Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 44ebe94906dafa251c4d8a96f698e327b17b1614
      
https://github.com/WebKit/WebKit/commit/44ebe94906dafa251c4d8a96f698e327b17b1614
  Author: Sosuke Suzuki <[email protected]>
  Date:   2026-08-24 (Mon, 24 Aug 2026)

  Changed paths:
    A JSTests/microbenchmarks/regexp-lookbehind-lookahead.js
    A JSTests/stress/regexp-lookbehind-jit-lookahead-unicode.js
    A JSTests/stress/regexp-lookbehind-jit-lookahead.js
    M Source/JavaScriptCore/yarr/YarrJIT.cpp

  Log Message:
  -----------
  [YARR] Compile lookbehinds containing lookaheads in JIT
https://bugs.webkit.org/show_bug.cgi?id=322390

Reviewed by Daniel Liu.

A lookbehind containing a lookahead, fell back to the interpreter.

To match backward, the JIT compiles a lookbehind from a copy of its
disjunction tree with the terms reversed and inputPosition renumbered from
the assertion's position. A lookahead inside the lookbehind is still matched
forward, so its terms must not be reversed, but their inputPosition values
come from the parser and continue the pattern-order numbering of the
enclosing alternative, which does not match the reversed numbering the JIT
gave that alternative. Compiling them as-is would read the wrong characters,
so the JIT refused the pattern.

This patch gives such a lookahead the same treatment as a lookbehind: a copy
of its disjunction, kept in match order, with inputPosition renumbered from
0, compiled with a checked offset of 0. The ParentheticalAssertionBegin op
already moves the index to the assertion's position, so the forward code
works unchanged from there.

reverseDisjunctionForBackward() becomes copyDisjunctionInMatchOrder(), which
handles both directions. m_reversedDisjunctions becomes
m_copiedDisjunctions, and its type changes from
Vector<std::unique_ptr<PatternDisjunction>> to Bag<PatternDisjunction>: the
copies are only created and kept alive until the generator is destroyed,
never looked up, so creating them in place lets the function return a plain
pointer instead of passing ownership around.

                                                 Baseline                  
Patched

regexp-lookbehind-lookahead                1411.3836+-12.6421    ^    
174.3478+-4.0373        ^ definitely 8.0952x faster

Tests: JSTests/microbenchmarks/regexp-lookbehind-lookahead.js
       JSTests/stress/regexp-lookbehind-jit-lookahead-unicode.js
       JSTests/stress/regexp-lookbehind-jit-lookahead.js

* JSTests/microbenchmarks/regexp-lookbehind-lookahead.js: Added.
* JSTests/stress/regexp-lookbehind-jit-lookahead-unicode.js: Added.
(shouldBe):
(stringify):
(stringifyIndices):
* JSTests/stress/regexp-lookbehind-jit-lookahead.js: Added.
(shouldBe):
(stringify):
(stringifyIndices):
(shouldBe.stringify):
* Source/JavaScriptCore/yarr/YarrJIT.cpp:

Canonical link: https://commits.webkit.org/319758@main



To unsubscribe from these emails, change your notification settings at 
https://github.com/WebKit/WebKit/settings/notifications

Reply via email to