1663243 - replace() using RegEx shorthand \S causes browser tab to hang

Status: RESOLVED DUPLICATE of bug 1391654

(Core :: JavaScript Engine, defect, P3)

Description

[backeschwein]

Attachment: Aufnahme #8.mp4

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.83 Safari/537.36

Steps to reproduce:

Using replace() with the RegEx shorthand \S causes the browser tab to hang. Please use following code:

<script>
let content = "Foo [mono,mark:white]bar[/mark,mono].";
content = content.replace(/[(\S+)?](.?)[/([a-z]+)*?]/gi, '');

document.write('Result: ');
document.write(content);

</script>

Actual results:

Browser tab hangs.

Expected results:

Output of the result.

Comment 1

[Tooru Fujisawa [:arai]]

Because of markdown, the testcase is rendered wrongly.

<script>
let content = "Foo [mono,mark:white]bar[/mark,mono].";
content = content.replace(/\[(\S+)*?](.*?)\[\/([a-z]+)*?]/gi, '');

document.write('Result: ');
document.write(content);
</script>

Comment 2

[backeschwein]

What do you mean by 'markdown'?

Comment 3

[Tooru Fujisawa [:arai]]

This comment field supports Markdown styling, and code should be inside triple backquotes.
https://guides.github.com/features/mastering-markdown/

part of the code in comment #0 is styled as italic, because of asterisk

Comment 4

[backeschwein]

I see, thanks for fixing it for me, I was not aware of it.

Comment 5

[Tooru Fujisawa [:arai]]

\S isn't key part of this issue, but any pattern that matches to all characters in the content can cause this issue.

This seems to cause catastrophic backtracking because of nesting + and *?.
The same happens on chrome, but not on Safari.

For now, I'd suggest simplifying the pattern to something simpler and more deterministic.

Comment 6

[backeschwein]

Yes, this is also present in Chrome, I reported it:
https://bugs.chromium.org/p/chromium/issues/detail?id=1125234

Comment 7

[Tooru Fujisawa [:arai]]

https://bugs.chromium.org/p/chromium/issues/detail?id=1125234#c11

We are currently looking into non-backtracking engine to solve these kinds of issues, see https://crbug.com/v8/10765.

Comment 8

[André Bargull [:anba]]

Closing as a dup of bug 1391654 per comment #5.