436700 - fixing backref assert. r=dmandelin
authorIgor Bukanov <igor@mir2.org>
Fri, 20 Mar 2009 12:30:40 +0100
changeset 26532 a45eb680c66c025374d17437ba3995ba5f68ed2e
parent 26531 4fc08ad56525fb0c5d3dd64587fc9d2ebacdf88b
child 26533 9297d5d86348d8cac57b1107ba09d6cd06d5715f
push id6115
push userrsayre@mozilla.com
push dateTue, 24 Mar 2009 17:50:03 +0000
treeherdermozilla-central@4a34c6235bb7 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersdmandelin
bugs436700
milestone1.9.2a1pre
436700 - fixing backref assert. r=dmandelin
js/src/jsregexp.cpp
--- a/js/src/jsregexp.cpp
+++ b/js/src/jsregexp.cpp
@@ -1261,17 +1261,24 @@ ParseTerm(CompilerState *state)
                     /* Treat this as flat. termStart - 1 is the \. */
                     c = '\\';
                     goto asFlat;
                 }
 
                 /* Treat this as an octal escape. */
                 goto doOctal;
             }
-            JS_ASSERT(1 <= num && num <= 0x10000);
+
+            /*
+             * When FindParenCount calls the regex parser recursively (to find
+             * the number of backrefs) num can be arbitrary and the maximum
+             * supported number of backrefs does not bound it.
+             */
+            JS_ASSERT_IF(!(state->flags & JSREG_FIND_PAREN_COUNT),
+                         1 <= num && num <= 0x10000);
             state->result = NewRENode(state, REOP_BACKREF);
             if (!state->result)
                 return JS_FALSE;
             state->result->u.parenIndex = num - 1;
             state->progLength
                 += 1 + GetCompactIndexWidth(state->result->u.parenIndex);
             break;
           /* Control escape */