--- a/js/src/irregexp/RegExpEngine.cpp
+++ b/js/src/irregexp/RegExpEngine.cpp
@@ -996,17 +996,17 @@ ChoiceNode::FilterASCII(int depth, bool 
         RegExpNode* replacement =
             alternatives()[i].node()->FilterASCII(depth - 1, ignore_case);
         if (replacement != nullptr) {
             alternatives()[i].set_node(replacement);
             new_alternatives.append(alternatives()[i]);
         }
     }
 
-    alternatives_.appendAll(new_alternatives);
+    alternatives_ = Move(new_alternatives);
     return this;
 }
 
 // -------------------------------------------------------------------
 // NegativeLookaheadChoiceNode
 
 bool
 NegativeLookaheadChoiceNode::FillInBMInfo(int offset,

new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/basic/bug1081175.js
@@ -0,0 +1,20 @@
+var input = "webkit-search-cancel-button-aaaaaaa-bbbbb-ccccccc-dddddddd,"
+var bad_regex = '([a-u-]|\\u0080|\\u0100)*[d]';
+
+function forceUnicode(s) {
+    return ('\uffff' + s).replace(/^\uffff/, '');
+}
+function testRegex(input) {
+    for (var i = 0; i < input.length; i++) {
+        var sub = input.substring(0, i + 1);
+	var res = sub.match(bad_regex);
+	if (i >= 50) {
+	    assertEq(res.length, 2);
+	    assertEq(res[1], sub.substr(-2, 1));
+	} else {
+	    assertEq(res, null);
+	}
+    }
+}
+testRegex(input);
+testRegex(forceUnicode(input));