johnson 2.0.0.pre1 → 2.0.0.pre2

data/vendor/spidermonkey/jsregexp.c

@@ -1,4364 +0,0 @@
-/* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
- * vim: set sw=4 ts=8 et tw=78:
- *
- * ***** BEGIN LICENSE BLOCK *****
- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
- *
- * The contents of this file are subject to the Mozilla Public License Version
- * 1.1 (the "License"); you may not use this file except in compliance with
- * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/
- *
- * Software distributed under the License is distributed on an "AS IS" basis,
- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
- * for the specific language governing rights and limitations under the
- * License.
- *
- * The Original Code is Mozilla Communicator client code, released
- * March 31, 1998.
- *
- * The Initial Developer of the Original Code is
- * Netscape Communications Corporation.
- * Portions created by the Initial Developer are Copyright (C) 1998
- * the Initial Developer. All Rights Reserved.
- *
- * Contributor(s):
- *
- * Alternatively, the contents of this file may be used under the terms of
- * either of the GNU General Public License Version 2 or later (the "GPL"),
- * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
- * in which case the provisions of the GPL or the LGPL are applicable instead
- * of those above. If you wish to allow use of your version of this file only
- * under the terms of either the GPL or the LGPL, and not to allow others to
- * use your version of this file under the terms of the MPL, indicate your
- * decision by deleting the provisions above and replace them with the notice
- * and other provisions required by the GPL or the LGPL. If you do not delete
- * the provisions above, a recipient may use your version of this file under
- * the terms of any one of the MPL, the GPL or the LGPL.
- *
- * ***** END LICENSE BLOCK ***** */
-
-/*
- * JS regular expressions, after Perl.
- */
-#include "jsstddef.h"
-#include <stdlib.h>
-#include <string.h>
-#include <stdarg.h>
-#include "jstypes.h"
-#include "jsarena.h" /* Added by JSIFY */
-#include "jsutil.h" /* Added by JSIFY */
-#include "jsapi.h"
-#include "jsarray.h"
-#include "jsatom.h"
-#include "jscntxt.h"
-#include "jsconfig.h"
-#include "jsfun.h"
-#include "jsgc.h"
-#include "jsinterp.h"
-#include "jslock.h"
-#include "jsnum.h"
-#include "jsobj.h"
-#include "jsopcode.h"
-#include "jsregexp.h"
-#include "jsscan.h"
-#include "jsscope.h"
-#include "jsstr.h"
-
-typedef enum REOp {
-#define REOP_DEF(opcode, name) opcode,
-#include "jsreops.tbl"
-#undef REOP_DEF
-    REOP_LIMIT /* META: no operator >= to this */
-} REOp;
-
-#define REOP_IS_SIMPLE(op)  ((op) <= REOP_NCLASS)
-
-#ifdef REGEXP_DEBUG
-const char *reop_names[] = {
-#define REOP_DEF(opcode, name) name,
-#include "jsreops.tbl"
-#undef REOP_DEF
-    NULL
-};
-#endif
-
-#ifdef __GNUC__
-static int
-re_debug(const char *fmt, ...) __attribute__ ((format(printf, 1, 2)));
-#endif
-
-#ifdef REGEXP_DEBUG
-static int
-re_debug(const char *fmt, ...)
-{
-    va_list ap;
-    int retval;
-
-    va_start(ap, fmt);
-    retval = vprintf(fmt, ap);
-    va_end(ap);
-    return retval;
-}
-
-static void
-re_debug_chars(const jschar *chrs, size_t length)
-{
-    int i = 0;
-
-    printf(" \"");
-    while (*chrs && i++ < length) {
-        putchar((char)*chrs++);
-    }
-    printf("\"");
-}
-#else  /* !REGEXP_DEBUG */
-/* This should be optimized to a no-op by our tier-1 compilers. */
-static int
-re_debug(const char *fmt, ...)
-{
-    return 0;
-}
-
-static void
-re_debug_chars(const jschar *chrs, size_t length)
-{
-}
-#endif /* !REGEXP_DEBUG */
-
-struct RENode {
-    REOp            op;         /* r.e. op bytecode */
-    RENode          *next;      /* next in concatenation order */
-    void            *kid;       /* first operand */
-    union {
-        void        *kid2;      /* second operand */
-        jsint       num;        /* could be a number */
-        size_t      parenIndex; /* or a parenthesis index */
-        struct {                /* or a quantifier range */
-            uintN  min;
-            uintN  max;
-            JSPackedBool greedy;
-        } range;
-        struct {                /* or a character class */
-            size_t  startIndex;
-            size_t  kidlen;     /* length of string at kid, in jschars */
-            size_t  index;      /* index into class list */
-            uint16  bmsize;     /* bitmap size, based on max char code */
-            JSPackedBool sense;
-        } ucclass;
-        struct {                /* or a literal sequence */
-            jschar  chr;        /* of one character */
-            size_t  length;     /* or many (via the kid) */
-        } flat;
-        struct {
-            RENode  *kid2;      /* second operand from ALT */
-            jschar  ch1;        /* match char for ALTPREREQ */
-            jschar  ch2;        /* ditto, or class index for ALTPREREQ2 */
-        } altprereq;
-    } u;
-};
-
-#define RE_IS_LETTER(c)     (((c >= 'A') && (c <= 'Z')) ||                    \
-                             ((c >= 'a') && (c <= 'z')) )
-#define RE_IS_LINE_TERM(c)  ((c == '\n') || (c == '\r') ||                    \
-                             (c == LINE_SEPARATOR) || (c == PARA_SEPARATOR))
-
-#define CLASS_CACHE_SIZE    4
-
-typedef struct CompilerState {
-    JSContext       *context;
-    JSTokenStream   *tokenStream; /* For reporting errors */
-    const jschar    *cpbegin;
-    const jschar    *cpend;
-    const jschar    *cp;
-    size_t          parenCount;
-    size_t          classCount;   /* number of [] encountered */
-    size_t          treeDepth;    /* maximum depth of parse tree */
-    size_t          progLength;   /* estimated bytecode length */
-    RENode          *result;
-    size_t          classBitmapsMem; /* memory to hold all class bitmaps */
-    struct {
-        const jschar *start;        /* small cache of class strings */
-        size_t length;              /* since they're often the same */
-        size_t index;
-    } classCache[CLASS_CACHE_SIZE];
-    uint16          flags;
-} CompilerState;
-
-typedef struct EmitStateStackEntry {
-    jsbytecode      *altHead;       /* start of REOP_ALT* opcode */
-    jsbytecode      *nextAltFixup;  /* fixup pointer to next-alt offset */
-    jsbytecode      *nextTermFixup; /* fixup ptr. to REOP_JUMP offset */
-    jsbytecode      *endTermFixup;  /* fixup ptr. to REOPT_ALTPREREQ* offset */
-    RENode          *continueNode;  /* original REOP_ALT* node being stacked */
-    jsbytecode      continueOp;     /* REOP_JUMP or REOP_ENDALT continuation */
-    JSPackedBool    jumpToJumpFlag; /* true if we've patched jump-to-jump to
-                                       avoid 16-bit unsigned offset overflow */
-} EmitStateStackEntry;
-
-/*
- * Immediate operand sizes and getter/setters.  Unlike the ones in jsopcode.h,
- * the getters and setters take the pc of the offset, not of the opcode before
- * the offset.
