898823 - JavaScript `'cdefg'.match(/.?e.?/)` returns "cdefg"

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[joe.farro]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:23.0) Gecko/20100101 Firefox/23.0 (Beta/Release)
Build ID: 20130725195523

Steps to reproduce:

Execute the following JavaScript in the Scratchpad:

var result = 'cdefg'.match(/.e.?/);

Object.keys(result).forEach(function(key) {
    console.log(key + ':', result[key]);
});


Actual results:

result is:
--
[03:34:47.861] "0:" "cdefg"
[03:34:47.861] "index:" 0
[03:34:47.861] "input:" "cdefg"


Expected results:

result is:
--
[03:35:14.657] "0:" "def"
[03:35:14.657] "index:" 1
[03:35:14.657] "input:" "cdefg"

Comment 1

[joe.farro]

Attachment: Build info for the version I experienced the bug on.

Comment 2

[Alice0775 White]

Is it the following typos? A quantifier "?" is missing?

var result = 'cdefg'.match(/.e.?/);

Comment 3

[Alice0775 White]

STR
var result = 'cdefg'.match(/.?e.?/);
Object.keys(result).forEach(function(key) {
    console.log(key + ':', result[key]);
});


Regression window(m-i)
Good:
http://hg.mozilla.org/integration/mozilla-inbound/rev/9b495a47e51d
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:19.0) Gecko/19.0 Firefox/19.0 ID:20121101213244
Bad:
http://hg.mozilla.org/integration/mozilla-inbound/rev/8bf2f8cb5e73
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:19.0) Gecko/19.0 Firefox/19.0 ID:20121101213645
Pushlog:
http://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=9b495a47e51d&tochange=8bf2f8cb5e73

Regressed by:
bf2f8cb5e73	David Anderson — Update Yarr to WebKit rev 130234 (bug 740015, r=dmandelin).

Comment 4

[Till Schneidereit [:till]]

This is, indeed, an issue in Yarr itself: the result reproduces in Safari 6.0.5's jsc.

Interestingly, the regexp from comment 0's STR results in 'def', so the '.?' at the expression's end is interpreted correctly. Looks like an error in interpreting the first '.?' throws Yarr off.

I'll look if Yarr has a bug open for this and will file one, if not.

Comment 5

[joe.farro]

A "?" quantifier is missing after initial "." in the regexp.

JavaScript code to reproduce should read:

var result = 'cdefg'.match(/.?e.?/);

Object.keys(result).forEach(function(key) {
    console.log(key + ':', result[key]);
});

(In reply to joe.farro from comment #0)
> Execute the following JavaScript in the Scratchpad:
> 
> var result = 'cdefg'.match(/.e.?/);

Comment 6

[joe.farro]

Seems to be a combination of both '.?' without a capturing group that causes the issue. The following are fine:

    /.e./
    /.?e./
    /.e.?/
    /(.?e.?)/
    /(.?)e.?/
    /.?e(.?)/
    /.?(e).?/

http://jsfiddle.net/bJnHK/


(In reply to Till Schneidereit [:till] from comment #4)
> ... Looks like an error in
> interpreting the first '.?' throws Yarr off.
> 
> I'll look if Yarr has a bug open for this and will file one, if not.

Comment 7

[Till Schneidereit [:till]]

(In reply to joe.farro from comment #6)
> Seems to be a combination of both '.?' without a capturing group that causes
> the issue. The following are fine:

Yeah, and so is this one:
'cdefgh'.match('.?e.?g')

but not this one:
'cdefgh'.match('.?e.?g.?')

Looks like '.?' at the beginning and the end of a regexp breaks. That somewhat restricted set of conditions explains why we didn't stumble upon this much earlier.

Thanks for reporting, btw!

Comment 8

[joe.farro]

No problem!

It's from a question on stackoverflow:

http://stackoverflow.com/questions/17905625/e-matches-entire-string-rather-than-expected-substring

Comment 9

[Till Schneidereit [:till]]

I filed https://bugs.webkit.org/show_bug.cgi?id=119191 for the Yarr issue.

Comment 10

[Lukas Blakk [:lsblakk] use ?needinfo]

This is a regression from FF19 and that combined with the webkit aspect make this very much not a candidate for blocking release (unless I'm missing some user impact here that is newly aggravated).  If a low risk fix is found, please nominate for uplift.

Comment 11

[André Bargull [:anba]]

No longer reproducible, 'cdefg'.match(/.?e.?/) returns ["def"]. Probably fixed when Yarr was replaced with irregexp. Resolving as WFM.