Hermes: Assertion failure in lib/Regex/Executor.cpp:1051: "Character should be astral"

[WilliamParks]

Bug Description

The provided code samples produce the following assertion failure.

hermes: ../lib/Regex/Executor.cpp:1051: const hermes::regex::Context::CodeUnit *hermes::regex::Context::match(State *, bool) [Traits = hermes::regex::UTF16RegexTraits]: Assertion `insn->c >= 0x010000 && "Character should be astral"' failed.

Hermes version: 6f2458530bdd52bd3cff7254431fe24ae0a92ee1, current master
React Native version (if any): N/A
Android version (if any): N/A
Platform (most likely one of arm64-v8a, armeabi-v7a, x86, x86_64): x86_64

Steps To Reproduce

code example:

function main() {
    var v2 = String.fromCharCode(2820266362);
    var v3 = v2.toString();
    var v5 = String.fromCodePoint();
    var v6 = v5 + v2;
    var v9 = RegExp(v3,"iu");
    var v10 = v9.exec(v6);
}
main();

function main() {
    var v1 = [1337,1337,1337,1337,1337];
    var v2 = 13.37;
    var v5 = 0 < 400;
    var v7 = v5 != 0;
    while (v7 != 0) {
        var v10 = 128 * v2;
        var v12 = String.fromCharCode(v10);
        var v13 = v2++;
        var v15 = String.fromCodePoint();
        var v17 = v12 + "+";
        var v20 = RegExp(v17,"iu");
        var v21 = v1 + v15;
        var v22 = v20.exec(v21);
    }
}
main();

The Expected Behavior

No assertion failure

[HongxuChen]

Based on the above snippet, I found a reduced POC:

v1 = 1;
i = 0;
while (i < 6000) {
    v2 = 11 * v1;
    v2 = String.fromCharCode(v2);
    v1++;
    RegExp(v2, "iu").exec(v2);
    i++;
}

[neildhar]

Thanks for reporting this! It looks like that assert may be incorrect, I'll verify and put up a fix.

[neildhar]

Fixed in c04d69e2d52d17ca04d6a5ca0fa5392ef7edf7cd.