Revision control
++ // Copyright (C) 2016 The Qt Company Ltd.
++ // SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only
++ // Qt-Security score:significant
++ // TODO: verifyj critical part should be in YARR
++
++ #include "qv4regexp_p.h"
++ #include "qv4engine_p.h"
++ #include "qv4scopedvalue_p.h"
++ #include <private/qv4mm_p.h>
++ #include <runtime/VM.h>
++
++ using namespace QV4;
++
++ #if ENABLE(YARR_JIT)
++ static constexpr qsizetype LongStringJitThreshold = 1024;
++ static constexpr int LongStringJitBoost = 3;
++ #endif
++
++ static JSC::RegExpFlags jscFlags(quint8 flags)
++ {
++ JSC::RegExpFlags jscFlags = JSC::NoFlags;
++ if (flags & CompiledData::RegExp::RegExp_Global)
++ jscFlags = static_cast<JSC::RegExpFlags>(jscFlags | JSC::FlagGlobal);
++ if (flags & CompiledData::RegExp::RegExp_IgnoreCase)
++ jscFlags = static_cast<JSC::RegExpFlags>(jscFlags | JSC::FlagIgnoreCase);
++ if (flags & CompiledData::RegExp::RegExp_Multiline)
++ jscFlags = static_cast<JSC::RegExpFlags>(jscFlags | JSC::FlagMultiline);
++ if (flags & CompiledData::RegExp::RegExp_Unicode)
++ jscFlags = static_cast<JSC::RegExpFlags>(jscFlags | JSC::FlagUnicode);
++ if (flags & CompiledData::RegExp::RegExp_Sticky)
++ jscFlags = static_cast<JSC::RegExpFlags>(jscFlags | JSC::FlagSticky);
++ return jscFlags;
++ }
++
++ RegExpCache::~RegExpCache()
++ {
++ for (RegExpCache::Iterator it = begin(), e = end(); it != e; ++it) {
++ if (RegExp *re = it.value().as<RegExp>())
++ re->d()->cache = nullptr;
++ }
++ }
++
++ DEFINE_MANAGED_VTABLE(RegExp);
++
++ uint RegExp::match(const QString &string, int start, uint *matchOffsets)
++ {
++ // Note that we rely on the side-effect of checkStackLimits updating
++ // cppStackLimit (which might be necessary after a thread move):
++ // hasCppStackOverflow's recheck will trigger after a move (if it
++ // didn't, we'd had overlapping stack regions, which can't be).
++ if (!isValid() || internalClass()->engine->checkStackLimits())
++ return JSC::Yarr::offsetNoMatch;
++
++ #if ENABLE(YARR_JIT)
++ auto *priv = d();
++
++ auto regenerateByteCode = [](Heap::RegExp *regexp) {
++ const void* stackLimit = regexp->internalClass->engine->cppStackLimit;
++ JSC::Yarr::ErrorCode error = JSC::Yarr::ErrorCode::NoError;
++ JSC::Yarr::YarrPattern yarrPattern(WTF::String(*regexp->pattern), jscFlags(regexp->flags),
++ error, const_cast<void *>(stackLimit));
++
++ // As we successfully parsed the pattern before, we should still be able to.
++ Q_ASSERT(error == JSC::Yarr::ErrorCode::NoError);
++
++ regexp->byteCode = JSC::Yarr::byteCompile(
++ yarrPattern,
++ regexp->internalClass->engine->bumperPointerAllocator).release();
++ };
++
++ auto removeJitCode = [](Heap::RegExp *regexp) {
++ delete regexp->jitCode;
++ regexp->jitCode = nullptr;
++ regexp->jitFailed = true;
++ };
++
++ auto removeByteCode = [](Heap::RegExp *regexp) {
++ delete regexp->byteCode;
++ regexp->byteCode = nullptr;
++ };
++
++ if (!priv->jitCode) {
++
++ // Long strings count as more calls. We want the JIT to run earlier.
++ const bool longString = string.length() > LongStringJitThreshold;
++ if (longString)
++ priv->interpreterCallCount += LongStringJitBoost;
++
++ if (priv->internalClass->engine->canJIT(priv)) {
++ removeByteCode(priv);
++
++ JSC::Yarr::ErrorCode error = JSC::Yarr::ErrorCode::NoError;
++ const void* stackLimit = internalClass()->engine->cppStackLimit;
++ JSC::Yarr::YarrPattern yarrPattern(
++ WTF::String(*priv->pattern), jscFlags(priv->flags), error, const_cast<void *>(stackLimit));
++ if (!yarrPattern.m_containsBackreferences) {
++ priv->jitCode = new JSC::Yarr::YarrCodeBlock;
++ JSC::VM *vm = static_cast<JSC::VM *>(priv->internalClass->engine);
++ JSC::Yarr::jitCompile(yarrPattern, JSC::Yarr::Char16, vm, *priv->jitCode);
++ }
++
++ if (!priv->hasValidJITCode()) {
++ removeJitCode(priv);
++ regenerateByteCode(priv);
++ }
++ } else if (!longString) {
++ // Short strings do the regular post-increment to honor
++ // QV4_JIT_CALL_THRESHOLD.
