[webkit-changes] [WebKit/WebKit] 584a9a: [JSC] RegExp /u flag doesn't respect atomicity of ...

[Michael Saboff]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 584a9a820ab2d2408314858daaccc8a9f01f6c56
      https://github.com/WebKit/WebKit/commit/584a9a820ab2d2408314858daaccc8a9f01f6c56
  Author: Michael Saboff <msaboff at apple.com>
  Date:   2024-01-11 (Thu, 11 Jan 2024)

  Changed paths:
    A JSTests/stress/regexp-unicode-dangling-surrogates.js
    M JSTests/test262/expectations.yaml
    M Source/JavaScriptCore/yarr/YarrInterpreter.cpp
    M Source/JavaScriptCore/yarr/YarrJIT.cpp

  Log Message:
  -----------
  [JSC] RegExp /u flag doesn't respect atomicity of surrogate pairs
https://bugs.webkit.org/show_bug.cgi?id=267011
rdar://120391451

Reviewed by Alexey Shvayka.

Fixed bug where a dangling surrogate in a pattern matches half a valid surrogate pair in a subject string.
Updated the reading of surrogates that when we read starting in the middle of a valid surrogate pair, we return an error
codepoint which we never match.  Updated backtracking for non-greedy character class matching to use the start index
as the appropriate index to reset when we fail to match, instead of doing math with the current match count.

Added a new test and updated the Test262 expections file.

* JSTests/stress/regexp-unicode-dangling-surrogates.js: Added.
(arrayToString):
(objectToString):
(dumpValue):
(compareArray):
(compareGroups):
(testRegExp):
(testRegExpSyntaxError):
* JSTests/test262/expectations.yaml:
* Source/JavaScriptCore/yarr/YarrInterpreter.cpp:
(JSC::Yarr::Interpreter::InputStream::readChecked):
* Source/JavaScriptCore/yarr/YarrJIT.cpp:

Canonical link: https://commits.webkit.org/272928@main