Branch: refs/heads/webkitglib/2.52
Home: https://github.com/WebKit/WebKit
Commit: 27bad3866d55a66eb092caffcd4e1caebfc4eeff
https://github.com/WebKit/WebKit/commit/27bad3866d55a66eb092caffcd4e1caebfc4eeff
Author: Kai Tamkun <[email protected]>
Date: 2026-09-07 (Mon, 07 Sep 2026)
Changed paths:
A JSTests/stress/yarr-jit-non-bmp-backtrack-index-overflow.js
A JSTests/stress/yarr-jit-non-bmp-backtrack-index-underflow.js
M Source/JavaScriptCore/runtime/RegExpMatchesArray.h
M Source/JavaScriptCore/yarr/YarrJIT.cpp
Log Message:
-----------
Cherry-pick [email protected] (30b9a27b47e8).
https://bugs.webkit.org/show_bug.cgi?id=316996
[JSC] YarrJIT non-BMP backtrack trampoline (L>F branch) does not add
firstCharacterAdditionalReadSize to index, returns start > end
https://bugs.webkit.org/show_bug.cgi?id=316996
rdar://177699255
Reviewed by Yijia Huang.
This patch fixes a mistake where firstCharacterAdditionalReadSize isn't
added
to the index register in YarrJIT during backtracking.
Test: JSTests/stress/yarr-jit-non-bmp-backtrack-index-underflow.js
* JSTests/stress/yarr-jit-non-bmp-backtrack-index-overflow.js: Added.
* JSTests/stress/yarr-jit-non-bmp-backtrack-index-underflow.js: Added.
* Source/JavaScriptCore/runtime/RegExpMatchesArray.h:
(JSC::createRegExpMatchesArray):
* Source/JavaScriptCore/yarr/YarrJIT.cpp:
Identifier: [email protected]
Canonical link: https://commits.webkit.org/305877.1153@webkitglib/2.52
Commit: 4934ed9294e3ce3c69c68556caa21b99da7c6ceb
https://github.com/WebKit/WebKit/commit/4934ed9294e3ce3c69c68556caa21b99da7c6ceb
Author: Yusuke Suzuki <[email protected]>
Date: 2026-09-07 (Mon, 07 Sep 2026)
Changed paths:
A JSTests/stress/uint32-array-result-int32-dfg.js
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp
Log Message:
-----------
Cherry-pick [email protected] (2bc65ac3560e).
https://bugs.webkit.org/show_bug.cgi?id=319112
[JSC] DFG Uint32Array load should consider about Int32 speculation path
https://bugs.webkit.org/show_bug.cgi?id=319112
rdar://176792844
Reviewed by Mark Lam.
DFG Uint32Array GetByVal may have Int32 result with speculation. But the
current code is always using boxed-double for boxed result. We should
use boxed-int32 when this speculation is set. The same thing is already
done in FTL.
Test: JSTests/stress/uint32-array-result-int32-dfg.js
* JSTests/stress/uint32-array-result-int32-dfg.js: Added.
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::setIntTypedArrayLoadResult):
Identifier: [email protected]
Canonical link: https://commits.webkit.org/305877.1154@webkitglib/2.52
Compare: https://github.com/WebKit/WebKit/compare/d4e5df1c246d...4934ed9294e3
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
