chore: sync upstream changes

.github/upstream-workflows/tests.yaml

@@ -190,70 +190,3 @@ jobs:
         env:
           RUSTDOCFLAGS: ${{ matrix.rust_flags }}
 
-  browser-wasm:
-    name: Browser WASM
-    runs-on: ubuntu-latest
-    env:
-      CARGO_TERM_COLOR: always
-    steps:
-      - name: Checkout sources
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@master
-        with:
-          toolchain: stable
-          target: wasm32-unknown-unknown
-
-      - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: 22
-
-      - name: Install Chrome and ChromeDriver
-        id: setup-chrome
-        uses: browser-actions/setup-chrome@2e1d749697dd1612b833dba4a722266286fbefcd # v2.1.2
-        with:
-          chrome-version: stable
-          install-dependencies: true
-          install-chromedriver: true
-
-      - name: Add ChromeDriver to PATH
-        run: echo "$(dirname '${{ steps.setup-chrome.outputs.chromedriver-path }}')" >> "$GITHUB_PATH"
-
-      - name: Install wasm-pack
-        run: cargo install --locked wasm-pack --version 0.14.0
-
-      - name: Install wasm-bindgen CLI
-        run: cargo install --locked wasm-bindgen-cli --version 0.2.113
-
-      - name: Install terser
-        run: npm install --global terser
-
-      - name: Write webdriver.json
-        run: |
-          cat > js-wasm/webdriver.json <<EOF
-          {
-            "goog:chromeOptions": {
-              "binary": "${{ steps.setup-chrome.outputs.chrome-path }}"
-            }
-          }
-          EOF
-
-      - name: Run Node-targeted Rust tests
-        run: npm --prefix js-wasm run test:wasm-node
-
-      - name: Run headless browser Rust tests
-        run: npm --prefix js-wasm run test:wasm-browser
-        env:
-          CHROMEDRIVER: ${{ steps.setup-chrome.outputs.chromedriver-path }}
-          WASM_BINDGEN_TEST_WEBDRIVER_JSON: ${{ github.workspace }}/js-wasm/webdriver.json
-
-      - name: Build browser package
-        run: npm --prefix js-wasm run build:web
-
-      - name: Run JS integration tests
-        run: npm --prefix js-wasm run test:js
-
-      - name: Validate npm package contents
-        run: npm --prefix js-wasm run pack:dry-run

.github/upstream-workflows/wasm_tests.yaml

@@ -0,0 +1,76 @@
+name: WASM tests
+
+on:
+  create:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+
+jobs:
+  browser-wasm:
+    name: Browser WASM
+    runs-on: ubuntu-latest
+    env:
+      CARGO_TERM_COLOR: always
+    steps:
+      - name: Checkout sources
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: stable
+          target: wasm32-unknown-unknown
+
+      - name: Install Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 22
+
+      - name: Install Chrome and ChromeDriver
+        id: setup-chrome
+        uses: browser-actions/setup-chrome@2e1d749697dd1612b833dba4a722266286fbefcd # v2.1.2
+        with:
+          chrome-version: stable
+          install-dependencies: true
+          install-chromedriver: true
+
+      - name: Add ChromeDriver to PATH
+        run: echo "$(dirname '${{ steps.setup-chrome.outputs.chromedriver-path }}')" >> "$GITHUB_PATH"
+
+      - name: Install wasm-pack
+        run: cargo install --locked wasm-pack --version 0.14.0
+
+      - name: Install wasm-bindgen CLI
+        run: cargo install --locked wasm-bindgen-cli --version 0.2.113
+
+      - name: Install terser
+        run: npm install --global terser
+
+      - name: Write webdriver.json
+        run: |
+          cat > js-wasm/webdriver.json <<EOF
+          {
+            "goog:chromeOptions": {
+              "binary": "${{ steps.setup-chrome.outputs.chrome-path }}"
+            }
+          }
+          EOF
+
+      - name: Run Node-targeted Rust tests
+        run: npm --prefix js-wasm run test:wasm-node
+
+      - name: Run headless browser Rust tests
+        run: npm --prefix js-wasm run test:wasm-browser
+        env:
+          CHROMEDRIVER: ${{ steps.setup-chrome.outputs.chromedriver-path }}
+          WASM_BINDGEN_TEST_WEBDRIVER_JSON: ${{ github.workspace }}/js-wasm/webdriver.json
+
+      - name: Build browser package
+        run: npm --prefix js-wasm run build:web
+
+      - name: Run JS integration tests
+        run: npm --prefix js-wasm run test:js
+
+      - name: Validate npm package contents
+        run: npm --prefix js-wasm run pack:dry-run

