Bug 375715: "Assertion failure: (c2 <= cs->length) && (c1 <= c2)" with /[\Wb-G]/, patch by mrbkap, r=crowder

git-svn-id: svn://10.0.0.236/trunk@226911 18797224-902f-48f8-a5cc-f745e15eee43
2007-05-23 21:13:13 +00:00
parent cbeaa5e589
commit 7a45773492
1 changed files with 8 additions and 2 deletions
--- a/mozilla/js/src/jsregexp.c
+++ b/mozilla/js/src/jsregexp.c
@@ -981,8 +981,14 @@ lexHex:
                                         JSMSG_BAD_CLASS_RANGE);
                    return JS_FALSE;
                }
-                target->u.ucclass.bmsize = 65535;
-                return JS_TRUE;
+                max = 65535;
+
+                /*
+                 * If this is the start of a range, ensure that it's less than
+                 * the end.
+                 */
+                localMax = 0;
+                break;
              case '0':
              case '1':
              case '2':