Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 4681ea866adfe6ae9731ebb2ff0fe0b706446a1b
https://github.com/WebKit/WebKit/commit/4681ea866adfe6ae9731ebb2ff0fe0b706446a1b
Author: Yusuke Suzuki <[email protected]>
Date: 2026-10-13 (Tue, 13 Oct 2026)
Changed paths:
A JSTests/stress/regexp-constructor-call-is-not-construct.js
M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
Log Message:
-----------
[JSC] DFG should not turn a call to RegExp into NewRegExpUntyped
https://bugs.webkit.org/show_bug.cgi?id=327458
rdar://189954203
Reviewed by Dan Hecht.
ByteCodeParser::handleConstantFunction lowered RegExp to NewRegExpUntyped
without
checking whether the site is a construct. For a call, argument 0 is `this`, so
`RegExp.call(RegExp, re, undefined)` passed the new.target == callee check and
allocated a fresh RegExp. Called as a function, RegExp returns the pattern
itself
when it is a RegExp, the flags are undefined, and pattern.constructor is RegExp.
This patch restricts the lowering to construct sites.
Test: JSTests/stress/regexp-constructor-call-is-not-construct.js
* JSTests/stress/regexp-constructor-call-is-not-construct.js: Added.
(shouldBe):
(callWithCalleeAsThis):
(construct):
* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleConstantFunction):
Canonical link: https://commits.webkit.org/323678@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
