ASSERTION FAILED: subpattern in JSC::Yarr::YarrGenerator<JSC::Yarr::YarrJITDefaultRegisters>::clearSubpatternStart WinCairo 258195@main Debug MiniBrowser reports an assertion failure by loading the following web pages. https://www.asahi.com/ https://www.yomiuri.co.jp/ https://www3.nhk.or.jp/news/ https://www.nikkei.com/ ASSERTION FAILED: subpattern C:\home\webkit\gc\Source\JavaScriptCore\yarr/YarrJIT.cpp(771) : JSC::Yarr::YarrGenerator<struct JSC::Yarr::YarrJITDefaultRegisters>::clearSubpatternStart 1 00007FFB1355248B WTFCrash 2 00007FFAEB1F204E WTFCrashWithInfo 3 00007FFAECE3B39D JSC::Yarr::YarrGenerator<JSC::Yarr::YarrJITDefaultRegisters>::clearSubpatternStart 4 00007FFAECE458DA JSC::Yarr::YarrGenerator<JSC::Yarr::YarrJITDefaultRegisters>::generate 5 00007FFAECE3CB65 JSC::Yarr::YarrGenerator<JSC::Yarr::YarrJITDefaultRegisters>::compile 6 00007FFAECD8A86A JSC::Yarr::jitCompile 7 00007FFAECBB2984 JSC::RegExp::compile 8 00007FFAEBBB2A20 JSC::RegExp::compileIfNecessary 9 00007FFAECBCFA8C JSC::RegExp::matchInline<WTF::Vector<int,0,WTF::CrashOnOverflow,16,WTF::FastMalloc>,0> 10 00007FFAECBB1A6C JSC::RegExp::match 11 00007FFAECC5F400 JSC::RegExpGlobalData::performMatch 12 00007FFAECC3F622 JSC::replaceUsingRegExpSearch 13 00007FFAECC4097A JSC::replaceUsingRegExpSearch 14 00007FFAECC61A33 JSC::replace 15 00007FFAECC2D894 operationStringProtoFuncReplaceGeneric 16 0000018600108DF7 (null)
Regressed by 258195@main (bug#249330)
I confirmed this is reproducible with Mac Debug MiniBrowser.
<rdar://problem/103674725>
Created attachment 464185 [details] test case
Yusuke reverted the offending patch in 258310@main (b396fd875ee3): <https://commits.webkit.org/258310@main> (see https://bugs.webkit.org/show_bug.cgi?id=249855). *** This bug has been marked as a duplicate of bug 249855 ***