[Webkit-unassigned] [Bug 21232] RegExp.prototype.test bug with '@'

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=21232


barraclough at apple.com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED




------- Comment #2 from barraclough at apple.com  2008-09-30 09:22 PDT -------
There are two problems here, relating to the handling of hyphens in character
ranges.

(1) In order to prevent [a\-c] from being treated as [a-c], we're forcing a
flush after the hyphen has been added to the class.  Unfortunately this will
give incorrect behaviour on the regexp [\--@], which should generate the range
'-'..'@', but instead due to the flush will add '-' twice and '@' once to the
class, all treated as separate characters.  The easy solution looks like it
would be to flush prior to adding '\-' to the class, but this is also
incorrect, since [+-\-] would now add separate characters rather than a range. 
In order to prevent '\-' as being treated as a regular '-', but to still allow
it itself to be a part of a range, we should flush the class under construction
before adding the hyphen only if m_isPendingDash is not already set (since if
m_isPendingDash is set this is a range, and the escaped hyphen is the last
character in the range).

(2) The second bug is that we're not reseting m_isPendingDash when we flush. 
So, given the regular expression [oh-\shoot, we'll add the 'o', be in a state
that the 'h' and the hyphen are pending, when we see the character class next
we'll flush, adding the 'h' and the hyphen, putting ourselves in an illegal
state where m_isPendingDash is set but m_charBuffer isn't.  When the subsequent
'h' and 'o' are added to the set these will be treated as a range, since
m_isPendingDash was not cleared.  This bug is not restricted to escaped hypens,
and can be defended against will an assert when adding new chars that we're not
in a state with m_isPendingDash set but not m_charBuffer.

In combination, the bug in this specific regexp is that the range '+'..'E' is
getting added to the class.

patch coming.


-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.