fix: all alternatives in lookbehind alternation now checked (#57)

Author: jbachorik

reggie-codegen/src/main/java/com/datadoghq/reggie/codegen/analysis/FallbackPatternDetector.java

@@ -59,10 +59,6 @@ public static String needsFallback(RegexNode ast, PatternAnalyzer.MatchingStrate
     if (v.lookbehindBeforeUnbounded) {
       return "lookbehind followed by unbounded quantifier";
     }
-    // Bug 4: alternation inside lookbehind
-    if (v.alternationInLookbehind) {
-      return "alternation inside lookbehind";
-    }
     // Bug 5: lookbehind and lookahead used together (sandwich / interaction)
     if (v.hasLookbehind && v.hasLookahead) {
       return "lookbehind and lookahead combined";
@@ -100,26 +96,9 @@ private static boolean containsLookahead(RegexNode node) {
     return false;
   }
 
-  /** Returns true if {@code node} is or directly contains an AlternationNode. */
-  private static boolean containsDirectAlternation(RegexNode node) {
-    if (node instanceof AlternationNode) {
-      return true;
-    }
-    if (node instanceof GroupNode) {
-      return ((GroupNode) node).child instanceof AlternationNode;
-    }
-    if (node instanceof ConcatNode) {
-      for (RegexNode c : ((ConcatNode) node).children) {
-        if (c instanceof AlternationNode) return true;
-      }
-    }
-    return false;
-  }
-
   private static final class Visitor implements RegexVisitor<Void> {
     boolean lookaheadInQuantifier = false;
     boolean lookbehindBeforeUnbounded = false;
-    boolean alternationInLookbehind = false;
     boolean hasLookahead = false;
     boolean hasLookbehind = false;
 
@@ -130,9 +109,6 @@ public Void visitAssertion(AssertionNode node) {
       }
       if (isLookbehind(node.type)) {
         hasLookbehind = true;
-        if (containsDirectAlternation(node.subPattern)) {
-          alternationInLookbehind = true;
-        }
       }
       node.subPattern.accept(this);
       return null;

reggie-codegen/src/main/java/com/datadoghq/reggie/codegen/analysis/StructuralHash.java

@@ -116,8 +116,11 @@ private static int computeDFATopologyHash(DFA dfa) {
       // Group action count (affects bytecode for group tracking)
       hash = 31 * hash + state.groupActions.size();
 
-      // Assertion check count (affects bytecode for assertion validation)
+      // Assertion checks — include type to distinguish positive from negative assertions
       hash = 31 * hash + state.assertionChecks.size();
+      for (var ac : state.assertionChecks) {
+        hash = 31 * hash + ac.type.hashCode();
+      }
 
       // Include character sets - critical for case sensitivity
       for (var entry : state.transitions.entrySet()) {

reggie-codegen/src/main/java/com/datadoghq/reggie/codegen/automaton/NFA.java

@@ -299,6 +299,9 @@ public int contentHashCode() {
       // Include group markers
       hash = 31 * hash + (state.enterGroup != null ? state.enterGroup + 1 : 0);
       hash = 31 * hash + (state.exitGroup != null ? state.exitGroup + 1 : 0);
+
+      // Assertion type distinguishes (?<=...) from (?<!...) — must not collide
+      hash = 31 * hash + (state.assertionType != null ? state.assertionType.hashCode() : 0);
     }
 
     return hash;

reggie-codegen/src/main/java/com/datadoghq/reggie/codegen/codegen/NFABytecodeGenerator.java

@@ -3657,7 +3657,8 @@ private void generateAssertionCheck(
       // Check if we can use lightweight simulation for tiny sub-NFAs
       int subNFASize = countReachableStates(assertionState.assertionStartState);
 
