Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 540f0965c655f2b6a78683c12ea43fd269978886
      
https://github.com/WebKit/WebKit/commit/540f0965c655f2b6a78683c12ea43fd269978886
  Author: Sosuke Suzuki <[email protected]>
  Date:   2026-08-02 (Sun, 02 Aug 2026)

  Changed paths:
    A JSTests/stress/regexp-v-flag-class-set-op-character-widths.js
    M Source/JavaScriptCore/yarr/YarrPattern.cpp

  Log Message:
  -----------
  [YARR] v-mode class set operations produce stale character widths
https://bugs.webkit.org/show_bug.cgi?id=320720

Reviewed by Yusuke Suzuki.

CharacterClassConstructor tracked m_characterWidths incrementally in
addSorted / addSortedRange, but the UnicodeSets set-op and inversion paths
(latin1Op, nonLatin1OpSorted, invertMatches) rebuild the match / range
vectors by swapping in new ones without touching the width bits. So the
bits went stale: unions dropped the rhs widths (wrong fixed offsets and an
assertion failure in hasSharedLeadSurrogate), and intersections /
subtractions left over-wide widths behind.

    new RegExp("^[\\u{10001}-\\u{10002}\\p{Ll}]$", "v").test("a")
    // was false

Instead, derive CharacterClass::m_characterWidths from the final vectors
in charClass(). The widths are just an O(1) summary of the sorted match /
range vectors (emptiness plus first / last code point), so deriving them
once at the constructor's exit is cheaper and simpler than keeping an
incremental copy in sync at every set-op site.

Test: JSTests/stress/regexp-v-flag-class-set-op-character-widths.js

* JSTests/stress/regexp-v-flag-class-set-op-character-widths.js: Added.
(shouldBe):
* Source/JavaScriptCore/yarr/YarrPattern.cpp:
(JSC::Yarr::CharacterClassConstructor::CharacterClassConstructor):
(JSC::Yarr::CharacterClassConstructor::reset):
(JSC::Yarr::CharacterClassConstructor::charClass):
(JSC::Yarr::CharacterClassConstructor::addSorted):
(JSC::Yarr::CharacterClassConstructor::addSortedRange):
(JSC::Yarr::CharacterClassConstructor::characterWidths):
(JSC::Yarr::CharacterClassConstructor::hasNonBMPCharacters): Deleted.

Canonical link: https://commits.webkit.org/318416@main



To unsubscribe from these emails, change your notification settings at 
https://github.com/WebKit/WebKit/settings/notifications

Reply via email to