Bug 210576 – Certain regexes with range-quantified groups fail to match

• Component: JavaScriptCore
• Status: NEW

[Ross Kirsling]

I'm not even sure what to title this, but I extracted it from test262/harness/testIntl.js.

The following is false for JSC but true for all other engines:
```
/(?:\w+-)+((\w){5,8})-\1/.test('de-gregory-gregory')
```

This was as far as I could manage to shrink the regex.
(The backreference can be inlined and the nested group can be made a non-capturing group, but everything else seems needed?)

[Devin Rousso]

This works tho 🤔

```
/(?:\w+-)+(\w{5,8})-\1/.test('de-gregory-gregory')
```

[Ross Kirsling]

(In reply to Devin Rousso from comment #1)
> This works tho 🤔
> 
> ```
> /(?:\w+-)+(\w{5,8})-\1/.test('de-gregory-gregory')
> ```

Hence the title. :P

[Alexey Shvayka]

(In reply to Ross Kirsling from comment #0)
> The following is false for JSC but true for all other engines:

Same result in Safari 12.1. I wonder if it's the same issue as in https://bugs.webkit.org/show_bug.cgi?id=188407?

[Devin Rousso]

(In reply to Ross Kirsling from comment #2)
> (In reply to Devin Rousso from comment #1)
> > This works tho 🤔
> > 
> > ```
> > /(?:\w+-)+(\w{5,8})-\1/.test('de-gregory-gregory')
> > ```
> 
> Hence the title. :P

🤦‍♂️

[Ross Kirsling]

Alexey noticed that my shrunken regex in comment 0 succeeds with a `u` flag, but the original regex does not. If we unshrink just a bit, this fails:

  /(?:\w+-)+((\w){5,8})-((\w){5,8}-)*\1/u.test('de-gregory-gregory')

...which may suggest multiple issues at play.


I also kept trying ways to further shrink/restrict the comment 0 regex and noticed that the following fails (with or without `u`):

  /^(?:aa~)+(?:a){2,3}~aa?a?a?$/.test('aa~aa~aaaa')

...so nested groups may not be necessary, but that (?:a){2,3} is really important. It needs to be a quantified group with a lower bound greater than 1 and an upper bound greater than the lower bound. (Presumably the bound restrictions are needed so that it doesn't get automatically simplified?)