<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>47324</bug_id>
          
          <creation_ts>2010-10-06 20:46:29 -0700</creation_ts>
          <short_desc>REGRESSION(r68204-r68242): Crash during execution of String.replace with specific regular expression</short_desc>
          <delta_ts>2010-10-08 14:32:59 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>JavaScriptCore</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>Mac</rep_platform>
          <op_sys>OS X 10.6</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>InRadar</keywords>
          <priority>P1</priority>
          <bug_severity>Major</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter>ben.dyer</reporter>
          <assigned_to name="Michael Saboff">msaboff</assigned_to>
          <cc>ap</cc>
    
    <cc>commit-queue</cc>
    
    <cc>ggaren</cc>
    
    <cc>msaboff</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>290782</commentid>
    <comment_count>0</comment_count>
      <attachid>70032</attachid>
    <who name="">ben.dyer</who>
    <bug_when>2010-10-06 20:46:29 -0700</bug_when>
    <thetext>Created attachment 70032
Crash report

Loading WebKit r69221 and executing the following line of JavaScript in the console results in a crash:
&apos;&quot;&apos;.replace(/([^\\])?([&quot;&apos;])/g, &apos;$1\\$2&apos;)

The crash occurs when the script is executed on the console after inspecting the start page, or a blank page. When other pages are viewed, results differ; for instance, running the script after loading http://www.apple.com/ results in the following output:
&quot;!\&quot;&quot;

Loading http://www.google.com.au/ and running the same script results in:
&quot;!&quot;#$%&amp;&apos;()*+,-./0123456789:;&lt;=&gt;?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~\&quot;&quot;

Neither of the above results is correct; expected result from Safari Version 5.0.2 [6533.18.5] and WebKit nightlies up to and including r68204 is &quot;\&quot;&quot;.

The exact output (and whether the script crashes or just returns unexpected results) depends on the page loaded and the build of WebKit. However, all WebKit nightlies from r68242 onwards exhibit incorrect behaviour.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>290786</commentid>
    <comment_count>1</comment_count>
    <who name="">ben.dyer</who>
    <bug_when>2010-10-06 21:01:23 -0700</bug_when>
    <thetext>This looks like it&apos;s related to the patch for https://bugs.webkit.org/show_bug.cgi?id=46404 (http://trac.webkit.org/changeset/68207)</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>291257</commentid>
    <comment_count>2</comment_count>
    <who name="Alexey Proskuryakov">ap</who>
    <bug_when>2010-10-07 14:24:42 -0700</bug_when>
    <thetext>I&apos;ve got a crash in a debug build:

#0	0x101cb9300 in WTF::VectorBufferBase&lt;unsigned short&gt;::allocateBuffer at Vector.h:286
#1	0x101b652e5 in WTF::Vector&lt;unsigned short, 0ul&gt;::reserveCapacity at Vector.h:871
#2	0x101cba9fa in WTF::Vector&lt;unsigned short, 0ul&gt;::expandCapacity at Vector.h:788
#3	0x101b65452 in WTF::Vector&lt;unsigned short, 0ul&gt;::expandCapacity at Vector.h:795
#4	0x101cbaa4c in WTF::Vector&lt;unsigned short, 0ul&gt;::append&lt;unsigned short&gt; at Vector.h:931
#5	0x101ce116b in JSC::substituteBackreferencesSlow at StringPrototype.cpp:209
#6	0x101ce127e in JSC::substituteBackreferences at StringPrototype.cpp:223
#7	0x101ce1a55 in JSC::stringProtoFuncReplace at StringPrototype.cpp:402

That&apos;s because newCapacity was 18446744072277895851 (0xffffffffaaaaaaab AKA -1431655765). An obvious question: why didn&apos;t this crash nightlies? Is CRASH macro broken, or does newCapacity just happen to be different?</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>291267</commentid>
    <comment_count>3</comment_count>
    <who name="Geoffrey Garen">ggaren</who>
    <bug_when>2010-10-07 14:49:10 -0700</bug_when>
    <thetext>&lt;rdar://problem/8526497&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>291779</commentid>
    <comment_count>4</comment_count>
      <attachid>70271</attachid>
    <who name="Michael Saboff">msaboff</who>
    <bug_when>2010-10-08 11:29:05 -0700</bug_when>
    <thetext>Created attachment 70271
Patch adding check for valid subexpression index

This patch adds a check that the beginning index of a subexpression is not negative before using it in a replacement.

