A somewhat reduced test case is: Here is a somewhat reduced test case /:(?:\w)+\(([‘]?)((?:\([^\)]+\)|[^\(\)]*){1,2})\1\)/.exec(“:not('.hs-processed')”) Prior to r222601, the handling of a greedy parenthesis minimum count during backtracking was always 0, ignoring the actual minimum from the pattern. In this case, the parenthesized subpattern, ((?:\([^\)]+\)|[^\(\)]*){1,2}, has a minimum count of 1. Here is a RegExp pattern dump of that part of the expression. non-captured subpattern {1,2} greedy,frame location 4 alternative list,frame location 5 alternative #0: minimum size: 3 character inputPosition 3 '(' not character class inputPosition 4 [ASCII:(')')] not character class inputPosition 5 [ASCII:(')')] {0,...} greedy,frame location 1 character inputPosition 5 ')' alternative #1: minimum size: 0 not character class inputPosition 3 [ASCII:('(',')')] {0,...} greedy,frame location 1 With change r222601, we stop backtracking parenthesis when the match count is equal to the minimum without trying to backtrack the contained sub pattern. If that sub match fails and we are at the minimum, then we can fail the parenthesis backtracking.
<rdar://problem/35126949>
Created attachment 325069 [details] Patch
Comment on attachment 325069 [details] Patch r=me.
Comment on attachment 325069 [details] Patch Clearing flags on attachment: 325069 Committed r224072: <https://trac.webkit.org/changeset/224072>
All reviewed patches have been landed. Closing bug.