commit 297e4770ac1860ed02b418c7060d63da09cc8283
author mark.lam@apple.com <mark.lam@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Tue Oct 22 05:44:31 2019 +0000
committer mark.lam@apple.com <mark.lam@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> Tue Oct 22 05:44:31 2019 +0000
tree c60886c68f8c3604e8024c87a6b3e667a1eb2b9d
parent a2ef6df9a95b8209a07942ea1b5fce24b87caeb8

Rolling out r251411: Fix is incorrect.
https://bugs.webkit.org/show_bug.cgi?id=203230

Not reviewed.

JSTests:

* stress/incorrect-exception-assertion-in-operationRegExpExecNonGlobalOrSticky.js: Removed.

Source/JavaScriptCore:

* dfg/DFGOperations.cpp:



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@251418 268f45cc-cd09-0410-ab3c-d52691b4dbfc

JSTests/ChangeLog

diff --git a/JSTests/ChangeLog b/JSTests/ChangeLog
index dca3bb1..7695e57 100644
--- a/JSTests/ChangeLog
+++ b/JSTests/ChangeLog
@@ -1,5 +1,14 @@
 2019-10-21  Mark Lam  <mark.lam@apple.com>
 
+        Rolling out r251411: Fix is incorrect.
+        https://bugs.webkit.org/show_bug.cgi?id=203230
+
+        Not reviewed.
+
+        * stress/incorrect-exception-assertion-in-operationRegExpExecNonGlobalOrSticky.js: Removed.
+
+2019-10-21  Mark Lam  <mark.lam@apple.com>
+
         Fix incorrect assertion in operationRegExpExecNonGlobalOrSticky().
         https://bugs.webkit.org/show_bug.cgi?id=203230
         <rdar://problem/56460749>

JSTests/stress/incorrect-exception-assertion-in-operationRegExpExecNonGlobalOrSticky.js

diff --git a/JSTests/stress/incorrect-exception-assertion-in-operationRegExpExecNonGlobalOrSticky.js b/JSTests/stress/incorrect-exception-assertion-in-operationRegExpExecNonGlobalOrSticky.js
deleted file mode 100644
index bd3d04c..0000000
--- a/JSTests/stress/incorrect-exception-assertion-in-operationRegExpExecNonGlobalOrSticky.js
+++ /dev/null
@@ -1,26 +0,0 @@
-//@ runDefault("--alwaysUseShadowChicken=true", "--jitPolicyScale=0", "--useRandomizingFuzzerAgent=1", "--maxPerThreadStackUsage=1572863")
-//@ slow!
-
-class C {
-    constructor(func) {
-        this.func = func;
-    }
-    runTest() {
-        this.func();
-    }
-}
-function recurseAndTest() {
-    try {
-        recurseAndTest();
-        test.runTest();
-    } catch (e) {
-    }
-}
-const howManyParentheses = 1000;
-const deepRE = new RegExp('('.repeat(howManyParentheses) + ')'.repeat(howManyParentheses));
-let test = 
-    new C(() => {
-        deepRE.exec('');
-    });
-
-recurseAndTest();

Source/JavaScriptCore/ChangeLog

diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index a83e1c9..4833a5f 100644
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,5 +1,14 @@
 2019-10-21  Mark Lam  <mark.lam@apple.com>
 
+        Rolling out r251411: Fix is incorrect.
+        https://bugs.webkit.org/show_bug.cgi?id=203230
+
+        Not reviewed.
+
+        * dfg/DFGOperations.cpp:
+
+2019-10-21  Mark Lam  <mark.lam@apple.com>
+
         Fix incorrect assertion in operationRegExpExecNonGlobalOrSticky().
         https://bugs.webkit.org/show_bug.cgi?id=203230
         <rdar://problem/56460749>

Source/JavaScriptCore/dfg/DFGOperations.cpp

diff --git a/Source/JavaScriptCore/dfg/DFGOperations.cpp b/Source/JavaScriptCore/dfg/DFGOperations.cpp
index 3d8ab52..a1f6576 100644
--- a/Source/JavaScriptCore/dfg/DFGOperations.cpp
+++ b/Source/JavaScriptCore/dfg/DFGOperations.cpp
@@ -1245,9 +1245,12 @@
     unsigned lastIndex = 0;
     MatchResult result;
     JSArray* array = createRegExpMatchesArray(vm, globalObject, string, input, regExp, lastIndex, result);
-    RETURN_IF_EXCEPTION(scope, { });
-    ASSERT(array);
+    if (!array) {
+        ASSERT(!scope.exception());
+        return JSValue::encode(jsNull());
+    }
 
+    RETURN_IF_EXCEPTION(scope, { });
     globalObject->regExpGlobalData().recordMatch(vm, globalObject, regExp, string, result);
     return JSValue::encode(array);
 }