Regexp: Fix overflow in min-match-length calculation. Crbug=126412.

src/ast.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 944 matching lines @@
   min_match_ = first_alternative->min_match();
   max_match_ = first_alternative->max_match();
   for (int i = 1; i < alternatives->length(); i++) {
     RegExpTree* alternative = alternatives->at(i);
     min_match_ = Min(min_match_, alternative->min_match());
     max_match_ = Max(max_match_, alternative->max_match());
   }
 }
 
 
+static int IncreaseBy(int previous, int increase) {
+  if (RegExpTree::kInfinity - previous < increase) {
+    return RegExpTree::kInfinity;
+  } else {
+    return previous + increase;
+  }
+}
+
 RegExpAlternative::RegExpAlternative(ZoneList<RegExpTree*>* nodes)
     : nodes_(nodes) {
   ASSERT(nodes->length() > 1);
   min_match_ = 0;
   max_match_ = 0;
   for (int i = 0; i < nodes->length(); i++) {
     RegExpTree* node = nodes->at(i);
-    min_match_ += node->min_match();
+    int node_min_match = node->min_match();
+    min_match_ = IncreaseBy(min_match_, node_min_match);
     int node_max_match = node->max_match();
-    if (kInfinity - max_match_ < node_max_match) {
-      max_match_ = kInfinity;
-    } else {
-      max_match_ += node->max_match();
-    }
+    max_match_ = IncreaseBy(max_match_, node_max_match);
   }
 }
 
 
 CaseClause::CaseClause(Isolate* isolate,
                        Expression* label,
                        ZoneList<Statement*>* statements,
                        int pos)
     : label_(label),
       statements_(statements),
@@ skipping 110 matching lines @@
     OS::SNPrintF(buffer, "%d", Smi::cast(*handle_)->value());
     str = arr;
   } else {
     str = DoubleToCString(handle_->Number(), buffer);
   }
   return FACTORY->NewStringFromAscii(CStrVector(str));
 }
 
 
 } }  // namespace v8::internal