[Webkit-unassigned] [Bug 178890] New: REGRESSION(r 222601): We fail to properly backtrack into a sub pattern of a parenthesis with non-zero minimum

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=178890

            Bug ID: 178890
           Summary: REGRESSION(r 222601): We fail to properly backtrack
                    into a sub pattern of a parenthesis with non-zero
                    minimum
           Product: WebKit
           Version: Other
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: msaboff at apple.com

A somewhat reduced test case is:
Here is a somewhat reduced test case /:(?:\w)+\(([‘]?)((?:\([^\)]+\)|[^\(\)]*){1,2})\1\)/.exec(“:not('.hs-processed')”)

Prior to r222601, the handling of a greedy parenthesis minimum count during backtracking was always 0, ignoring the actual minimum from the pattern.  In this case, the parenthesized subpattern, ((?:\([^\)]+\)|[^\(\)]*){1,2}, has a minimum count of 1.  Here is a RegExp pattern dump of that part of the expression.

      non-captured subpattern {1,2} greedy,frame location 4
        alternative list,frame location 5
        alternative #0: minimum size: 3
          character inputPosition 3 '('
          not character class inputPosition 4 [ASCII:(')')]
          not character class inputPosition 5 [ASCII:(')')] {0,...} greedy,frame location 1
          character inputPosition 5 ')'
        alternative #1: minimum size: 0
          not character class inputPosition 3 [ASCII:('(',')')] {0,...} greedy,frame location 1

With change r222601, we stop backtracking parenthesis when the match count is equal to the minimum without trying to backtrack the contained sub pattern.  If that sub match fails and we are at the minimum, then we can fail the parenthesis backtracking.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20171026/7a704a25/attachment.html>