[regexp] Fix modifiers for ChoiceNodes

pthier · V8 LUCI CQ · commit 72b0e27bd936 · 2025-09-30T00:12:41.000-07:00
Each alternative might modify flags when their sub-graph is emitted. We need to restore flags to the value at the beginning of a ChoiceNode for each alternative. Drive-by: Move regexp-modifiers test out of harmony/ Fixed: 447583670 Change-Id: I9f41e51f34df7659461da0a4fcd28b7e157f52e1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6995181 Reviewed-by: Jakob Linke <jgruber@chromium.org> Commit-Queue: Patrick Thier <pthier@chromium.org> Cr-Commit-Position: refs/heads/main@{#102838}
diff --git a/src/regexp/regexp-compiler.cc b/src/regexp/regexp-compiler.cc
@@ -3238,20 +3238,25 @@ void ChoiceNode::Emit(RegExpCompiler* compiler, Trace* trace) {
   int text_length = FixedLengthLoopLengthForAlternative(&alternatives_->at(0));
   AlternativeGenerationList alt_gens(choice_count, zone());
 
+  // Flags need to be reset to the state of the ChoiceNode at the beginning
+  // of each alternative (in-line and out-of-line), as flags might be modified
+  // when emitting an alternative.
+  RegExpFlags flags = compiler->flags();
   if (choice_count > 1 && text_length != kNodeIsTooComplexForFixedLengthLoops) {
     trace = EmitFixedLengthLoop(compiler, trace, &alt_gens, &preload,
-                                &fixed_length_loop_state, text_length);
+                                &fixed_length_loop_state, text_length, flags);
   } else {
     preload.eats_at_least_ = EmitOptimizedUnanchoredSearch(compiler, trace);
 
-    EmitChoices(compiler, &alt_gens, 0, trace, &preload);
+    EmitChoices(compiler, &alt_gens, 0, trace, &preload, flags);
   }
 
   // At this point we need to generate slow checks for the alternatives where
   // the quick check was inlined.  We can recognize these because the associated
   // label was bound.
   int new_flush_budget = trace->flush_budget() / choice_count;
   for (int i = 0; i < choice_count; i++) {
+    compiler->set_flags(flags);
     AlternativeGeneration* alt_gen = alt_gens.at(i);
     Trace new_trace(*trace);
     // If there are actions to be flushed we have to limit how many times
@@ -3271,7 +3276,7 @@ void ChoiceNode::Emit(RegExpCompiler* compiler, Trace* trace) {
 Trace* ChoiceNode::EmitFixedLengthLoop(
     RegExpCompiler* compiler, Trace* trace, AlternativeGenerationList* alt_gens,
     PreloadState* preload, FixedLengthLoopState* fixed_length_loop_state,
-    int text_length) {
+    int text_length, RegExpFlags flags) {
   RegExpMacroAssembler* macro_assembler = compiler->macro_assembler();
   // Here we have special handling for greedy loops containing only text nodes
   // and other simple nodes.  We call these fixed length loops.  These are
@@ -3298,7 +3303,7 @@ Trace* ChoiceNode::EmitFixedLengthLoop(
 
   // In a fixed length loop there is only one other choice, which is what
   // comes after the greedy quantifer.  Try to match that now.
-  EmitChoices(compiler, alt_gens, 1, new_trace, preload);
+  EmitChoices(compiler, alt_gens, 1, new_trace, preload, flags);
 
   fixed_length_loop_state->BindStepBackwardsLabel(macro_assembler);
   // If we have unwound to the bottom then backtrack.
@@ -3358,7 +3363,7 @@ int ChoiceNode::EmitOptimizedUnanchoredSearch(RegExpCompiler* compiler,
 void ChoiceNode::EmitChoices(RegExpCompiler* compiler,
                              AlternativeGenerationList* alt_gens,
                              int first_choice, Trace* trace,
-                             PreloadState* preload) {
+                             PreloadState* preload, RegExpFlags flags) {
   RegExpMacroAssembler* macro_assembler = compiler->macro_assembler();
   SetUpPreLoad(compiler, trace, preload);
 
@@ -3369,6 +3374,7 @@ void ChoiceNode::EmitChoices(RegExpCompiler* compiler,
   int new_flush_budget = trace->flush_budget() / choice_count;
 
   for (int i = first_choice; i < choice_count; i++) {
+    compiler->set_flags(flags);
     bool is_last = i == choice_count - 1;
     bool fall_through_on_failure = !is_last;
     GuardedAlternative alternative = alternatives_->at(i);
diff --git a/src/regexp/regexp-nodes.h b/src/regexp/regexp-nodes.h
@@ -709,10 +709,10 @@ class ChoiceNode : public RegExpNode {
                              AlternativeGenerationList* alt_gens,
                              PreloadState* preloads,
                              FixedLengthLoopState* fixed_length_loop_state,
-                             int text_length);
+                             int text_length, RegExpFlags flags);
   void EmitChoices(RegExpCompiler* compiler,
                    AlternativeGenerationList* alt_gens, int first_choice,
-                   Trace* trace, PreloadState* preloads);
+                   Trace* trace, PreloadState* preloads, RegExpFlags flags);
 
   // If true, this node is never checked at the start of the input.
   // Allows a new trace to start with at_start() set to false.
diff --git a/test/mjsunit/regexp-modifiers.js b/test/mjsunit/regexp-modifiers.js
@@ -51,6 +51,11 @@ test(/F(?i:oo(?-i:b)a)r/, ['Foobar', 'FoObAr'], ['FooBar', 'FoobaR']);
 test(/F(?i:oo(?i:b)a)r/, ['Foobar', 'FoObAr', 'FOOBAr'], ['FoobaR']);
 test(/^[a-z](?-i:[a-z])$/i, ['ab', 'Ab'], ['aB']);
 test(/^(?i:[a-z])[a-z]$/, ['ab', 'Ab'], ['aB']);
+test(/(?i:foo|bar)/, ['FOO', 'FOo', 'Foo', 'fOO', 'BAR', 'BAr', 'Bar', 'bAR']);
+test(/(?i:foo|bar|baz)/, [
+  'FOO', 'FOo', 'Foo', 'fOO', 'BAR', 'BAr', 'Bar', 'bAR', 'BAZ', 'BAz', 'Baz',
+  'bAZ'
+]);
 test(
     /Foo(?i:B[\q{ĀĂĄ|AaA}--\q{āăą}])r/v, ['FooBaaar', 'FoobAAAr'],
     ['FooBĀĂĄr', 'FooBaaaR']);