- */
-#define ARG_LEN             2
-#define GET_ARG(pc)         ((uint16)(((pc)[0] << 8) | (pc)[1]))
-#define SET_ARG(pc, arg)    ((pc)[0] = (jsbytecode) ((arg) >> 8),       \
-                             (pc)[1] = (jsbytecode) (arg))
-
-#define OFFSET_LEN          ARG_LEN
-#define OFFSET_MAX          (JS_BIT(ARG_LEN * 8) - 1)
-#define GET_OFFSET(pc)      GET_ARG(pc)
-
-/*
- * Maximum supported tree depth is maximum size of EmitStateStackEntry stack.
- * For sanity, we limit it to 2^24 bytes.
- */
-#define TREE_DEPTH_MAX  (JS_BIT(24) / sizeof(EmitStateStackEntry))
-
-/*
- * The maximum memory that can be allocated for class bitmaps.
- * For sanity, we limit it to 2^24 bytes.
- */
-#define CLASS_BITMAPS_MEM_LIMIT JS_BIT(24)
-
-/*
- * Functions to get size and write/read bytecode that represent small indexes
- * compactly.
- * Each byte in the code represent 7-bit chunk of the index. 8th bit when set
- * indicates that the following byte brings more bits to the index. Otherwise
- * this is the last byte in the index bytecode representing highest index bits.
- */
-static size_t
-GetCompactIndexWidth(size_t index)
-{
-    size_t width;
-
-    for (width = 1; (index >>= 7) != 0; ++width) { }
-    return width;
-}
-
-static JS_INLINE jsbytecode *
-WriteCompactIndex(jsbytecode *pc, size_t index)
-{
-    size_t next;
-
-    while ((next = index >> 7) != 0) {
-        *pc++ = (jsbytecode)(index | 0x80);
-        index = next;
-    }
-    *pc++ = (jsbytecode)index;
-    return pc;
-}
-
-static JS_INLINE jsbytecode *
-ReadCompactIndex(jsbytecode *pc, size_t *result)
-{
-    size_t nextByte;
-
-    nextByte = *pc++;
-    if ((nextByte & 0x80) == 0) {
-        /*
-         * Short-circuit the most common case when compact index <= 127.
-         */
-        *result = nextByte;
-    } else {
-        size_t shift = 7;
-        *result = 0x7F & nextByte;
-        do {
-            nextByte = *pc++;
-            *result |= (nextByte & 0x7F) << shift;
-            shift += 7;
-        } while ((nextByte & 0x80) != 0);
-    }
-    return pc;
-}
-
-typedef struct RECapture {
-    ptrdiff_t index;           /* start of contents, -1 for empty  */
-    size_t length;             /* length of capture */
-} RECapture;
-
-typedef struct REMatchState {
-    const jschar *cp;
-    RECapture parens[1];      /* first of 're->parenCount' captures,
-                                 allocated at end of this struct */
-} REMatchState;
-
-struct REBackTrackData;
-
-typedef struct REProgState {
-    jsbytecode *continue_pc;        /* current continuation data */
-    jsbytecode continue_op;
-    ptrdiff_t index;                /* progress in text */
-    size_t parenSoFar;              /* highest indexed paren started */
-    union {
-        struct {
-            uintN min;             /* current quantifier limits */
-            uintN max;
-        } quantifier;
-        struct {
-            size_t top;             /* backtrack stack state */
-            size_t sz;
-        } assertion;
-    } u;
-} REProgState;
-
-typedef struct REBackTrackData {
-    size_t sz;                      /* size of previous stack entry */
-    jsbytecode *backtrack_pc;       /* where to backtrack to */
-    jsbytecode backtrack_op;
-    const jschar *cp;               /* index in text of match at backtrack */
-    size_t parenIndex;              /* start index of saved paren contents */
-    size_t parenCount;              /* # of saved paren contents */
-    size_t saveStateStackTop;       /* number of parent states */
-    /* saved parent states follow */
-    /* saved paren contents follow */
-} REBackTrackData;
-
-#define INITIAL_STATESTACK  100
-#define INITIAL_BACKTRACK   8000
-
-typedef struct REGlobalData {
-    JSContext *cx;
-    JSRegExp *regexp;               /* the RE in execution */
-    JSBool ok;                      /* runtime error (out_of_memory only?) */
-    size_t start;                   /* offset to start at */
-    ptrdiff_t skipped;              /* chars skipped anchoring this r.e. */
-    const jschar    *cpbegin;       /* text base address */
-    const jschar    *cpend;         /* text limit address */
-
-    REProgState *stateStack;        /* stack of state of current parents */
-    size_t stateStackTop;
-    size_t stateStackLimit;
-
-    REBackTrackData *backTrackStack;/* stack of matched-so-far positions */
-    REBackTrackData *backTrackSP;
-    size_t backTrackStackSize;
-    size_t cursz;                   /* size of current stack entry */
-    size_t backTrackCount;          /* how many times we've backtracked */
-    size_t backTrackLimit;          /* upper limit on backtrack states */
-
-    JSArenaPool     pool;           /* It's faster to use one malloc'd pool
-                                       than to malloc/free the three items
-                                       that are allocated from this pool */
-} REGlobalData;
-
-/*
- * 1. If IgnoreCase is false, return ch.
- * 2. Let u be ch converted to upper case as if by calling
- *    String.prototype.toUpperCase on the one-character string ch.
- * 3. If u does not consist of a single character, return ch.
- * 4. Let cu be u's character.
- * 5. If ch's code point value is greater than or equal to decimal 128 and cu's
- *    code point value is less than decimal 128, then return ch.
- * 6. Return cu.
- */
-static JS_INLINE uintN
-upcase(uintN ch)
-{
-    uintN cu;
-
-    JS_ASSERT((uintN) (jschar) ch == ch);
-    if (ch < 128) {
-        if (ch - (uintN) 'a' <= (uintN) ('z' - 'a'))
-            ch -= (uintN) ('a' - 'A');
-        return ch;
-    }
-
-    cu = JS_TOUPPER(ch);
-    return (cu < 128) ? ch : cu;
-}
-
-static JS_INLINE uintN
-downcase(uintN ch)
-{
-    JS_ASSERT((uintN) (jschar) ch == ch);
-    if (ch < 128) {
-        if (ch - (uintN) 'A' <= (uintN) ('Z' - 'A'))
-            ch += (uintN) ('a' - 'A');
-        return ch;
-    }
-
-    return JS_TOLOWER(ch);
-}
-
-/* Construct and initialize an RENode, returning NULL for out-of-memory */
-static RENode *
-NewRENode(CompilerState *state, REOp op)
-{
-    JSContext *cx;
-    RENode *ren;
-
-    cx = state->context;
-    JS_ARENA_ALLOCATE_CAST(ren, RENode *, &cx->tempPool, sizeof *ren);
-    if (!ren) {
-        js_ReportOutOfScriptQuota(cx);
-        return NULL;
-    }
-    ren->op = op;
-    ren->next = NULL;
-    ren->kid = NULL;
-    return ren;
-}
-
-/*
- * Validates and converts hex ascii value.
