Skip to content

Convert tre_ast_to_tnfa() to iteration over a tre_stack - #144

Open
kevinushey wants to merge 2 commits into
laurikari:masterfrom
kevinushey:fix-ast-to-tnfa-recursion
Open

Convert tre_ast_to_tnfa() to iteration over a tre_stack#144
kevinushey wants to merge 2 commits into
laurikari:masterfrom
kevinushey:fix-ast-to-tnfa-recursion

Conversation

@kevinushey

Copy link
Copy Markdown

These pull requests were generated with Claude Code, but were reviewed by me (@kevinushey) before posting. I'll respond personally to any feedback; please let me know if this is okay.


This converts tre_ast_to_tnfa() from recursion to iteration over a tre_stack, resolving the TODO at the top of lib/tre-compile.c:

Fix tre_ast_to_tnfa() to recurse using a stack instead of recursive function calls.

Problem. The recursive implementation overflows the C stack for large patterns — recursion depth is proportional to pattern size. A catenation of 50,000 literals crashes tre_regcomp() on Windows x64 (1 MB default stack, mingw-w64 gcc); the same pattern compiles and matches correctly with this change:

PATCHED   n=50000 compile=OK exec rc=0 match=(0,50000)
UNPATCHED n=50000 CRASHED (stack overflow)

Approach.

  • Reuses the compilation stack already allocated in tre_compile() rather than allocating a new one; both call sites are inside tre_compile(), where the stack is idle at those points.
  • Traversal order is preserved: children are pushed right-then-left so the left child pops first, and tre_make_trans() for CATENATION/ITERATION fires before descending into children, exactly as the recursive version did.
  • The counting pass call site now checks the return value, since the iterative version can fail with REG_ESPACE if the stack cannot grow (the recursive counting pass could not fail).

Testing. Built with mingw-w64 gcc 14 on Windows; verified the crash reproduction above, plus sanity checks ((a|b)+c, capture groups) and larger alternation/catenation patterns up to the existing TRE_MAX_STACK parse limit, which now fails cleanly with REG_ESPACE instead of crashing.

Provenance. A version of this fix (with a separately allocated stack) has been carried in GNU R's vendored copy of TRE since 2011 and is exercised by every ERE regex call in R.

The recursive implementation overflows the C stack for large patterns:
a catenation of 50,000 literals crashes tre_regcomp() on Windows
(1 MB default stack). Reuse the compilation stack already allocated in
tre_compile() and iterate instead, preserving the traversal order of
the recursive version (children pushed right-then-left, tre_make_trans
invoked before descending, as before).

The counting pass call site now checks the return value, since the
iterative version can fail with REG_ESPACE if the stack cannot grow.

Removes the corresponding TODO item at the top of the file.

This fix has been carried in GNU R's vendored copy of TRE since 2011
(with a separately allocated stack there).
Compile and match a 60000-character ERE in a thread with a 1 MB
stack. With the recursive tre_ast_to_tnfa() this crashes (one C
stack frame per AST node); with the iterative version from this
branch it compiles and matches within the small stack.

A thread with pthread_attr_setstacksize() is used rather than
setrlimit(RLIMIT_STACK) because lowering the rlimit does not shrink
a main-thread stack that earlier tests have already grown, and macOS
pre-maps the main stack at exec time. pthread_create() is in libc on
glibc >= 2.34 and on macOS, so no build system changes are needed;
the test is compiled out on platforms without pthreads.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant