60923 - RegExp() constructor can cause js shell to dump core

Status: VERIFIED DUPLICATE of bug 57631

(Core :: JavaScript Engine, defect, P3)

Description

[David Flanagan]

Using the standalone js interpreter shell, call the RegExp() constructor
with a regexp string that is not legal.  It causes the interpreter to dump core.

% ./js
js> r = new RegExp("[]") 
Segmentation fault (core dumped)

% ./js
js> r = new RegExp("\d{s}")
Segmentation fault (core dumped)

Comment 1

[David Flanagan]

The correct behavior, by the way, is that the RegExp() constructor should
throw a SyntaxError object, I think.

Note that I've only tested this in the JS shell, not in a browser, so I don't
know if it actually manages to crash mozilla, or just the standalone shell.

Comment 2

[Phil Schwartau]

Confirming on WinNT. Changing OS to "All"  Will attach stack trace below -

Comment 3

[Phil Schwartau]

Attachment: WinNT stack trace -

Comment 4

[rogerl (gone)]

Dup of 57631 - note this is a debug build issue only.

*** This bug has been marked as a duplicate of 57631 ***

Comment 5

[Phil Schwartau]

Marking verified as duplicate -