- */
-static JSBool
-isASCIIHexDigit(jschar c, uintN *digit)
-{
-    uintN cv = c;
-
-    if (cv < '0')
-        return JS_FALSE;
-    if (cv <= '9') {
-        *digit = cv - '0';
-        return JS_TRUE;
-    }
-    cv |= 0x20;
-    if (cv >= 'a' && cv <= 'f') {
-        *digit = cv - 'a' + 10;
-        return JS_TRUE;
-    }
-    return JS_FALSE;
-}
-
-
-typedef struct {
-    REOp op;
-    const jschar *errPos;
-    size_t parenIndex;
-} REOpData;
-
-static JSBool
-ReportRegExpErrorHelper(CompilerState *state, uintN flags, uintN errorNumber,
-                        const jschar *arg)
-{
-    if (state->tokenStream) {
-        return js_ReportCompileErrorNumber(state->context, state->tokenStream,
-                                           NULL, JSREPORT_UC | flags,
-                                           errorNumber, arg);
-    }
-    return JS_ReportErrorFlagsAndNumberUC(state->context, flags,
-                                          js_GetErrorMessage, NULL,
-                                          errorNumber, arg);
-}
-
-static JSBool
-ReportRegExpError(CompilerState *state, uintN flags, uintN errorNumber)
-{
-    return ReportRegExpErrorHelper(state, flags, errorNumber, NULL);
-}
-
-/*
- * Process the op against the two top operands, reducing them to a single
- * operand in the penultimate slot. Update progLength and treeDepth.
- */
-static JSBool
-ProcessOp(CompilerState *state, REOpData *opData, RENode **operandStack,
-          intN operandSP)
-{
-    RENode *result;
-
-    switch (opData->op) {
-      case REOP_ALT:
-        result = NewRENode(state, REOP_ALT);
-        if (!result)
-            return JS_FALSE;
-        result->kid = operandStack[operandSP - 2];
-        result->u.kid2 = operandStack[operandSP - 1];
-        operandStack[operandSP - 2] = result;
-
-        if (state->treeDepth == TREE_DEPTH_MAX) {
-            ReportRegExpError(state, JSREPORT_ERROR, JSMSG_REGEXP_TOO_COMPLEX);
-            return JS_FALSE;
-        }
-        ++state->treeDepth;
-
-        /*
-         * Look at both alternates to see if there's a FLAT or a CLASS at
-         * the start of each. If so, use a prerequisite match.
-         */
-        if (((RENode *) result->kid)->op == REOP_FLAT &&
-            ((RENode *) result->u.kid2)->op == REOP_FLAT &&
-            (state->flags & JSREG_FOLD) == 0) {
-            result->op = REOP_ALTPREREQ;
-            result->u.altprereq.ch1 = ((RENode *) result->kid)->u.flat.chr;
-            result->u.altprereq.ch2 = ((RENode *) result->u.kid2)->u.flat.chr;
-            /* ALTPREREQ, <end>, uch1, uch2, <next>, ...,
-                                            JUMP, <end> ... ENDALT */
-            state->progLength += 13;
-        }
-        else
-        if (((RENode *) result->kid)->op == REOP_CLASS &&
-            ((RENode *) result->kid)->u.ucclass.index < 256 &&
-            ((RENode *) result->u.kid2)->op == REOP_FLAT &&
-            (state->flags & JSREG_FOLD) == 0) {
-            result->op = REOP_ALTPREREQ2;
-            result->u.altprereq.ch1 = ((RENode *) result->u.kid2)->u.flat.chr;
-            result->u.altprereq.ch2 = ((RENode *) result->kid)->u.ucclass.index;
-            /* ALTPREREQ2, <end>, uch1, uch2, <next>, ...,
-                                            JUMP, <end> ... ENDALT */
-            state->progLength += 13;
-        }
-        else
-        if (((RENode *) result->kid)->op == REOP_FLAT &&
-            ((RENode *) result->u.kid2)->op == REOP_CLASS &&
-            ((RENode *) result->u.kid2)->u.ucclass.index < 256 &&
-            (state->flags & JSREG_FOLD) == 0) {
-            result->op = REOP_ALTPREREQ2;
-            result->u.altprereq.ch1 = ((RENode *) result->kid)->u.flat.chr;
-            result->u.altprereq.ch2 =
-                ((RENode *) result->u.kid2)->u.ucclass.index;
-            /* ALTPREREQ2, <end>, uch1, uch2, <next>, ...,
-                                          JUMP, <end> ... ENDALT */
-            state->progLength += 13;
-        }
-        else {
-            /* ALT, <next>, ..., JUMP, <end> ... ENDALT */
-            state->progLength += 7;
-        }
-        break;
-
-      case REOP_CONCAT:
-        result = operandStack[operandSP - 2];
-        while (result->next)
-            result = result->next;
-        result->next = operandStack[operandSP - 1];
-        break;
-
-      case REOP_ASSERT:
-      case REOP_ASSERT_NOT:
-      case REOP_LPARENNON:
-      case REOP_LPAREN:
-        /* These should have been processed by a close paren. */
-        ReportRegExpErrorHelper(state, JSREPORT_ERROR, JSMSG_MISSING_PAREN,
-                                opData->errPos);
-        return JS_FALSE;
-
-      default:;
-    }
-    return JS_TRUE;
-}
-
-/*
- * Parser forward declarations.
- */
-static JSBool ParseTerm(CompilerState *state);
-static JSBool ParseQuantifier(CompilerState *state);
-static intN ParseMinMaxQuantifier(CompilerState *state, JSBool ignoreValues);
-
-/*
- * Top-down regular expression grammar, based closely on Perl4.
- *
- *  regexp:     altern                  A regular expression is one or more
- *              altern '|' regexp       alternatives separated by vertical bar.
- */
-#define INITIAL_STACK_SIZE  128
-
-static JSBool
-ParseRegExp(CompilerState *state)
-{
-    size_t parenIndex;
-    RENode *operand;
-    REOpData *operatorStack;
-    RENode **operandStack;
-    REOp op;
-    intN i;
-    JSBool result = JS_FALSE;
-
-    intN operatorSP = 0, operatorStackSize = INITIAL_STACK_SIZE;
-    intN operandSP = 0, operandStackSize = INITIAL_STACK_SIZE;
-
-    /* Watch out for empty regexp */
-    if (state->cp == state->cpend) {
-        state->result = NewRENode(state, REOP_EMPTY);
-        return (state->result != NULL);
-    }
-
-    operatorStack = (REOpData *)
-        JS_malloc(state->context, sizeof(REOpData) * operatorStackSize);
-    if (!operatorStack)
-        return JS_FALSE;
-
-    operandStack = (RENode **)
-        JS_malloc(state->context, sizeof(RENode *) * operandStackSize);
-    if (!operandStack)
-        goto out;
-
-    for (;;) {
-        parenIndex = state->parenCount;
-        if (state->cp == state->cpend) {
-            /*
-             * If we are at the end of the regexp and we're short one or more
-             * operands, the regexp must have the form /x|/ or some such, with
-             * left parentheses making us short more than one operand.
