Bug 60866
| Summary: | Evaluation order broken for empty alternatives in subpatterns | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Gavin Barraclough <barraclough> |
| Component: | JavaScriptCore | Assignee: | Gavin Barraclough <barraclough> |
| Status: | RESOLVED FIXED | ||
| Severity: | Normal | CC: | ggaren, pvarga, zherczeg |
| Priority: | P2 | ||
| Version: | 528+ (Nightly build) | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Bug Depends on: | 60860 | ||
| Bug Blocks: | |||
Gavin Barraclough
for example:
/(|a)/.exec("a");
should return ["",""], but instead returns ["a","a"].
This was broken by https://bugs.webkit.org/show_bug.cgi?id=51395, which will be reverted (this unsafe optimization does not appear significant to any benchmarks we are tracking, we should reimplement in a more restricted, safe fashion only if we can demonstrate an important workload benefitting from doing so).
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Gavin Barraclough
This unsafe optimization is masking further problems in the JIT, reverting the optimization causes failures in fast/regex/parentheses.
These issues are fixed by 60860.
Geoffrey Garen
rs=me to roll out that optimization with a layout test for
/(|a)/.exec("a")
/(a|)/.exec("b")
Gavin Barraclough
Fixed in r86547.
Zoltan Herczeg
Perhaps a non-greedy conversion? (|a) == a?? (a|) == a?
Gavin Barraclough
Conversion to an appropriately greedy quantifier would be possible, but would limit the scope of this optimization. We would consider such a patch if it were to provide a useful performance gain on an interesting workload.