327170 - Reuse of RegExp in string.replace(rx.compile(...), function() { rx.compile(...); }) causes a crash

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Jonas Jonsson]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.1) Gecko/20060111 Firefox/1.5.0.1
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.1) Gecko/20060111 Firefox/1.5.0.1

http://www.fatbrain.org/js-bug2.txt for the source-code version. Not much more to say, u fix ;)

Reproducible: Always

Steps to Reproduce:
1. Create a RegExp object.
2. Run replace function on some string: "teststring".replace(rx.compile("s", "g"), function() { fx.compile("bleh", "g"); })
3. Crash.

Actual Results:  
Crash

Comment 1

[Blake Kaplan (:mrbkap) (inactive)]

I can reproduce this.

Comment 2

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Fix

We need to make sure that we hold a reference to the regular expression while we're using it.

Comment 3

[Brendan Eich [:brendan]]

Comment on attachment 211897 [details] [diff] [review]
Fix

Great, thanks -- r=me.

/be

Comment 4

[Brendan Eich [:brendan]]

FMR, not good -- want fixed on branches.

/be

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

Comment on attachment 211897 [details] [diff] [review]
Fix

I think we want this on the 1.8.0 branch.

Comment 6

[Blake Kaplan (:mrbkap) (inactive)]

Fix checked into trunk.

Comment 7

[Daniel Veditz [:dveditz]]

Comment on attachment 211897 [details] [diff] [review]
Fix

approved for old branches, a=dveditz for drivers

Comment 8

[Blake Kaplan (:mrbkap) (inactive)]

Fix checked into the 1.7 branches.

Comment 9

[Bob Clary [:bc] (inactive)]

Attachment: ecma_3/RegExp/regress-327170.js

Comment 10

[Bob Clary [:bc] (inactive)]

v with today's ff trunk/mozilla 1.7.13 on winxp. i'll v1.0.8 with the regular test run later.

Comment 11

[Bob Clary [:bc] (inactive)]

v 1.7.13, 1.9a1 20060217 win/linux/mac, still needs checkin on 1.8.0.1 and 1.8 branches.

Comment 12

[Blake Kaplan (:mrbkap) (inactive)]

Fix checked into the 1.8 branches.

Comment 13

[Bob Clary [:bc] (inactive)]

v ff 1.8.0.1/1.8/1.9 20060302 win/linux/mac

Comment 14

[Bob Clary [:bc] (inactive)]

Checking in regress-327170.js;
/cvsroot/mozilla/js/tests/ecma_3/RegExp/regress-327170.js,v  <--  regress-327170.js
initial revision: 1.1