From 00c45243bd62f45f402aa5e6d0d12d53591904c1 Mon Sep 17 00:00:00 2001
From: Ali Mohammad Pur <ali.mpfard@gmail.com>
Date: Thu, 24 Oct 2024 11:39:26 +0200
Subject: [PATCH] LibRegex: Don't blindly accept inverted charclasses for
 atomic rewrite

---
 Tests/LibRegex/Regex.cpp                      |  1 +
 .../Libraries/LibRegex/RegexOptimizer.cpp     | 21 ++++++++++++++++---
 2 files changed, 19 insertions(+), 3 deletions(-)

diff --git a/Tests/LibRegex/Regex.cpp b/Tests/LibRegex/Regex.cpp
index 24222821a6f..8bd85a2ef43 100644
--- a/Tests/LibRegex/Regex.cpp
+++ b/Tests/LibRegex/Regex.cpp
@@ -707,6 +707,7 @@ TEST_CASE(ECMA262_match)
         { "^(.*?):[ \\t]*([^\\r\\n]*)$"sv, "content-length: 488\r\ncontent-type: application/json; charset=utf-8\r\n"sv, true, global_multiline.value() },
         { "^\\?((&?category=[0-9]+)?(&?shippable=1)?(&?ad_type=demand)?(&?page=[0-9]+)?(&?locations=(r|d)_[0-9]+)?)+$"sv,
             "?category=54&shippable=1&baby_age=p,0,1,3"sv, false }, // ladybird#968, ?+ should not loop forever.
+        { "([^\\s]+):\\s*([^;]+);"sv, "font-family: 'Inter';"sv, true }, // optimizer bug, blindly accepting inverted char classes [^x] as atomic rewrite opportunities.
     };
     // clang-format on
 
diff --git a/Userland/Libraries/LibRegex/RegexOptimizer.cpp b/Userland/Libraries/LibRegex/RegexOptimizer.cpp
index 75858ae64aa..52b0e6ec54b 100644
--- a/Userland/Libraries/LibRegex/RegexOptimizer.cpp
+++ b/Userland/Libraries/LibRegex/RegexOptimizer.cpp
@@ -198,8 +198,19 @@ static bool has_overlap(Vector<CompareTypeAndValuePair> const& lhs, Vector<Compa
         if (lhs_negated_char_classes.contains(value))
             return false;
 
-        // This char class might match something in the ranges we have, and checking that is far too expensive, so just bail out.
-        return true;
+        if (lhs_ranges.is_empty())
+            return false;
+
+        for (auto it = lhs_ranges.begin(); it != lhs_ranges.end(); ++it) {
+            auto start = it.key();
+            auto end = *it;
+            for (u32 ch = start; ch <= end; ++ch) {
+                if (OpCode_Compare::matches_character_class(value, ch, false))
+                    return true;
+            }
+        }
+
+        return false;
     };
 
     for (auto const& pair : lhs) {
@@ -302,6 +313,10 @@ static bool has_overlap(Vector<CompareTypeAndValuePair> const& lhs, Vector<Compa
             dbgln("  {}..{}", it.key(), *it);
     }
 
+    temporary_inverse = false;
+    reset_temporary_inverse = false;
+    inverse = false;
+
     for (auto const& pair : rhs) {
         if (reset_temporary_inverse) {
             reset_temporary_inverse = false;
@@ -310,7 +325,7 @@ static bool has_overlap(Vector<CompareTypeAndValuePair> const& lhs, Vector<Compa
             reset_temporary_inverse = true;
         }
 
-        dbgln_if(REGEX_DEBUG, "check {} ({})...", character_compare_type_name(pair.type), pair.value);
+        dbgln_if(REGEX_DEBUG, "check {} ({}) [inverted? {}]...", character_compare_type_name(pair.type), pair.value, current_lhs_inversion_state());
 
         switch (pair.type) {
         case CharacterCompareType::Inverse: