Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: d22fa241f19e4a2ab3565132df3bc7db82d0b684
https://github.com/WebKit/WebKit/commit/d22fa241f19e4a2ab3565132df3bc7db82d0b684
Author: Sosuke Suzuki <[email protected]>
Date: 2026-09-15 (Tue, 15 Sep 2026)
Changed paths:
A JSTests/stress/regexp-test-regexp-is-also-the-argument.js
M Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp
Log Message:
-----------
[JSC] DFG `RegExpTest` asserts when the RegExp is also the argument
https://bugs.webkit.org/show_bug.cgi?id=324211
Reviewed by Yusuke Suzuki.
In `regExp.test(regExp)` both operands of RegExpTest are the same node, so
baseGPR and argumentGPR are the same register. Debug builds then hit
ASSERT(noOverlap(baseGPR, argumentGPR, scratch1GPR, scratch2GPR)) in
emitRegExpMinimumLengthFilterGuards(), added in 320487@main.
The function only reads baseGPR and argumentGPR and only writes the scratch
registers, so assert each input against the scratch registers separately, as
emitRegExpStickyFirstCharacterFilterGuards() already does. The generated code
does not change: a RegExp argument is not a string, so it branches to the
slow path call before the guards run.
Test: JSTests/stress/regexp-test-regexp-is-also-the-argument.js
* JSTests/stress/regexp-test-regexp-is-also-the-argument.js: Added.
(shouldBe):
(testConstant):
(testConstantAnchored):
(testConstantSticky):
* Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::emitRegExpMinimumLengthFilterGuards):
Canonical link: https://commits.webkit.org/321146@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
