Bug 231382 - RegExpExec can't statically prove which of the two structures it will get in AI by just looking at the RegExp*
Summary: RegExpExec can't statically prove which of the two structures it will get in ...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Saam Barati
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2021-10-07 11:52 PDT by Saam Barati
Modified: 2021-10-08 12:33 PDT (History)
6 users (show)

See Also:

Attachments
patch (4.37 KB, patch)
2021-10-07 11:56 PDT, Saam Barati 		no flags Details | Formatted Diff | Diff
patch (4.42 KB, patch)
2021-10-07 11:58 PDT, Saam Barati 		mark.lam: review+
Details | Formatted Diff | Diff
patch for landing (4.43 KB, patch)
2021-10-08 10:55 PDT, Saam Barati 		no flags Details | Formatted Diff | Diff
Show Obsolete (2) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Saam Barati 2021-10-07 11:52:02 PDT 
...
Comment 1 Saam Barati 2021-10-07 11:56:54 PDT 
Created attachment 440519 [details]
patch
Comment 2 Saam Barati 2021-10-07 11:57:46 PDT 
<rdar://83722151>
Comment 3 Saam Barati 2021-10-07 11:58:30 PDT 
Created attachment 440520 [details]
patch
Comment 4 Michael Saboff 2021-10-07 12:03:46 PDT 
Comment on attachment 440520 [details]
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=440520&action=review

> JSTests/stress/reg-exp-exec-cant-prove-which-structure-it-produces-in-ai.js:6
> +    let a = r.exec(/b/);

Do you really want to match a RegExp (/b/) with r?  Or does that somehow trigger the prior bug?

> Source/JavaScriptCore/ChangeLog:9
> +        Because of the RegExp.prototype.compile API, we don't know if the RegExp

I think you want to change the last "RegExp" in this line to "Match result"
Comment 5 Mark Lam 2021-10-07 14:13:45 PDT 
Comment on attachment 440520 [details]
patch

r=me
Comment 6 Saam Barati 2021-10-08 10:46:55 PDT 
Comment on attachment 440520 [details]
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=440520&action=review

>> JSTests/stress/reg-exp-exec-cant-prove-which-structure-it-produces-in-ai.js:6
>> +    let a = r.exec(/b/);
> 
> Do you really want to match a RegExp (/b/) with r?  Or does that somehow trigger the prior bug?

This is just the test the fuzzer came up with.

>> Source/JavaScriptCore/ChangeLog:9
>> +        Because of the RegExp.prototype.compile API, we don't know if the RegExp
> 
> I think you want to change the last "RegExp" in this line to "Match result"

Will fix.
Comment 7 Saam Barati 2021-10-08 10:55:38 PDT 
Created attachment 440645 [details]
patch for landing
Comment 8 EWS 2021-10-08 12:01:51 PDT 
Committed r283818 (242709@main): <https://commits.webkit.org/242709@main>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 440645 [details].
Comment 9 Saam Barati 2021-10-08 12:33:53 PDT 
Comment on attachment 440520 [details]
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=440520&action=review

>>> Source/JavaScriptCore/ChangeLog:9
>>> +        Because of the RegExp.prototype.compile API, we don't know if the RegExp
>> 
>> I think you want to change the last "RegExp" in this line to "Match result"
> 
> Will fix.

I forgot to do this 🤦‍♂️