[Webkit-unassigned] [Bug 246274] New: String.prototype.replace should not take fast path if the pattern is RegExp Object and the lastIndex is not numeric

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Mon Oct 10 04:52:57 PDT 2022


https://bugs.webkit.org/show_bug.cgi?id=246274

            Bug ID: 246274
           Summary: String.prototype.replace should not take fast path if
                    the pattern is RegExp Object and the lastIndex is not
                    numeric
           Product: WebKit
           Version: WebKit Local Build
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: entryhii at gmail.com

for (let i = 0; i < 3000; ++i) {
  let r = /abcd/;
  regexLastIndex = {};
  regexLastIndex.toString = function () {
    print(i)
    return "1";
  };
  r.lastIndex = regexLastIndex;
  "test".replace(r, "cons")
}

With the above script as input to JSC, run JSC with the following parameters:
./jsc test.js --useConcurrentJIT=0

This bug is similar to 191731, but they are different. The above js scripts should print 0-2999, but jsc only prints 0-2209.

In DFGBytecodeParser, replace is inlined into StringReplace node. In DFGStrengthReduction, StringReplace is converted to Identity.
So after DFG, lastIndex is no longer read and updated. Therefore, regexLastIndex.toString is no longer invoked.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20221010/24e2fa67/attachment-0001.htm>


More information about the webkit-unassigned mailing list