From 255262b02928d3f38c00dd91952e3253c11c78f1 Mon Sep 17 00:00:00 2001
From: Ulya Fokanova <skvadrik@gmail.com>
Date: Mon, 20 Jan 2014 19:07:42 +0300
Subject: [PATCH] Fixed segfault: regexp [^]* with 'bFlag' enabled.

Changed 'unmap' function: now spans, that must be unmapped,
are always binded to upper adjacent span (if such span exists).
The previous version of 'unmap' used to bind unmapped spans
either to upper, or to lower adjacent span. Because of this change,
some tests need to be updated.
---
 re2c/code.cc                             | 46 +++++++++-------------
 re2c/test/bug1479044.b.c                 | 33 ++++++++--------
 re2c/test/cvsignore.b.c                  |  2 +-
 re2c/test/cvsignore.ub.c                 |  2 +-
 re2c/test/cvsignore.wb.c                 |  2 +-
 re2c/test/input12.boinput12.c.c          |  5 ++-
 re2c/test/scanner_re2c.bi.c              | 28 ++++++-------
 re2c/test/segfault_full_range_star.bi.c  | 50 ++++++++++++++++++++++++
 re2c/test/segfault_full_range_star.bi.re |  3 ++
 9 files changed, 108 insertions(+), 63 deletions(-)
 mode change 100755 => 100644 re2c/test/bug1479044.b.c
 create mode 100644 re2c/test/segfault_full_range_star.bi.c
 create mode 100644 re2c/test/segfault_full_range_star.bi.re

diff --git a/re2c/code.cc b/re2c/code.cc
index 23e9b9e4..d0e13b9f 100644
--- a/re2c/code.cc
+++ b/re2c/code.cc
@@ -132,42 +132,32 @@ void Go::compact()
 	nSpans = i + 1;
 }
 
+/*
+ * Find all spans, that map to the given state. For each of them,
+ * find upper adjacent span, that maps to another state (if such
+ * span exists, otherwize try lower one).
+ * If input contains single span that maps to the given state,
+ * then output contains 0 spans.
+ */
 void Go::unmap(Go *base, const State *x)
 {
-	Span *s = span, *b = base->span, *e = &b[base->nSpans];
-	uint lb = 0;
-	s->ub = 0;
-	s->to = NULL;
-
-	for (; b != e; ++b)
+	nSpans = 0;
+	for (uint i = 0; i < base->nSpans; ++i)
 	{
-		if (b->to == x)
-		{
-			if ((s->ub - lb) > 1)
-			{
-				s->ub = b->ub;
-			}
-		}
-		else
+		if (base->span[i].to != x)
 		{
-			if (b->to != s->to)
+			if (nSpans > 0 && span[nSpans - 1].to == base->span[i].to)
+				span[nSpans - 1].ub = base->span[i].ub;
+			else
 			{
-				if (s->ub)
-				{
-					lb = s->ub;
-					++s;
-				}
-
-				s->to = b->to;
+				span[nSpans].to = base->span[i].to;
+				span[nSpans].ub = base->span[i].ub;
+				++nSpans;
 			}
-
-			s->ub = b->ub;
 		}
 	}
-
-	s->ub = e[ -1].ub;
-	++s;
-	nSpans = s - span;
+	if (nSpans > 0)
+		span[nSpans - 1].ub = base->span[base->nSpans - 1].ub;
 }
 
 static void doGen(const Go *g, const State *s, uint *bm, uint f, uint m)
diff --git a/re2c/test/bug1479044.b.c b/re2c/test/bug1479044.b.c
old mode 100755
new mode 100644
index ac013f49..59441db0
--- a/re2c/test/bug1479044.b.c
+++ b/re2c/test/bug1479044.b.c
@@ -292,7 +292,7 @@ yy33:
 	if (yybm[256+yych] & 128) {
 		goto yy32;
 	}
-	if (yych <= 'l') goto yy19;
+	if (yych <= '\n') goto yy19;
 	goto yy35;
 yy34:
 	yych = *++YYCURSOR;
@@ -329,7 +329,7 @@ yy35:
 	if (yybm[256+yych] & 128) {
 		goto yy32;
 	}
-	if (yych <= 'l') goto yy19;
