From 80256c7452b04fd920563071c4e9996d3626f5ea Mon Sep 17 00:00:00 2001
From: "erik.corry@gmail.com"
 <erik.corry@gmail.com@ce2b1a6d-e550-0410-aec6-3dcde31c8c00>
Date: Mon, 7 May 2012 13:23:56 +0000
Subject: [PATCH] Fix crash bug in VisitChoice (bug=126272). Review URL:
 https://chromiumcodereview.appspot.com/10332035

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11519 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
---
 src/jsregexp.cc                  | 17 ++++++++++++-----
 test/mjsunit/regexp-capture-3.js |  4 ++++
 2 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/src/jsregexp.cc b/src/jsregexp.cc
index 54f6818..3455abc 100644
--- a/src/jsregexp.cc
+++ b/src/jsregexp.cc
@@ -2722,8 +2722,8 @@ RegExpNode* ChoiceNode::FilterASCII(int depth) {
     GuardedAlternative alternative = alternatives_->at(i);
     RegExpNode* replacement = alternative.node()->FilterASCII(depth - 1);
     ASSERT(replacement != this);  // No missing EMPTY_MATCH_CHECK.
-    alternatives_->at(i).set_node(replacement);
     if (replacement != NULL) {
+      alternatives_->at(i).set_node(replacement);
       surviving++;
       survivor = replacement;
     }
@@ -2739,9 +2739,11 @@ RegExpNode* ChoiceNode::FilterASCII(int depth) {
   ZoneList<GuardedAlternative>* new_alternatives =
       new ZoneList<GuardedAlternative>(surviving);
   for (int i = 0; i < choice_count; i++) {
-    GuardedAlternative alternative = alternatives_->at(i);
-    if (alternative.node() != NULL) {
-      new_alternatives->Add(alternative);
+    RegExpNode* replacement =
+        alternatives_->at(i).node()->FilterASCII(depth - 1);
+    if (replacement != NULL) {
+      alternatives_->at(i).set_node(replacement);
+      new_alternatives->Add(alternatives_->at(i));
     }
   }
   alternatives_ = new_alternatives;
@@ -5832,7 +5834,12 @@ RegExpEngine::CompilationResult RegExpEngine::Compile(
       node = loop_node;
     }
   }
-  if (is_ascii) node = node->FilterASCII(RegExpCompiler::kMaxRecursion);
+  if (is_ascii) {
+    node = node->FilterASCII(RegExpCompiler::kMaxRecursion);
+    // Do it again to propagate the new nodes to places where they were not
+    // put because they had not been calculated yet.
+    if (node != NULL) node = node->FilterASCII(RegExpCompiler::kMaxRecursion);
+  }
 
   if (node == NULL) node = new EndNode(EndNode::BACKTRACK);
   data->node = node;
diff --git a/test/mjsunit/regexp-capture-3.js b/test/mjsunit/regexp-capture-3.js
index 5cf7d8d..9bdd600 100755
--- a/test/mjsunit/regexp-capture-3.js
+++ b/test/mjsunit/regexp-capture-3.js
@@ -212,3 +212,7 @@ regex9.exec(input0);
 
 var regex10 = new RegExp(re, "i");
 regex10.exec(input0);
+
+var regex11 = /^(?:[^\u0000-\u0080]|[0-9a-z?,.!&\s#()])+$/i;
+regex11.exec(input0);
+
-- 
2.7.4