Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 6646c49f2a7b64b914fb29eed508b172b15c7c68
https://github.com/WebKit/WebKit/commit/6646c49f2a7b64b914fb29eed508b172b15c7c68
Author: Yusuke Suzuki <[email protected]>
Date: 2026-06-02 (Tue, 02 Jun 2026)
Changed paths:
A JSTests/stress/regexp-fixedcount-zero-length-content-backtrack.js
A JSTests/stress/regexp-greedy-nested-quantifier-backtrack.js
A JSTests/stress/regexp-greedy-varcount-minfail.js
A JSTests/stress/regexp-greedy-varcount-multialt.js
M JSTests/stress/regexp-large-quantifier.js
A JSTests/stress/regexp-multialt-content-backtracking.js
M JSTests/stress/regexp-quantify-atom-copy-term-out-of-stack.js
A JSTests/stress/regexp-variable-count-native.js
M JSTests/stress/regexp-variable-counted-parentheses-with-min.js
M JSTests/stress/regress-159954.js
M Source/JavaScriptCore/yarr/YarrInterpreter.cpp
M Source/JavaScriptCore/yarr/YarrJIT.cpp
M Source/JavaScriptCore/yarr/YarrJIT.h
M Source/JavaScriptCore/yarr/YarrPattern.cpp
Log Message:
-----------
[JSC] Implement Variable Count Parentheses in YarrJIT
https://bugs.webkit.org/show_bug.cgi?id=307145
rdar://problem/169778246
Reviewed by Yijia Huang.
This patch adds JIT support for {m,n} parentheses quantifiers with m > 0 (e.g.
/(a){3,5}/).
Previously the JIT compiled only {0,N} (Greedy/NonGreedy) and {N,N}
(FixedCount).
The implementation extends the existing variable-count (Greedy/NonGreedy) model.
ParenContext save-at-BEGIN, address-based alt dispatch, and the natural
backtracking-state alt-chain.
Forward direction:
- Greedy: unchanged shape — keep iterating up to max.
- NonGreedy: skip the initial-skip-jump when min > 0 (we must run min mandatory
iterations).
End.fwd loops back to BEGIN while count < min.
- Both: an iter that matched zero characters punts to the interpreter.
Backward direction:
- count >= min (or count > 0 for min == 0): decrement count
and jump to End.reentry - accept fewer iterations.
- count < min and count > 0: jump to End.contentBacktrackEntryLabel
to retry the latest remaining iter's content with different alternatives.
This is what enforces min: without it, accept-fewer plus a
trivially-succeeding
post-parens would return matches with fewer than min iterations.
- count == 0 (with min > 0): the parens fail: clear captures, fall
through to backtrack propagation.
- End.bt's case bodies are unchanged.
Tests: JSTests/stress/regexp-fixedcount-zero-length-content-backtrack.js
JSTests/stress/regexp-greedy-nested-quantifier-backtrack.js
JSTests/stress/regexp-multialt-content-backtracking.js
JSTests/stress/regexp-variable-count-native.js
* JSTests/stress/regexp-fixedcount-zero-length-content-backtrack.js: Added.
(result):
* JSTests/stress/regexp-greedy-nested-quantifier-backtrack.js: Added.
(test):
* JSTests/stress/regexp-greedy-varcount-minfail.js: Added.
(shouldBe):
* JSTests/stress/regexp-greedy-varcount-multialt.js: Added.
(check):
* JSTests/stress/regexp-large-quantifier.js:
* JSTests/stress/regexp-multialt-content-backtracking.js: Added.
(shouldBe):
* JSTests/stress/regexp-quantify-atom-copy-term-out-of-stack.js:
(test):
* JSTests/stress/regexp-variable-count-native.js: Added.
(shouldBe):
(re):
(re.a):
(i.re):
(i.shouldBe):
(shouldBe.a):
* JSTests/stress/regexp-variable-counted-parentheses-with-min.js:
(re):
* JSTests/stress/regress-159954.js:
(testRegExpThrows):
(testRegExpResult):
(testRegExp): Deleted.
* Source/JavaScriptCore/yarr/YarrInterpreter.cpp:
(JSC::Yarr::Interpreter::backtrackParentheses):
* Source/JavaScriptCore/yarr/YarrJIT.cpp:
(JSC::Yarr::dumpCompileFailure):
* Source/JavaScriptCore/yarr/YarrJIT.h:
* Source/JavaScriptCore/yarr/YarrPattern.cpp:
(JSC::Yarr::YarrPatternConstructor::quantifyAtom):
Canonical link: https://commits.webkit.org/314383@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
