[JSC] DFG strength reduction folds a compiler-thread RegExp execution failure into a definite no-match#69438
Open
sosukesuzuki wants to merge 1 commit into
Open
Conversation
… failure into a definite no-match https://bugs.webkit.org/show_bug.cgi?id=319452 Reviewed by NOBODY (OOPS!). 313689@main made RegExp bytecode compilation mutator-only: when Yarr JIT code returns JITCodeFailure on a compiler thread and no bytecode exists, matchInline bails out with -1 / MatchResult::failed(). That bail is indistinguishable from a real no-match. If a RegExp only ever runs via the Yarr JIT (so bytecode is never compiled) and the JIT stack check fails against the small compiler-thread stack, matchConcurrently reports an authoritative no-match and DFG strength reduction permanently folds exec to null and test to false, even though the mutator matches successfully. This patch keeps the JITCodeFailure sentinel on the bail path and makes matchConcurrently return false for it, so strength reduction gives up folding and defers to runtime. const re = new RegExp("^" + "a?".repeat(30000) + "$"); function f() { return re.test("a"); } // After DFG tier-up, f() returns false forever; direct re.test("a") is true. Test: JSTests/stress/dfg-strength-reduction-regexp-jit-code-failure-not-no-match.js * JSTests/stress/dfg-strength-reduction-regexp-jit-code-failure-not-no-match.js: Added. (foldableTest): (foldableExec): * Source/JavaScriptCore/runtime/RegExp.cpp: (JSC::RegExp::matchConcurrently): * Source/JavaScriptCore/runtime/RegExpInlines.h: (JSC::RegExp::matchInline):
Collaborator
|
EWS run on current version of this PR (hash a27da05) Details |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🧪 api-mac
🧪 api-ios
a27da05
a27da05