[Webkit-unassigned] [Bug 200190] New: JavaScriptCore's Regex can't match the content.

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=200190

            Bug ID: 200190
           Summary: JavaScriptCore's Regex can't match the content.
           Product: WebKit
           Version: WebKit Local Build
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: nwu_ty at 163.com

Created attachment 375010

  --> https://bugs.webkit.org/attachment.cgi?id=375010&action=review

testcase

#Testcase:
1 var func = function() {
2     var reg = /(.*d.*){5,}/;
3     var str1 = 'adadshare.com/files/61674290/a.a.Third_GG_SG_.partlasPlayground.zip | C:\Documents and Settings';
4     // var str2 = 'adadshare.com/files/61674290/a.a.d_GG_SG_.partlasPlayground.zip | C:\Documents and Settings';
5     print(str1.search(reg));
6     // print(str2.search(reg));
7 };
8 
9 func();

#Command:
./webkit/WebKitBuild/Release/bin/jsc testcase.js

#Output:
-1

#Expected output:
0

#Description:
When executing the above testcase, the expected output should be "0" according to ECMAScript-262 standard. However, JavaScriptCore outputs "-1" while other JS engines such as V8, SpiderMonkey, QuickJS output "0".

And if I remove a few characters from str1(such as replace str1(line3) with str2(line 4)), the error disappears and JavaScriptCore outputs "0" normally. This is so weird that I suspect it's a bug of JavaScriptCore.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20190727/836e502b/attachment-0001.html>