-      if (subNFASize <= 6
+      if (!isLookbehind
+          && subNFASize <= 6
           && tryLightweightSimulation(
               mv,
               assertionState,
@@ -3666,7 +3667,6 @@ && tryLightweightSimulation(
               isPositive,
               assertionFailed,
               assertionPassed,
-              isLookbehind,
               allocator)) {
         // Lightweight simulation succeeded
         mv.visitLabel(assertionPassed);
@@ -3775,6 +3775,10 @@ private String extractLiteral(NFA.NFAState start, Set<NFA.NFAState> acceptStates
     while (visited.add(current)) {
       // Check for epsilon transitions (skip empty transitions)
       if (!current.getEpsilonTransitions().isEmpty()) {
+        // Multiple epsilon transitions indicate alternation — not a simple literal
+        if (current.getEpsilonTransitions().size() > 1) {
+          return null;
+        }
         // Follow epsilon if it leads to non-assertion state
         boolean foundNonAssertion = false;
         for (NFA.NFAState target : current.getEpsilonTransitions()) {
@@ -3858,6 +3862,10 @@ private String extractLiteralFromState(NFA.NFAState start, Set<NFA.NFAState> acc
 
       // Follow epsilon transitions (skip semantically-significant states)
       if (!current.getEpsilonTransitions().isEmpty()) {
+        // Multiple epsilon transitions indicate alternation — not a simple literal
+        if (current.getEpsilonTransitions().size() > 1) {
+          return null;
+        }
         boolean foundPlainEpsilon = false;
         for (NFA.NFAState target : current.getEpsilonTransitions()) {
           // Stop at assertion states and backref states: following through them would
@@ -3975,7 +3983,6 @@ private boolean tryLightweightSimulation(
       boolean isPositive,
       Label assertionFailed,
       Label assertionPassed,
-      boolean isLookbehind,
       LocalVariableAllocator allocator) {
     // Try to detect .*[CharClass] pattern (most common in password validation)
     CharSet targetCharSet =
@@ -5704,6 +5711,8 @@ private CharSet extractDotStarCharClass(NFA.NFAState start, Set<NFA.NFAState> ac
     queue.add(start);
     reachable.add(start);
 
+    CharSet acceptCharSet = null; // accumulates union of all accept-state charsets
+
     // BFS to find all reachable states
     while (!queue.isEmpty()) {
       NFA.NFAState current = queue.poll();
@@ -5714,7 +5723,8 @@ private CharSet extractDotStarCharClass(NFA.NFAState start, Set<NFA.NFAState> ac
         if (acceptStates.contains(trans.target)) {
           // Check if this is a specific charset (not "any char" which includes ANY_EXCEPT_NEWLINE)
           if (!trans.chars.isAnyChar()) {
-            return trans.chars;
+            acceptCharSet =
+                (acceptCharSet == null) ? trans.chars : acceptCharSet.union(trans.chars);
           }
         }
 
@@ -5731,7 +5741,7 @@ private CharSet extractDotStarCharClass(NFA.NFAState start, Set<NFA.NFAState> ac
       }
     }
 
-    return null;
+    return acceptCharSet;
   }
 
   /**

reggie-processor/src/test/java/com/datadoghq/reggie/processor/ReggieMatcherBytecodeGeneratorTest.java

@@ -464,12 +464,13 @@ void testLargeNegatedRangeCharsetStrategy() throws Exception {
   @Test
   void testFallbackPatternsRejected() {
     // Patterns with known engine bugs must fail at build time, not produce buggy bytecode.
-    // Note: multiple-backref patterns (e.g. (\w+)\s+\1\s+\1) are now handled natively
-    // and no longer rejected.
+    // Note: multiple-backref patterns and alternation-in-lookbehind are now handled natively.
+    // Bug 3: lookbehind before unbounded quantifier still requires fallback.
     assertThrows(
         UnsupportedOperationException.class,
         () ->
-            new ReggieMatcherBytecodeGenerator("test.generated", "AltLookbehind", "(?<=a|b)c")
+            new ReggieMatcherBytecodeGenerator(
+                    "test.generated", "LookbehindUnbounded", "(?<=\\d)[a-z]+")
                 .generate());
   }
 

reggie-runtime/src/test/java/com/datadoghq/reggie/runtime/FallbackVerificationTest.java

@@ -55,13 +55,13 @@ void lookbehindUnboundedQuantifier() {
     assertFalse(m.find("abc"));
   }
 
-  // Bug 4: alternation inside lookbehind
+  // Bug 4 (fixed): alternation inside lookbehind — now handled natively
   @Test
   void alternationInsideLookbehind() {
     ReggieMatcher m = Reggie.compile("(?<=a|b)c");
-    assertTrue(m instanceof JavaRegexFallbackMatcher);
+    assertFalse(m instanceof JavaRegexFallbackMatcher);
     assertTrue(m.find("ac"));
-    assertTrue(m.find("bc")); // was incorrectly false before fallback
+    assertTrue(m.find("bc"));
     assertFalse(m.find("xc"));
   }
 
