Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: bd5f1e5b17d9fbc4bfc6e5d78e1f7d6153f7416a
https://github.com/WebKit/WebKit/commit/bd5f1e5b17d9fbc4bfc6e5d78e1f7d6153f7416a
Author: Anand Srinivasan <[email protected]>
Date: 2026-06-30 (Tue, 30 Jun 2026)
Changed paths:
A JSTests/stress/yarr-negative-offset.js
M Source/JavaScriptCore/yarr/YarrJIT.cpp
Log Message:
-----------
YarrJIT negativeOffsetIndexedAddress discards adjusted base register
https://bugs.webkit.org/show_bug.cgi?id=312415
rdar://174714198
Reviewed by Yijia Huang.
In YarrJIT negativeOffsetIndexedAddress computes a negative offset from
a base address but the function mistakenly uses the original value
instead of the adjusted value. This patch fixes it to use the adjusted
value.
Test: JSTests/stress/yarr-negative-offset.js
* JSTests/stress/yarr-negative-offset.js: Added.
(catch):
* Source/JavaScriptCore/yarr/YarrJIT.cpp:
Originally-landed-as: 305413.685@safari-7624-branch (30c8460241f3).
rdar://180436598
Canonical link: https://commits.webkit.org/316127@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
