8282134: Certain regex can cause a JS trap in WebView

arapte · arapte · commit 3cfee27342f3 · 2022-04-28T18:01:02.000Z
Backport-of: 73963960dc6e56fe34d7aa5fb4ce6f6d2f07acc5
diff --git a/modules/javafx.web/src/main/native/Source/JavaScriptCore/yarr/YarrJIT.cpp b/modules/javafx.web/src/main/native/Source/JavaScriptCore/yarr/YarrJIT.cpp
@@ -2135,7 +2135,7 @@ class YarrGenerator final : public YarrJITInfo, private MacroAssembler {
 
         if (!nonGreedyFailuresDecrementIndex.empty()) {
             nonGreedyFailuresDecrementIndex.link(this);
-            breakpoint();
+            sub32(TrustedImm32(1), index);
         }
         nonGreedyFailures.link(this);
         sub32(countRegister, index);
diff --git a/modules/javafx.web/src/test/java/test/javafx/scene/web/LoadTest.java b/modules/javafx.web/src/test/java/test/javafx/scene/web/LoadTest.java
@@ -413,4 +413,12 @@ public void onError() {
             throw new AssertionError(ex);
         }
     }
+
+    // JDK-8282134 Certain regex can cause a JS trap in WebView
+    @Test public void jsRegexpTrapTest() {
+        final String FILE = "src/test/resources/test/html/unicode.html";
+        load(new File(FILE));
+        WebEngine web = getEngine();
+        assertTrue("Load task completed successfully", getLoadState() == SUCCEEDED);
+    }
 }
diff --git a/modules/javafx.web/src/test/resources/test/html/unicode.html b/modules/javafx.web/src/test/resources/test/html/unicode.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<body>
+<script>
+    let a = "\ud800\ud800\udc00"
+    let b = /(.*[^x]+?)[^]*([1])/u
+    b.exec(a)
+</script>
+
+<p id="regtest">PASS</p>
+
+</body>
+</html>

Original file line number	Diff line number	Diff line change
`@@ -2135,7 +2135,7 @@ class YarrGenerator final : public YarrJITInfo, private MacroAssembler {`
`2135`	`2135`
`2136`	`2136`	`if (!nonGreedyFailuresDecrementIndex.empty()) {`
`2137`	`2137`	`nonGreedyFailuresDecrementIndex.link(this);`
`2138`		`- breakpoint();`
	`2138`	`+ sub32(TrustedImm32(1), index);`
`2139`	`2139`	`}`
`2140`	`2140`	`nonGreedyFailures.link(this);`
`2141`	`2141`	`sub32(countRegister, index);`
Original file line number	Diff line number	Diff line change
`@@ -413,4 +413,12 @@ public void onError() {`
`413`	`413`	`throw new AssertionError(ex);`
`414`	`414`	`}`
`415`	`415`	`}`
	`416`	`+`
	`417`	`+ // JDK-8282134 Certain regex can cause a JS trap in WebView`
	`418`	`+ @Test public void jsRegexpTrapTest() {`
	`419`	`+ final String FILE = "src/test/resources/test/html/unicode.html";`
	`420`	`+ load(new File(FILE));`
	`421`	`+ WebEngine web = getEngine();`
	`422`	`+ assertTrue("Load task completed successfully", getLoadState() == SUCCEEDED);`
	`423`	`+ }`
`416`	`424`	`}`