Bug 231382

Summary: RegExpExec can't statically prove which of the two structures it will get in AI by just looking at the RegExp*
Product: WebKit Reporter: Saam Barati <saam>
Component: JavaScriptCoreAssignee: Saam Barati <saam>
Status: RESOLVED FIXED    
Severity: Normal CC: ews-watchlist, keith_miller, mark.lam, msaboff, tzagallo, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
patch
none
patch
mark.lam: review+
patch for landing none

Saam Barati
Reported 2021-10-07 11:52:02 PDT
...
Attachments
patch (4.37 KB, patch)
2021-10-07 11:56 PDT, Saam Barati 		no flags
DetailsFormatted DiffDiff
patch (4.42 KB, patch)
2021-10-07 11:58 PDT, Saam Barati 		mark.lam: review+
DetailsFormatted DiffDiff
patch for landing (4.43 KB, patch)
2021-10-08 10:55 PDT, Saam Barati 		no flags
DetailsFormatted DiffDiff
Show Obsolete (2) View All Add attachment proposed patch, testcase, etc.
Saam Barati
Comment 1 2021-10-07 11:56:54 PDT
Created attachment 440519 [details] patch
Saam Barati
Comment 2 2021-10-07 11:57:46 PDT
<rdar://83722151>
Saam Barati
Comment 3 2021-10-07 11:58:30 PDT
Created attachment 440520 [details] patch
Michael Saboff
Comment 4 2021-10-07 12:03:46 PDT
Comment on attachment 440520 [details] patch View in context: https://bugs.webkit.org/attachment.cgi?id=440520&action=review > JSTests/stress/reg-exp-exec-cant-prove-which-structure-it-produces-in-ai.js:6 > + let a = r.exec(/b/); Do you really want to match a RegExp (/b/) with r? Or does that somehow trigger the prior bug? > Source/JavaScriptCore/ChangeLog:9 > + Because of the RegExp.prototype.compile API, we don't know if the RegExp I think you want to change the last "RegExp" in this line to "Match result"
Mark Lam
Comment 5 2021-10-07 14:13:45 PDT
Comment on attachment 440520 [details] patch r=me
Saam Barati
Comment 6 2021-10-08 10:46:55 PDT
Comment on attachment 440520 [details] patch View in context: https://bugs.webkit.org/attachment.cgi?id=440520&action=review >> JSTests/stress/reg-exp-exec-cant-prove-which-structure-it-produces-in-ai.js:6 >> + let a = r.exec(/b/); > > Do you really want to match a RegExp (/b/) with r? Or does that somehow trigger the prior bug? This is just the test the fuzzer came up with. >> Source/JavaScriptCore/ChangeLog:9 >> + Because of the RegExp.prototype.compile API, we don't know if the RegExp > > I think you want to change the last "RegExp" in this line to "Match result" Will fix.
Saam Barati
Comment 7 2021-10-08 10:55:38 PDT
Created attachment 440645 [details] patch for landing
EWS
Comment 8 2021-10-08 12:01:51 PDT
Committed r283818 (242709@main): <https://commits.webkit.org/242709@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 440645 [details].
Saam Barati
Comment 9 2021-10-08 12:33:53 PDT
Comment on attachment 440520 [details] patch View in context: https://bugs.webkit.org/attachment.cgi?id=440520&action=review >>> Source/JavaScriptCore/ChangeLog:9 >>> + Because of the RegExp.prototype.compile API, we don't know if the RegExp >> >> I think you want to change the last "RegExp" in this line to "Match result" > > Will fix. I forgot to do this 🤦‍♂️
Note You need to log in before you can comment on or make changes to this bug.