Bug 20142 – REGRESSION(r35245): /=/ weirdness

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Will Moffat]

The regexp /=/ behaves very strangely unless you escape the equals sign. Firefox does not require the escape.


WebKit: 
/=/.toString()  --> "//"   BUG?
/=/.test('=')   --> true   ok
'='.match(/=/)  --> [""]   BUG?
'='.match(/\=/) --> ["="]  ok 

FF3:
/=/.toString()  --> "/=/"  OK
/=/.test('=')   --> true   OK
'='.match(/=/)  --> ["="]  OK   
'='.match(/\=/) --> ["="]  OK

[Alexey Proskuryakov]

Weird. Confirmed as a regression with r35291.

[Alexey Proskuryakov]

Regressed between r35231 and r35249, <http://trac.webkit.org/projects/webkit/changeset/35245> is the only suspicious revision in this range.

This is related to the fact that "/=" can be either a beginning of a regexp, or a "divide and assign" operation.  It's not necessary to escape '=' at positions other than the very beginning of a regexp.

[Will Moffat]

To put the bug into context, it breaks all sites which do JsonP using jQuery

http://code.jquery.com/nightlies/jquery-nightly.js (grep for jsre)

[Oliver Hunt]

Ah, whoops, it's fairly obvious just by looking at the diff, spot the error:
-                                            $$ = createNodeFeatureInfo<ExpressionNode*>(new RegExpNode(GLOBAL_DATA, "=" + l.pattern(), l.flags()), 0);
+                                            RegExpNode* node = new RegExpNode(GLOBAL_DATA, l.pattern(), l.flags());
+                                            int size = l.pattern().size() + 2; // + 2 for the two /'s
+                                            SET_EXCEPTION_LOCATION(node, @1.first_column, @1.first_column + size, @1.first_column + size);
+                                            $$ = createNodeFeatureInfo<ExpressionNode*>(node, 0);

Will fix shortly.

[Oliver Hunt]

Committing to http://svn.webkit.org/repository/webkit/trunk ...
	M	JavaScriptCore/ChangeLog
	M	JavaScriptCore/kjs/grammar.y
	M	LayoutTests/ChangeLog
	A	LayoutTests/fast/js/regexp-divequal-expected.txt
	A	LayoutTests/fast/js/regexp-divequal.html
	A	LayoutTests/fast/js/resources/regexp-divequal.js
Committed r35323