Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: e8f0cb20dfb0f7180bf9182cb665b1c9daa3b1d0
https://github.com/WebKit/WebKit/commit/e8f0cb20dfb0f7180bf9182cb665b1c9daa3b1d0
Author: Sosuke Suzuki <[email protected]>
Date: 2026-03-14 (Sat, 14 Mar 2026)
Changed paths:
A JSTests/stress/regexp-match-fast-global-dce-lastmatch.js
M Source/JavaScriptCore/dfg/DFGNodeType.h
Log Message:
-----------
[JSC] RegExpMatchFastGlobal should have NodeMustGenerate to prevent FTL DCE
https://bugs.webkit.org/show_bug.cgi?id=309953
Reviewed by Yusuke Suzuki.
DFGStrengthReductionPhase converts RegExpMatchFast to RegExpMatchFastGlobal
when the regexp is a constant with the global flag. This conversion calls
setOpAndDefaultFlags(RegExpMatchFastGlobal) which resets flags to the
default, and RegExpMatchFastGlobal was missing NodeMustGenerate.
DFGClobberize.h correctly declares write(RegExpState) for this node, so DFG
DCE preserves it. However FTL DCE only checks NodeMustGenerate, so when the
match result is unused it eliminates the node and RegExp.lastMatch/$1/etc.
are left stale from a prior match:
function test(s) { s.match(/l/g); } // result unused
/seed/.test("seeded");
test("hello");
RegExp.lastMatch; // FTL: "seed" (stale), expected: "l"
RegExpMatchFast (the source op) already has NodeMustGenerate. Adding it to
RegExpMatchFastGlobal makes FTL behavior match DFG and lower tiers.
Test: JSTests/stress/regexp-match-fast-global-dce-lastmatch.js
* JSTests/stress/regexp-match-fast-global-dce-lastmatch.js: Added.
(shouldBe):
(test):
(testMulti):
(testCapture):
(testNoMatch):
* Source/JavaScriptCore/dfg/DFGNodeType.h:
Canonical link: https://commits.webkit.org/309271@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
