Bug 273254 – [Yarr] Regex Lookbehinds differs from v8

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Dylan Conway]

The following text and regex will fail to replace. Using v8 it will match and replace successfully.

```
console.log("<TData = SettingsControllerGetAllResponse>(".replace(/(?<=TData = |<)(\w+(?:Error|Response))/g, "foo"));
```

Received output:
"<TData = SettingsControllerGetAllResponse>("

Expected output:
"<TData = foo>("


This example is minified from: https://github.com/oven-sh/bun/issues/10508

[Radar WebKit Bug Importer]

<rdar://problem/127440248>

[Karl Dubost]

Thanks for the report. 
I can confirm the output.

string: "<TData = SettingsControllerGetAllResponse>("
then 

.replace(
   /(?<=TData = |<)(\w+(?:Error|Response))/g, 
   "foo"
   )

[Karl Dubost]

This gives the proper result in both Firefox and Chrome.

[Karl Dubost]

(?<=TData = |<)(\w+(?:Error|Response))>

This one is working, aka just adding ">" at the end.

[Karl Dubost]

OK
Just adding a Z on Error is making it work.

(?<=TData = |<)(\w+(?:ErrorZ|Response))

It seems there's a minimum size required on the strings to match set to 6 characters.

We can see that with 

(?<=TData = |<)(\w+(?:Respo))  FAIL
(?<=TData = |<)(\w+(?:Respon)) PASS

[Karl Dubost]

This?
        const size_t thresholdForBinarySearch = 6;


https://searchfox.org/wubkat/rev/7051b8f5cd90af80f03a58d74741cdb04c800b6e/Source/JavaScriptCore/yarr/YarrInterpreter.cpp#520

[Karl Dubost]

There is no threshold for Firefox and Chrome

This is working for example.
(?<=TData = |<)(\w+(?:R))

[Michael Saboff]

Currently working on this bug.

This issue is not the length itself of the lookbehind, but the lookbehind length relative to the remaining expression's minimum length.

[Michael Saboff]

Pull request: https://github.com/WebKit/WebKit/pull/28641

[EWS]

Committed 278863@main (fafab4133900): <https://commits.webkit.org/278863@main>

Reviewed commits have been landed. Closing PR #28641 and removing active labels.