+	if (yych <= '\n') goto yy19;
 yy40:
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
@@ -350,7 +350,7 @@ yy42:
 	if (yybm[0+yych] & 2) {
 		goto yy42;
 	}
-	if (yych <= '-') goto yy19;
+	if (yych <= '\n') goto yy19;
 	if (yych >= '/') goto yy40;
 yy44:
 	++YYCURSOR;
@@ -404,7 +404,7 @@ yy48:
 	if (yybm[0+yych] & 2) {
 		goto yy42;
 	}
-	if (yych <= '-') goto yy19;
+	if (yych <= '\n') goto yy19;
 	if (yych <= '.') goto yy44;
 	goto yy40;
 yy49:
@@ -539,7 +539,7 @@ yy55:
 	if (yybm[0+yych] & 2) {
 		goto yy42;
 	}
-	if (yych <= '-') goto yy19;
+	if (yych <= '\n') goto yy19;
 	if (yych >= '/') goto yy40;
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
@@ -594,7 +594,7 @@ yy61:
 	if (yybm[0+yych] & 2) {
 		goto yy42;
 	}
-	if (yych <= '-') goto yy63;
+	if (yych <= '\n') goto yy63;
 	if (yych <= '.') goto yy44;
 	goto yy40;
 yy63:
@@ -628,7 +628,7 @@ yy71:
 	if (yybm[0+yych] & 8) {
 		goto yy71;
 	}
-	if (yych <= ',') goto yy19;
+	if (yych <= '\n') goto yy19;
 yy73:
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
@@ -687,7 +687,7 @@ yy82:
 	if (yybm[0+yych] & 32) {
 		goto yy81;
 	}
-	if (yych <= ',') goto yy19;
+	if (yych <= '\n') goto yy19;
 	if (yych >= '.') goto yy85;
 yy83:
 	++YYCURSOR;
@@ -818,7 +818,7 @@ yy92:
 	if (yybm[0+yych] & 32) {
 		goto yy81;
 	}
-	if (yych <= ',') goto yy19;
+	if (yych <= '\n') goto yy19;
 	if (yych <= '-') goto yy83;
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
@@ -879,7 +879,7 @@ yy92:
 	if (yybm[0+yych] & 32) {
 		goto yy81;
 	}
-	if (yych <= ',') goto yy19;
+	if (yych <= '\n') goto yy19;
 	if (yych <= '-') goto yy83;
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
@@ -930,7 +930,7 @@ yy92:
 	if (yybm[0+yych] & 32) {
 		goto yy81;
 	}
-	if (yych <= ',') goto yy107;
+	if (yych <= '\n') goto yy107;
 	if (yych <= '-') goto yy83;
 	goto yy85;
 yy107:
@@ -964,7 +964,8 @@ yy116:
 	if (yybm[0+yych] & 64) {
 		goto yy115;
 	}
-	if (yych != '.') goto yy19;
+	if (yych <= ',') goto yy19;
+	if (yych >= '/') goto yy19;
 	yych = *++YYCURSOR;
 	if (yych == '\n') goto yy19;
 yy118:
@@ -974,7 +975,7 @@ yy118:
 	if (yybm[0+yych] & 128) {
 		goto yy118;
 	}
-	if (yych <= '-') goto yy19;
+	if (yych <= '\n') goto yy19;
 yy120:
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
@@ -1043,7 +1044,7 @@ yy122:
 	if (yybm[0+yych] & 128) {
 		goto yy118;
 	}
-	if (yych <= '-') goto yy19;
+	if (yych <= '\n') goto yy19;
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
 	yych = *YYCURSOR;
@@ -1086,13 +1087,13 @@ yy122:
 	if (yybm[0+yych] & 128) {
 		goto yy118;
 	}
-	if (yych >= '.') goto yy120;
+	if (yych >= '\v') goto yy120;
 yy132:
 #line 17 "bug1479044.b.re"
 	{
 		return "dsl";
 	}
-#line 1096 "<stdout>"
+#line 1097 "<stdout>"
 yy133:
 	yych = *++YYCURSOR;
 	if (yych != 's') goto yy19;
diff --git a/re2c/test/cvsignore.b.c b/re2c/test/cvsignore.b.c
index cdbc6a69..38a1a906 100755
--- a/re2c/test/cvsignore.b.c
+++ b/re2c/test/cvsignore.b.c
@@ -140,7 +140,7 @@ yy18:
 	if (yybm[0+yych] & 128) {
 		goto yy17;
 	}
-	if (yych <= '#') goto yy6;
+	if (yych <= '\n') goto yy6;
 	goto yy15;
 yy19:
