On the computational complexity of JavaScript regex matching

TL;DR

This paper investigates the computational complexity of JavaScript regular expression matching, establishing its PSPACE-hardness and OptP-hardness, and clarifying how features like lookarounds and quantifiers affect complexity.

Contribution

It provides the first formal proofs of JavaScript regex matching complexity, mechanized in the Rocq proof assistant, detailing the impact of regex features on computational difficulty.

Findings

JavaScript regex matching is PSPACE-hard even without negative lookarounds.

Without lower-bounded quantifiers, regex matching is PSPACE-complete.

Removing lookarounds and lower-bounded quantifiers reduces complexity to OptP-complete.

Abstract

Despite widespread use, the complexity class of modern regular expression matching was not well-understood. Previous work proved that regular expression matching with backreferences and lookarounds was PSPACE-complete, but the proof was not mechanized and applied to an abstract regex language. This paper clarifies the question for JavaScript regular expressions. In this paper, we prove the following new results, with most core proofs mechanized in the Rocq proof assistant. We prove that JavaScript regex matching is indeed PSPACE-hard, even without negative lookarounds, and OptP-hard as well; that JavaScript regex matching without lower-bounded quantifiers (i.e. quantifiers with a non-zero minimum number of repetitions) is PSPACE-complete; and that JavaScript regex matching without lower-bounded quantifiers and without lookarounds is OptP-complete.