Skip to content

[JSC] DFG strength reduction folds a compiler-thread RegExp execution failure into a definite no-match#69438

Open
sosukesuzuki wants to merge 1 commit into
WebKit:mainfrom
sosukesuzuki:eng/dfg-regexp-fold-jit-code-failure
Open

[JSC] DFG strength reduction folds a compiler-thread RegExp execution failure into a definite no-match#69438
sosukesuzuki wants to merge 1 commit into
WebKit:mainfrom
sosukesuzuki:eng/dfg-regexp-fold-jit-code-failure

Conversation

@sosukesuzuki

@sosukesuzuki sosukesuzuki commented Jul 15, 2026

Copy link
Copy Markdown
Contributor

a27da05

[JSC] DFG strength reduction folds a compiler-thread RegExp execution failure into a definite no-match
https://bugs.webkit.org/show_bug.cgi?id=319452

Reviewed by NOBODY (OOPS!).

313689@main made RegExp bytecode compilation mutator-only: when Yarr JIT code returns
JITCodeFailure on a compiler thread and no bytecode exists, matchInline bails out with
-1 / MatchResult::failed().

That bail is indistinguishable from a real no-match. If a RegExp only ever runs via the
Yarr JIT (so bytecode is never compiled) and the JIT stack check fails against the small
compiler-thread stack, matchConcurrently reports an authoritative no-match and DFG
strength reduction permanently folds exec to null and test to false, even though the
mutator matches successfully.

This patch keeps the JITCodeFailure sentinel on the bail path and makes matchConcurrently
return false for it, so strength reduction gives up folding and defers to runtime.

    const re = new RegExp("^" + "a?".repeat(30000) + "$");
    function f() { return re.test("a"); }
    // After DFG tier-up, f() returns false forever; direct re.test("a") is true.

Test: JSTests/stress/dfg-strength-reduction-regexp-jit-code-failure-not-no-match.js

* JSTests/stress/dfg-strength-reduction-regexp-jit-code-failure-not-no-match.js: Added.
(foldableTest):
(foldableExec):
* Source/JavaScriptCore/runtime/RegExp.cpp:
(JSC::RegExp::matchConcurrently):
* Source/JavaScriptCore/runtime/RegExpInlines.h:
(JSC::RegExp::matchInline):

a27da05

Misc iOS, visionOS, tvOS & watchOS macOS Linux Windows
✅ 🧪 style ✅ 🛠 ios ✅ 🛠 mac ✅ 🛠 wpe ✅ 🛠 win
✅ 🛠 ios-sim ✅ 🛠 mac-AS-debug ✅ 🧪 wpe-wk2 ⏳ 🧪 win-tests
✅ 🧪 webkitperl ✅ 🧪 ios-wk2 loading 🧪 api-mac ✅ 🧪 api-wpe
✅ 🧪 ios-wk2-wpt ⏳ 🧪 api-mac-debug ✅ 🛠 gtk3-libwebrtc
✅ 🧪 jsc-x86-64 loading-orange 🧪 api-ios ✅ 🧪 mac-wk2 ✅ 🛠 gtk
✅ 🛠 🧪 jsc-debug-arm64 ⏳ 🛠 ios-safer-cpp ⏳ 🧪 mac-AS-debug-wk2 ✅ 🧪 gtk-wk2
✅ 🛠 vision ✅ 🧪 api-gtk
✅ 🛠 vision-sim ⏳ 🧪 mac-intel-wk2 ⏳ 🛠 playstation
✅ 🧪 vision-wk2 ⏳ 🛠 mac-safer-cpp ✅ 🛠 jsc-armv7
✅ 🛠 tv ❌ 🧪 mac-site-isolation ✅ 🧪 jsc-armv7-tests
✅ 🛠 tv-sim
✅ 🛠 watch
✅ 🛠 watch-sim

… failure into a definite no-match

https://bugs.webkit.org/show_bug.cgi?id=319452

Reviewed by NOBODY (OOPS!).

313689@main made RegExp bytecode compilation mutator-only: when Yarr JIT code returns
JITCodeFailure on a compiler thread and no bytecode exists, matchInline bails out with
-1 / MatchResult::failed().

That bail is indistinguishable from a real no-match. If a RegExp only ever runs via the
Yarr JIT (so bytecode is never compiled) and the JIT stack check fails against the small
compiler-thread stack, matchConcurrently reports an authoritative no-match and DFG
strength reduction permanently folds exec to null and test to false, even though the
mutator matches successfully.

This patch keeps the JITCodeFailure sentinel on the bail path and makes matchConcurrently
return false for it, so strength reduction gives up folding and defers to runtime.

    const re = new RegExp("^" + "a?".repeat(30000) + "$");
    function f() { return re.test("a"); }
    // After DFG tier-up, f() returns false forever; direct re.test("a") is true.

Test: JSTests/stress/dfg-strength-reduction-regexp-jit-code-failure-not-no-match.js

* JSTests/stress/dfg-strength-reduction-regexp-jit-code-failure-not-no-match.js: Added.
(foldableTest):
(foldableExec):
* Source/JavaScriptCore/runtime/RegExp.cpp:
(JSC::RegExp::matchConcurrently):
* Source/JavaScriptCore/runtime/RegExpInlines.h:
(JSC::RegExp::matchInline):
@sosukesuzuki sosukesuzuki requested a review from a team as a code owner July 15, 2026 02:01
@sosukesuzuki sosukesuzuki self-assigned this Jul 15, 2026
@sosukesuzuki sosukesuzuki added the JavaScriptCore For bugs in JavaScriptCore, the JS engine used by WebKit, other than kxmlcore issues. label Jul 15, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

JavaScriptCore For bugs in JavaScriptCore, the JS engine used by WebKit, other than kxmlcore issues.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants