Closed Bug 687302 Opened 13 years ago Closed 13 years ago

Assertion failure: limit >= start, at jsregexpinlines.h:274

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Platform:
x86
Linux
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 679986
Tracking Flags:
Tracking Status
firefox6 - unaffected
firefox7 - wontfix

People

(Reporter: decoder, Assigned: dmandelin)

References

Details

(Keywords: assertion, regression, testcase, Whiteboard: [sg:critical?] js-triage-needed wanted-standalone-js) 

The following test asserts on mozilla-central (tested revision 7054f0e3e70e) when run with options "-j -m":

re = new RegExp("(((..).)|(.))+?a[b-m]|\(\1\)*\(x\)" , "i");
re.exec("aaaaaaceax");


This bug was created as clone of bug 679986 because dmandelin suggested the testcase above might be a different problem from that in bug 679986.
copying status whiteboard from cloned bug -- as good a first guess as any.
Whiteboard: [sg:critical?] js-triage-needed
Assignee: general → dmandelin
Whiteboard: [sg:critical?] js-triage-needed → [sg:critical?] js-triage-needed wanted-standalone-js
Fixed by the patch in the other bug, also the key feature is the same (alternative in a *-quantified group matches empty).
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → DUPLICATE
Group: core-security
You need to log in before you can comment on or make changes to this bug.