Also added the submitters test case to JS tests.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>291864</commentid>
    <comment_count>5</comment_count>
      <attachid>70271</attachid>
    <who name="WebKit Commit Bot">commit-queue</who>
    <bug_when>2010-10-08 14:32:54 -0700</bug_when>
    <thetext>Comment on attachment 70271
Patch adding check for valid subexpression index

Clearing flags on attachment: 70271

Committed r69422: &lt;http://trac.webkit.org/changeset/69422&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>291865</commentid>
    <comment_count>6</comment_count>
    <who name="WebKit Commit Bot">commit-queue</who>
    <bug_when>2010-10-08 14:32:59 -0700</bug_when>
    <thetext>All reviewed patches have been landed.  Closing bug.</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="0"
              isprivate="0"
          >
            <attachid>70032</attachid>
            <date>2010-10-06 20:46:29 -0700</date>
            <delta_ts>2010-10-06 20:46:29 -0700</delta_ts>
            <desc>Crash report</desc>
            <filename>crashreport.txt</filename>
            <type>text/plain</type>
            <size>5741</size>
            <attacher>ben.dyer</attacher>
            
              <data encoding="base64">UHJvY2VzczogICAgICAgICBTYWZhcmkgWzUxOTQyXQpQYXRoOiAgICAgICAgICAgIC9BcHBsaWNh
dGlvbnMvU2FmYXJpLmFwcC9Db250ZW50cy9NYWNPUy9TYWZhcmkKSWRlbnRpZmllcjogICAgICBv
cmcud2Via2l0Lm5pZ2h0bHkuV2ViS2l0ClZlcnNpb246ICAgICAgICAgcjY5MjIxICg2OTIyMSkK
Q29kZSBUeXBlOiAgICAgICBYODYgKE5hdGl2ZSkKUGFyZW50IFByb2Nlc3M6ICBsYXVuY2hkIFs2
NTFdCgpEYXRlL1RpbWU6ICAgICAgIDIwMTAtMTAtMDcgMTQ6MjY6MjkuNjEzICsxMTAwCk9TIFZl
cnNpb246ICAgICAgTWFjIE9TIFggMTAuNi40ICgxMEY1NjkpClJlcG9ydCBWZXJzaW9uOiAgNgoK
SW50ZXJ2YWwgU2luY2UgTGFzdCBSZXBvcnQ6ICAgICAgICAgIDY3NjE2ODYgc2VjCkNyYXNoZXMg
