/* This is JavaScriptCore's variant of the PCRE library. While this library

started out as a copy of PCRE, many of the features of PCRE have been

removed. This library now supports only the regular expression features

required by the JavaScript language specification, and has only the functions

needed by JavaScriptCore and the rest of WebKit.

                 Originally written by Philip Hazel

           Copyright (c) 1997-2006 University of Cambridge

    Copyright (C) 2002, 2004, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.

    Copyright (C) 2007 Eric Seidel <eric@webkit.org>

-----------------------------------------------------------------------------

Redistribution and use in source and binary forms, with or without

modification, are permitted provided that the following conditions are met:

    * Redistributions of source code must retain the above copyright notice,

      this list of conditions and the following disclaimer.

    * Redistributions in binary form must reproduce the above copyright

      notice, this list of conditions and the following disclaimer in the

      documentation and/or other materials provided with the distribution.

    * Neither the name of the University of Cambridge nor the names of its

      contributors may be used to endorse or promote products derived from

      this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"

AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE

ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE

LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR

CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF

SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS

INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN

CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE

POSSIBILITY OF SUCH DAMAGE.

-----------------------------------------------------------------------------

*/

/* This module contains jsRegExpExecute(), the externally visible function

that does pattern matching using an NFA algorithm, following the rules from

the JavaScript specification. There are also some supporting functions. */

#include "config.h"

#include "pcre_internal.h"

#include <limits.h>

#include <wtf/ASCIICType.h>

#include <wtf/Vector.h>

#if REGEXP_HISTOGRAM

#include <wtf/DateMath.h>

#include <runtime/UString.h>

#endif

using namespace WTF;

#if COMPILER(GCC)

#define USE_COMPUTED_GOTO_FOR_MATCH_RECURSION

//#define USE_COMPUTED_GOTO_FOR_MATCH_OPCODE_LOOP

#endif

/* Avoid warnings on Windows. */

#undef min

#undef max

#ifndef USE_COMPUTED_GOTO_FOR_MATCH_RECURSION

typedef int ReturnLocation;

#else

typedef void* ReturnLocation;

#endif

#if !REGEXP_HISTOGRAM

class HistogramTimeLogger {

public:

    HistogramTimeLogger(const JSRegExp*) { }

};

#else

using namespace JSC;

class Histogram {

public:

    ~Histogram();

    void add(const JSRegExp*, double);

private:

    typedef HashMap<RefPtr<UString::Rep>, double> Map;

    Map times;

};

class HistogramTimeLogger {

public:

    HistogramTimeLogger(const JSRegExp*);

    ~HistogramTimeLogger();

private:

    const JSRegExp* m_re;

    double m_startTime;

};

#endif

/* Structure for building a chain of data for holding the values of

the subject pointer at the start of each bracket, used to detect when

an empty string has been matched by a bracket to break infinite loops. */ 

struct BracketChainNode {

    BracketChainNode* previousBracket;

    const UChar* bracketStart;

};

struct MatchFrame : FastAllocBase {

    ReturnLocation returnLocation;

    struct MatchFrame* previousFrame;

    /* Function arguments that may change */

    struct {

        const UChar* subjectPtr;

        const unsigned char* instructionPtr;

        int offsetTop;

        BracketChainNode* bracketChain;

    } args;

    /* PCRE uses "fake" recursion built off of gotos, thus

     stack-based local variables are not safe to use.  Instead we have to

     store local variables on the current MatchFrame. */

    struct {

        const unsigned char* data;

        const unsigned char* startOfRepeatingBracket;

        const UChar* subjectPtrAtStartOfInstruction; // Several instrutions stash away a subjectPtr here for later compare

        const unsigned char* instructionPtrAtStartOfOnce;

        int repeatOthercase;

        int ctype;

        int fc;

        int fi;

        int length;

        int max;

        int number;

        int offset;

        int saveOffset1;

        int saveOffset2;

        int saveOffset3;

        BracketChainNode bracketChainNode;

    } locals;

};

/* Structure for passing "static" information around between the functions

doing traditional NFA matching, so that they are thread-safe. */

struct MatchData {

  int*   offsetVector;         /* Offset vector */

  int    offsetEnd;            /* One past the end */

  int    offsetMax;            /* The maximum usable for return data */

  bool   offsetOverflow;       /* Set if too many extractions */

  const UChar*  startSubject;         /* Start of the subject string */

  const UChar*  endSubject;           /* End of the subject string */

  const UChar*  endMatchPtr;         /* Subject position at end match */

  int    endOffsetTop;        /* Highwater mark at end of match */

  bool   multiline;

  bool   ignoreCase;

