Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 2165451fd3ee573c8dec57c8e05aac5910ffe877
https://github.com/WebKit/WebKit/commit/2165451fd3ee573c8dec57c8e05aac5910ffe877
Author: Sosuke Suzuki <[email protected]>
Date: 2026-08-20 (Thu, 20 Aug 2026)
Changed paths:
A JSTests/stress/regexp-backreference-greedy-non-bmp-capture-restore-pos.js
M Source/JavaScriptCore/yarr/YarrInterpreter.cpp
Log Message:
-----------
[YARR] `tryConsumeBackReference` should restore input position when a
surrogate pair read fails in interpreter
https://bugs.webkit.org/show_bug.cgi?id=321409
Reviewed by Yusuke Suzuki.
In tryConsumeBackReference, the Forward direction speculatively advances the
input by matchSize before comparing. When the captured character is non-BMP and
the input at that offset is not a valid surrogate pair, readSurrogatePairChecked
returns errorCodePoint and we took an early return that only restored the
position for Backward, leaving Forward matchSize code units ahead. FixedCount
and
NonGreedy callers overwrite the position afterwards, but the Greedy loop relies
on tryConsumeBackReference to restore it, so a failed iteration consumed input:
/(\u{1F601})\1*$/u.exec("\u{1F601}ab") // ["\u{1F601}ab", ...],
should be null
/(\u{1F601})(\1*)?/u.exec("\u{1F601}\n\u{1F601}") // splits the second
surrogate pair
280563@main introduced the early return so that errorCodePoint is not passed to
areCanonicallyEquivalent; 313026@main added the Backward restore. This patch
instead guards the comparison with the errorCodePoint check and falls through to
the existing mismatch path, which restores the position for both directions.
Test: JSTests/stress/regexp-backreference-greedy-non-bmp-capture-restore-pos.js
* JSTests/stress/regexp-backreference-greedy-non-bmp-capture-restore-pos.js:
Added.
(shouldBe):
* Source/JavaScriptCore/yarr/YarrInterpreter.cpp:
(JSC::Yarr::Interpreter::tryConsumeBackReference):
Canonical link: https://commits.webkit.org/319560@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
