How does regexp (RE2) differ from PCRE engines? Why doesn't Go support backreferences, and what are the performance guarantees?

Go's regexp uses RE2 syntax and automata-based matching (a Thompson NFA, a one-pass matcher and a bounded backtracker). It guarantees matching in O(m·n) time, linear in the input length for a given pattern, so catastrophic backtracking (ReDoS) cannot happen. The cost is losing features that require backtracking: backreferences (\1) and lookahead/lookbehind. Matching with backreferences is NP-hard, so no linear-time guarantee can include them. That is why patterns taken from user input are safe to run in Go.

evil := regexp.MustCompile(`^(a+)+

  
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
  
  
    )
fmt.Println(evil.MatchString(strings.Repeat("a", 50) + "b")) // false, instantly (PCRE: exponential)

_, err := regexp.Compile(`(\w)\1`)
fmt.Println(err) // error parsing regexp: invalid escape sequence: `\1`

// What does this print? Leftmost-first (Perl) vs leftmost-longest (POSIX)
fmt.Println(regexp.MustCompile(`a|ab`).FindString("ab"))      // a
fmt.Println(regexp.MustCompilePOSIX(`a|ab`).FindString("ab")) // ab

var slugRe = regexp.MustCompile(`^[a-z0-9]+(?:-[a-z0-9]+)*

  
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
  
  
    ) // compile once at package level

Performance notes: the constant factor is often higher than PCRE or JIT engines for simple patterns. Compile patterns once, never inside a loop or a handler. For simple checks, use strings.Contains, HasPrefix or Cut. A *Regexp is safe for concurrent use. If you need backreferences, do a second pass in code, or use a third-party backtracking library and set timeouts.