Avoid OOM on regexps with nested quantifiers.

src/ast.h

Index: src/ast.h
===================================================================
--- src/ast.h	(revision 8295)
+++ src/ast.h	(working copy)
@@ -1763,6 +1763,7 @@
 class RegExpTree: public ZoneObject {
  public:
   static const int kInfinity = kMaxInt;
+  RegExpTree() : contains_expanded_quantifier_(false) { }
   virtual ~RegExpTree() { }
   virtual void* Accept(RegExpVisitor* visitor, void* data) = 0;
   virtual RegExpNode* ToNode(RegExpCompiler* compiler,
@@ -1772,6 +1773,12 @@
   virtual bool IsAnchoredAtEnd() { return false; }
   virtual int min_match() = 0;
   virtual int max_match() = 0;
+  virtual bool ContainsExpandedQuantifier() {
+    return contains_expanded_quantifier_;
+  }
+  void set_contains_expanded_quantifier(bool value) {
+    contains_expanded_quantifier_ = value;
+  }
   // Returns the interval of registers used for captures within this
   // expression.
   virtual Interval CaptureRegisters() { return Interval::Empty(); }
@@ -1782,6 +1789,9 @@
   virtual bool Is##Name();
   FOR_EACH_REG_EXP_TREE_TYPE(MAKE_ASTYPE)
 #undef MAKE_ASTYPE
+
+ protected:
+  bool contains_expanded_quantifier_;
 };
 
 
@@ -1798,6 +1808,7 @@
   virtual bool IsAnchoredAtEnd();
   virtual int min_match() { return min_match_; }
   virtual int max_match() { return max_match_; }
+  virtual bool ContainsExpandedQuantifier();
   ZoneList<RegExpTree*>* alternatives() { return alternatives_; }
  private:
   ZoneList<RegExpTree*>* alternatives_;
@@ -1819,6 +1830,7 @@
   virtual bool IsAnchoredAtEnd();
   virtual int min_match() { return min_match_; }
   virtual int max_match() { return max_match_; }
+  virtual bool ContainsExpandedQuantifier();
   ZoneList<RegExpTree*>* nodes() { return nodes_; }
  private:
   ZoneList<RegExpTree*>* nodes_;
@@ -1968,7 +1980,8 @@
         min_(min),
         max_(max),
         min_match_(min * body->min_match()),
-        type_(type) {
+        type_(type),
+        contains_expanded_quantifier_(false) {
     if (max > 0 && body->max_match() > kInfinity / max) {
       max_match_ = kInfinity;
     } else {
@@ -1990,6 +2003,9 @@
   virtual bool IsQuantifier();
   virtual int min_match() { return min_match_; }
   virtual int max_match() { return max_match_; }
+  virtual bool ContainsExpandedQuantifier() {
+    return contains_expanded_quantifier_ || body_->ContainsExpandedQuantifier();
+  }
   int min() { return min_; }
   int max() { return max_; }
   bool is_possessive() { return type_ == POSSESSIVE; }
@@ -2004,6 +2020,7 @@
   int min_match_;
   int max_match_;
   Type type_;
+  bool contains_expanded_quantifier_;
 };
 
 
@@ -2025,6 +2042,9 @@
   virtual bool IsCapture();
   virtual int min_match() { return body_->min_match(); }
   virtual int max_match() { return body_->max_match(); }
+  virtual bool ContainsExpandedQuantifier() {
+    return contains_expanded_quantifier_ || body_->ContainsExpandedQuantifier();
+  }
   RegExpTree* body() { return body_; }
   int index() { return index_; }
   static int StartRegister(int index) { return index * 2; }
@@ -2056,6 +2076,9 @@
   virtual bool IsAnchoredAtStart();
   virtual int min_match() { return 0; }
   virtual int max_match() { return 0; }
+  virtual bool ContainsExpandedQuantifier() {
+    return contains_expanded_quantifier_ || body_->ContainsExpandedQuantifier();
+  }
   RegExpTree* body() { return body_; }
   bool is_positive() { return is_positive_; }
   int capture_count() { return capture_count_; }