Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 3790f1e3cc0a7b0e02528d3440e588a491b28be4
https://github.com/WebKit/WebKit/commit/3790f1e3cc0a7b0e02528d3440e588a491b28be4
Author: Sosuke Suzuki <[email protected]>
Date: 2024-02-23 (Fri, 23 Feb 2024)
Changed paths:
A JSTests/stress/string-replace-regexp-deopt-lastindex.js
M Source/JavaScriptCore/dfg/DFGFixupPhase.cpp
Log Message:
-----------
[JSC] Don't optimize String.prototype.replace for RegExp searchValue with
non-numeric lastIndex.
https://bugs.webkit.org/show_bug.cgi?id=246274
Reviewed by Alexey Shvayka.
In DFGByteCodeParser, String.prototype.replace with a RegExp object as
searchValue is inlined into a StringReplace node.
So after DFG, lastIndex is no longer read and updated. Therefore,
searchValue.lastIndex.toString is no longer invoked.
This patch changes the code so that it doesn't inline if searchValue.lastIndex
isn't numeric.
https://tc39.es/ecma262/#sec-string.prototype.replace
* JSTests/stress/string-replace-regexp-deopt-lastindex.js: Added.
(shouldBe):
(foo.regexLastIndex.toString):
(foo):
* Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::addStringReplacePrimordialChecks):
Canonical link: https://commits.webkit.org/275255@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
