Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: bffe36ec16ef0d6db5f2652a670cd2f16e446742
https://github.com/WebKit/WebKit/commit/bffe36ec16ef0d6db5f2652a670cd2f16e446742
Author: Sosuke Suzuki <[email protected]>
Date: 2026-09-26 (Sat, 26 Sep 2026)
Changed paths:
A JSTests/stress/string-regexp-methods-cross-realm-dfg.js
A JSTests/stress/string-regexp-methods-cross-realm.js
M Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
M Source/JavaScriptCore/dfg/DFGOperations.cpp
M Source/JavaScriptCore/runtime/JSRegExpStringIterator.cpp
M Source/JavaScriptCore/runtime/RegExpObject.h
M Source/JavaScriptCore/runtime/RegExpObjectInlines.h
M Source/JavaScriptCore/runtime/RegExpPrototype.cpp
M Source/JavaScriptCore/runtime/RegExpPrototypeInlines.h
M Source/JavaScriptCore/runtime/StringPrototype.cpp
Log Message:
-----------
[JSC] String and RegExp fast paths should not be taken across realms
https://bugs.webkit.org/show_bug.cgi?id=325134
Reviewed by Yusuke Suzuki.
Fix two issues in the same way as 321451@main.
1. String.prototype.match / matchAll / replace / replaceAll / search / split
and RegExp.prototype.test / @@match / @@matchAll / @@search / @@split took
the fast path for a RegExp from another realm, and ran it with the current
realm.
2. DFG inlined these String.prototype and RegExp.prototype functions from
another realm, and ran them with the caller's realm.
Tests: JSTests/stress/string-regexp-methods-cross-realm-dfg.js
JSTests/stress/string-regexp-methods-cross-realm.js
* JSTests/stress/string-regexp-methods-cross-realm-dfg.js: Added.
(shouldBe):
(realmOf):
(realmOfThrownError):
(matchRegExp):
(splitRegExp):
(searchRegExp):
(replaceRegExp):
(otherMatch):
(otherSplit):
(otherSearch):
(otherReplace):
(otherReplaceAll):
(otherTest):
(otherSymbolMatch):
(otherSymbolSearch):
(otherSymbolSplit):
(lastMatches):
* JSTests/stress/string-regexp-methods-cross-realm.js: Added.
(shouldBe):
(realmOf):
(lastMatchAfter):
(regExp):
(withOwnProperty):
(shouldBe.realmOf.string_appeared_here.split.regExp):
(shouldBe.realmOf.prototype.Symbol.split.call.regExp):
(shouldBe.lastMatchAfter.prototype.Symbol.replace.call.regExp.prototype.exec):
(shouldBe.lastMatchAfter.prototype.Symbol.replace.call.regExp.other.RegExp.prototype.exec):
(shouldBe.lastMatchAfter.prototype.Symbol.replace.call.regExp):
* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::handleIntrinsicCall):
* Source/JavaScriptCore/dfg/DFGOperations.cpp:
(JSC::DFG::JSC_DEFINE_JIT_OPERATION):
* Source/JavaScriptCore/runtime/JSRegExpStringIterator.cpp:
(JSC::JSRegExpStringIterator::nextImpl):
* Source/JavaScriptCore/runtime/RegExpObject.h:
* Source/JavaScriptCore/runtime/RegExpObjectInlines.h:
(JSC::RegExpObject::isSymbolMatchFastAndNonObservable):
(JSC::RegExpObject::isSymbolSearchFastAndNonObservable):
(JSC::RegExpObject::isSymbolMatchAllFastAndNonObservable):
(JSC::RegExpObject::isSymbolReplaceFastAndNonObservable):
(JSC::RegExpObject::isSymbolSplitFastAndNonObservable):
* Source/JavaScriptCore/runtime/RegExpPrototype.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION):
(JSC::regExpSearchGeneric):
(JSC::regExpSplitSlow):
* Source/JavaScriptCore/runtime/RegExpPrototypeInlines.h:
(JSC::regExpExecWatchpointIsValid):
* Source/JavaScriptCore/runtime/StringPrototype.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION):
(JSC::stringMatchSlow):
(JSC::stringSearchSlow):
(JSC::stringMatchAllSlow):
Canonical link: https://commits.webkit.org/321990@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
