1700451 - Regular expression quantifier should not apply to assertions

Status: RESOLVED INVALID

(Core :: JavaScript Engine, defect, P3)

Description

[robert]

User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:86.0) Gecko/20100101 Firefox/86.0

Steps to reproduce:

The following JavaScript was run:

/a(?!b)*/.test('ab')

Actual results:

expression evaluates to 'true'

Expected results:

expected throwing "SyntaxError: nothing to repeat" as is the case with /a**/

When consulting the ECMAScript 2020 Language Specification [1], it appears that a Quantifier (ie, *) can only follow an Atom - but an Assertion is not an Atom.

[1] https://262.ecma-international.org/11.0/#sec-regexp-regular-expression-objects

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::JavaScript Engine' component, and is moving the bug to that component. Please revert this change in case you think the bot is wrong.

Comment 2

[Iain Ireland [:iain]]

Thanks for the report! Nice catch!

Regexp parsing is implemented in irregexp, which we share with V8. I confirmed that Chrome also allows this regexp. It looks like this was intentional:

  // For compatibility with JSC and ES3, we allow quantifiers after
  // lookaheads, and break in all cases.
  break;

(The comment predates lookbehinds, but they appear to be allowed as well.)

The original patch is almost ten years old, so it's likely that quantified assertions are web reality at this point (in the sense that starting to throw SyntaxErrors could break websites). Maybe we should update the specification.

Comment 3

[Iain Ireland [:iain]]

Andre Bargull points out that this is already documented in Annex B as being permitted in non-Unicode regexps.