[Webkit-unassigned] [Bug 42666] New: YARR: "Assertion failure: buf[idx + 1] >= buf[idx]"

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=42666

           Summary: YARR: "Assertion failure: buf[idx + 1] >= buf[idx]"
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: PC
               URL: https://bugzilla.mozilla.org/show_bug.cgi?id=576836
        OS/Version: Mac OS X 10.5
            Status: NEW
          Keywords: NeedsRadar
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: oliver at apple.com


>From mozilla: https://bugzilla.mozilla.org/show_bug.cgi?id=576836

The input has to be in the form of a .js file rather than shell input.

"AAB".split(/A|B(((?=)){1,2})/);

Assertion failure: get(0, 1) <= int(input->length()), at ../jscntxt.h:1699

"AAB".split(/B(((?=)){1,2})/);

Assertion failure: buf[idx + 1] >= buf[idx], at ../jsregexp.cpp:225

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.