@@ -74,12 +74,12 @@ void lookbehindLookaheadSandwich() {
     assertFalse(m.find("value"));
   }
 
-  // Named groups via fallback matcher: hasNamedGroups() must return true
+  // Named groups: hasNamedGroups() must return true for native engine too
   @Test
-  void namedGroupFallbackHasNamedGroupsTrue() {
-    // alternation inside lookbehind triggers fallback; named group present
+  void namedGroupInLookbehind_nativeEngineSupportsGroupAccess() {
+    // Bug 4 fixed: alternation inside lookbehind is now handled natively
     ReggieMatcher m = Reggie.compile("(?<=a|b)(?<x>c)");
-    assertTrue(m instanceof JavaRegexFallbackMatcher);
+    assertFalse(m instanceof JavaRegexFallbackMatcher);
     MatchResult r = m.findMatch("ac");
     assertNotNull(r);
     assertTrue(r.hasNamedGroups());

reggie-runtime/src/test/java/com/datadoghq/reggie/runtime/LookbehindAlternationTest.java

@@ -0,0 +1,165 @@
+/*
+ * Copyright 2026-Present Datadog, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.datadoghq.reggie.runtime;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+import com.datadoghq.reggie.Reggie;
+import java.util.List;
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+
+/** Acceptance tests for REQ-DataDog-java-reggie-30: lookbehind alternation correctness. */
+public class LookbehindAlternationTest {
+
+  // --- Positive lookbehind alternation (?<=a|b)c ---
+
+  @Test
+  @Tag("acceptance")
+  public void positiveLookbehindAlternation_firstAlternativeMatches() {
+    ReggieMatcher m = Reggie.compile("(?<=a|b)c");
+    assertTrue(m.find("ac"), "'ac': 'c' preceded by 'a' must match");
+  }
+
+  @Test
+  @Tag("acceptance")
+  public void positiveLookbehindAlternation_secondAlternativeMatches() {
+    // Core reproduction from the bug report: only first alternative was evaluated
+    ReggieMatcher m = Reggie.compile("(?<=a|b)c");
+    assertTrue(
+        m.find("bc"), "'bc': 'c' preceded by 'b' must match — was incorrectly false before fix");
+  }
+
+  @Test
+  @Tag("acceptance")
+  public void positiveLookbehindAlternation_noMatchWhenPrecursorAbsent() {
+    ReggieMatcher m = Reggie.compile("(?<=a|b)c");
+    assertFalse(m.find("xc"), "'xc': 'c' not preceded by 'a' or 'b' must not match");
+    assertFalse(m.find("xca"), "'xca': 'c' at index 1 is preceded by 'x', not 'a' or 'b'");
+  }
+
+  @Test
+  @Tag("acceptance")
+  public void positiveLookbehindAlternation_fullReproductionCase() {
+    ReggieMatcher m = Reggie.compile("(?<=a|b)c");
+    assertTrue(m.find("ac"), "ac  => true  (first alternative)");
+    assertTrue(m.find("bc"), "bc  => true  (second alternative, was false before fix)");
+    assertFalse(m.find("xc"), "xc  => false (no matching predecessor)");
+  }
+
+  // --- Negative lookbehind alternation (?<!a|b)c ---
+
+  @Test
+  @Tag("acceptance")
+  public void negativeLookbehindAlternation_firstAlternativeSuppressesMatch() {
+    ReggieMatcher m = Reggie.compile("(?<!a|b)c");
+    assertFalse(m.find("ac"), "'ac': 'c' preceded by 'a' must NOT match negative lookbehind");
+  }
+
+  @Test
+  @Tag("acceptance")
+  public void negativeLookbehindAlternation_secondAlternativeSuppressesMatch() {
+    ReggieMatcher m = Reggie.compile("(?<!a|b)c");
+    assertFalse(m.find("bc"), "'bc': 'c' preceded by 'b' must NOT match negative lookbehind");
+  }
+
+  @Test
+  @Tag("acceptance")
