Permit spec-breaking syntax in Regex character classes, allowing ranges that would be permitted per the grammar rules in the spec but not necessarily following the syntax rules.

e.g.: allow [,|-\s] (as if it was [,|\-\s]) or [.\!=-\w] (as if it was [.\!=\-\w]) -- as taken from 2 reported websites.
ECMA2015 has an Annex B that attempts to describe this kind of web browser exception behavior, but fails miserably at it, making this still a spec-breaking thing.

1 files changed, 13 insertions, 5 deletions

diff --git a/js/src/yarr/YarrParser.h b/js/src/yarr/YarrParser.h
index b949006a6..f7a1f8344 100644
--- a/js/src/yarr/YarrParser.h
+++ b/js/src/yarr/YarrParser.h
@@ -149,12 +149,20 @@ private:
                 m_state = AfterCharacterClass;
                 m_delegate.atomCharacterClassBuiltIn(classID, invert);
                 return;
-
+                
+                // If we hit either of these cases, we have an invalid range
+                // that looks something like /[x-\d]/ or /[\d-\d]/.
+                // According to ECMA-262 this should be a syntax error, but
+                // mainstream browser parity (as opposed to spec compliance)
+                // has allowed the web to be broken. Instead, we comply with
+                // the ECMA-262 grammar, and assume the grammar to have matched
+                // the range correctly, but tweak our interpretation of
+                // CharacterRange. Effectively we implicitly handle the hyphen
+                // as if it were escaped, e.g. /[\w-_]/ is treated as /[\w\-_]/.
             case CachedCharacterHyphen:
-                // Error! We have a range that looks like [x-\d]. We require
-                // the end of the range to be a single character.
-                m_err = CharacterClassInvalidRange;
-                return;
+                m_delegate.atomCharacterClassAtom(m_character);
+                m_delegate.atomCharacterClassAtom('-');
+                // Fall through
             case AfterCharacterClassHyphen:
                 m_delegate.atomCharacterClassBuiltIn(classID, invert);
                 m_state = Empty;