Bug 305192

Summary: [JSC] `RegExp.prototype [ %Symbol.split% ]` Incorrectly Uses Fast Path when `limit` is not a Number
Product: WebKit Reporter: Keita Nonaka <iKonnyaku40>
Component: JavaScriptCoreAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal CC: webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Local Build   
Hardware: Unspecified   
OS: Unspecified   

Keita Nonaka
Reported 2026-01-09 04:50:30 PST
`RegExp.prototype [ %Symbol.split% ]` incorrectly uses fast path when `limit` is not a number
Attachments
Keita Nonaka
Comment 1 2026-01-09 04:54:55 PST
Radar WebKit Bug Importer
Comment 2 2026-01-16 04:51:13 PST
EWS
Comment 3 2026-01-20 05:50:12 PST
Committed 305879@main (d21256503ee6): <https://commits.webkit.org/305879@main> Reviewed commits have been landed. Closing PR #56330 and removing active labels.
Note You need to log in before you can comment on or make changes to this bug.