Avoid OOM on regexps with nested quantifiers.

src/jsregexp.cc

 // Copyright 2006-2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 3748 matching lines @@
   // this case.
   static const int kMaxUnrolledMinMatches = 3;  // Unroll (foo)+ and (foo){3,}
   static const int kMaxUnrolledMaxMatches = 3;  // Unroll (foo)? and (foo){x,3}
   if (max == 0) return on_success;  // This can happen due to recursion.
   bool body_can_be_empty = (body->min_match() == 0);
   int body_start_reg = RegExpCompiler::kNoRegister;
   Interval capture_registers = body->CaptureRegisters();
   bool needs_capture_clearing = !capture_registers.is_empty();
   if (body_can_be_empty) {
     body_start_reg = compiler->AllocateRegister();
-  } else if (FLAG_regexp_optimization && !needs_capture_clearing) {
+  } else if (FLAG_regexp_optimization &&
+             !body->ContainsExpandedQuantifier() &&
+             !needs_capture_clearing) {
     // Only unroll if there are no captures and the body can't be
     // empty.
     if (min > 0 && min <= kMaxUnrolledMinMatches) {
       int new_max = (max == kInfinity) ? max : max - min;
       // Recurse once to get the loop or optional matches after the fixed ones.
       RegExpNode* answer = ToNode(
           0, new_max, is_greedy, body, compiler, on_success, true);
       // Unroll the forced matches from 0 to min.  This can cause chains of
       // TextNodes (which the parser does not generate).  These should be
       // combined if it turns out they hinder good code generation.
       for (int i = 0; i < min; i++) {
         answer = body->ToNode(compiler, answer);
       }
+      if (min > 1) body->set_contains_expanded_quantifier(true);
       return answer;
     }
     if (max <= kMaxUnrolledMaxMatches) {
       ASSERT(min == 0);
       // Unroll the optional matches up to max.
       RegExpNode* answer = on_success;
       for (int i = 0; i < max; i++) {
         ChoiceNode* alternation = new ChoiceNode(2);
         if (is_greedy) {
           alternation->AddAlternative(GuardedAlternative(body->ToNode(compiler,
                                                                       answer)));
           alternation->AddAlternative(GuardedAlternative(on_success));
         } else {
           alternation->AddAlternative(GuardedAlternative(on_success));
           alternation->AddAlternative(GuardedAlternative(body->ToNode(compiler,
                                                                       answer)));
         }
         answer = alternation;
         if (not_at_start) alternation->set_not_at_start();
       }
+      if (max > 1) body->set_contains_expanded_quantifier(true);
       return answer;
     }
   }
   bool has_min = min > 0;
   bool has_max = max < RegExpTree::kInfinity;
   bool needs_counter = has_min || has_max;
   int reg_ctr = needs_counter
       ? compiler->AllocateRegister()
       : RegExpCompiler::kNoRegister;
   LoopChoiceNode* center = new LoopChoiceNode(body->min_match() == 0);
@@ skipping 1566 matching lines @@
   }
 
   return compiler.Assemble(&macro_assembler,
                            node,
                            data->capture_count,
                            pattern);
 }
 
 
 }}  // namespace v8::internal