From 7a45773492923f3e97d0ce29fd9e85b1b8c87c21 Mon Sep 17 00:00:00 2001
From: "crowder%fiverocks.com"
 <crowder%fiverocks.com@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Wed, 23 May 2007 21:13:13 +0000
Subject: [PATCH] Bug 375715: "Assertion failure: (c2 <= cs->length) && (c1 <=
 c2)" with /[\Wb-G]/, patch by mrbkap, r=crowder

git-svn-id: svn://10.0.0.236/trunk@226911 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/js/src/jsregexp.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/mozilla/js/src/jsregexp.c b/mozilla/js/src/jsregexp.c
index 1f85f477e4c..328a61f526f 100644
--- a/mozilla/js/src/jsregexp.c
+++ b/mozilla/js/src/jsregexp.c
@@ -981,8 +981,14 @@ lexHex:
                                          JSMSG_BAD_CLASS_RANGE);
                     return JS_FALSE;
                 }
-                target->u.ucclass.bmsize = 65535;
-                return JS_TRUE;
+                max = 65535;
+
+                /*
+                 * If this is the start of a range, ensure that it's less than
+                 * the end.
+                 */
+                localMax = 0;
+                break;
               case '0':
               case '1':
               case '2':