REGRESSION(r222601): We fail to properly backtrack into a sub pattern of a parenthesis with non-zero minimum

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Michael Saboff]

A somewhat reduced test case is:
Here is a somewhat reduced test case /:(?:\w)+\(([‘]?)((?:\([^\)]+\)|[^\(\)]*){1,2})\1\)/.exec(“:not('.hs-processed')”)

Prior to r222601, the handling of a greedy parenthesis minimum count during backtracking was always 0, ignoring the actual minimum from the pattern.  In this case, the parenthesized subpattern, ((?:\([^\)]+\)|[^\(\)]*){1,2}, has a minimum count of 1.  Here is a RegExp pattern dump of that part of the expression.

      non-captured subpattern {1,2} greedy,frame location 4
        alternative list,frame location 5
        alternative #0: minimum size: 3
          character inputPosition 3 '('
          not character class inputPosition 4 [ASCII:(')')]
          not character class inputPosition 5 [ASCII:(')')] {0,...} greedy,frame location 1
          character inputPosition 5 ')'
        alternative #1: minimum size: 0
          not character class inputPosition 3 [ASCII:('(',')')] {0,...} greedy,frame location 1

With change r222601, we stop backtracking parenthesis when the match count is equal to the minimum without trying to backtrack the contained sub pattern.  If that sub match fails and we are at the minimum, then we can fail the parenthesis backtracking.

[Michael Saboff]

<rdar://problem/35126949>

[Michael Saboff]

Created attachment 325069 [details]
Patch

[Keith Miller]

Comment on attachment 325069 [details]
Patch

r=me.

[WebKit Commit Bot]

Comment on attachment 325069 [details]
Patch

Clearing flags on attachment: 325069

Committed r224072: <https://trac.webkit.org/changeset/224072>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.