Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 7b5e7da783f58bd8ee2321ff0a399617f0d2acc8
      
https://github.com/WebKit/WebKit/commit/7b5e7da783f58bd8ee2321ff0a399617f0d2acc8
  Author: Sosuke Suzuki <[email protected]>
  Date:   2026-08-09 (Sun, 09 Aug 2026)

  Changed paths:
    A JSTests/stress/regexp-v-flag-class-set-op-inverted-property.js
    M Source/JavaScriptCore/yarr/YarrPattern.cpp

  Log Message:
  -----------
  [YARR] `\P{...}` on the right side of a v-mode `&&` or `--` becomes a union
https://bugs.webkit.org/show_bug.cgi?id=321252

Reviewed by Yusuke Suzuki.

appendInverted() adds the complement of its operand directly to the accumulated
matches and ranges without consulting m_setOp, so a pending && or -- turns into 
a union.

    /[\p{L}&&\P{Lu}]/v.test("A")        // true, should be false
    /^[\q{ab|c|1}&&\P{L}]$/v.test("ab") // true, should be false

When an intersection or subtraction is pending, materialize the complement into 
a
temporary CharacterClass and funnel it through append(), which dispatches on 
m_setOp
for both matches and strings. addSortedInverted()'s adjacent-merge branch 
targets the
member range vectors, but it cannot fire for the temporary since complement 
pieces
are always separated by an element of the operand.

Test: JSTests/stress/regexp-v-flag-class-set-op-inverted-property.js

* JSTests/stress/regexp-v-flag-class-set-op-inverted-property.js: Added.
(shouldBe):
* Source/JavaScriptCore/yarr/YarrPattern.cpp:
(JSC::Yarr::CharacterClassConstructor::appendInverted):

Canonical link: https://commits.webkit.org/318854@main



To unsubscribe from these emails, change your notification settings at 
https://github.com/WebKit/WebKit/settings/notifications

Reply via email to