-             */
-            if (operatorSP >= operandSP) {
-                operand = NewRENode(state, REOP_EMPTY);
-                if (!operand)
-                    goto out;
-                goto pushOperand;
-            }
-        } else {
-            switch (*state->cp) {
-              case '(':
-                ++state->cp;
-                if (state->cp + 1 < state->cpend &&
-                    *state->cp == '?' &&
-                    (state->cp[1] == '=' ||
-                     state->cp[1] == '!' ||
-                     state->cp[1] == ':')) {
-                    switch (state->cp[1]) {
-                      case '=':
-                        op = REOP_ASSERT;
-                        /* ASSERT, <next>, ... ASSERTTEST */
-                        state->progLength += 4;
-                        break;
-                      case '!':
-                        op = REOP_ASSERT_NOT;
-                        /* ASSERTNOT, <next>, ... ASSERTNOTTEST */
-                        state->progLength += 4;
-                        break;
-                      default:
-                        op = REOP_LPARENNON;
-                        break;
-                    }
-                    state->cp += 2;
-                } else {
-                    op = REOP_LPAREN;
-                    /* LPAREN, <index>, ... RPAREN, <index> */
-                    state->progLength
-                        += 2 * (1 + GetCompactIndexWidth(parenIndex));
-                    state->parenCount++;
-                    if (state->parenCount == 65535) {
-                        ReportRegExpError(state, JSREPORT_ERROR,
-                                          JSMSG_TOO_MANY_PARENS);
-                        goto out;
-                    }
-                }
-                goto pushOperator;
-
-              case ')':
-                /*
-                 * If there's no stacked open parenthesis, throw syntax error.
-                 */
-                for (i = operatorSP - 1; ; i--) {
-                    if (i < 0) {
-                        ReportRegExpError(state, JSREPORT_ERROR,
-                                          JSMSG_UNMATCHED_RIGHT_PAREN);
-                        goto out;
-                    }
-                    if (operatorStack[i].op == REOP_ASSERT ||
-                        operatorStack[i].op == REOP_ASSERT_NOT ||
-                        operatorStack[i].op == REOP_LPARENNON ||
-                        operatorStack[i].op == REOP_LPAREN) {
-                        break;
-                    }
-                }
-                /* FALL THROUGH */
-
-              case '|':
-                /* Expected an operand before these, so make an empty one */
-                operand = NewRENode(state, REOP_EMPTY);
-                if (!operand)
-                    goto out;
-                goto pushOperand;
-
-              default:
-                if (!ParseTerm(state))
-                    goto out;
-                operand = state->result;
-pushOperand:
-                if (operandSP == operandStackSize) {
-                    RENode **tmp;
-                    operandStackSize += operandStackSize;
-                    tmp = (RENode **)
-                        JS_realloc(state->context, operandStack,
-                                   sizeof(RENode *) * operandStackSize);
-                    if (!tmp)
-                        goto out;
-                    operandStack = tmp;
-                }
-                operandStack[operandSP++] = operand;
-                break;
-            }
-        }
-
-        /* At the end; process remaining operators. */
-restartOperator:
-        if (state->cp == state->cpend) {
-            while (operatorSP) {
-                --operatorSP;
-                if (!ProcessOp(state, &operatorStack[operatorSP],
-                               operandStack, operandSP))
-                    goto out;
-                --operandSP;
-            }
-            JS_ASSERT(operandSP == 1);
-            state->result = operandStack[0];
-            result = JS_TRUE;
-            goto out;
-        }
-
-        switch (*state->cp) {
-          case '|':
-            /* Process any stacked 'concat' operators */
-            ++state->cp;
-            while (operatorSP &&
-                   operatorStack[operatorSP - 1].op == REOP_CONCAT) {
-                --operatorSP;
-                if (!ProcessOp(state, &operatorStack[operatorSP],
-                               operandStack, operandSP)) {
-                    goto out;
-                }
-                --operandSP;
-            }
-            op = REOP_ALT;
-            goto pushOperator;
-
-          case ')':
-            /*
-             * If there's no stacked open parenthesis, throw syntax error.
-             */
-            for (i = operatorSP - 1; ; i--) {
-                if (i < 0) {
-                    ReportRegExpError(state, JSREPORT_ERROR,
-                                      JSMSG_UNMATCHED_RIGHT_PAREN);
-                    goto out;
-                }
-                if (operatorStack[i].op == REOP_ASSERT ||
-                    operatorStack[i].op == REOP_ASSERT_NOT ||
-                    operatorStack[i].op == REOP_LPARENNON ||
-                    operatorStack[i].op == REOP_LPAREN) {
-                    break;
-                }
-            }
-            ++state->cp;
-
-            /* Process everything on the stack until the open parenthesis. */
-            for (;;) {
-                JS_ASSERT(operatorSP);
-                --operatorSP;
-                switch (operatorStack[operatorSP].op) {
-                  case REOP_ASSERT:
-                  case REOP_ASSERT_NOT:
-                  case REOP_LPAREN:
-                    operand = NewRENode(state, operatorStack[operatorSP].op);
-                    if (!operand)
-                        goto out;
-                    operand->u.parenIndex =
-                        operatorStack[operatorSP].parenIndex;
-                    JS_ASSERT(operandSP);
-                    operand->kid = operandStack[operandSP - 1];
-                    operandStack[operandSP - 1] = operand;
-                    if (state->treeDepth == TREE_DEPTH_MAX) {
-                        ReportRegExpError(state, JSREPORT_ERROR,
-                                          JSMSG_REGEXP_TOO_COMPLEX);
-                        goto out;
-                    }
-                    ++state->treeDepth;
-                    /* FALL THROUGH */
-
-                  case REOP_LPARENNON:
-                    state->result = operandStack[operandSP - 1];
-                    if (!ParseQuantifier(state))
-                        goto out;
-                    operandStack[operandSP - 1] = state->result;
-                    goto restartOperator;
-                  default:
-                    if (!ProcessOp(state, &operatorStack[operatorSP],
-                                   operandStack, operandSP))
-                        goto out;
-                    --operandSP;
-                    break;
-                }
-            }
-            break;
-
-          case '{':
-          {
-            const jschar *errp = state->cp;
-
-            if (ParseMinMaxQuantifier(state, JS_TRUE) < 0) {
-                /*
-                 * This didn't even scan correctly as a quantifier, so we should
-                 * treat it as flat.
