[Webkit-unassigned] [Bug 212725] RegExpConstructor throws invalid ranges out of character classes from specific non-ascii input

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=212725

--- Comment #2 from Yusuke Suzuki <ysuzuki at apple.com> ---
(In reply to Huáng Jùnliàng from comment #0)
> Safari TP 107 throws on the following snippet
> 
> ```js
> // \u1f7c-\u1f7d
> var range = "[ὼ-ώ]";
> var regex = new RegExp(range);
> ```

In the above code, it looks like the range is not `\u1f7c-\u1f7d`.

[..."ὼ-ώ"].map((ch) => ch.charCodeAt(0).toString(16)) // => ["1f7c","2d","3ce"]

Since 0x3ce is smaller than 0x1f7c, this throws a SyntaxError.

I've ensured that the above script throws a SyntaxError in Firefox and Chrome.
So, it seems that this is a minifier's bug.
Can you check the result with the other browsers?

> 
> However it does not throw when the range above is escaped as ascii only:
> 
> ```js
> var range = "[\u1f7c-\u1f7d]";
> var regex = new RegExp(range);
> ```
> 
> While `1f7c` seems random, the following snippet is good.
> 
> ```js
> // \u1f7b-\u1f7c
> var range="[ύ-ὼ]",regex=new RegExp(range);
> ```
> 
> I don't think this issue can be related to recent Unicode version updates
> because \u1f7b - \u1f7d have been available since Unicode 1.1.
> 
> 
> **Context**
> 
> Found this issue when debugging
> https://github.com/babel/website/issues/2254, JSC throws on Babel's ugly
> identifier name detection regex:
> https://github.com/babel/babel/blob/master/packages/babel-helper-validator-
> identifier/src/identifier.js after minified by terser.
> 
> **Related version**
> This issue is also reproducible on Safari Version 13.1.1 (15609.2.9.1.2).

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20200609/d33ceba4/attachment.htm>