Bug 157723 – RegExp /y flag incorrect handling of mixed-length alternation

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Steven Levithan]

This issue broke the XRegExp library. I've added a workaround in XRegExp 3.1.1 -- see <https://github.com/slevithan/xregexp/issues/135>.

Safari Technology Preview v9.1.1 has a bug in its handling of the ES 2015 RegExp /y flag. Here is some test output, with the last example showing the bug:

```
/a|b/y.test('a'); // -> true
/a|b/y.test('b'); // -> true
/b|a/y.test('a'); // -> true
/b|a/y.test('b'); // -> true
/aa|bb/y.test('aa'); // -> true
/aa|bb/y.test('bb'); // -> true
/bb|aa/y.test('aa'); // -> true
/bb|aa/y.test('bb'); // -> true
/a|bb/y.test('a'); // -> true
/a|bb/y.test('bb'); // -> true
/bb|a/y.test('bb'); // -> true
/bb|a/y.test('a'); // -> false [should be true]
```

It seems that if a regex with flag y evaluates a path within a regex with more than 1 character, it advances its internal lastIndex that the y flag is anchored to, and does not reset this position when the alternative fails and another path in the regex with fewer characters to match is tried. Or something along those lines.

Safari 9.1 does not have this issue, since 9.1.1 is the first version to support /y. Also, no other current browser that supports /y (Edge, Firefox, Chrome, Opera) has this bug.

[Radar WebKit Bug Importer]

<rdar://problem/26289787>

[Michael Saboff]

The problem is in the YARR JIT, the interpreter works fine.

Seems that the existing alternative backtracking code for dissimilar alternative sizes was bailing for sticky mode.  There was code we didn't emit for sticky patterns.  Have a patch in the works that emits the code to properly back track for dissimilar alternatives, but it still doesn't advance to try the next index.

[Michael Saboff]

Created attachment 279017 [details]
Patch

[Michael Saboff]

Comment on attachment 279017 [details]
Patch

r=filip

[Michael Saboff]

Comment on attachment 279017 [details]
Patch

Going to commit manually.

[Michael Saboff]

Committed r200946: <http://trac.webkit.org/changeset/200946>

[Mathias Bynens]

…That was quick. Thanks, Michael!

[Steven Levithan]

Thanks for the fast fix! Glad this won't make it to a stable browser and make adoption of /y harder.