Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(22)

Issue 22815033: Fix crash due RegExpAtom method called on RegExpCharacterClass object. (Closed)

Created:
7 years, 4 months ago by Benedikt Meurer
Modified:
7 years, 4 months ago
CC:
v8-dev
Visibility:
Public.

Description

Fix crash due RegExpAtom method called on RegExpCharacterClass object. In the RegExpUnparser::VisitText(RegExpText* that, void* data) function always RegExpUnparser::VisitAtom function called via that->elements()->at(i).data.u_atom->Accept(this, data); even if the type of the object is RegExpCharacterClass. The problem shows using g++ 4.7(.2, .3) since r16232, since GCC optimizes virtual method calls to direct calls based on __final/final hints. Tested on MIPS and x64: Program received signal SIGSEGV, Segmentation fault. 0x0000000000588928 in v8::internal::RegExpUnparser::VisitAtom(v8::internal::RegExpAtom*, void*) () This cleans up the TextElement class to avoid the unsafe+unchecked union access, that caused the crash. TEST=cctest/test-regexp/ParserRegression R=jkummerow@chromium.org Committed: https://code.google.com/p/v8/source/detail?r=16289

Patch Set 1 #

Unified diffs Side-by-side diffs Delta from patch set Stats (+79 lines, -72 lines) Patch
M src/ast.cc View 1 chunk +2 lines, -2 lines 0 comments Download
M src/jsregexp.h View 1 chunk +32 lines, -11 lines 0 comments Download
M src/jsregexp.cc View 16 chunks +45 lines, -59 lines 0 comments Download

Messages

Total messages: 3 (0 generated)
Benedikt Meurer
PTAL
7 years, 4 months ago (2013-08-23 10:28:38 UTC) #1
Jakob Kummerow
LGTM! Nice cleanup, looks much better now.
7 years, 4 months ago (2013-08-23 11:04:56 UTC) #2
Benedikt Meurer
7 years, 4 months ago (2013-08-23 11:06:25 UTC) #3
Message was sent while issue was closed.
Committed patchset #1 manually as r16289.

Powered by Google App Engine
This is Rietveld 408576698