 	yych = *++YYCURSOR;
diff --git a/re2c/test/cvsignore.ub.c b/re2c/test/cvsignore.ub.c
index 50b229d0..92045086 100755
--- a/re2c/test/cvsignore.ub.c
+++ b/re2c/test/cvsignore.ub.c
@@ -142,7 +142,7 @@ yy18:
 	} else if (yybm[0+yych] & 128) {
 		goto yy17;
 	}
-	if (yych <= '#') goto yy6;
+	if (yych <= '\n') goto yy6;
 	goto yy15;
 yy19:
 	yych = *++YYCURSOR;
diff --git a/re2c/test/cvsignore.wb.c b/re2c/test/cvsignore.wb.c
index 8289fdc1..cc21ec75 100755
--- a/re2c/test/cvsignore.wb.c
+++ b/re2c/test/cvsignore.wb.c
@@ -142,7 +142,7 @@ yy18:
 	} else if (yybm[0+yych] & 128) {
 		goto yy17;
 	}
-	if (yych <= '#') goto yy6;
+	if (yych <= '\n') goto yy6;
 	goto yy15;
 yy19:
 	yych = *++YYCURSOR;
diff --git a/re2c/test/input12.boinput12.c.c b/re2c/test/input12.boinput12.c.c
index 765e34be..7301fb5e 100755
--- a/re2c/test/input12.boinput12.c.c
+++ b/re2c/test/input12.boinput12.c.c
@@ -52,13 +52,14 @@ yy3:
 	if (yybm[0+yych] & 128) {
 		goto yy3;
 	}
-	if (yych != 'b') goto yy2;
+	if (yych <= '`') goto yy2;
+	if (yych >= 'c') goto yy2;
 	yych = *++YYCURSOR;
 	if (yych != 'b') goto yy2;
 	++YYCURSOR;
 #line 3 "input12.boinput12.c.re"
 	{ return 1; }
-#line 62 "input12.c"
+#line 63 "input12.c"
 }
 #line 5 "input12.boinput12.c.re"
 
diff --git a/re2c/test/scanner_re2c.bi.c b/re2c/test/scanner_re2c.bi.c
index 322aa3c2..43dfa27f 100644
--- a/re2c/test/scanner_re2c.bi.c
+++ b/re2c/test/scanner_re2c.bi.c
@@ -253,7 +253,7 @@ yy29:
 	if (yybm[0+yych] & 128) {
 		goto yy29;
 	}
-	if (yych <= '!') goto yy13;
+	if (yych <= '\n') goto yy13;
 	if (yych <= '"') goto yy32;
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
@@ -967,7 +967,7 @@ yy160:
 	if (yybm[0+yych] & 16) {
 		goto yy160;
 	}
-	if (yych <= '!') goto yy144;
+	if (yych <= '\n') goto yy144;
 	if (yych <= '"') goto yy163;
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
@@ -1216,7 +1216,7 @@ yy199:
 	if (yybm[0+yych] & 64) {
 		goto yy198;
 	}
-	if (yych <= '[') goto yy144;
+	if (yych <= '\n') goto yy144;
 	if (yych <= '\\') goto yy202;
 	goto yy203;
 yy200:
@@ -1265,7 +1265,7 @@ yy209:
 	if (yybm[0+yych] & 128) {
 		goto yy208;
 	}
-	if (yych <= '&') goto yy144;
+	if (yych <= '\n') goto yy144;
 	if (yych <= '\'') goto yy211;
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
@@ -1612,7 +1612,7 @@ yy264:
 	if (yybm[0+yych] & 16) {
 		goto yy263;
 	}
-	if (yych <= '&') goto yy265;
+	if (yych <= '\n') goto yy265;
 	if (yych <= '\'') goto yy259;
 	goto yy266;
 yy265:
@@ -1640,7 +1640,7 @@ yy268:
 	if (yybm[0+yych] & 32) {
 		goto yy267;
 	}
-	if (yych <= '!') goto yy265;
+	if (yych <= '\n') goto yy265;
 	if (yych <= '"') goto yy259;
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
@@ -1955,7 +1955,7 @@ yy320:
 	if (yybm[0+yych] & 128) {
 		goto yy320;
 	}
-	if (yych <= '!') goto yy304;
+	if (yych <= '\n') goto yy304;
 	if (yych <= '"') goto yy323;
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
@@ -2228,12 +2228,12 @@ yy356:
 	if (yybm[0+yych] & 16) {
 		goto yy356;
 	}
-	if (yych <= '!') {
+	if (yych <= ' ') {
 		if (yych == '\n') goto yy348;
 		goto yy366;
 	} else {
