The following testcase asserts on TI revision ac0989a03bf1 (run with options -m -a -n), tested on 32 bit:
AddRegExpCases(/a*b/, "xxx", 0, null );
AddRegExpCases(/x\d\dy/, "abcx45ysss235", 3, );
function AddRegExpCases(regexp, pattern, index, matches_array )
This is the same basic issue as bug 650662, but exposed an additional problem that when emitting code for JSOP_LENGTH we don't always include rejoin points for calls associated with JSOP_GETPROP (which LENGTH is sometimes but not always implemented in terms using).
Automatically extracted testcase for this bug was committed: