Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 116394de195ba16045408b3d0548743026aa8846
https://github.com/WebKit/WebKit/commit/116394de195ba16045408b3d0548743026aa8846
Author: Kai Tamkun <[email protected]>
Date: 2026-06-15 (Mon, 15 Jun 2026)
Changed paths:
A JSTests/stress/regexp-boundary-assertion-with-surrogate.js
M Source/JavaScriptCore/yarr/YarrJIT.cpp
Log Message:
-----------
[JSC] Yarr JIT \B+unicode+surrogate produces corrupted JSString, crashes
WebContent
https://bugs.webkit.org/show_bug.cgi?id=312604
rdar://173555471
Reviewed by Yusuke Suzuki.
Prevents corruption of firstCharacterAdditionalReadSize by disabling the
use-first-non-BMP-character optimization in word boundary assertions.
Test: JSTests/stress/regexp-boundary-assertion-with-surrogate.js
* JSTests/stress/regexp-boundary-assertion-with-surrogate.js: Added.
* Source/JavaScriptCore/yarr/YarrJIT.cpp:
Canonical link: https://commits.webkit.org/315250@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
