Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 437e137889eae81f02f1c27a384a6da3c94803f8
https://github.com/WebKit/WebKit/commit/437e137889eae81f02f1c27a384a6da3c94803f8
Author: Sosuke Suzuki <[email protected]>
Date: 2026-02-10 (Tue, 10 Feb 2026)
Changed paths:
A JSTests/stress/regexp-nongreedy-backref-zero-width.js
M Source/JavaScriptCore/yarr/YarrJIT.cpp
Log Message:
-----------
[YARR] Fix infinite loop in JIT for non-greedy backreference to zero-width
capture
https://bugs.webkit.org/show_bug.cgi?id=307415
Reviewed by Yusuke Suzuki.
A non-greedy backreference like \1*? can loop forever in the JIT when
the referenced capture is undefined or empty. Each match succeeds
without consuming input, but the backtrack code keeps retrying.
Add a zero-width progress check to backtrackBackReference NonGreedy,
similar to existing guards in ParenthesesSubpatternEnd
Test: JSTests/stress/regexp-nongreedy-backref-zero-width.js
* JSTests/stress/regexp-nongreedy-backref-zero-width.js: Added.
(shouldBe):
* Source/JavaScriptCore/yarr/YarrJIT.cpp:
Canonical link: https://commits.webkit.org/307156@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
