Bug 23121 – RegExp fails for non-greedy quatifier following negative char sets w/ single char

• Component: JavaScriptCore
• Status: RESOLVED CONFIGURATION CHANGED

[Prestaul]

RegExp fails to properly match strings when the pattern includes a non-greedy quantifier for a negative character class that only contains one character.  For example:

'FAILURE'.replace(/^[^Z]*?$/g, 'SUCCESS');  // output: "FAILURE"
'FAILURE'.replace(/^[^Z]+?$/g, 'SUCCESS');  // output: "FAILURE"


The greedy quantifier works:

'FAILURE'.replace(/^[^Z]*$/g, 'SUCCESS');  // output: "SUCCESS"


More that one character works:

'FAILURE'.replace(/^[^ZQ]*?$/g, 'SUCCESS');  // output: "SUCCESS"


Shorthand character classes work:

'FAILURE'.replace(/^[^\s]*?$/g, 'SUCCESS');  // output: "SUCCESS"
'FAILURE'.replace(/^[^\W]*?$/g, 'SUCCESS');  // output: "SUCCESS"


Positive character classes work:

'FAILURE'.replace(/^[FAILURE]*?$/g, 'SUCCESS');  // output: "SUCCESS"
'FAILURE'.replace(/^[\w]*?$/g, 'SUCCESS');  // output: "SUCCESS"


I've seen the bug on both Max and PC.

[Mark Rowe (bdash)]

<rdar://problem/6474231>

[Alexey Shvayka]

(In reply to Prestaul from comment #0)
> RegExp fails to properly match strings when the pattern includes a
> non-greedy quantifier for a negative character class that only contains one
> character.  For example:
> 
> 'FAILURE'.replace(/^[^Z]*?$/g, 'SUCCESS');  // output: "FAILURE"
> 'FAILURE'.replace(/^[^Z]+?$/g, 'SUCCESS');  // output: "FAILURE"

As of rev. 255785, both test cases output "SUCCESS".
Test coverage: https://trac.webkit.org/browser/webkit/trunk/LayoutTests/fast/regex/script-tests/pcre-test-1.js?rev=255785#L2753