-                 */
-                op = REOP_CONCAT;
-                goto pushOperator;
-            }
-
-            state->cp = errp;
-            /* FALL THROUGH */
-          }
-
-          case '+':
-          case '*':
-          case '?':
-            ReportRegExpErrorHelper(state, JSREPORT_ERROR, JSMSG_BAD_QUANTIFIER,
-                                    state->cp);
-            result = JS_FALSE;
-            goto out;
-
-          default:
-            /* Anything else is the start of the next term. */
-            op = REOP_CONCAT;
-pushOperator:
-            if (operatorSP == operatorStackSize) {
-                REOpData *tmp;
-                operatorStackSize += operatorStackSize;
-                tmp = (REOpData *)
-                    JS_realloc(state->context, operatorStack,
-                               sizeof(REOpData) * operatorStackSize);
-                if (!tmp)
-                    goto out;
-                operatorStack = tmp;
-            }
-            operatorStack[operatorSP].op = op;
-            operatorStack[operatorSP].errPos = state->cp;
-            operatorStack[operatorSP++].parenIndex = parenIndex;
-            break;
-        }
-    }
-out:
-    if (operatorStack)
-        JS_free(state->context, operatorStack);
-    if (operandStack)
-        JS_free(state->context, operandStack);
-    return result;
-}
-
-/*
- * Hack two bits in CompilerState.flags, for use within FindParenCount to flag
- * its being on the stack, and to propagate errors to its callers.
- */
-#define JSREG_FIND_PAREN_COUNT  0x8000
-#define JSREG_FIND_PAREN_ERROR  0x4000
-
-/*
- * Magic return value from FindParenCount and GetDecimalValue, to indicate
- * overflow beyond GetDecimalValue's max parameter, or a computed maximum if
- * its findMax parameter is non-null.
- */
-#define OVERFLOW_VALUE          ((uintN)-1)
-
-static uintN
-FindParenCount(CompilerState *state)
-{
-    CompilerState temp;
-    int i;
-
-    if (state->flags & JSREG_FIND_PAREN_COUNT)
-        return OVERFLOW_VALUE;
-
-    /*
-     * Copy state into temp, flag it so we never report an invalid backref,
-     * and reset its members to parse the entire regexp.  This is obviously
-     * suboptimal, but GetDecimalValue calls us only if a backref appears to
-     * refer to a forward parenthetical, which is rare.
-     */
-    temp = *state;
-    temp.flags |= JSREG_FIND_PAREN_COUNT;
-    temp.cp = temp.cpbegin;
-    temp.parenCount = 0;
-    temp.classCount = 0;
-    temp.progLength = 0;
-    temp.treeDepth = 0;
-    temp.classBitmapsMem = 0;
-    for (i = 0; i < CLASS_CACHE_SIZE; i++)
-        temp.classCache[i].start = NULL;
-
-    if (!ParseRegExp(&temp)) {
-        state->flags |= JSREG_FIND_PAREN_ERROR;
-        return OVERFLOW_VALUE;
-    }
-    return temp.parenCount;
-}
-
-/*
- * Extract and return a decimal value at state->cp.  The initial character c
- * has already been read.  Return OVERFLOW_VALUE if the result exceeds max.
- * Callers who pass a non-null findMax should test JSREG_FIND_PAREN_ERROR in
- * state->flags to discover whether an error occurred under findMax.
- */
-static uintN
-GetDecimalValue(jschar c, uintN max, uintN (*findMax)(CompilerState *state),
-                CompilerState *state)
-{
-    uintN value = JS7_UNDEC(c);
-    JSBool overflow = (value > max && (!findMax || value > findMax(state)));
-
-    /* The following restriction allows simpler overflow checks. */
-    JS_ASSERT(max <= ((uintN)-1 - 9) / 10);
-    while (state->cp < state->cpend) {
-        c = *state->cp;
-        if (!JS7_ISDEC(c))
-            break;
-        value = 10 * value + JS7_UNDEC(c);
-        if (!overflow && value > max && (!findMax || value > findMax(state)))
-            overflow = JS_TRUE;
-        ++state->cp;
-    }
-    return overflow ? OVERFLOW_VALUE : value;
-}
-
-/*
- * Calculate the total size of the bitmap required for a class expression.
- */
-static JSBool
-CalculateBitmapSize(CompilerState *state, RENode *target, const jschar *src,
-                    const jschar *end)
-{
-    uintN max = 0;
-    JSBool inRange = JS_FALSE;
-    jschar c, rangeStart = 0;
-    uintN n, digit, nDigits, i;
-
-    target->u.ucclass.bmsize = 0;
-    target->u.ucclass.sense = JS_TRUE;
-
-    if (src == end)
-        return JS_TRUE;
-
-    if (*src == '^') {
-        ++src;
-        target->u.ucclass.sense = JS_FALSE;
-    }
-
-    while (src != end) {
-        JSBool canStartRange = JS_TRUE;
-        uintN localMax = 0;
-
-        switch (*src) {
-          case '\\':
-            ++src;
-            c = *src++;
-            switch (c) {
-              case 'b':
-                localMax = 0x8;
-                break;
-              case 'f':
-                localMax = 0xC;
-                break;
-              case 'n':
-                localMax = 0xA;
-                break;
-              case 'r':
-                localMax = 0xD;
-                break;
-              case 't':
-                localMax = 0x9;
-                break;
-              case 'v':
-                localMax = 0xB;
-                break;
-              case 'c':
-                if (src < end && RE_IS_LETTER(*src)) {
-                    localMax = (uintN) (*src++) & 0x1F;
-                } else {
-                    --src;
-                    localMax = '\\';
-                }
-                break;
-              case 'x':
-                nDigits = 2;
-                goto lexHex;
-              case 'u':
-                nDigits = 4;
-lexHex:
-                n = 0;
-                for (i = 0; (i < nDigits) && (src < end); i++) {
-                    c = *src++;
-                    if (!isASCIIHexDigit(c, &digit)) {
-                        /*
-                         * Back off to accepting the original
-                         *'\' as a literal.
-                         */
-                        src -= i + 1;
-                        n = '\\';
-                        break;
-                    }
-                    n = (n << 4) | digit;
-                }
-                localMax = n;
-                break;
-              case 'd':
-                canStartRange = JS_FALSE;
-                if (inRange) {
-                    JS_ReportErrorNumber(state->context,
-                                         js_GetErrorMessage, NULL,
-                                         JSMSG_BAD_CLASS_RANGE);
-                    return JS_FALSE;
-                }
-                localMax = '9';
-                break;
-              case 'D':
-              case 's':
-              case 'S':
-              case 'w':
-              case 'W':
-                canStartRange = JS_FALSE;
-                if (inRange) {
-                    JS_ReportErrorNumber(state->context,
-                                         js_GetErrorMessage, NULL,
-                                         JSMSG_BAD_CLASS_RANGE);
-                    return JS_FALSE;
-                }
-                max = 65535;
-
-                /*
-                 * If this is the start of a range, ensure that it's less than
-                 * the end.
