  This paper explores the extent to which regular expressions (regexes) are
portable across programming languages. Many languages offer similar regex
syntaxes, and it would be natural to assume that regexes can be ported across
language boundaries. But can regexes be copy/pasted across language boundaries
while retaining their semantic and performance characteristics?
  In our survey of 158 professional software developers, most indicated that
they re-use regexes across language boundaries and about half reported that
they believe regexes are a universal language. We experimentally evaluated the
riskiness of this practice using a novel regex corpus -- 537,806 regexes from
193,524 projects written in JavaScript, Java, PHP, Python, Ruby, Go, Perl, and
Rust. Using our polyglot regex corpus, we explored the hitherto-unstudied regex
portability problems: logic errors due to semantic differences, and security
vulnerabilities due to performance differences.
  We report that developers' belief in a regex lingua franca is understandable
but unfounded. Though most regexes compile across language boundaries, 15%
exhibit semantic differences across languages and 10% exhibit performance
differences across languages. We explained these differences using regex
documentation, and further illuminate our findings by investigating regex
engine implementations. Along the way we found bugs in the regex engines of
JavaScript-V8, Python, Ruby, and Rust, and potential semantic and performance
regex bugs in thousands of modules.
