Bug 267011 – [JSC] RegExp /u flag doesn't respect atomicity of surrogate pairs

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Alexey Shvayka]

Simple test case: /\uDC9A$/u.exec("a💚") // \uDC9A being a trailing surrogate of 💚
Expected: null
Actual: matches \uDC9A

The bug is observed in both JIT and Interpreter, anywhere we match characters (another good example is negated character classes).
Current logic allows us to end up in-between trailing and leading surrogate, producing false matches.

Related test262 failures:
  * test/built-ins/RegExp/prototype/Symbol.search/u-lastindex-advance.js
  * test/built-ins/RegExp/prototype/Symbol.split/u-lastindex-adv-thru-failure.js
  * test/built-ins/RegExp/prototype/exec/u-lastindex-adv.js
  * test/language/literals/regexp/u-astral-char-class-invert.js

[Radar WebKit Bug Importer]

<rdar://problem/120391451>

[Michael Saboff]

Pull request: https://github.com/WebKit/WebKit/pull/22631

[EWS]

Committed 272928@main (584a9a820ab2): <https://commits.webkit.org/272928@main>

Reviewed commits have been landed. Closing PR #22631 and removing active labels.

[Alexey Shvayka]

*** Bug 205477 has been marked as a duplicate of this bug. ***

[Michael Saboff]

The fix in 272928@main regressed performance in JetStream2 / UniPoker.  Rolling this out to address the performance regression.

[Michael Saboff]

Fix with performance regression reverted in 273081@main (9d426c6ff391): <https://commits.webkit.org/273081@main>

[Brent Fulgham]

This is now being tracked as:
<rdar://124217243>

[Michael Saboff]

Pull request: https://github.com/WebKit/WebKit/pull/25793

[EWS]

Committed 276031@main (67969c218ddf): <https://commits.webkit.org/276031@main>

Reviewed commits have been landed. Closing PR #25793 and removing active labels.