Closed Bug 687302 Opened 9 years ago Closed 9 years ago

Assertion failure: limit >= start, at jsregexpinlines.h:274

Categories

(Core :: JavaScript Engine, defect, critical)

x86
Linux
defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 679986
Tracking Status
firefox6 - unaffected
firefox7 - wontfix

People

(Reporter: decoder, Assigned: dmandelin)

References

Details

(Keywords: assertion, regression, testcase, Whiteboard: [sg:critical?] js-triage-needed wanted-standalone-js)

The following test asserts on mozilla-central (tested revision 7054f0e3e70e) when run with options "-j -m":

re = new RegExp("(((..).)|(.))+?a[b-m]|\(\1\)*\(x\)" , "i");
re.exec("aaaaaaceax");


This bug was created as clone of bug 679986 because dmandelin suggested the testcase above might be a different problem from that in bug 679986.
copying status whiteboard from cloned bug -- as good a first guess as any.
Whiteboard: [sg:critical?] js-triage-needed
Assignee: general → dmandelin
Whiteboard: [sg:critical?] js-triage-needed → [sg:critical?] js-triage-needed wanted-standalone-js
Fixed by the patch in the other bug, also the key feature is the same (alternative in a *-quantified group matches empty).
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 679986
Group: core-security
You need to log in before you can comment on or make changes to this bug.