From cc21c2e81de8dcd96f912a3bb0c9a26a573c4543 Mon Sep 17 00:00:00 2001
From: Shannon Booth <shannon.ml.booth@gmail.com>
Date: Fri, 20 Mar 2026 01:51:48 +0100
Subject: [PATCH] Limit component match result iteration to group name list
 size

User-provided regexp parts may contain nested capturing groups, causing
execResult to contain more captures than there are URLPattern groups.
---
 spec.bs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/spec.bs b/spec.bs
index 2ac693a..07b0a6d 100644
--- a/spec.bs
+++ b/spec.bs
@@ -595,7 +595,7 @@ A <dfn>component</dfn> is a [=struct=] with the following [=struct/items=]:
   1. Set |result|["{{URLPatternComponentResult/input}}"] to |input|.
   1. Let |groups| be a <code>[=record=]<{{USVString}}, ({{USVString}} or {{undefined}})></code>.
   1. Let |index| be 1.
-  1. While |index| is less than [$Get$](|execResult|, "`length`"):
+  1. While |index| is less than or equal to |component|'s [=component/group name list=]'s [=list/size=]:
     1. Let |name| be |component|'s [=component/group name list=][|index| &minus; 1].
     1. Let |value| be [$Get$](|execResult|, [$ToString$](|index|)).
     1. Set |groups|[|name|] to |value|.