Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: ae0a88e6c1a7b79fe470e6fdd0a7d4ef93018156
https://github.com/WebKit/WebKit/commit/ae0a88e6c1a7b79fe470e6fdd0a7d4ef93018156
Author: Sosuke Suzuki <[email protected]>
Date: 2026-09-17 (Thu, 17 Sep 2026)
Changed paths:
A
JSTests/stress/regexp-lookbehind-named-backreference-to-last-opened-group.js
M Source/JavaScriptCore/yarr/YarrPattern.cpp
Log Message:
-----------
[YARR] `\k<name>` in a lookbehind matches empty when the group was opened last
https://bugs.webkit.org/show_bug.cgi?id=324402
Reviewed by Yusuke Suzuki.
/(?<n>.)..(?<=\k<n>.)/.exec("abc") returns a match instead of null. A named
back reference inside a lookbehind is queued as a forward reference and
resolved when the lookbehind is closed. atomNamedBackReference() stored
m_numSubpatterns in the term, and the resolver discarded the reference when
the named group's id was equal to that value. This also holds for a group
that was closed before the lookbehind if it is the last group opened so far,
so a valid reference became an empty match. Numbered references do not go
through this comparison.
Remove the comparison and the stored value, and always convert the term to a
named back reference. A reference from inside its own unclosed group is
already turned into a forward reference before it is queued, and a reference
to a group that has not captured yet matches empty at run time.
Test:
JSTests/stress/regexp-lookbehind-named-backreference-to-last-opened-group.js
* JSTests/stress/regexp-lookbehind-named-backreference-to-last-opened-group.js:
Added.
(shouldBe):
(matchOf):
* Source/JavaScriptCore/yarr/YarrPattern.cpp:
(JSC::Yarr::YarrPatternConstructor::tryConvertingForwardReferencesToBackreferences):
(JSC::Yarr::YarrPatternConstructor::atomNamedBackReference):
Canonical link: https://commits.webkit.org/321355@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