U2luY2UgTGFzdCBSZXBvcnQ6ICAgICAgICAgICA3NwpQZXItQXBwIEludGVydmFsIFNpbmNlIExh
c3QgUmVwb3J0OiAgNzI5MiBzZWMKUGVyLUFwcCBDcmFzaGVzIFNpbmNlIExhc3QgUmVwb3J0OiAg
IDcKQW5vbnltb3VzIFVVSUQ6ICAgICAgICAgICAgICAgICAgICAgIERBMjkwMThDLUFFNzItNDA4
Ny1BNkY1LTIwQUZBMzAyNjVFNQoKRXhjZXB0aW9uIFR5cGU6ICBFWENfQkFEX0FDQ0VTUyAoU0lH
U0VHVikKRXhjZXB0aW9uIENvZGVzOiBLRVJOX0lOVkFMSURfQUREUkVTUyBhdCAweDAwMDAwMDAw
YmJhZGJlZWYKQ3Jhc2hlZCBUaHJlYWQ6ICAwICBEaXNwYXRjaCBxdWV1ZTogY29tLmFwcGxlLm1h
aW4tdGhyZWFkCgpUaHJlYWQgMCBDcmFzaGVkOiAgRGlzcGF0Y2ggcXVldWU6IGNvbS5hcHBsZS5t
YWluLXRocmVhZAowICAgY29tLmFwcGxlLkphdmFTY3JpcHRDb3JlICAgICAgCTB4MDA2ZDExOTAg
V1RGOjpWZWN0b3I8dW5zaWduZWQgc2hvcnQsIDB1bD46OmV4cGFuZENhcGFjaXR5KHVuc2lnbmVk
IGxvbmcpICsgMTc2CjEgICBjb20uYXBwbGUuSmF2YVNjcmlwdENvcmUgICAgICAJMHgwMDZkMTFm
MCB2b2lkIFdURjo6VmVjdG9yPHVuc2lnbmVkIHNob3J0LCAwdWw+OjphcHBlbmQ8dW5zaWduZWQg
c2hvcnQ+KHVuc2lnbmVkIHNob3J0IGNvbnN0KiwgdW5zaWduZWQgbG9uZykgKyA2NAoyICAgY29t
LmFwcGxlLkphdmFTY3JpcHRDb3JlICAgICAgCTB4MDA3MzdjYmQgSlNDOjpzdWJzdGl0dXRlQmFj
a3JlZmVyZW5jZXNTbG93KEpTQzo6VVN0cmluZyBjb25zdCYsIEpTQzo6VVN0cmluZyBjb25zdCYs
IGludCBjb25zdCosIEpTQzo6UmVnRXhwKiwgdW5zaWduZWQgbG9uZykgKyAzMDEKMyAgIGNvbS5h
cHBsZS5KYXZhU2NyaXB0Q29yZSAgICAgIAkweDAwNzNjZWY2IEpTQzo6c3RyaW5nUHJvdG9GdW5j
UmVwbGFjZShKU0M6OkV4ZWNTdGF0ZSopICsgMTEyNTQKNCAgID8/PyAgICAgICAgICAgICAgICAg
ICAgICAgICAgIAkweDE3YmUwYTUzIDAgKyAzOTgzMzA0NTEKNSAgIGNvbS5hcHBsZS5KYXZhU2Ny
aXB0Q29yZSAgICAgIAkweDAwNjEyYWJjIEpTQzo6SW50ZXJwcmV0ZXI6OmV4ZWN1dGUoSlNDOjpF
dmFsRXhlY3V0YWJsZSosIEpTQzo6RXhlY1N0YXRlKiwgSlNDOjpKU09iamVjdCosIGludCwgSlND
OjpTY29wZUNoYWluTm9kZSosIEpTQzo6SlNWYWx1ZSopICsgMTI5MgoKVGhyZWFkIDE6ICBEaXNw
YXRjaCBxdWV1ZTogY29tLmFwcGxlLmxpYmRpc3BhdGNoLW1hbmFnZXIKMCAgIGxpYlN5c3RlbS5C
LmR5bGliICAgICAgICAgICAgIAkweDkzYzU5OTQyIGtldmVudCArIDEwCjEgICBsaWJTeXN0ZW0u
Qi5keWxpYiAgICAgICAgICAgICAJMHg5M2M1YTA1YyBfZGlzcGF0Y2hfbWdyX2ludm9rZSArIDIx