++ ++priv->interpreterCallCount;
++ }
++ }
++ #endif
++
++ WTF::String s(string);
++
++ #if ENABLE(YARR_JIT)
++ if (priv->hasValidJITCode()) {
++ static const uint offsetJITFail = std::numeric_limits<unsigned>::max() - 1;
++ uint ret = JSC::Yarr::offsetNoMatch;
++ #if ENABLE(YARR_JIT_ALL_PARENS_EXPRESSIONS)
++ char buffer[8192];
++ ret = uint(priv->jitCode->execute(s.characters16(), start, s.size(),
++ (int*)matchOffsets, buffer, 8192).start);
++ #else
++ ret = uint(priv->jitCode->execute(s.characters16(), start, s.length(),
++ (int*)matchOffsets).start);
++ #endif
++ if (ret != offsetJITFail)
++ return ret;
++
++ removeJitCode(priv);
++ // JIT failed. We need byteCode to run the interpreter.
++ Q_ASSERT(!priv->byteCode);
++ regenerateByteCode(priv);
++ }
++ #endif // ENABLE(YARR_JIT)
++
++ return JSC::Yarr::interpret(byteCode(), s.characters16(), string.size(), start, matchOffsets);
++ }
++
++ QString RegExp::getSubstitution(const QString &matched, const QString &str, int position, const Value *captures, int nCaptures, const QString &replacement)
++ {
++ QString result;
++
++ int matchedLength = matched.size();
++ Q_ASSERT(position >= 0 && position <= str.size());
++ int tailPos = position + matchedLength;
++ int seenDollar = -1;
++ for (int i = 0; i < replacement.size(); ++i) {
++ QChar ch = replacement.at(i);
++ if (seenDollar >= 0) {
++ if (ch.unicode() == '$') {
++ result += QLatin1Char('$');
++ } else if (ch.unicode() == '&') {
++ result += matched;
++ } else if (ch.unicode() == '`') {
++ result += str.left(position);
++ } else if (ch.unicode() == '\'') {
++ result += str.mid(tailPos);
++ } else if (ch.unicode() >= '0' && ch.unicode() <= '9') {
++ int n = ch.unicode() - '0';
++ if (i + 1 < replacement.size()) {
++ ch = replacement.at(i + 1);
++ if (ch.unicode() >= '0' && ch.unicode() <= '9') {
++ n = n*10 + (ch.unicode() - '0');
++ ++i;
++ }
++ }
++ if (n > 0 && n <= nCaptures) {
++ String *s = captures[n].stringValue();
++ if (s)
++ result += s->toQString();
++ } else {
++ for (int j = seenDollar; j <= i; ++j)
++ result += replacement.at(j);
++ }
++ } else {
++ result += QLatin1Char('$');
++ result += ch;
++ }
++ seenDollar = -1;
++ } else {
++ if (ch == QLatin1Char('$')) {
++ seenDollar = i;
++ continue;
++ }
++ result += ch;
++ }
++ }
++ if (seenDollar >= 0)
++ result += QLatin1Char('$');
++ return result;
++ }
++
++ Heap::RegExp *RegExp::create(
++ ExecutionEngine *engine, const QString &pattern, CompiledData::RegExp::Flags flags)
++ {
++ RegExpCacheKey key(pattern, flags);
++
++ RegExpCache *cache = engine->regExpCache;
++ if (!cache)
++ cache = engine->regExpCache = new RegExpCache;
++
++ QV4::WeakValue &cachedValue = (*cache)[key];
++ if (QV4::RegExp *result = cachedValue.as<RegExp>())
++ return result->d();
++
++ Scope scope(engine);
++ Scoped<RegExp> result(scope, engine->memoryManager->alloc<RegExp>(engine, pattern, flags));
++
++ result->d()->cache = cache;
++ cachedValue.set(engine, result);
++
++ return result->d();
++ }
++
++ void Heap::RegExp::init(ExecutionEngine *engine, const QString &pattern, uint flags)
++ {
++ Base::init();
++ this->pattern = new QString(pattern);
++ this->flags = flags;
++
++ JSC::Yarr::ErrorCode error = JSC::Yarr::ErrorCode::NoError;
++ // compare the comment in RegExp::match
++ if (engine->checkStackLimits())
++ return;
++ const void* stackLimit = internalClass->engine->cppStackLimit;
++ JSC::Yarr::YarrPattern yarrPattern(WTF::String(pattern), jscFlags(flags), error, const_cast<void *>(stackLimit));
++ if (error != JSC::Yarr::ErrorCode::NoError)
++ return;
++ subPatternCount = yarrPattern.m_numSubpatterns;
++ Q_UNUSED(engine);
++ byteCode = JSC::Yarr::byteCompile(yarrPattern, internalClass->engine->bumperPointerAllocator).release();
++ if (byteCode)
++ valid = true;
++ }
++
++ void Heap::RegExp::destroy()
++ {
++ if (cache) {
++ RegExpCacheKey key(this);
++ cache->remove(key);
++ }
++ #if ENABLE(YARR_JIT)
++ delete jitCode;
++ #endif
++ delete byteCode;
++ delete pattern;
++ Base::destroy();
++ }