] > b[a.size() - 1] ? 1 : 0;
+        return 0;
     }
 
     static void sort(Vector<Vector<UChar32>>& utf32Strings)