Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 33b8987214b234143e062450bdc9d442219db7f9
https://github.com/WebKit/WebKit/commit/33b8987214b234143e062450bdc9d442219db7f9
Author: Sosuke Suzuki <[email protected]>
Date: 2026-02-25 (Wed, 25 Feb 2026)
Changed paths:
A JSTests/stress/regexp-modifiers-16bit-backreference.js
M Source/JavaScriptCore/yarr/YarrJIT.cpp
Log Message:
-----------
[Yarr] Fix ASSERT failure with case-insensitive backreferences inside RegExp
modifier groups
https://bugs.webkit.org/show_bug.cgi?id=308620
Reviewed by Yusuke Suzuki.
m_decode16BitForBackreferencesWithCalls was computed using only the
global ignoreCase flag (m_pattern.ignoreCase()), so it was false for
patterns like /(a)(?i:\1)/ that have no global /i flag. When such a
pattern was matched against a 16-bit string, the JIT entered the
16-bit case-insensitive backreference code path (because
term->ignoreCase() is true), hitting
ASSERT(m_decode16BitForBackreferencesWithCalls).
Fix by also checking m_pattern.m_containsModifiers, since a modifier
group can enable ignoreCase for individual backreference terms even
when the pattern-level flag is not set.
Test: JSTests/stress/regexp-modifiers-16bit-backreference.js
* JSTests/stress/regexp-modifiers-16bit-backreference.js: Added.
(shouldBe):
* Source/JavaScriptCore/yarr/YarrJIT.cpp:
Canonical link: https://commits.webkit.org/308265@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
