576828 - Regexp engines disagree on seemingly nonsensical recursive backreference

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

/(z\1){3}/.exec("zzz");

OLD: ["zzz", "z"]
YARR: null

Comment 1

[Steven Levithan]

According to ES 3 and 5's definition of RepeatMatcher (step 4), ["zzz", "z"] (OLD) is correct, and YARR is wrong. If step 4 is skipped (which appears to be what happens for both YARR and IE), /(z\1){3}/ matches "zzzzzz" only (returning ["zzzzzz", "zzz"]).

(Note that, outside of ECMAScript-based regex implementations where backreferences to nonparticipating groups match the empty string, this regex can't match anything.)

Comment 2

[barraclough]

Hi, OOI this seems to be fixed in yarr in ToT WebKit.  Not sure when the fix went in I'm afraid, just thought I'd mention in case it hunting down the change would be an easier way to fix.

cheers,
G.

Comment 3

[Chris Leary [:cdleary] (not checking bugmail)]

Attachment: Add test to suite.

This was fixed by the YARR update (bug 625600). Nice simple test to add to our suite so we can close this out.

Comment 4

[Chris Leary [:cdleary] (not checking bugmail)]

http://hg.mozilla.org/tracemonkey/rev/31a757125589

Comment 5

[Chris Leary [:cdleary] (not checking bugmail)]

http://hg.mozilla.org/mozilla-central/rev/31a757125589