[Webkit-unassigned] [Bug 267011] New: [JSC] RegExp /u flag doesn't respect atomicity of surrogate pairs

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=267011

            Bug ID: 267011
           Summary: [JSC] RegExp /u flag doesn't respect atomicity of
                    surrogate pairs
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: ashvayka at apple.com

Simple test case: /\uDC9A$/u.exec("a��") // \uDC9A being a trailing surrogate of ��
Expected: null
Actual: matches \uDC9A

The bug is observed in both JIT and Interpreter, anywhere we match characters (another good example is negated character classes).
Current logic allows us to end up in-between trailing and leading surrogate, producing false matches.

Related test262 failures:
  * test/built-ins/RegExp/prototype/Symbol.search/u-lastindex-advance.js
  * test/built-ins/RegExp/prototype/Symbol.split/u-lastindex-adv-thru-failure.js
  * test/built-ins/RegExp/prototype/exec/u-lastindex-adv.js
  * test/language/literals/regexp/u-astral-char-class-invert.js

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20240103/9062df6a/attachment.htm>