};

/* The maximum remaining length of subject we are prepared to search for a

reqByte match. */

#define REQ_BYTE_MAX 1000

/* The below limit restricts the number of "recursive" match calls in order to

avoid spending exponential time on complex regular expressions. */

static const unsigned matchLimit = 1000000;

#ifdef DEBUG

/*************************************************

*        Debugging function to print chars       *

*************************************************/

/* Print a sequence of chars in printable format, stopping at the end of the

subject if the requested.

Arguments:

  p           points to characters

  length      number to print

  isSubject  true if printing from within md.startSubject

  md          pointer to matching data block, if isSubject is true

*/

static void pchars(const UChar* p, int length, bool isSubject, const MatchData& md)

{

    if (isSubject && length > md.endSubject - p)

        length = md.endSubject - p;

    while (length-- > 0) {

        int c;

        if (isASCIIPrintable(c = *(p++)))

            printf("%c", c);

        else if (c < 256)

            printf("\\x%02x", c);

        else

            printf("\\x{%x}", c);

    }

}

#endif

/*************************************************

*          Match a back-reference                *

*************************************************/

/* If a back reference hasn't been set, the length that is passed is greater

than the number of characters left in the string, so the match fails.

Arguments:

  offset      index into the offset vector

  subjectPtr        points into the subject

  length      length to be matched

  md          points to match data block

Returns:      true if matched

*/

static bool matchRef(int offset, const UChar* subjectPtr, int length, const MatchData& md)

{

    const UChar* p = md.startSubject + md.offsetVector[offset];

#ifdef DEBUG

    if (subjectPtr >= md.endSubject)

        printf("matching subject <null>");

    else {

        printf("matching subject ");

        pchars(subjectPtr, length, true, md);

    }

    printf(" against backref ");

    pchars(p, length, false, md);

    printf("\n");

#endif

    /* Always fail if not enough characters left */

    if (length > md.endSubject - subjectPtr)

        return false;

    /* Separate the caselesss case for speed */

    if (md.ignoreCase) {

        while (length-- > 0) {

            UChar c = *p++;

            int othercase = jsc_pcre_ucp_othercase(c);

            UChar d = *subjectPtr++;

            if (c != d && othercase != d)

                return false;

        }

    }

    else {

        while (length-- > 0)

            if (*p++ != *subjectPtr++)

                return false;

    }

    return true;

}

#ifndef USE_COMPUTED_GOTO_FOR_MATCH_RECURSION

/* Use numbered labels and switch statement at the bottom of the match function. */

#define RMATCH_WHERE(num) num

#define RRETURN_LABEL RRETURN_SWITCH

#else

/* Use GCC's computed goto extension. */

/* For one test case this is more than 40% faster than the switch statement.

We could avoid the use of the num argument entirely by using local labels,

but using it for the GCC case as well as the non-GCC case allows us to share

a bit more code and notice if we use conflicting numbers.*/

#define RMATCH_WHERE(num) &&RRETURN_##num

#define RRETURN_LABEL *stack.currentFrame->returnLocation

#endif

#define RECURSIVE_MATCH_COMMON(num) \

    goto RECURSE;\

    RRETURN_##num: \

    stack.popCurrentFrame();

#define RECURSIVE_MATCH(num, ra, rb) \

    do { \

        stack.pushNewFrame((ra), (rb), RMATCH_WHERE(num)); \

        RECURSIVE_MATCH_COMMON(num) \

    } while (0)

#define RECURSIVE_MATCH_NEW_GROUP(num, ra, rb) \

    do { \

        stack.pushNewFrame((ra), (rb), RMATCH_WHERE(num)); \

        startNewGroup(stack.currentFrame); \

        RECURSIVE_MATCH_COMMON(num) \

    } while (0)

#define RRETURN goto RRETURN_LABEL

#define RRETURN_NO_MATCH do { isMatch = false; RRETURN; } while (0)

/*************************************************

*         Match from current position            *

*************************************************/

/* On entry instructionPtr points to the first opcode, and subjectPtr to the first character

in the subject string, while substringStart holds the value of subjectPtr at the start of the

last bracketed group - used for breaking infinite loops matching zero-length

strings. This function is called recursively in many circumstances. Whenever it

returns a negative (error) response, the outer match() call must also return the

same response.