+  public void negativeLookbehindAlternation_matchWhenPrecursorAbsent() {
+    ReggieMatcher m = Reggie.compile("(?<!a|b)c");
+    assertTrue(m.find("xc"), "'xc': 'c' not preceded by 'a' or 'b' must match negative lookbehind");
+  }
+
+  @Test
+  @Tag("acceptance")
+  public void negativeLookbehindAlternation_fullCoverage() {
+    ReggieMatcher m = Reggie.compile("(?<!a|b)c");
+    assertFalse(m.find("ac"), "ac  => false (first alternative blocks)");
+    assertFalse(m.find("bc"), "bc  => false (second alternative blocks)");
+    assertTrue(m.find("xc"), "xc  => true  (no alternative matches, assertion passes)");
+  }
+
+  // --- Multi-character equal-width lookbehind alternation (?<=ab|cd)x ---
+
+  @Test
+  @Tag("acceptance")
+  public void multiCharPositiveLookbehind_firstAlternativeMatches() {
+    ReggieMatcher m = Reggie.compile("(?<=ab|cd)x");
+    assertTrue(m.find("abx"), "'abx': 'x' preceded by 'ab' must match");
+  }
+
+  @Test
+  @Tag("acceptance")
+  public void multiCharPositiveLookbehind_secondAlternativeMatches() {
+    ReggieMatcher m = Reggie.compile("(?<=ab|cd)x");
+    assertTrue(m.find("cdx"), "'cdx': 'x' preceded by 'cd' must match");
+  }
+
+  @Test
+  @Tag("acceptance")
+  public void multiCharPositiveLookbehind_noMatchForWrongPrefix() {
+    ReggieMatcher m = Reggie.compile("(?<=ab|cd)x");
+    assertFalse(m.find("efx"), "'efx': 'x' not preceded by 'ab' or 'cd' must not match");
+    assertFalse(m.find("acx"), "'acx': partial overlap must not match");
+    assertFalse(m.find("xbx"), "'xbx': 'x' preceded by 'xb', not 'ab' or 'cd'");
+  }
+
+  @Test
+  @Tag("acceptance")
+  public void multiCharPositiveLookbehind_bothAlternativesInString() {
+    ReggieMatcher m = Reggie.compile("(?<=ab|cd)x");
+    List<MatchResult> matches = m.findAll("abx cdx");
+    assertEquals(2, matches.size(), "Both 'abx' and 'cdx' occurrences must be found");
+  }
+
+  @Test
+  @Tag("acceptance")
+  public void multiCharNegativeLookbehind_bothAlternativesSuppress() {
+    ReggieMatcher m = Reggie.compile("(?<!ab|cd)x");
+    assertFalse(m.find("abx"), "'abx': 'x' preceded by 'ab' must not match negative lookbehind");
+    assertFalse(m.find("cdx"), "'cdx': 'x' preceded by 'cd' must not match negative lookbehind");
+    assertTrue(m.find("efx"), "'efx': 'x' not preceded by 'ab' or 'cd' must match");
+  }
+
+  // --- Native engine usage assertions ---
+
+  @Test
+  @Tag("acceptance")
+  public void positiveLookbehindAlternation_usesNativeEngine() {
+    ReggieMatcher m = Reggie.compile("(?<=a|b)c");
+    assertFalse(
+        m instanceof JavaRegexFallbackMatcher,
+        "(?<=a|b)c must be handled by the native Reggie engine, not java.util.regex fallback");
+  }
+
+  @Test
+  @Tag("acceptance")
+  public void negativeLookbehindAlternation_usesNativeEngine() {
+    ReggieMatcher m = Reggie.compile("(?<!a|b)c");
+    assertFalse(
+        m instanceof JavaRegexFallbackMatcher,
+        "(?<!a|b)c must be handled by the native Reggie engine, not java.util.regex fallback");
+  }
+
+  @Test
+  @Tag("acceptance")
+  public void multiCharLookbehindAlternation_usesNativeEngine() {
+    ReggieMatcher m = Reggie.compile("(?<=ab|cd)x");
+    assertFalse(
+        m instanceof JavaRegexFallbackMatcher,
+        "(?<=ab|cd)x must be handled by the native Reggie engine, not java.util.regex fallback");
+  }
+}