Limit EatAtLeast recursion by a budget.

test/mjsunit/regress/regress-crbug-178790.js

Index: test/mjsunit/regress/regress-crbug-178790.js
diff --git a/test/mjsunit/regress/regress-1878.js b/test/mjsunit/regress/regress-crbug-178790.js
similarity index 75%
copy from test/mjsunit/regress/regress-1878.js
copy to test/mjsunit/regress/regress-crbug-178790.js
index fbc47bdd1463d09d67220cd640eb96c56b57d1c7..e21a3237f1034ca49104047ffd32efa01fcab89d 100644
--- a/test/mjsunit/regress/regress-1878.js
+++ b/test/mjsunit/regress/regress-crbug-178790.js
@@ -1,4 +1,4 @@
-// Copyright 2012 the V8 project authors. All rights reserved.
+// Copyright 2013 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
@@ -25,20 +25,22 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// See: http://code.google.com/p/v8/issues/detail?id=1878
-
-// Flags: --allow-natives-syntax --expose_natives_as=natives
-
-var a = Array();
-
+// Create a regexp in the form of a?a?...a? so that fully
+// traversing the entire graph would be prohibitively expensive.
+// This should not cause time out.
+var r1 = "";
 for (var i = 0; i < 1000; i++) {
-  var ai = natives.InternalArray(10000);
-  assertFalse(%HaveSameMap(ai, a));
-  assertTrue(%HasFastObjectElements(ai));
+  r1 += "a?";
 }
+"test".match(RegExp(r1));

[erikcorry, 2013/03/01 09:15:53]

It would be nice with a version with a lot of alternatives.  Something like:

(a?|b?|c?|d?|e?|f?)(a?|b?|c?|d?|e?f)...

 
+// Create a regexp in the form of ((..(a)a..)a.
+// Compiling it causes EatsAtLeast to reach the maximum
+// recursion depth possible with a given budget.
+// This should not cause a stack overflow.
+var r2 = "a";
 for (var i = 0; i < 1000; i++) {
-  var ai = new natives.InternalArray(10000);
-  assertFalse(%HaveSameMap(ai, a));
-  assertTrue(%HasFastObjectElements(ai));
+  r2 = "(" + r2 + ")a";
 }
+"test".match(RegExp(r2));
+