-                 */
-                localMax = 0;
-                break;
-              case '0':
-              case '1':
-              case '2':
-              case '3':
-              case '4':
-              case '5':
-              case '6':
-              case '7':
-                /*
-                 *  This is a non-ECMA extension - decimal escapes (in this
-                 *  case, octal!) are supposed to be an error inside class
-                 *  ranges, but supported here for backwards compatibility.
-                 *
-                 */
-                n = JS7_UNDEC(c);
-                c = *src;
-                if ('0' <= c && c <= '7') {
-                    src++;
-                    n = 8 * n + JS7_UNDEC(c);
-                    c = *src;
-                    if ('0' <= c && c <= '7') {
-                        src++;
-                        i = 8 * n + JS7_UNDEC(c);
-                        if (i <= 0377)
-                            n = i;
-                        else
-                            src--;
-                    }
-                }
-                localMax = n;
-                break;
-
-              default:
-                localMax = c;
-                break;
-            }
-            break;
-          default:
-            localMax = *src++;
-            break;
-        }
-
-        if (inRange) {
-            /* Throw a SyntaxError here, per ECMA-262, 15.10.2.15. */
-            if (rangeStart > localMax) {
-                JS_ReportErrorNumber(state->context,
-                                     js_GetErrorMessage, NULL,
-                                     JSMSG_BAD_CLASS_RANGE);
-                return JS_FALSE;
-            }
-            inRange = JS_FALSE;
-        } else {
-            if (canStartRange && src < end - 1) {
-                if (*src == '-') {
-                    ++src;
-                    inRange = JS_TRUE;
-                    rangeStart = (jschar)localMax;
-                    continue;
-                }
-            }
-            if (state->flags & JSREG_FOLD)
-                rangeStart = localMax;   /* one run of the uc/dc loop below */
-        }
-
-        if (state->flags & JSREG_FOLD) {
-            jschar maxch = localMax;
-
-            for (i = rangeStart; i <= localMax; i++) {
-                jschar uch, dch;
-            
-                uch = upcase(i);
-                dch = downcase(i);
-                maxch = JS_MAX(maxch, uch);
-                maxch = JS_MAX(maxch, dch);
-            }
-            localMax = maxch;
-        }
-
-        if (localMax > max)
-            max = localMax;
-    }
-    target->u.ucclass.bmsize = max;
-    return JS_TRUE;
-}
-
-/*
- *  item:       assertion               An item is either an assertion or
- *              quantatom               a quantified atom.
- *
- *  assertion:  '^'                     Assertions match beginning of string
- *                                      (or line if the class static property
- *                                      RegExp.multiline is true).
- *              '$'                     End of string (or line if the class
- *                                      static property RegExp.multiline is
- *                                      true).
- *              '\b'                    Word boundary (between \w and \W).
- *              '\B'                    Word non-boundary.
- *
- *  quantatom:  atom                    An unquantified atom.
- *              quantatom '{' n ',' m '}'
- *                                      Atom must occur between n and m times.
- *              quantatom '{' n ',' '}' Atom must occur at least n times.
- *              quantatom '{' n '}'     Atom must occur exactly n times.
- *              quantatom '*'           Zero or more times (same as {0,}).
- *              quantatom '+'           One or more times (same as {1,}).
- *              quantatom '?'           Zero or one time (same as {0,1}).
- *
- *              any of which can be optionally followed by '?' for ungreedy
- *
- *  atom:       '(' regexp ')'          A parenthesized regexp (what matched
- *                                      can be addressed using a backreference,
- *                                      see '\' n below).
- *              '.'                     Matches any char except '\n'.
- *              '[' classlist ']'       A character class.
- *              '[' '^' classlist ']'   A negated character class.
- *              '\f'                    Form Feed.
- *              '\n'                    Newline (Line Feed).
- *              '\r'                    Carriage Return.
- *              '\t'                    Horizontal Tab.
- *              '\v'                    Vertical Tab.
- *              '\d'                    A digit (same as [0-9]).
- *              '\D'                    A non-digit.
- *              '\w'                    A word character, [0-9a-z_A-Z].
- *              '\W'                    A non-word character.
- *              '\s'                    A whitespace character, [ \b\f\n\r\t\v].
- *              '\S'                    A non-whitespace character.
- *              '\' n                   A backreference to the nth (n decimal
- *                                      and positive) parenthesized expression.
- *              '\' octal               An octal escape sequence (octal must be
- *                                      two or three digits long, unless it is
- *                                      0 for the null character).
- *              '\x' hex                A hex escape (hex must be two digits).
- *              '\u' unicode            A unicode escape (must be four digits).
- *              '\c' ctrl               A control character, ctrl is a letter.
- *              '\' literalatomchar     Any character except one of the above
- *                                      that follow '\' in an atom.
- *              otheratomchar           Any character not first among the other
- *                                      atom right-hand sides.
- */
-static JSBool
-ParseTerm(CompilerState *state)
-{
-    jschar c = *state->cp++;
-    uintN nDigits;
-    uintN num, tmp, n, i;
-    const jschar *termStart;
-
-    switch (c) {
-    /* assertions and atoms */
-      case '^':
-        state->result = NewRENode(state, REOP_BOL);
-        if (!state->result)
-            return JS_FALSE;
-        state->progLength++;
-        return JS_TRUE;
-      case '$':
-        state->result = NewRENode(state, REOP_EOL);
-        if (!state->result)
-            return JS_FALSE;
-        state->progLength++;
-        return JS_TRUE;
-      case '\\':
-        if (state->cp >= state->cpend) {
-            /* a trailing '\' is an error */
-            ReportRegExpError(state, JSREPORT_ERROR, JSMSG_TRAILING_SLASH);
-            return JS_FALSE;
-        }
-        c = *state->cp++;
-        switch (c) {
-        /* assertion escapes */
-          case 'b' :
-            state->result = NewRENode(state, REOP_WBDRY);
-            if (!state->result)
-                return JS_FALSE;
-            state->progLength++;
-            return JS_TRUE;
-          case 'B':
-            state->result = NewRENode(state, REOP_WNONBDRY);
-            if (!state->result)
-                return JS_FALSE;
-            state->progLength++;
-            return JS_TRUE;
-          /* Decimal escape */
-          case '0':
-            /* Give a strict warning. See also the note below. */
-            if (!ReportRegExpError(state, JSREPORT_WARNING | JSREPORT_STRICT,
-                                   JSMSG_INVALID_BACKREF)) {
-                return JS_FALSE;
-            }
-     doOctal:
-            num = 0;
-            while (state->cp < state->cpend) {
-                c = *state->cp;
-                if (c < '0' || '7' < c)
-                    break;
-                state->cp++;
-                tmp = 8 * num + (uintN)JS7_UNDEC(c);
-                if (tmp > 0377)
-                    break;
-                num = tmp;
-            }
-            c = (jschar)num;
-    doFlat:
-            state->result = NewRENode(state, REOP_FLAT);
-            if (!state->result)
-                return JS_FALSE;
-            state->result->u.flat.chr = c;
-            state->result->u.flat.length = 1;
-            state->progLength += 3;
-            break;
-          case '1':
-          case '2':
-          case '3':
-          case '4':
-          case '5':
-          case '6':
-          case '7':
-          case '8':
-          case '9':
-            termStart = state->cp - 1;
-            num = GetDecimalValue(c, state->parenCount, FindParenCount, state);
-            if (state->flags & JSREG_FIND_PAREN_ERROR)
-                return JS_FALSE;
-            if (num == OVERFLOW_VALUE) {
-                /* Give a strict mode warning. */
-                if (!ReportRegExpError(state,
-                                       JSREPORT_WARNING | JSREPORT_STRICT,
-                                       (c >= '8')
-                                       ? JSMSG_INVALID_BACKREF
-                                       : JSMSG_BAD_BACKREF)) {
-                    return JS_FALSE;
-                }
-
-                /*
-                 * Note: ECMA 262, 15.10.2.9 says that we should throw a syntax
-                 * error here. However, for compatibility with IE, we treat the
-                 * whole backref as flat if the first character in it is not a
-                 * valid octal character, and as an octal escape otherwise.