NQoyICAgbGliU3lzdGVtLkIuZHlsaWIgICAgICAgICAgICAgCTB4OTNjNTk1MTkgX2Rpc3BhdGNo
X3F1ZXVlX2ludm9rZSArIDE2MwozICAgbGliU3lzdGVtLkIuZHlsaWIgICAgICAgICAgICAgCTB4
OTNjNTkyYmUgX2Rpc3BhdGNoX3dvcmtlcl90aHJlYWQyICsgMjQwCjQgICBsaWJTeXN0ZW0uQi5k
eWxpYiAgICAgICAgICAgICAJMHg5M2M1OGQ0MSBfcHRocmVhZF93cXRocmVhZCArIDM5MAo1ICAg
bGliU3lzdGVtLkIuZHlsaWIgICAgICAgICAgICAgCTB4OTNjNThiODYgc3RhcnRfd3F0aHJlYWQg
KyAzMAoKVGhyZWFkIDI6CjAgICBsaWJTeXN0ZW0uQi5keWxpYiAgICAgICAgICAgICAJMHg5M2M1
ODlkMiBfX3dvcmtxX2tlcm5yZXR1cm4gKyAxMAoxICAgbGliU3lzdGVtLkIuZHlsaWIgICAgICAg
ICAgICAgCTB4OTNjNThmNjggX3B0aHJlYWRfd3F0aHJlYWQgKyA5NDEKMiAgIGxpYlN5c3RlbS5C
LmR5bGliICAgICAgICAgICAgIAkweDkzYzU4Yjg2IHN0YXJ0X3dxdGhyZWFkICsgMzAKClRocmVh
ZCAzOiAgV2ViQ29yZTogSWNvbkRhdGFiYXNlCjAgICBsaWJTeXN0ZW0uQi5keWxpYiAgICAgICAg
ICAgICAJMHg5M2M2MTA2NiBfX3NlbXdhaXRfc2lnbmFsICsgMTAKMSAgIGxpYlN5c3RlbS5CLmR5
bGliICAgICAgICAgICAgIAkweDkzYzYwZDIyIF9wdGhyZWFkX2NvbmRfd2FpdCArIDExOTEKMiAg
IGxpYlN5c3RlbS5CLmR5bGliICAgICAgICAgICAgIAkweDkzYzYyOWI4IHB0aHJlYWRfY29uZF93
YWl0JFVOSVgyMDAzICsgNzMKMyAgIGNvbS5hcHBsZS5XZWJDb3JlICAgICAgICAgICAgIAkweDAw
ZDg2MjVlIFdlYkNvcmU6Okljb25EYXRhYmFzZTo6c3luY1RocmVhZE1haW5Mb29wKCkgKyAyNzAK
NCAgIGNvbS5hcHBsZS5XZWJDb3JlICAgICAgICAgICAgIAkweDAwZDg2MzljIFdlYkNvcmU6Oklj
b25EYXRhYmFzZTo6aWNvbkRhdGFiYXNlU3luY1RocmVhZCgpICsgMTg4CjUgICBsaWJTeXN0ZW0u
Qi5keWxpYiAgICAgICAgICAgICAJMHg5M2M2MDgxZCBfcHRocmVhZF9zdGFydCArIDM0NQo2ICAg
bGliU3lzdGVtLkIuZHlsaWIgICAgICAgICAgICAgCTB4OTNjNjA2YTIgdGhyZWFkX3N0YXJ0ICsg
MzQKClRocmVhZCA0OiAgU2FmYXJpOiBTYWZlQnJvd3NpbmdNYW5hZ2VyCjAgICBsaWJTeXN0ZW0u
Qi5keWxpYiAgICAgICAgICAgICAJMHg5M2MzMzBmYSBtYWNoX21zZ190cmFwICsgMTAKMSAgIGxp
YlN5c3RlbS5CLmR5bGliICAgICAgICAgICAgIAkweDkzYzMzODY3IG1hY2hfbXNnICsgNjgKMiAg
IGNvbS5hcHBsZS5Db3JlRm91bmRhdGlvbiAgICAgIAkweDkzOGEzZmFmIF9fQ0ZSdW5Mb29wUnVu
