Merge pull request chakra-core#6857 from rhuanjl/FixCharTrieClone

Fix CharTrie::CloneFrom

CharTrie::CloneFrom uses recursion to clone a CharTrie tree. Currently this can overflow the native stack producing an uncatchable hard crash.

Fix by inserting a PROBE_STACK call that checks sufficient stack space is left and throws a catchable JS exception if not.

Fix chakra-core#6835

Author: ppenzin

lib/Parser/CharTrie.cpp

@@ -1,5 +1,6 @@
 //-------------------------------------------------------------------------------------------------------
 // Copyright (C) Microsoft. All rights reserved.
+// Copyright (c) ChakraCore Project Contributors. All rights reserved.
 // Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
 //-------------------------------------------------------------------------------------------------------
 #include "ParserPch.h"
@@ -199,16 +200,17 @@ namespace UnifiedRegex
 #endif
     }
 
-    void RuntimeCharTrie::CloneFrom(ArenaAllocator* allocator, const CharTrie& other)
+    void RuntimeCharTrie::CloneFrom(Js::ScriptContext* scriptContext, ArenaAllocator* allocator, const CharTrie& other)
     {
+        PROBE_STACK_NO_DISPOSE(scriptContext, Js::Constants::MinStackRegex);
         count = other.count;
         if (count > 0)
         {
             children = AnewArray(allocator, RuntimeCharTrieEntry, count);
             for (int i = 0; i < count; i++)
             {
                 children[i].c = other.children[i].c;
-                children[i].node.CloneFrom(allocator,  other.children[i].node);
+                children[i].node.CloneFrom(scriptContext, allocator,  other.children[i].node);
             }
         }
         else

lib/Parser/CharTrie.h

@@ -1,5 +1,6 @@
 //-------------------------------------------------------------------------------------------------------
 // Copyright (C) Microsoft. All rights reserved.
+// Copyright (c) ChakraCore Project Contributors. All rights reserved.
 // Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
 //-------------------------------------------------------------------------------------------------------
 #pragma once
@@ -65,7 +66,7 @@ namespace UnifiedRegex
     public:
         inline RuntimeCharTrie() : count(0), children(0) {}
         void FreeBody(ArenaAllocator* allocator);
-        void CloneFrom(ArenaAllocator* allocator, const CharTrie& other);
+        void CloneFrom(Js::ScriptContext* scriptContext, ArenaAllocator* allocator, const CharTrie& other);
 
         bool Match
             ( const Char* const input

lib/Parser/RegexCompileTime.cpp

@@ -1,5 +1,6 @@
 //-------------------------------------------------------------------------------------------------------
 // Copyright (C) Microsoft. All rights reserved.
+// Copyright (c) ChakraCore Project Contributors. All rights reserved.
 // Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
 //-------------------------------------------------------------------------------------------------------
 #include "ParserPch.h"
@@ -2538,7 +2539,7 @@ namespace UnifiedRegex
                     {
                         // Root of trie will live in compile-time allocator, but body will be in run-time allocator
                         runtimeTrie = Anew(compiler.ctAllocator, RuntimeCharTrie);
-                        runtimeTrie->CloneFrom(compiler.rtAllocator, trie);
+                        runtimeTrie->CloneFrom(compiler.scriptContext, compiler.rtAllocator, trie);
                         scheme = Trie;
                     }
                     return;

test/Regex/regexCharTrieStack.js

@@ -0,0 +1,54 @@
+//-------------------------------------------------------------------------------------------------------
+// Copyright (C) Microsoft. All rights reserved.
+// Copyright (c) ChakraCore Project Contributors. All rights reserved.
+// Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
+//-------------------------------------------------------------------------------------------------------
+
+var testString = "tacgattttatcgcgactagttaatcatcatagcaagtaaaatttgaattatgtcattat\
+catgctccattaacaggttatttaattgatactgacgaaattttttcacaatgggttttc\
+tagaatttaatatcagtaattgaagccttcataggggtcctactagtatcctacacgacg\
+caggtccgcagtatcctggagggacgtgttactgattaaaagggtcaaaggaatgaaggc\
+tcacaatgttacctgcttcaccatagtgagccgatgagttttacattagtactaaatccc\
+aaatcatactttacgatgaggcttgctagcgctaaagagaatacatacaccaccacatag\
+aattgttagcgatgatatcaaatagactcctggaagtgtcagggggaaactgttcaatat\
+ttcgtccacaggactgaccaggcatggaaaagactgacgttggaaactataccatctcac\
+gcccgacgcttcactaattgatgatccaaaaaatatagcccggattcctgattagcaaag\
+ggttcacagagaaagatattatcgacgtatatcccaaaaaacagacgtaatgtgcatctt\
+cgaatcgggatgaatacttgtatcataaaaatgtgacctctagtatacaggttaatgtta\
+ctcacccacgtatttggtctaattatgttttatttagtgacaatccaatagataaccggt\
+cctattaagggctatatttttagcgaccacgcgtttaaacaaaggattgtatgtagatgg\
+gcttgatataagatttcggatgtatgggttttataatcgttggagagctcaatcatgagc\
+taatacatggatttcgctacctcaccgagagaccttgcatgaagaattctaaccaaaagt\
+ttaataggccggattggattgagttaattaagaccttgttcagtcatagtaaaaaccctt\n\
+aaattttaccgattgacaaagtgagcagtcgcaataccctatgcgaaacgcctcgatagt\n\
+gactaggtatacaaggtttttgagttcctttgaaatagttaactaatttaaaattaatta\n\
+acgacatggaaatcacagaacctaatgctttgtaggagttatttatgctgtttactgcct\n\
+ctacaaccctaataaagcagtcctaagaatgaaacgcatcttttagttcagaaagtggta\n\
+tccagggtggtcaatttaataaattcaacatcgggtctcaggatattcggtcatataatt\n\
+tattaagggctcttcgagtcttactctgagtgaaattggaaacagtcatccttttcgttg\n\
+tgaggcatcttacaccgctatcgatatacaatgcattccaccgcggtgtcccgtacacaa\n\
+ggaaacttgttaccttggggatataagaaaactcacacgtctcattattaaactgagtac\n\
+tggaacgcacctcggatctgttgcactggattaaaatccgattatttttaaaaatattca\n\
+gtgctagagcatatcaggtctacttttttatctggtatgtaaagcccacggagcgatagt\n\
+gagatccttacgactcaacgaaaagttataacataactcccgttagccaaagcccaatcc\n\
+\n";
+testString = testString + testString + testString;
+testString = testString + testString + testString;
+testString = testString + testString + testString;
+testString = testString + testString + testString;
+var seqs = [/a|tttaccct/ig];
+
+Array.prototype.push.call(seqs, false, Array.prototype.concat.call(seqs, seqs, testString));
+try {
+  for (i in seqs) {
+    testString.match(seqs[i]);
+  }
+  print ("Test should produce Stack over flow but didn't, case may need amending")
+}
+catch(e) {
+  if (e == "Error: Out of stack space") {
+    print ("pass")
+  } else {
+    print ("Wrong error thrown, expected \"Error: Out of stack space\" but recieved \"" + e + "\"");
+  }
+}

test/Regex/rlexe.xml

@@ -247,4 +247,9 @@
       <compile-flags>-args summary -endargs</compile-flags>
     </default>
   </test>
+  <test>
+    <default>
+      <files>regexCharTrieStack.js</files>
+    </default>
+  </test>
 </regress-exe>