-                 */
-                state->cp = termStart;
-                if (c >= '8') {
-                    /* Treat this as flat. termStart - 1 is the \. */
-                    c = '\\';
-                    goto asFlat;
-                }
-
-                /* Treat this as an octal escape. */
-                goto doOctal;
-            }
-            JS_ASSERT(1 <= num && num <= 0x10000);
-            state->result = NewRENode(state, REOP_BACKREF);
-            if (!state->result)
-                return JS_FALSE;
-            state->result->u.parenIndex = num - 1;
-            state->progLength
-                += 1 + GetCompactIndexWidth(state->result->u.parenIndex);
-            break;
-          /* Control escape */
-          case 'f':
-            c = 0xC;
-            goto doFlat;
-          case 'n':
-            c = 0xA;
-            goto doFlat;
-          case 'r':
-            c = 0xD;
-            goto doFlat;
-          case 't':
-            c = 0x9;
-            goto doFlat;
-          case 'v':
-            c = 0xB;
-            goto doFlat;
-          /* Control letter */
-          case 'c':
-            if (state->cp < state->cpend && RE_IS_LETTER(*state->cp)) {
-                c = (jschar) (*state->cp++ & 0x1F);
-            } else {
-                /* back off to accepting the original '\' as a literal */
-                --state->cp;
-                c = '\\';
-            }
-            goto doFlat;
-          /* HexEscapeSequence */
-          case 'x':
-            nDigits = 2;
-            goto lexHex;
-          /* UnicodeEscapeSequence */
-          case 'u':
-            nDigits = 4;
-lexHex:
-            n = 0;
-            for (i = 0; i < nDigits && state->cp < state->cpend; i++) {
-                uintN digit;
-                c = *state->cp++;
-                if (!isASCIIHexDigit(c, &digit)) {
-                    /*
-                     * Back off to accepting the original 'u' or 'x' as a
-                     * literal.
-                     */
-                    state->cp -= i + 2;
-                    n = *state->cp++;
-                    break;
-                }
-                n = (n << 4) | digit;
-            }
-            c = (jschar) n;
-            goto doFlat;
-          /* Character class escapes */
-          case 'd':
-            state->result = NewRENode(state, REOP_DIGIT);
-doSimple:
-            if (!state->result)
-                return JS_FALSE;
-            state->progLength++;
-            break;
-          case 'D':
-            state->result = NewRENode(state, REOP_NONDIGIT);
-            goto doSimple;
-          case 's':
-            state->result = NewRENode(state, REOP_SPACE);
-            goto doSimple;
-          case 'S':
-            state->result = NewRENode(state, REOP_NONSPACE);
-            goto doSimple;
-          case 'w':
-            state->result = NewRENode(state, REOP_ALNUM);
-            goto doSimple;
-          case 'W':
-            state->result = NewRENode(state, REOP_NONALNUM);
-            goto doSimple;
-          /* IdentityEscape */
-          default:
-            state->result = NewRENode(state, REOP_FLAT);
-            if (!state->result)
-                return JS_FALSE;
-            state->result->u.flat.chr = c;
-            state->result->u.flat.length = 1;
-            state->result->kid = (void *) (state->cp - 1);
-            state->progLength += 3;
-            break;
-        }
-        break;
-      case '[':
-        state->result = NewRENode(state, REOP_CLASS);
-        if (!state->result)
-            return JS_FALSE;
-        termStart = state->cp;
-        state->result->u.ucclass.startIndex = termStart - state->cpbegin;
-        for (;;) {
-            if (state->cp == state->cpend) {
-                ReportRegExpErrorHelper(state, JSREPORT_ERROR,
-                                        JSMSG_UNTERM_CLASS, termStart);
-
-                return JS_FALSE;
-            }
-            if (*state->cp == '\\') {
-                state->cp++;
-                if (state->cp != state->cpend)
-                    state->cp++;
-                continue;
-            }
-            if (*state->cp == ']') {
-                state->result->u.ucclass.kidlen = state->cp - termStart;
-                break;
-            }
-            state->cp++;
-        }
-        for (i = 0; i < CLASS_CACHE_SIZE; i++) {
-            if (!state->classCache[i].start) {
-                state->classCache[i].start = termStart;
-                state->classCache[i].length = state->result->u.ucclass.kidlen;
-                state->classCache[i].index = state->classCount;
-                break;
-            }
-            if (state->classCache[i].length ==
-                state->result->u.ucclass.kidlen) {
-                for (n = 0; ; n++) {
-                    if (n == state->classCache[i].length) {
-                        state->result->u.ucclass.index
-                            = state->classCache[i].index;
-                        goto claim;
-                    }
-                    if (state->classCache[i].start[n] != termStart[n])
-                        break;
-                }
-            }
-        }
-        state->result->u.ucclass.index = state->classCount++;
-
-    claim:
-        /*
-         * Call CalculateBitmapSize now as we want any errors it finds
-         * to be reported during the parse phase, not at execution.
-         */
-        if (!CalculateBitmapSize(state, state->result, termStart, state->cp++))
-            return JS_FALSE;
-        /*
-         * Update classBitmapsMem with number of bytes to hold bmsize bits,
-         * which is (bitsCount + 7) / 8 or (highest_bit + 1 + 7) / 8
-         * or highest_bit / 8 + 1 where highest_bit is u.ucclass.bmsize.
