Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 8f069ce3b3ce2fda5f7cd113f145ee1abb3b26e0
https://github.com/WebKit/WebKit/commit/8f069ce3b3ce2fda5f7cd113f145ee1abb3b26e0
Author: Kai Tamkun <[email protected]>
Date: 2026-09-01 (Tue, 01 Sep 2026)
Changed paths:
A JSTests/stress/yarr-jit-non-bmp-backtrack-index-overflow.js
A JSTests/stress/yarr-jit-non-bmp-backtrack-index-underflow.js
M Source/JavaScriptCore/runtime/RegExpMatchesArray.h
Log Message:
-----------
[JSC] YarrJIT non-BMP backtrack trampoline (L>F branch) does not add
firstCharacterAdditionalReadSize to index, returns start > end
https://bugs.webkit.org/show_bug.cgi?id=316996
rdar://177699255
Reviewed by Yijia Huang.
This patch fixes a mistake where firstCharacterAdditionalReadSize isn't added
to the index register in YarrJIT during backtracking.
Test: JSTests/stress/yarr-jit-non-bmp-backtrack-index-underflow.js
* JSTests/stress/yarr-jit-non-bmp-backtrack-index-overflow.js: Added.
* JSTests/stress/yarr-jit-non-bmp-backtrack-index-underflow.js: Added.
* Source/JavaScriptCore/runtime/RegExpMatchesArray.h:
(JSC::createRegExpMatchesArray):
* Source/JavaScriptCore/yarr/YarrJIT.cpp:
Originally-landed-as: [email protected] (30b9a27b47e8).
rdar://185367107
Canonical link: https://commits.webkit.org/320264@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