 		if (yych <= '"') goto yy354;
-		if (yych <= '[') goto yy366;
+		if (yych <= ';') goto yy366;
 		goto yy368;
 	}
 yy358:
@@ -2243,11 +2243,11 @@ yy358:
 	if (yybm[0+yych] & 32) {
 		goto yy358;
 	}
-	if (yych <= '&') {
+	if (yych <= ' ') {
 		if (yych == '\n') goto yy348;
 	} else {
 		if (yych <= '\'') goto yy354;
-		if (yych >= '\\') goto yy363;
+		if (yych >= '<') goto yy363;
 	}
 yy360:
 	++YYCURSOR;
@@ -2256,7 +2256,7 @@ yy360:
 	if (yybm[0+yych] & 64) {
 		goto yy360;
 	}
-	if (yych <= '&') goto yy362;
+	if (yych <= '\n') goto yy362;
 	if (yych <= '\'') goto yy364;
 	goto yy365;
 yy362:
@@ -2300,7 +2300,7 @@ yy366:
 	if (yybm[0+yych] & 128) {
 		goto yy366;
 	}
-	if (yych <= '!') goto yy362;
+	if (yych <= '\n') goto yy362;
 	if (yych <= '"') goto yy364;
 	goto yy369;
 yy368:
@@ -2427,7 +2427,7 @@ yy380:
 	if (yybm[0+yych] & 64) {
 		goto yy379;
 	}
-	if (yych <= '!') goto yy381;
+	if (yych <= '\n') goto yy381;
 	if (yych <= '"') goto yy383;
 	goto yy382;
 yy381:
diff --git a/re2c/test/segfault_full_range_star.bi.c b/re2c/test/segfault_full_range_star.bi.c
new file mode 100644
index 00000000..5b1c7847
--- /dev/null
+++ b/re2c/test/segfault_full_range_star.bi.c
@@ -0,0 +1,50 @@
+/* Generated by re2c */
+
+{
+	YYCTYPE yych;
+	static const unsigned char yybm[] = {
+		128, 128, 128, 128, 128, 128, 128, 128, 
+		128, 128, 128, 128, 128, 128, 128, 128, 
+		128, 128, 128, 128, 128, 128, 128, 128, 
+		128, 128, 128, 128, 128, 128, 128, 128, 
+		128, 128, 128, 128, 128, 128, 128, 128, 
+		128, 128, 128, 128, 128, 128, 128, 128, 
+		128, 128, 128, 128, 128, 128, 128, 128, 
+		128, 128, 128, 128, 128, 128, 128, 128, 
+		128, 128, 128, 128, 128, 128, 128, 128, 
+		128, 128, 128, 128, 128, 128, 128, 128, 
+		128, 128, 128, 128, 128, 128, 128, 128, 
+		128, 128, 128, 128, 128, 128, 128, 128, 
+		128, 128, 128, 128, 128, 128, 128, 128, 
+		128, 128, 128, 128, 128, 128, 128, 128, 
+		128, 128, 128, 128, 128, 128, 128, 128, 
+		128, 128, 128, 128, 128, 128, 128, 128, 
+		128, 128, 128, 128, 128, 128, 128, 128, 
+		128, 128, 128, 128, 128, 128, 128, 128, 
+		128, 128, 128, 128, 128, 128, 128, 128, 
+		128, 128, 128, 128, 128, 128, 128, 128, 
+		128, 128, 128, 128, 128, 128, 128, 128, 
+		128, 128, 128, 128, 128, 128, 128, 128, 
+		128, 128, 128, 128, 128, 128, 128, 128, 
+		128, 128, 128, 128, 128, 128, 128, 128, 
+		128, 128, 128, 128, 128, 128, 128, 128, 
+		128, 128, 128, 128, 128, 128, 128, 128, 
+		128, 128, 128, 128, 128, 128, 128, 128, 
+		128, 128, 128, 128, 128, 128, 128, 128, 
+		128, 128, 128, 128, 128, 128, 128, 128, 
+		128, 128, 128, 128, 128, 128, 128, 128, 
+		128, 128, 128, 128, 128, 128, 128, 128, 
+		128, 128, 128, 128, 128, 128, 128, 128, 
+	};
+	goto yy0;
+yy1:
+	++YYCURSOR;
+yy0:
+	if (YYLIMIT <= YYCURSOR) YYFILL(1);
+	yych = *YYCURSOR;
+	if (yybm[0+yych] & 128) {
+		goto yy1;
+	}
+	{}
+}
+
diff --git a/re2c/test/segfault_full_range_star.bi.re b/re2c/test/segfault_full_range_star.bi.re
new file mode 100644
index 00000000..ac2151cf
--- /dev/null
+++ b/re2c/test/segfault_full_range_star.bi.re
@@ -0,0 +1,3 @@
+/*!re2c
+	[^]*	{}
+*/
-- 
2.40.0