The regexp /=/ behaves very strangely unless you escape the equals sign. Firefox does not require the escape. WebKit: /=/.toString() --> "//" BUG? /=/.test('=') --> true ok '='.match(/=/) --> [""] BUG? '='.match(/\=/) --> ["="] ok FF3: /=/.toString() --> "/=/" OK /=/.test('=') --> true OK '='.match(/=/) --> ["="] OK '='.match(/\=/) --> ["="] OK
Weird. Confirmed as a regression with r35291.
Regressed between r35231 and r35249, <http://trac.webkit.org/projects/webkit/changeset/35245> is the only suspicious revision in this range. This is related to the fact that "/=" can be either a beginning of a regexp, or a "divide and assign" operation. It's not necessary to escape '=' at positions other than the very beginning of a regexp.
To put the bug into context, it breaks all sites which do JsonP using jQuery http://code.jquery.com/nightlies/jquery-nightly.js (grep for jsre)
Ah, whoops, it's fairly obvious just by looking at the diff, spot the error: - $$ = createNodeFeatureInfo<ExpressionNode*>(new RegExpNode(GLOBAL_DATA, "=" + l.pattern(), l.flags()), 0); + RegExpNode* node = new RegExpNode(GLOBAL_DATA, l.pattern(), l.flags()); + int size = l.pattern().size() + 2; // + 2 for the two /'s + SET_EXCEPTION_LOCATION(node, @1.first_column, @1.first_column + size, @1.first_column + size); + $$ = createNodeFeatureInfo<ExpressionNode*>(node, 0); Will fix shortly.
Committing to http://svn.webkit.org/repository/webkit/trunk ... M JavaScriptCore/ChangeLog M JavaScriptCore/kjs/grammar.y M LayoutTests/ChangeLog A LayoutTests/fast/js/regexp-divequal-expected.txt A LayoutTests/fast/js/regexp-divequal.html A LayoutTests/fast/js/resources/regexp-divequal.js Committed r35323