ICsgMjA3OQozICAgY29tLmFwcGxlLkNvcmVGb3VuZGF0aW9uICAgICAgCTB4OTM4YTMwOTQgQ0ZS
dW5Mb29wUnVuU3BlY2lmaWMgKyA0NTIKNCAgIGNvbS5hcHBsZS5Db3JlRm91bmRhdGlvbiAgICAg
IAkweDkzOGEyZWMxIENGUnVuTG9vcFJ1bkluTW9kZSArIDk3CjUgICBjb20uYXBwbGUuU2FmYXJp
ICAgICAgICAgICAgICAJMHgwMDAyZjRmZiAweDEwMDAgKyAxODk2OTUKNiAgIGNvbS5hcHBsZS5T
YWZhcmkgICAgICAgICAgICAgIAkweDAwMDJmMjQ4IDB4MTAwMCArIDE4OTAwMAo3ICAgY29tLmFw
cGxlLlNhZmFyaSAgICAgICAgICAgICAgCTB4MDAwMmYxZTEgMHgxMDAwICsgMTg4ODk3CjggICBs
aWJTeXN0ZW0uQi5keWxpYiAgICAgICAgICAgICAJMHg5M2M2MDgxZCBfcHRocmVhZF9zdGFydCAr
IDM0NQo5ICAgbGliU3lzdGVtLkIuZHlsaWIgICAgICAgICAgICAgCTB4OTNjNjA2YTIgdGhyZWFk
X3N0YXJ0ICsgMzQKClRocmVhZCA1OgowICAgbGliU3lzdGVtLkIuZHlsaWIgICAgICAgICAgICAg
CTB4OTNjMzMwZmEgbWFjaF9tc2dfdHJhcCArIDEwCjEgICBsaWJTeXN0ZW0uQi5keWxpYiAgICAg
ICAgICAgICAJMHg5M2MzMzg2NyBtYWNoX21zZyArIDY4CjIgICBjb20uYXBwbGUuQ29yZUZvdW5k
YXRpb24gICAgICAJMHg5MzhhM2ZhZiBfX0NGUnVuTG9vcFJ1biArIDIwNzkKMyAgIGNvbS5hcHBs
ZS5Db3JlRm91bmRhdGlvbiAgICAgIAkweDkzOGEzMDk0IENGUnVuTG9vcFJ1blNwZWNpZmljICsg
NDUyCjQgICBjb20uYXBwbGUuQ29yZUZvdW5kYXRpb24gICAgICAJMHg5MzhhMmVjMSBDRlJ1bkxv
b3BSdW5Jbk1vZGUgKyA5Nwo1ICAgY29tLmFwcGxlLkZvdW5kYXRpb24gICAgICAgICAgCTB4OTE3
MjU0MmMgK1tOU1VSTENvbm5lY3Rpb24oTlNVUkxDb25uZWN0aW9uUmVhbGx5SW50ZXJuYWwpIF9y
ZXNvdXJjZUxvYWRMb29wOl0gKyAzMjkKNiAgIGNvbS5hcHBsZS5Gb3VuZGF0aW9uICAgICAgICAg
IAkweDkxNmVjOGQ0IC1bTlNUaHJlYWQgbWFpbl0gKyA0NQo3ICAgY29tLmFwcGxlLkZvdW5kYXRp
b24gICAgICAgICAgCTB4OTE2ZWM4ODQgX19OU1RocmVhZF9fbWFpbl9fICsgMTQ5OQo4ICAgbGli
U3lzdGVtLkIuZHlsaWIgICAgICAgICAgICAgCTB4OTNjNjA4MWQgX3B0aHJlYWRfc3RhcnQgKyAz
NDUKOSAgIGxpYlN5c3RlbS5CLmR5bGliICAgICAgICAgICAgIAkweDkzYzYwNmEyIHRocmVhZF9z
dGFydCArIDM0CgpUaHJlYWQgNjoKMCAgIGxpYlN5c3RlbS5CLmR5bGliICAgICAgICAgICAgIAkw
eDkzYzUyMDg2IHNlbGVjdCREQVJXSU5fRVhUU04gKyAxMAoxICAgY29tLmFwcGxlLkNvcmVGb3Vu
