509036 - ArrayIndexOutOfBoundsException thrown in regexp.NativeRegExp.parseTerm when regex pattern includes a group (()) and ends with brace ({)

Status: RESOLVED FIXED

(Rhino Graveyard :: Core, defect)

Description

[Adam Krouskop]

User-Agent:       Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.0.13) Gecko/2009080316 Ubuntu/8.10 (intrepid) Firefox/3.0.13
Build Identifier: Rhino 1.7 release 2 2009 03 22

When defining a regular expression literal that includes a grouping construct and which ends with an opening curly brace, a is thrown at

Reproducible: Always

Steps to Reproduce:
Attempt to use regex literal /(){/
Actual Results:  
$ rhino
Rhino 1.7 release 2 2009 03 22
js> /(){/
Exception in thread "main" java.lang.ArrayIndexOutOfBoundsException: 3
	at org.mozilla.javascript.regexp.NativeRegExp.parseTerm(NativeRegExp.java:1085)
	at org.mozilla.javascript.regexp.NativeRegExp.parseAlternative(NativeRegExp.java:483)
	at org.mozilla.javascript.regexp.NativeRegExp.parseDisjunction(NativeRegExp.java:444)
	at org.mozilla.javascript.regexp.NativeRegExp.compileRE(NativeRegExp.java:311)
	at org.mozilla.javascript.regexp.RegExpImpl.compileRegExp(RegExpImpl.java:53)
	at org.mozilla.javascript.Interpreter.generateRegExpLiterals(Interpreter.java:657)
	at org.mozilla.javascript.Interpreter.generateICodeFromTree(Interpreter.java:562)
	at org.mozilla.javascript.Interpreter.compile(Interpreter.java:504)
	at org.mozilla.javascript.Context.compileImpl(Context.java:2391)
	at org.mozilla.javascript.Context.compileString(Context.java:1359)
	at org.mozilla.javascript.Context.compileString(Context.java:1348)
	at org.mozilla.javascript.tools.shell.Main.loadScriptFromSource(Main.java:495)
	at org.mozilla.javascript.tools.shell.Main.processSource(Main.java:421)
	at org.mozilla.javascript.tools.shell.Main.processFiles(Main.java:196)
	at org.mozilla.javascript.tools.shell.Main$IProxy.run(Main.java:117)
	at org.mozilla.javascript.Context.call(Context.java:515)
	at org.mozilla.javascript.ContextFactory.call(ContextFactory.java:507)
	at org.mozilla.javascript.tools.shell.Main.exec(Main.java:179)
	at org.mozilla.javascript.tools.shell.Main.main(Main.java:157)


Expected Results:  
Expression should produce a RegEx object, with no exception thrown.

Comment 1

[Hannes Wallnoefer]

Fixed in git master:

https://github.com/mozilla/rhino/commit/016b980ffa9aac2ec36b209cae32e26d1d64746a

Comment 2

[Klaus Rennecke]

This fix is incomplete: it does not catch cases where there is a digit after the open brace. See also: https://github.com/mozilla/rhino/pull/102