lib/src/compiler/ir/ast2ir.rs

@@ -519,13 +519,22 @@ fn expr_from_ast(
         }
 
         ast::Expr::Regexp(regexp) => {
-            re::parser::Parser::new()
+            let hir = re::parser::Parser::new()
                 .relaxed_re_syntax(ctx.relaxed_re_syntax)
                 .parse(regexp.as_ref())
                 .map_err(|err| {
                     re_error_to_compile_error(ctx.report_builder, regexp, err)
                 })?;
 
+            hir.build_automata().map_err(|err| {
+                InvalidRegexp::build(
+                    ctx.report_builder,
+                    err.to_string(),
+                    ctx.report_builder.span_to_code_loc(regexp.span()),
+                    None,
+                )
+            })?;
+
             ctx.ir
                 .constant(TypeValue::Regexp(Some(Regexp::new(regexp.literal))))
         }

lib/src/compiler/rules.rs

@@ -475,20 +475,11 @@ impl Rules {
         let parser = re::parser::Parser::new()
             .relaxed_re_syntax(self.relaxed_re_syntax);
 
-        let hir = parser.parse(&re).unwrap().into_inner();
+        let hir = parser.parse(&re).unwrap();
 
-        // Set a size limit for the NFA automata. The default limit (10MB) is
-        // too small for certain regexps seen in YARA rules in the wild, see:
-        // https://github.com/VirusTotal/yara-x/issues/85
-        let config = regex_automata::meta::Config::new()
-            .nfa_size_limit(Some(50 * 1024 * 1024));
-
-        regex_automata::meta::Builder::new()
-            .configure(config)
-            .build_from_hir(&hir)
-            .unwrap_or_else(|err| {
-                panic!("error compiling regex `{}`: {:#?}", re.as_str(), err)
-            })
+        hir.build_automata().unwrap_or_else(|err| {
+            panic!("error compiling regex `{}`: {:#?}", re.as_str(), err)
+        })
     }
 
     /// Returns a compiled multi-pattern `RegexSet` for a given `RegexSetId`.

lib/src/compiler/tests/testdata/errors/155.in

@@ -0,0 +1 @@
+rule test { condition: 50% of them }

lib/src/compiler/tests/testdata/errors/155.out

@@ -0,0 +1,7 @@
+error[E016]: no matching patterns
+ --> line:1:31
+  |
+1 | rule test { condition: 50% of them }
+  |                               ^^^^ there's no pattern in this set
+  |
+  = note: this rule doesn't define any patterns

lib/src/compiler/tests/testdata/errors/156.in

@@ -0,0 +1,4 @@
+rule test {
+   condition:
+      "abc" matches /([a-z]{1000}){1000}/
+}

lib/src/compiler/tests/testdata/errors/156.out

@@ -0,0 +1,5 @@
+error[E014]: invalid regular expression
+ --> line:3:21
+  |
+3 |       "abc" matches /([a-z]{1000}){1000}/
+  |                     ^^^^^^^^^^^^^^^^^^^^^ regex is too large

lib/src/re/hir.rs

@@ -318,6 +318,30 @@ impl Hir {
         self.inner
     }
 
+    /// Builds a [`regex_automata::meta::Regex`] from this HIR.
+    pub fn build_automata(
+        &self,
+    ) -> Result<regex_automata::meta::Regex, anyhow::Error> {
+        // Set a size limit for the NFA automata. The default limit (10MB) is
+        // not enough for certain regular expressions seen in the wild, see:
+        // https://github.com/VirusTotal/yara-x/issues/85
+        let config = regex_automata::meta::Config::new()
+            .nfa_size_limit(Some(50 * 1024 * 1024));
+
+        regex_automata::meta::Builder::new()
+            .configure(config)
+            .build_from_hir(&self.inner)
+            .map_err(|err| {
+                if err.size_limit().is_some() {
+                    anyhow::anyhow!("regex is too large")
+                } else if let Some(syntax_error) = err.syntax_error() {
+                    anyhow::anyhow!("{}", syntax_error)
+                } else {
+                    anyhow::anyhow!("{}", err)
+                }
+            })
+    }
+
     /// Returns the length (in bytes) of the smallest string matched by this HIR.
     ///
     /// A return value of `0` is possible and occurs when the HIR can match an