ZGF0aW9uICAgICAgCTB4OTM4ZTM4MGQgX19DRlNvY2tldE1hbmFnZXIgKyAxMDg1CjIgICBsaWJT
eXN0ZW0uQi5keWxpYiAgICAgICAgICAgICAJMHg5M2M2MDgxZCBfcHRocmVhZF9zdGFydCArIDM0
NQozICAgbGliU3lzdGVtLkIuZHlsaWIgICAgICAgICAgICAgCTB4OTNjNjA2YTIgdGhyZWFkX3N0
YXJ0ICsgMzQKClRocmVhZCA3OiAgU2FmYXJpOiBTbmFwc2hvdFN0b3JlCjAgICBsaWJTeXN0ZW0u
Qi5keWxpYiAgICAgICAgICAgICAJMHg5M2M2MTA2NiBfX3NlbXdhaXRfc2lnbmFsICsgMTAKMSAg
IGxpYlN5c3RlbS5CLmR5bGliICAgICAgICAgICAgIAkweDkzYzYwZDIyIF9wdGhyZWFkX2NvbmRf
d2FpdCArIDExOTEKMiAgIGxpYlN5c3RlbS5CLmR5bGliICAgICAgICAgICAgIAkweDkzYzYyOWI4
IHB0aHJlYWRfY29uZF93YWl0JFVOSVgyMDAzICsgNzMKMyAgIGNvbS5hcHBsZS5KYXZhU2NyaXB0
Q29yZSAgICAgIAkweDAwNzRhNTIxIFdURjo6VGhyZWFkQ29uZGl0aW9uOjp0aW1lZFdhaXQoV1RG
OjpNdXRleCYsIGRvdWJsZSkgKyA4MQo0ICAgY29tLmFwcGxlLlNhZmFyaSAgICAgICAgICAgICAg
CTB4MDAwNDU0MDMgMHgxMDAwICsgMjc5NTU1CjUgICBjb20uYXBwbGUuU2FmYXJpICAgICAgICAg
ICAgICAJMHgwMDA0NTM1MyAweDEwMDAgKyAyNzkzNzkKNiAgIGxpYlN5c3RlbS5CLmR5bGliICAg
ICAgICAgICAgIAkweDkzYzYwODFkIF9wdGhyZWFkX3N0YXJ0ICsgMzQ1CjcgICBsaWJTeXN0ZW0u
Qi5keWxpYiAgICAgICAgICAgICAJMHg5M2M2MDZhMiB0aHJlYWRfc3RhcnQgKyAzNAoKVGhyZWFk
IDg6CjAgICBsaWJTeXN0ZW0uQi5keWxpYiAgICAgICAgICAgICAJMHg5M2M1ODlkMiBfX3dvcmtx
X2tlcm5yZXR1cm4gKyAxMAoxICAgbGliU3lzdGVtLkIuZHlsaWIgICAgICAgICAgICAgCTB4OTNj
NThmNjggX3B0aHJlYWRfd3F0aHJlYWQgKyA5NDEKMiAgIGxpYlN5c3RlbS5CLmR5bGliICAgICAg
ICAgICAgIAkweDkzYzU4Yjg2IHN0YXJ0X3dxdGhyZWFkICsgMzAKClRocmVhZCAwIGNyYXNoZWQg
d2l0aCBYODYgVGhyZWFkIFN0YXRlICgzMi1iaXQpOgogIGVheDogMHhmZmZmZmZlZiAgZWJ4OiAw
eGZmZmZmZmVmICBlY3g6IDB4YmZmZmQ2YjQgIGVkeDogMHhiZmZmZDZiNAogIGVkaTogMHhiZmZm
ZDc0NCAgZXNpOiAweDAwMDAwMDAwICBlYnA6IDB4MDAwMDAwMDAgIGVzcDogMHhiZmZmZDY3MAog
ICBzczogMHgwMDAwMDAxZiAgZWZsOiAweDAwMDEwYTA2ICBlaXA6IDB4MDA2ZDExOTAgICBjczog
MHgwMDAwMDAxNwogICBkczogMHgwMDAwMDAxZiAgIGVzOiAweDAwMDAwMDFmICAgZnM6IDB4MDAw
MDAwMDAgICBnczogMHgwMDAwMDAzNwogIGNyMjogMHhiYmFkYmVlZgo=
</data>

