Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: afa9625807934c87738004032440cd1bc530c9dd
https://github.com/WebKit/WebKit/commit/afa9625807934c87738004032440cd1bc530c9dd
Author: Sosuke Suzuki <[email protected]>
Date: 2026-06-25 (Thu, 25 Jun 2026)
Changed paths:
A JSTests/stress/regexp-backreference-with-surrogate.js
M Source/JavaScriptCore/yarr/YarrJIT.cpp
Log Message:
-----------
[YARR] JIT backreference with non-BMP character skips next match start
position
https://bugs.webkit.org/show_bug.cgi?id=317626
Reviewed by Yusuke Suzuki.
`/(.)\1/u.exec("a\u{10000}\u{10000}b")` returns null on ARM64 with the
Yarr JIT, while the interpreter (and other engines) correctly return a
match at index 1.
When matchBackreference() reads a non-BMP character via readCharacter(),
tryReadUnicodeCharImpl<UseOptimization> writes 1 into
firstCharacterAdditionalReadSize. That register is meant to record
whether the *first* character of the current attempt was non-BMP, so the
re-entry path can advance index by 2 instead of 1. A backreference read
is not the first character, so this clobbers the register and causes the
re-entry path to skip index 1 (the actual match start).
315250@main fixed the same issue for word-boundary assertions by
disabling m_useFirstNonBMPCharacterOptimization for the duration of the
read. Apply the same SetForScope guard in matchBackreference().
Test: JSTests/stress/regexp-backreference-with-surrogate.js
* JSTests/stress/regexp-backreference-with-surrogate.js: Added.
(shouldBe):
* Source/JavaScriptCore/yarr/YarrJIT.cpp:
Canonical link: https://commits.webkit.org/315866@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
