Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 8c6275e1441775ef617f65034e8fe99de9e517f5
https://github.com/WebKit/WebKit/commit/8c6275e1441775ef617f65034e8fe99de9e517f5
Author: Sosuke Suzuki <[email protected]>
Date: 2026-07-21 (Tue, 21 Jul 2026)
Changed paths:
A JSTests/stress/regexp-backreference-lone-trail-then-lone-lead.js
M Source/JavaScriptCore/yarr/YarrInterpreter.cpp
Log Message:
-----------
[YARR] `InputStream::reread()` should check the code unit before a trail
surrogate, not after
https://bugs.webkit.org/show_bug.cgi?id=319932
Reviewed by Yusuke Suzuki.
reread() returns errorCodePoint for a trail surrogate whose *following* code
unit is a lead. The error case is a read landing in the middle of a pair, so it
must look at the preceding unit; readCheckedDontAdvance() already does this.
tryConsumeBackReference() rereads the captured text, and errorCodePoint there
fails the backreference unconditionally. Patterns with a lookbehind always run
in the interpreter, so this reproduces with default options:
var unit = "\uDC00\uD800a";
/(?<=^)(...)\1/u.test(unit + unit); // false, should be true
Also move the from + 1 < length check into the lead branch, so that a trail
surrogate at the end of the input is still checked.
Introduced in 280563@main.
Test: JSTests/stress/regexp-backreference-lone-trail-then-lone-lead.js
* JSTests/stress/regexp-backreference-lone-trail-then-lone-lead.js: Added.
(shouldBe):
* Source/JavaScriptCore/yarr/YarrInterpreter.cpp:
(JSC::Yarr::Interpreter::InputStream::reread):
Canonical link: https://commits.webkit.org/317694@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
