From de11d56041d5aa9c5e69b031990ad17068dbef7a Mon Sep 17 00:00:00 2001
From: pthier <[email protected]>
Date: Thu, 09 Jul 2026 17:00:27 +0200
Subject: [PATCH] [regexp] Hard Check that index + 1 is a Smi in AdvanceStringIndex

Bug: 532595489
Change-Id: I3fb2a3246ebbf801b883cc9fe22a7903cf7b1edd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8070079
Reviewed-by: Jakob Linke <[email protected]>
Commit-Queue: Patrick Thier <[email protected]>
Auto-Submit: Patrick Thier <[email protected]>
Cr-Commit-Position: refs/heads/main@{#108562}
---

diff --git a/src/builtins/builtins-regexp-gen.cc b/src/builtins/builtins-regexp-gen.cc
index b371c20..be445c3 100644
--- a/src/builtins/builtins-regexp-gen.cc
+++ b/src/builtins/builtins-regexp-gen.cc
@@ -1603,7 +1603,8 @@
     // Must be in Smi range on the fast path. We control the value of {index}
     // on all call-sites and can never exceed the length of the string.
     static_assert(String::kMaxLength + 2 < Smi::kMaxValue);
-    CSA_DCHECK(this, TaggedIsPositiveSmi(index_plus_one));
+    // TODO(532595489): Hard CHECK for now as a quick fix.
+    CSA_CHECK(this, TaggedIsPositiveSmi(index_plus_one));
   }
 
   Label if_isunicode(this), out(this);
diff --git a/test/mjsunit/mjsunit.status b/test/mjsunit/mjsunit.status
index 0606336..0d1d12a 100644
--- a/test/mjsunit/mjsunit.status
+++ b/test/mjsunit/mjsunit.status
@@ -86,6 +86,9 @@
   # https://crbug.com/485267831
   'regress/regress-485267831': [SKIP],
 
+  # https://crbug.com/532595489
+  'regress/regress-532595489': [FAIL, CRASH, NO_VARIANTS, ['not pointer_compression', SKIP]],
+
   ##############################################################################
   # Tests where variants make no sense.
   'd8/enable-tracing': [PASS, NO_VARIANTS],
diff --git a/test/mjsunit/regress/regress-532595489.js b/test/mjsunit/regress/regress-532595489.js
new file mode 100644
index 0000000..c80f7e0
--- /dev/null
+++ b/test/mjsunit/regress/regress-532595489.js
@@ -0,0 +1,17 @@
+// Copyright 2026 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const re = /(?:)/;
+
+function Species() {
+  return re;
+}
+
+const pseudo_re = {
+  flags: 'g',
+  lastIndex: 1073741823,
+  constructor: { [Symbol.species]: Species },
+};
+
+RegExp.prototype[Symbol.matchAll].call(pseudo_re, '').next();

diff --git a/test/mjsunit/mjsunit.status b/test/mjsunit/mjsunit.status
index 0606336..0d1d12a 100644
--- a/test/mjsunit/mjsunit.status
+++ b/test/mjsunit/mjsunit.status
@@ -86,6 +86,9 @@
   # https://crbug.com/485267831
   'regress/regress-485267831': [SKIP],
 
+  # https://crbug.com/532595489
+  'regress/regress-532595489': [FAIL, CRASH, NO_VARIANTS, ['not pointer_compression', SKIP]],
+
   ##############################################################################
   # Tests where variants make no sense.
   'd8/enable-tracing': [PASS, NO_VARIANTS],
diff --git a/test/mjsunit/regress/regress-532595489.js b/test/mjsunit/regress/regress-532595489.js
new file mode 100644
index 0000000..c80f7e0
--- /dev/null
+++ b/test/mjsunit/regress/regress-532595489.js
@@ -0,0 +1,17 @@
+// Copyright 2026 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const re = /(?:)/;
+
+function Species() {
+  return re;
+}
+
+const pseudo_re = {
+  flags: 'g',
+  lastIndex: 1073741823,
+  constructor: { [Symbol.species]: Species },
+};
+
+RegExp.prototype[Symbol.matchAll].call(pseudo_re, '').next();