364273 - Regular Expression causes entire Javascript block/file to not be executed

Status: VERIFIED INVALID

(Core :: JavaScript Engine, defect)

Description

[matt.obrien]

User-Agent:       Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8.1) Gecko/20061010 Firefox/2.0
Build Identifier: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8.1) Gecko/20061010 Firefox/2.0

If a regular expression with a syntax error is encountered, the entire script block or included .js file does not execute. The following regexp is will cause the problem in Firefox:
/[^\d-.\/]/

If the dash is moved after the period (/[^\d.-\/]/), the javascript will run correctly. Either form works correctly in other browsers (e.g. IE, Opera).

Output from the javascript shell (not sure what version):
js> var blah = '1a.p2/af3/.ah4-ajf5dio6a=sl;,l7-8-9-0';
js> blah.replace(/[^\d-.\/]/gi, '');
SyntaxError: invalid range in character class

Reproducible: Always

Steps to Reproduce:
1.Open a page that includes a "bad" regexp such as: /[^\d-.\/]/


Actual Results:  
No javascript in the same script block or included file runs.

Expected Results:  
Either the javascript runs until the line with the faulty regular expression is encountered and an error is thrown, or the entire block runs, as it does in other browsers.

Comment 1

[matt.obrien]

Attachment: bug demonstration

Comment 2

[Bob Clary [:bc] (inactive)]

we may care about compatibility above the purity of essence but 

ecma 262 3rd says

15.10.2.15  NonemptyClassRanges

    The production NonemptyClassRanges :: ClassAtom evaluates by evaluating ClassAtom to obtain a CharSet and returning that CharSet.

    The production NonemptyClassRanges :: ClassAtom NonemptyClassRangesNoDash evaluates as follows:

    1. Evaluate ClassAtom to obtain a CharSet A.
    2. Evaluate NonemptyClassRangesNoDash to obtain a CharSet B.
    3. Return the union of CharSets A and B.

    The production NonemptyClassRanges :: ClassAtom - ClassAtom ClassRanges evaluates as follows:

    1. Evaluate the first ClassAtom to obtain a CharSet A.
    2. Evaluate the second ClassAtom to obtain a CharSet B.
    3. Evaluate ClassRanges to obtain a CharSet C.
    4. Call CharacterRange(A, B) and let D be the resulting CharSet.
    5. Return the union of CharSets D and C.

    The internal helper function CharacterRange takes two CharSet parameters A and B and performs the following:

    1. If A does not contain exactly one character or B does not contain exactly  
       one character then throw a SyntaxError exception.
    2. Let a be the one character in CharSet A.
    3. Let b be the one character in CharSet B.
    4. Let i be the code point value of character a.
    5. Let j be the code point value of character b.
    6. If i > j then throw a SyntaxError exception.
       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    7. Return the set containing all characters numbered i through j, inclusive.

Any digit's code point will be greater than the code point of .

'0'.charCodeAt(0) = 48
'.'.charCodeAt(0) = 46

you want /.-\d/

Comment 3

[Brendan Eich [:brendan]]

What do other browsers do, exactly?  That is, what inputs match the invalid (by 3rd Edition ECMA-262's lights) regular expression?

/be

Comment 4

[Brendan Eich [:brendan]]

Comment 0's "Actual results" fails to mention the salient result: an error message in the Error console fingering the faulty line.  That's desired behavior unless we decide to emulate a "quirk" here for some greater interoperation good.  Given the lack of meaning for the faulty regexp, I don't see the greater-good argument, but it could be. With only one report and no TE bugs on file against websites counting on this misfeature, we should stand on the ECMA spec.

/be

Comment 5

[Bob Clary [:bc] (inactive)]

(In reply to comment #3)
IE6 and Opera 9 treat this as a non character range and match the individual characters in the class.

/[\d-.\/]/ as matching a digit, a dash, a period or right slash and /[^\d-.\/]/ as its complement.

Strangely enough, both IE and Opera throw on /[z-a]/

Comment 6

[Bob Clary [:bc] (inactive)]

IE is so weird here that I don't want to try to reverse engineer it.

/[.-\d]/.exec('0')
RegExpError: Invalid range in character set

/[\d-.]/.exec('0')
0

Comment 7

[matt.obrien]

The error wasn't picked up by my FireBug extension; next time I'll check the Error Console as well.

I don't think an exception needs to be made for this type of malformed regular expression. No one mentioned the effect that the entire block of javascript that the bad regular expression resides in goes unexecuted. Is that standard procedure for some classes of errors? I've only encountered errors where execution stops at the line with the error.

Comment 8

[Bob Clary [:bc] (inactive)]

As a SyntaxError we barf when compiling the script. IE barfs when it executes it. Both approaches are allowed by the standard.