Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: dc35ebdb9bf4758406098b665ee7974f1b28cb76
https://github.com/WebKit/WebKit/commit/dc35ebdb9bf4758406098b665ee7974f1b28cb76
Author: Sosuke Suzuki <[email protected]>
Date: 2026-08-10 (Mon, 10 Aug 2026)
Changed paths:
A JSTests/stress/regexp-string-list-non-bmp-alternative.js
M Source/JavaScriptCore/yarr/YarrJIT.cpp
Log Message:
-----------
[YARR] JIT string-list alternative with a non-BMP character matches after
only its leading characters
https://bugs.webkit.org/show_bug.cgi?id=321251
Reviewed by Yusuke Suzuki.
In a string-list group, a non-last alternative may branch to the group's
success target only from the comparison of its last character.
generatePatternCharacterOnce() collects adjacent characters into opList but,
with a 16-bit subject and /u or /v, stops at a non-BMP or lone surrogate
character, which is matched by its own Term afterwards. Since 292003@main
the success branch was emitted on reaching the end of opList rather than the
end of the alternative:
/^(?:a\u{1F600}|qa)/u.exec("azk\u0101") // ["azk"], expected null
/^(?:a\u{1F600}|qa)/u.exec("z\u{1F600}\u0101") // ["z\u{1F600}"], expected
null
Only use lastMatchTargets when m_ops[opIndex + opList.size()] is not a Term,
as 290791@main originally did.
Test: JSTests/stress/regexp-string-list-non-bmp-alternative.js
* JSTests/stress/regexp-string-list-non-bmp-alternative.js: Added.
(shouldBe):
(test):
* Source/JavaScriptCore/yarr/YarrJIT.cpp:
Canonical link: https://commits.webkit.org/318956@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
