[Webkit-unassigned] [Bug 212725] New: RegExpConstructor throws invalid ranges out of character classes from specific non-ascii input

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=212725

            Bug ID: 212725
           Summary: RegExpConstructor throws invalid ranges out of
                    character classes from specific non-ascii input
           Product: WebKit
           Version: Safari Technology Preview
          Hardware: Macintosh
                OS: macOS 10.15
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: jlhwung at gmail.com

Safari TP 107 throws on the following snippet

```js
// \u1f7c-\u1f7d
var range = "[ὼ-ώ]";
var regex = new RegExp(range);
```

However it does not throw when the range above is escaped as ascii only:

```js
var range = "[\u1f7c-\u1f7d]";
var regex = new RegExp(range);
```

While `1f7c` seems random, the following snippet is good.

```js
// \u1f7b-\u1f7c
var range="[ύ-ὼ]",regex=new RegExp(range);
```

I don't think this issue can be related to recent Unicode version updates because \u1f7b - \u1f7d have been available since Unicode 1.1.


**Context**

Found this issue when debugging https://github.com/babel/website/issues/2254, JSC throws on Babel's ugly identifier name detection regex: https://github.com/babel/babel/blob/master/packages/babel-helper-validator-identifier/src/identifier.js after minified by terser.

**Related version**
This issue is also reproducible on Safari Version 13.1.1 (15609.2.9.1.2).

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20200604/9d410877/attachment.htm>