          </attachment>
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>70271</attachid>
            <date>2010-10-08 11:29:05 -0700</date>
            <delta_ts>2010-10-08 14:32:53 -0700</delta_ts>
            <desc>Patch adding check for valid subexpression index</desc>
            <filename>47324.patch</filename>
            <type>text/plain</type>
            <size>3309</size>
            <attacher name="Michael Saboff">msaboff</attacher>
            
              <data encoding="base64">SW5kZXg6IEphdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBKYXZhU2NyaXB0
Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDY5NDExKQorKysgSmF2YVNjcmlwdENvcmUvQ2hhbmdl
TG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTQgQEAKKzIwMTAtMTAtMDggIE1pY2hhZWwg
U2Fib2ZmICA8bXNhYm9mZkBhcHBsZS5jb20+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZ
IChPT1BTISkuCisKKyAgICAgICAgQWRkZWQgY2hlY2sgdG8gc3RhcnQgb2Ygc3ViZXhwcmVzc2lv
biBiZWluZyBwb3NpdGl2ZSBiZWZvcmUgdXNpbmcKKyAgICAgICAgc3ViZXhwcmVzc2lvbiBpbiBy
ZXBsYWNlbWVudC4KKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dp
P2lkPTQ3MzI0CisKKyAgICAgICAgKiBydW50aW1lL1N0cmluZ1Byb3RvdHlwZS5jcHA6CisgICAg
ICAgIChKU0M6OnN1YnN0aXR1dGVCYWNrcmVmZXJlbmNlc1Nsb3cpOgorCiAyMDEwLTEwLTA3ICBE
YXZpZCBHb29kd2luICA8ZGF2aWRfZ29vZHdpbkBhcHBsZS5jb20+CiAKICAgICAgICAgUmV2aWV3
ZWQgYnkgT2xpdmVyIEh1bnQuCkluZGV4OiBKYXZhU2NyaXB0Q29yZS9ydW50aW1lL1N0cmluZ1By
b3RvdHlwZS5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PQotLS0gSmF2YVNjcmlwdENvcmUvcnVudGltZS9TdHJpbmdQ
cm90b3R5cGUuY3BwCShyZXZpc2lvbiA2OTM0OCkKKysrIEphdmFTY3JpcHRDb3JlL3J1bnRpbWUv
U3RyaW5nUHJvdG90eXBlLmNwcAkod29ya2luZyBjb3B5KQpAQCAtMjA2LDcgKzIwNiw4IEBAIHN0
YXRpYyBORVZFUl9JTkxJTkUgVVN0cmluZyBzdWJzdGl0dXRlQmEKICAgICAgICAgICAgIHN1YnN0
aXR1dGVkUmVwbGFjZW1lbnQuYXBwZW5kKHJlcGxhY2VtZW50LmNoYXJhY3RlcnMoKSArIG9mZnNl
dCwgaSAtIG9mZnNldCk7CiAgICAgICAgIGkgKz0gMSArIGFkdmFuY2U7CiAgICAgICAgIG9mZnNl
dCA9IGkgKyAxOwotICAgICAgICBzdWJzdGl0dXRlZFJlcGxhY2VtZW50LmFwcGVuZChzb3VyY2Uu
Y2hhcmFjdGVycygpICsgYmFja3JlZlN0YXJ0LCBiYWNrcmVmTGVuZ3RoKTsKKyAgICAgICAgaWYg
KGJhY2tyZWZTdGFydCA+PSAwKQorICAgICAgICAgICAgc3Vic3RpdHV0ZWRSZXBsYWNlbWVudC5h
cHBlbmQoc291cmNlLmNoYXJhY3RlcnMoKSArIGJhY2tyZWZTdGFydCwgYmFja3JlZkxlbmd0aCk7
CiAgICAgfSB3aGlsZSAoKGkgPSByZXBsYWNlbWVudC5maW5kKCckJywgaSArIDEpKSAhPSBub3RG
b3VuZCk7CiAKICAgICBpZiAocmVwbGFjZW1lbnQubGVuZ3RoKCkgLSBvZmZzZXQpCkluZGV4OiBM
