// PTAL regexp experts. What's up with this? x64 vs arm:

print("abcdefghijklmnabcdefghijklmn".substr(1).match(/(?=(abcdefghijklmn))(?<=\1)a/));

// Output:
# Compared x64,ignition with arm,ignition
#
# Flags of x64,ignition:
--abort_on_stack_overflow --expose-gc --allow-natives-syntax --invoke-weak-callbacks --omit-quit --es-staging --random-seed 1234 --ignition --turbo-filter=~ --hydrogen-filter=~ --validate-asm --nocrankshaft
# Flags of arm,ignition:
--abort_on_stack_overflow --expose-gc --allow-natives-syntax --invoke-weak-callbacks --omit-quit --es-staging --random-seed 1234 --ignition --turbo-filter=~ --hydrogen-filter=~ --validate-asm --nocrankshaft
#
# Difference:
- null
+ a,abcdefghijklmn
#
### Start of configuration x64,ignition:
null

### End of configuration x64,ignition
#
### Start of configuration arm,ignition:
a,abcdefghijklmn

### End of configuration arm,ignition

Looks like a bug. Currently a bit swamped but I can take a look next week.

My speculation is that on ARM, the regexp exec stub incorrectly unpacks the sliced string produced by substr.

Shorter repro:

var s = "abcdefgabcdef".substr(1);
print(s.match(/(?=(abcdefg))(?<=\1)/));

The string has to be a true sliced string, as in, longer than 13 characters. The lookbehind is probably reading out of bound on ARM. I'll take a look.

One character fix incoming.

Correctness fuzzer is awesome. I had a similar test for this issue in place, but it did not find this particular edge case.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/e3ae7ad9c7aa90b666541b093b9493cab744035a

commit e3ae7ad9c7aa90b666541b093b9493cab744035a
Author: Yang Guo <yangguo@chromium.org>
Date: Mon Feb 27 06:29:47 2017

[regexp] fix regexp lookbehind with back reference on ARM.

BUG= chromium:695416 

Change-Id: Ied3a389d0dfb0132c798bc85e10f7b1fd4432eb4
Reviewed-on: https://chromium-review.googlesource.com/446343
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43435}
[modify] https://crrev.com/e3ae7ad9c7aa90b666541b093b9493cab744035a/src/regexp/arm/regexp-macro-assembler-arm.cc
[modify] https://crrev.com/e3ae7ad9c7aa90b666541b093b9493cab744035a/src/regexp/ppc/regexp-macro-assembler-ppc.cc
[modify] https://crrev.com/e3ae7ad9c7aa90b666541b093b9493cab744035a/src/regexp/s390/regexp-macro-assembler-s390.cc
[modify] https://crrev.com/e3ae7ad9c7aa90b666541b093b9493cab744035a/test/mjsunit/harmony/regexp-lookbehind.js

Does this require merging back?

no. experimental feature is experimental :)

ClusterFuzz has detected this issue as fixed in range 43434:43435.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5280203153866752

Fuzzer: foozzie_js_mutation
Job Type: v8_foozzie
Platform Id: linux

Crash Type: V8 correctness failure
Crash Address: 
Crash State:
  configs: x64,ignition:arm,ignition
  sources: a8f
  
Sanitizer: address (ASAN)

Regressed: V8: 43152:43153
Fixed: V8: 43434:43435

Reproducer Testcase: https://cluster-fuzz.appspot.com/download/AMIfv96YgSCeE6vh8nLlAg6LhB5oTdZgjO8MsjSukvjS_2nByKV0CoJpxohYfpFXJCNe-TtmC_pH0_Yh4hK1n-_3eFIfS7b42xPfp7DxRIMp079qnI2g1fkEBcaetEyYkQnvZ2y8alncW-D8E2ioYGCoBC8-yS2Dx3d3Le-k9Fns2ijNmfGAYgaiwv8hd5Yb-yPB1X-8y_neozALXB6nJ85DvBmHqe0U-wOxbk5vwpD9qx3rq1wz_jWiwYOBSjXD2QW7QGmVqrIFwpMCWXq4Kqw1m3Q26onyG2VXSLQ_YMR6HI7u2vHBahtce-GhZxOrEdXKhx0qx47bD6ZYMRb5KKFDpJLYhhm1Use8nd2KXBMpvs1z3vrRmN0?testcase_id=5280203153866752


See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.