Closed Bug 31316 Opened 25 years ago Closed 24 years ago

Rhino: Regexp matches return garbage

Categories

(Core :: JavaScript Engine, defect, P3)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
Windows NT
Type:
defect

Tracking

()

Status:
VERIFIED FIXED

People

(Reporter: linus.walleij, Assigned: rogerl)

Details

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; N; NT4.0; en-US; m14)
BuildID:    2000030516

Doing a RegExp match on more than one group simultaneously
(using the | operator) seem to return **** in some fields of the
matched array.


Reproducible: Always
Steps to Reproduce:
1. Run a page with the HTML enclosed below

Actual Results:  An array with garbage at second index is returned

Expected Results:  Like Netscape 4.7 or IE, example in the HTML file.

<html>
<head>
<title>Article blueprint</title>
<script language="JavaScript">
<!--
function testbug()
{
        // Match all start elements, remember the element
	// First alternative: match 1 character, not /,<,>
	//                    match any number of characters, not /,<,>
	//                    match 1 character, not /,<,>
	// ELSE:
	//                    match 1 character, not /,<,>

	MatchRxStart  = /<([^\/<>][^<>]*[^\/])>|<([^\/<>])>/;
	MatchString = "<p>Some<br />test</p>";
        StartElement = MatchRxStart.exec(MatchString);
	alert(StartElement);
}
// -->
</script>
</head>
<body onLoad="testbug()">
<h1>Dummy page, look in the JavaScript Popup window</h1>
<p>Netscape 4.7 returns: '&lt;p&gt;','','p'</p>
<p>Internet Explorer 5 returns: '&lt;p&gt;,'','p'</p>
<p>Mozilla m14 returns: '&lt;p&gt;,'p&gt;','p'</p>
<p>Why the second match? It's no match! It should be blank.</p>
</body>
Nuts, good catch.

The paren state needs to be reset after an alternate fails, here's the patch:

Index: jsregexp.c
===================================================================
RCS file: /m/pub/mozilla/js/src/jsregexp.c,v
retrieving revision 3.23
diff -u -r3.23 jsregexp.c
--- jsregexp.c  2000/02/16 00:49:34     3.23
+++ jsregexp.c  2000/03/11 01:16:23
@@ -1665,8 +1665,12 @@
               ren = (RENode *)ren->kid;
               continue;
           }
+          num = state->parenCount;
           kidMatch = matchRENodes(state, (RENode *)ren->kid, stop, cp);
           if (kidMatch != NULL) return kidMatch;
+          for (i = num; i < state->parenCount; i++)
+              state->parens[i].length = 0;
+          state->parenCount = num;
           break;
         case REOP_QUANT:
           lastKid = NULL;
Status: UNCONFIRMED → ASSIGNED
Ever confirmed: true
Checked in the patch.
Status: ASSIGNED → RESOLVED
Closed: 24 years ago
Resolution: --- → FIXED
Still exists in Rhino. Also - need test case added
Status: RESOLVED → REOPENED
Resolution: FIXED → ---
Summary: Regexp matches return garbage → Rhino: Regexp matches return garbage
passing off to phil for testcase creation
QA Contact: rginda → pschwartau
Rhino fix checked in.
Status: REOPENED → RESOLVED
Closed: 24 years ago → 24 years ago
Resolution: --- → FIXED
Linus' testcase has been added to the JS testsuite: 

       js/tests/ecma_3/RegExp/regress-31316.js

This test passes in the current builds of the debug and optimized JS shell;
marking this bug VERIFIED -
Status: RESOLVED → VERIFIED
Oops, should have noted it's passing in the Rhino shells -
You need to log in before you can comment on or make changes to this bug.