tor-browser

commit 1732fe6724fcb0b43eb1735218cef27bb71c1c62
parent a198379dd7110a4fc8445ecb54435f4bcfdfe987
Author: Iain Ireland <iireland@mozilla.com>
Date:   Wed,  7 Jan 2026 17:28:52 +0000

Bug 2008866: Handle v flag correctly in RegExpMatchAll slow path r=dminor

The testcase spins infinitely without this fix.

Drive-by: removed the REGEXP_LEGACY_FEATURES_ENABLED_FLAG code here, which I accidentally let through while reviewing the legacy features patch. It's not necessary here: if we're taking the slow path, then we only look at the global/unicode flags (the spec represents `global` and `unicode` as separate boolean fields). The fast path reuses the flags from the existing regexp in certain cases to lazily copy the input regexp (see [here](https://searchfox.org/firefox-main/rev/33bba5cfe4a89dda0ee07fa9fbac578353713fd3/js/src/builtin/RegExp.js#1402-1406)), but that's irrelevant to the slow path.

Differential Revision: https://phabricator.services.mozilla.com/D278071

Diffstat:
M
js/src/builtin/RegExp.js
 | 
8
+++-----
A
js/src/jit-test/tests/regexp/bug2008866.js
 | 
3
+++

2 files changed, 6 insertions(+), 5 deletions(-)
diff --git a/js/src/builtin/RegExp.js b/js/src/builtin/RegExp.js
@@ -1238,11 +1238,9 @@ function RegExpMatchAll(string) {
     // Steps 9-12.
     flags =
       (callFunction(std_String_includes, flags, "g") ? REGEXP_GLOBAL_FLAG : 0) |
-      (callFunction(std_String_includes, flags, "u") ? REGEXP_UNICODE_FLAG : 0);
-
-      if (C === builtinCtor) {
-      flags |= REGEXP_LEGACY_FEATURES_ENABLED_FLAG;
-      }
+      (callFunction(std_String_includes, flags, "u") ? REGEXP_UNICODE_FLAG : 0) |
+      (callFunction(std_String_includes, flags, "v") ? REGEXP_UNICODESETS_FLAG : 0);
+    
     // Take the non-optimized path.
     lastIndex = REGEXP_STRING_ITERATOR_LASTINDEX_SLOW;
   }
diff --git a/js/src/jit-test/tests/regexp/bug2008866.js b/js/src/jit-test/tests/regexp/bug2008866.js
@@ -0,0 +1,3 @@
+class MyRegExp extends RegExp {}
+let r = new MyRegExp("(?:)", "gv");
+assertEq(Array.from('𠮷'.matchAll(r)).length, 2);