Arguments:

   subjectPtr        pointer in subject

   instructionPtr       position in code

   offsetTop  current top pointer

   md          pointer to "static" info for the match

Returns:       1 if matched          )  these values are >= 0

               0 if failed to match  )

               a negative error value if aborted by an error condition

                 (e.g. stopped by repeated call or recursion limit)

*/

static const unsigned numFramesOnStack = 16;

struct MatchStack {

    MatchStack()

        : framesEnd(frames + numFramesOnStack)

        , currentFrame(frames)

        , size(1) // match() creates accesses the first frame w/o calling pushNewFrame

    {

        ASSERT((sizeof(frames) / sizeof(frames[0])) == numFramesOnStack);

    }

    MatchFrame frames[numFramesOnStack];

    MatchFrame* framesEnd;

    MatchFrame* currentFrame;

    unsigned size;

    inline bool canUseStackBufferForNextFrame()

    {

        return size < numFramesOnStack;

    }

    inline MatchFrame* allocateNextFrame()

    {

        if (canUseStackBufferForNextFrame())

            return currentFrame + 1;

        return new MatchFrame;

    }

    inline void pushNewFrame(const unsigned char* instructionPtr, BracketChainNode* bracketChain, ReturnLocation returnLocation)

    {

        MatchFrame* newframe = allocateNextFrame();

        newframe->previousFrame = currentFrame;

        newframe->args.subjectPtr = currentFrame->args.subjectPtr;

        newframe->args.offsetTop = currentFrame->args.offsetTop;

        newframe->args.instructionPtr = instructionPtr;

        newframe->args.bracketChain = bracketChain;

        newframe->returnLocation = returnLocation;

        size++;

        currentFrame = newframe;

    }

    inline void popCurrentFrame()

    {

        MatchFrame* oldFrame = currentFrame;

        currentFrame = currentFrame->previousFrame;

        if (size > numFramesOnStack)

            delete oldFrame;

        size--;

    }

    void popAllFrames()

    {

        while (size)

            popCurrentFrame();

    }

};

static int matchError(int errorCode, MatchStack& stack)

{

    stack.popAllFrames();

    return errorCode;

}

/* Get the next UTF-8 character, not advancing the pointer, incrementing length

 if there are extra bytes. This is called when we know we are in UTF-8 mode. */

static inline void getUTF8CharAndIncrementLength(int& c, const unsigned char* subjectPtr, int& len)

{

    c = *subjectPtr;

    if ((c & 0xc0) == 0xc0) {

        int gcaa = jsc_pcre_utf8_table4[c & 0x3f];  /* Number of additional bytes */

        int gcss = 6 * gcaa;

        c = (c & jsc_pcre_utf8_table3[gcaa]) << gcss;

        for (int gcii = 1; gcii <= gcaa; gcii++) {

            gcss -= 6;

            c |= (subjectPtr[gcii] & 0x3f) << gcss;

        }

        len += gcaa;

    }

}

static inline void startNewGroup(MatchFrame* currentFrame)

{

    /* At the start of a bracketed group, add the current subject pointer to the

     stack of such pointers, to be re-instated at the end of the group when we hit

     the closing ket. When match() is called in other circumstances, we don't add to

     this stack. */

    currentFrame->locals.bracketChainNode.previousBracket = currentFrame->args.bracketChain;

    currentFrame->locals.bracketChainNode.bracketStart = currentFrame->args.subjectPtr;

    currentFrame->args.bracketChain = &currentFrame->locals.bracketChainNode;

}

// FIXME: "minimize" means "not greedy", we should invert the callers to ask for "greedy" to be less confusing

static inline void repeatInformationFromInstructionOffset(int instructionOffset, bool& minimize, int& minimumRepeats, int& maximumRepeats)

{

    // Instruction offsets are based off of OP_CRSTAR, OP_STAR, OP_TYPESTAR, OP_NOTSTAR

    static const char minimumRepeatsFromInstructionOffset[] = { 0, 0, 1, 1, 0, 0 };

    static const int maximumRepeatsFromInstructionOffset[] = { INT_MAX, INT_MAX, INT_MAX, INT_MAX, 1, 1 };

