Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: b44e00d2f037003c48d578eced64caddf9036dfa
https://github.com/WebKit/WebKit/commit/b44e00d2f037003c48d578eced64caddf9036dfa
Author: Sosuke Suzuki <[email protected]>
Date: 2026-09-08 (Tue, 08 Sep 2026)
Changed paths:
A JSTests/stress/regexp-escape-supplementary.js
M Source/JavaScriptCore/runtime/RegExpConstructor.cpp
Log Message:
-----------
[JSC] `RegExp.escape` should not narrow supplementary code points to 16 bits
https://bugs.webkit.org/show_bug.cgi?id=323642
Reviewed by Yusuke Suzuki.
regExpConstructorEscape reads a whole code point with U16_NEXT but then
classifies it through StringView::contains(char16_t) and isStrWhiteSpace,
which truncate it to its low 16 bits. A supplementary code point whose low
16 bits spell a syntax character, a punctuator, a control character or
whitespace is escaped even though the spec leaves it alone: U+2002A (low 16
bits "*") becomes "\" followed by U+2002A, and U+20009 (low 16 bits "\t")
becomes "\ud840\udc09". With the u or v flag the escaped string then never
matches the input. 56 low-16-bit values in each of the 16 supplementary
planes are affected.
Run the punctuator checks only for ASCII code points and the whitespace and
surrogate checks only for BMP code points, so that a supplementary code
point passes through unchanged. The branch that emitted a surrogate pair
escape is dead after this: nothing in the escape set is supplementary.
Tests: JSTests/stress/regexp-escape-supplementary.js
* JSTests/stress/regexp-escape-supplementary.js: Added.
(shouldBe):
* Source/JavaScriptCore/runtime/RegExpConstructor.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION):
Canonical link: https://commits.webkit.org/320682@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
