Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: e6d0f57f8d04cafcc07b9f35be0a9212b0745d04
https://github.com/WebKit/WebKit/commit/e6d0f57f8d04cafcc07b9f35be0a9212b0745d04
Author: Sosuke Suzuki <[email protected]>
Date: 2026-06-05 (Fri, 05 Jun 2026)
Changed paths:
A JSTests/stress/regexp-string-list-empty-alternative.js
M Source/JavaScriptCore/yarr/YarrPattern.cpp
Log Message:
-----------
[YARR] String list fast path drops a non-final empty alternative
https://bugs.webkit.org/show_bug.cgi?id=316288
Reviewed by Yusuke Suzuki.
A regex like /^(?:c||b)/ matched against "bccc" returned "b" under the
RegExp JIT instead of the empty string. The JIT "string list" fast path
plants each alternative's success jump off its character comparisons, so
an empty alternative emits no jump and execution falls through into the
next alternative as if the empty one had failed. The interpreter and the
spec match the empty alternative and return a zero-length match.
Without a trailing end-of-line anchor a string list is terminal: the
first empty alternative always matches and ends the overall match, so any
alternatives after it are unreachable. Drop them while building the
pattern, which leaves the empty alternative last so the JIT matches it via
its existing fall-through success path. Alternatives after an empty one
are kept when the list is end-of-line anchored, since there the empty
alternative does not guarantee an overall match.
* JSTests/stress/regexp-string-list-empty-alternative.js: Added.
* Source/JavaScriptCore/yarr/YarrPattern.cpp:
(JSC::Yarr::YarrPatternConstructor::checkForTerminalParentheses):
Canonical link: https://commits.webkit.org/314686@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