    ASSERT(instructionOffset >= 0);

    ASSERT(instructionOffset <= (OP_CRMINQUERY - OP_CRSTAR));

    minimize = (instructionOffset & 1); // this assumes ordering: Instruction, MinimizeInstruction, Instruction2, MinimizeInstruction2

    minimumRepeats = minimumRepeatsFromInstructionOffset[instructionOffset];

    maximumRepeats = maximumRepeatsFromInstructionOffset[instructionOffset];

}

static int match(const UChar* subjectPtr, const unsigned char* instructionPtr, int offsetTop, MatchData& md)

{

    bool isMatch = false;

    int min;

    bool minimize = false; /* Initialization not really needed, but some compilers think so. */

    unsigned remainingMatchCount = matchLimit;

    int othercase; /* Declare here to avoid errors during jumps */

    MatchStack stack;

    /* The opcode jump table. */

#ifdef USE_COMPUTED_GOTO_FOR_MATCH_OPCODE_LOOP

#define EMIT_JUMP_TABLE_ENTRY(opcode) &&LABEL_OP_##opcode,

    static void* opcodeJumpTable[256] = { FOR_EACH_OPCODE(EMIT_JUMP_TABLE_ENTRY) };

#undef EMIT_JUMP_TABLE_ENTRY

#endif

    /* One-time setup of the opcode jump table. */

#ifdef USE_COMPUTED_GOTO_FOR_MATCH_OPCODE_LOOP

    for (int i = 255; !opcodeJumpTable[i]; i--)

        opcodeJumpTable[i] = &&CAPTURING_BRACKET;

#endif

#ifdef USE_COMPUTED_GOTO_FOR_MATCH_RECURSION

    // Shark shows this as a hot line

    // Using a static const here makes this line disappear, but makes later access hotter (not sure why)

    stack.currentFrame->returnLocation = &&RETURN;

#else

    stack.currentFrame->returnLocation = 0;

#endif

    stack.currentFrame->args.subjectPtr = subjectPtr;

    stack.currentFrame->args.instructionPtr = instructionPtr;

    stack.currentFrame->args.offsetTop = offsetTop;

    stack.currentFrame->args.bracketChain = 0;

    startNewGroup(stack.currentFrame);

    /* This is where control jumps back to to effect "recursion" */

RECURSE:

    if (!--remainingMatchCount)

        return matchError(JSRegExpErrorHitLimit, stack);

    /* Now start processing the operations. */

#ifndef USE_COMPUTED_GOTO_FOR_MATCH_OPCODE_LOOP

    while (true)

#endif

    {

#ifdef USE_COMPUTED_GOTO_FOR_MATCH_OPCODE_LOOP

#define BEGIN_OPCODE(opcode) LABEL_OP_##opcode

#define NEXT_OPCODE goto *opcodeJumpTable[*stack.currentFrame->args.instructionPtr]

#else

#define BEGIN_OPCODE(opcode) case OP_##opcode

#define NEXT_OPCODE continue

#endif

#ifdef USE_COMPUTED_GOTO_FOR_MATCH_OPCODE_LOOP

        NEXT_OPCODE;

#else

        switch (*stack.currentFrame->args.instructionPtr)

#endif

        {

            /* Non-capturing bracket: optimized */

            BEGIN_OPCODE(BRA):

            NON_CAPTURING_BRACKET:

                DPRINTF(("start bracket 0\n"));

                do {

                    RECURSIVE_MATCH_NEW_GROUP(2, stack.currentFrame->args.instructionPtr + 1 + LINK_SIZE, stack.currentFrame->args.bracketChain);

                    if (isMatch)

                        RRETURN;

                    stack.currentFrame->args.instructionPtr += getLinkValue(stack.currentFrame->args.instructionPtr + 1);

                } while (*stack.currentFrame->args.instructionPtr == OP_ALT);

                DPRINTF(("bracket 0 failed\n"));

                RRETURN;

            /* Skip over large extraction number data if encountered. */

            BEGIN_OPCODE(BRANUMBER):

                stack.currentFrame->args.instructionPtr += 3;

                NEXT_OPCODE;

            /* End of the pattern. */

            BEGIN_OPCODE(END):