Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 338e02c8838aed9c72f9244a53c928a1e6a969e5
https://github.com/WebKit/WebKit/commit/338e02c8838aed9c72f9244a53c928a1e6a969e5
Author: Sosuke Suzuki <[email protected]>
Date: 2026-07-15 (Wed, 15 Jul 2026)
Changed paths:
A
JSTests/stress/dfg-strength-reduction-regexp-jit-code-failure-not-no-match.js
M Source/JavaScriptCore/runtime/RegExp.cpp
M Source/JavaScriptCore/runtime/RegExpInlines.h
Log Message:
-----------
[JSC] DFG strength reduction folds a compiler-thread RegExp execution failure
into a definite no-match
https://bugs.webkit.org/show_bug.cgi?id=319452
Reviewed by Yusuke Suzuki.
313689@main made RegExp bytecode compilation mutator-only: when Yarr JIT code
returns
JITCodeFailure on a compiler thread and no bytecode exists, matchInline bails
out with
-1 / MatchResult::failed().
That bail is indistinguishable from a real no-match. If a RegExp only ever runs
via the
Yarr JIT (so bytecode is never compiled) and the JIT stack check fails against
the small
compiler-thread stack, matchConcurrently reports an authoritative no-match and
DFG
strength reduction permanently folds exec to null and test to false, even
though the
mutator matches successfully.
This patch keeps the JITCodeFailure sentinel on the bail path and makes
matchConcurrently
return false for it, so strength reduction gives up folding and defers to
runtime.
const re = new RegExp("^" + "a?".repeat(30000) + "$");
function f() { return re.test("a"); }
// After DFG tier-up, f() returns false forever; direct re.test("a") is
true.
Test:
JSTests/stress/dfg-strength-reduction-regexp-jit-code-failure-not-no-match.js
*
JSTests/stress/dfg-strength-reduction-regexp-jit-code-failure-not-no-match.js:
Added.
(foldableTest):
(foldableExec):
* Source/JavaScriptCore/runtime/RegExp.cpp:
(JSC::RegExp::matchConcurrently):
* Source/JavaScriptCore/runtime/RegExpInlines.h:
(JSC::RegExp::matchInline):
Canonical link: https://commits.webkit.org/317231@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