YXlvdXRUZXN0cy9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvQ2hhbmdlTG9n
CShyZXZpc2lvbiA2OTQxMSkKKysrIExheW91dFRlc3RzL0NoYW5nZUxvZwkod29ya2luZyBjb3B5
KQpAQCAtMSwzICsxLDE0IEBACisyMDEwLTEwLTA4ICBNaWNoYWVsIFNhYm9mZiAgPG1zYWJvZmZA
YXBwbGUuY29tPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAg
ICAgIEFkZGVkIHRlc3QgY2FzZSB0byB2ZXJpZnkgc3ViZXhwcmVzc2lvbiB0aGF0IGRpZG4ndCBt
YXRjaCBpcyBub3QKKyAgICAgICAgaW5jbHVkZWQgaW4gcmVwbGFjZW1lbnQuCisgICAgICAgIGh0
dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD00NzMyNAorCisgICAgICAgICog
ZmFzdC9qcy9zY3JpcHQtdGVzdHMvc3RyaW5nLXJlcGxhY2UtMy5qczoKKyAgICAgICAgKiBmYXN0
L2pzL3N0cmluZy1yZXBsYWNlLTMtZXhwZWN0ZWQudHh0OgorCiAyMDEwLTEwLTA4ICBSZW5hdGEg
SG9kb3ZhbiAgPHJlbmlAaW5mLnUtc3plZ2VkLmh1PgogCiAgICAgICAgIFJldmlld2VkIGJ5IE5p
a29sYXMgWmltbWVybWFubi4KSW5kZXg6IExheW91dFRlc3RzL2Zhc3QvanMvc3RyaW5nLXJlcGxh
Y2UtMy1leHBlY3RlZC50eHQKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvZmFzdC9qcy9zdHJp
bmctcmVwbGFjZS0zLWV4cGVjdGVkLnR4dAkocmV2aXNpb24gNjkzNDgpCisrKyBMYXlvdXRUZXN0
cy9mYXN0L2pzL3N0cmluZy1yZXBsYWNlLTMtZXhwZWN0ZWQudHh0CSh3b3JraW5nIGNvcHkpCkBA
IC0xOSw2ICsxOSw3IEBAIFBBU1MgKCcnICsgdHdvQ2hhciArIHR3b0NoYXIgKyB0d29DaGFyKS4K
IFBBU1MgKCcnICsgdHdvQ2hhciArIHR3b0NoYXIgKyB0d29DaGFyKS5yZXBsYWNlKCdhYScsICdi
JykgaXMgJ2JhYWFhJwogUEFTUyAoJycgKyB0d29DaGFyICsgdHdvQ2hhciArIHR3b0NoYXIpLnJl
cGxhY2UoJ2FhJywgJ2JiJykgaXMgJ2JiYWFhYScKIFBBU1MgKCcnICsgdHdvQ2hhciArIHR3b0No
YXIgKyB0d29DaGFyKS5yZXBsYWNlKCdhJywgJ2JiJykgaXMgJ2JiYWFhYWEnCitQQVNTICciJy5y
ZXBsYWNlKC8oW15cXSk/KFsiJ10pL2csICckMVwkMicpIGlzICciJwogUEFTUyBzdWNjZXNzZnVs
bHlQYXJzZWQgaXMgdHJ1ZQogCiBURVNUIENPTVBMRVRFCkluZGV4OiBMYXlvdXRUZXN0cy9mYXN0
L2pzL3NjcmlwdC10ZXN0cy9zdHJpbmctcmVwbGFjZS0zLmpzCj09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExheW91
dFRlc3RzL2Zhc3QvanMvc2NyaXB0LXRlc3RzL3N0cmluZy1yZXBsYWNlLTMuanMJKHJldmlzaW9u
IDY5MzQ4KQorKysgTGF5b3V0VGVzdHMvZmFzdC9qcy9zY3JpcHQtdGVzdHMvc3RyaW5nLXJlcGxh
Y2UtMy5qcwkod29ya2luZyBjb3B5KQpAQCAtMzcsNCArMzcsNiBAQCBzaG91bGRCZSgiKCcnICsg
dHdvQ2hhciArIHR3b0NoYXIgKyB0d29DCiBzaG91bGRCZSgiKCcnICsgdHdvQ2hhciArIHR3b0No
YXIgKyB0d29DaGFyKS5yZXBsYWNlKCdhYScsICdiYicpIiwgIidiYmFhYWEnIik7CiBzaG91bGRC
ZSgiKCcnICsgdHdvQ2hhciArIHR3b0NoYXIgKyB0d29DaGFyKS5yZXBsYWNlKCdhJywgJ2JiJyki
LCAiJ2JiYWFhYWEnIik7CiAKK3Nob3VsZEJlKCInXCInLnJlcGxhY2UoLyhbXlxcXSk/KFtcIidd
KS9nLCAnJDFcXCQyJykiLCAiJ1wiJyIpOworCiB2YXIgc3VjY2Vzc2Z1bGx5UGFyc2VkID0gdHJ1
ZTsK
</data>

          </attachment>
      

    </bug>

</bugzilla>