-         */
-        n = (state->result->u.ucclass.bmsize >> 3) + 1;
-        if (n > CLASS_BITMAPS_MEM_LIMIT - state->classBitmapsMem) {
-            ReportRegExpError(state, JSREPORT_ERROR, JSMSG_REGEXP_TOO_COMPLEX);
-            return JS_FALSE;
-        }
-        state->classBitmapsMem += n;
-        /* CLASS, <index> */
-        state->progLength
-            += 1 + GetCompactIndexWidth(state->result->u.ucclass.index);
-        break;
-
-      case '.':
-        state->result = NewRENode(state, REOP_DOT);
-        goto doSimple;
-
-      case '{':
-      {
-        const jschar *errp = state->cp--;
-        intN err;
-
-        err = ParseMinMaxQuantifier(state, JS_TRUE);
-        state->cp = errp;
-
-        if (err < 0)
-            goto asFlat;
-
-        /* FALL THROUGH */
-      }
-      case '*':
-      case '+':
-      case '?':
-        ReportRegExpErrorHelper(state, JSREPORT_ERROR,
-                                JSMSG_BAD_QUANTIFIER, state->cp - 1);
-        return JS_FALSE;
-      default:
-asFlat:
-        state->result = NewRENode(state, REOP_FLAT);
-        if (!state->result)
-            return JS_FALSE;
-        state->result->u.flat.chr = c;
-        state->result->u.flat.length = 1;
-        state->result->kid = (void *) (state->cp - 1);
-        state->progLength += 3;
-        break;
-    }
-    return ParseQuantifier(state);
-}
-
-static JSBool
-ParseQuantifier(CompilerState *state)
-{
-    RENode *term;
-    term = state->result;
-    if (state->cp < state->cpend) {
-        switch (*state->cp) {
-          case '+':
-            state->result = NewRENode(state, REOP_QUANT);
-            if (!state->result)
-                return JS_FALSE;
-            state->result->u.range.min = 1;
-            state->result->u.range.max = (uintN)-1;
-            /* <PLUS>, <next> ... <ENDCHILD> */
-            state->progLength += 4;
-            goto quantifier;
-          case '*':
-            state->result = NewRENode(state, REOP_QUANT);
-            if (!state->result)
-                return JS_FALSE;
-            state->result->u.range.min = 0;
-            state->result->u.range.max = (uintN)-1;
-            /* <STAR>, <next> ... <ENDCHILD> */
-            state->progLength += 4;
-            goto quantifier;
-          case '?':
-            state->result = NewRENode(state, REOP_QUANT);
-            if (!state->result)
-                return JS_FALSE;
-            state->result->u.range.min = 0;
-            state->result->u.range.max = 1;
-            /* <OPT>, <next> ... <ENDCHILD> */
-            state->progLength += 4;
-            goto quantifier;
-          case '{':       /* balance '}' */
-          {
-            intN err;
-            const jschar *errp = state->cp;
-
-            err = ParseMinMaxQuantifier(state, JS_FALSE);
-            if (err == 0)
-                goto quantifier;
-            if (err == -1)
-                return JS_TRUE;
-
-            ReportRegExpErrorHelper(state, JSREPORT_ERROR, err, errp);
-            return JS_FALSE;
-          }
-          default:;
-        }
-    }
-    return JS_TRUE;
-
-quantifier:
-    if (state->treeDepth == TREE_DEPTH_MAX) {
-        ReportRegExpError(state, JSREPORT_ERROR, JSMSG_REGEXP_TOO_COMPLEX);
-        return JS_FALSE;
-    }
-
-    ++state->treeDepth;
-    ++state->cp;
-    state->result->kid = term;
-    if (state->cp < state->cpend && *state->cp == '?') {
-        ++state->cp;
-        state->result->u.range.greedy = JS_FALSE;
-    } else {
-        state->result->u.range.greedy = JS_TRUE;
-    }
-    return JS_TRUE;
-}
-
-static intN
-ParseMinMaxQuantifier(CompilerState *state, JSBool ignoreValues)
-{
-    uintN min, max;
-    jschar c;
-    const jschar *errp = state->cp++;
-
-    c = *state->cp;
-    if (JS7_ISDEC(c)) {
-        ++state->cp;
-        min = GetDecimalValue(c, 0xFFFF, NULL, state);
-        c = *state->cp;
-
-        if (!ignoreValues && min == OVERFLOW_VALUE)
-            return JSMSG_MIN_TOO_BIG;
-
-        if (c == ',') {
-            c = *++state->cp;
-            if (JS7_ISDEC(c)) {
-                ++state->cp;
-                max = GetDecimalValue(c, 0xFFFF, NULL, state);
-                c = *state->cp;
-                if (!ignoreValues && max == OVERFLOW_VALUE)
-                    return JSMSG_MAX_TOO_BIG;
-                if (!ignoreValues && min > max)
-                    return JSMSG_OUT_OF_ORDER;
-            } else {
-                max = (uintN)-1;
-            }
-        } else {
-            max = min;
-        }
-        if (c == '}') {
-            state->result = NewRENode(state, REOP_QUANT);
-            if (!state->result)
-                return JSMSG_OUT_OF_MEMORY;
-            state->result->u.range.min = min;
-            state->result->u.range.max = max;
-            /*
-             * QUANT, <min>, <max>, <next> ... <ENDCHILD>
-             * where <max> is written as compact(max+1) to make
-             * (uintN)-1 sentinel to occupy 1 byte, not width_of(max)+1.
-             */
-            state->progLength += (1 + GetCompactIndexWidth(min)
-                                  + GetCompactIndexWidth(max + 1)
-                                  +3);
-            return 0;
-        }
-    }
-
-    state->cp = errp;
-    return -1;
-}
-
-static JSBool
-SetForwardJumpOffset(jsbytecode *jump, jsbytecode *target)
-{
-    ptrdiff_t offset = target - jump;
-
-    /* Check that target really points forward. */
-    JS_ASSERT(offset >= 2);
-    if ((size_t)offset > OFFSET_MAX)
-        return JS_FALSE;
-
-    jump[0] = JUMP_OFFSET_HI(offset);
-    jump[1] = JUMP_OFFSET_LO(offset);
-    return JS_TRUE;
-}
-
-/*
- * Generate bytecode for the tree rooted at t using an explicit stack instead
- * of recursion.
- */
-static jsbytecode *
-EmitREBytecode(CompilerState *state, JSRegExp *re, size_t treeDepth,
-               jsbytecode *pc, RENode *t)
-{
-    EmitStateStackEntry *emitStateSP, *emitStateStack;
-    RECharSet *charSet;
-    REOp op;
-
-    if (treeDepth == 0) {
-        emitStateStack = NULL;
-    } else {
-        emitStateStack =
-            (EmitStateStackEntry *)JS_malloc(state->context,
-                                             sizeof(EmitStateStackEntry) *
-                                             treeDepth);
-        if (!emitStateStack)
-            return NULL;
-    }
-    emitStateSP = emitStateStack;
-    op = t->op;
-    JS_ASSERT(op < REOP_LIMIT);
-
-    for (;;) {
-        *pc++ = op;
-        switch (op) {
-          case REOP_EMPTY:
-            --pc;
-            break;
-
-          case REOP_ALTPREREQ2:
-          case REOP_ALTPREREQ:
-            JS_ASSERT(emitStateSP);
-            emitStateSP->altHead = pc - 1;
-            emitStateSP->endTermFixup = pc;
-            pc += OFFSET_LEN;
-            SET_ARG(pc, t->u.altprereq.ch1);
-            pc += ARG_LEN;
-            SET_ARG(pc, t->u.altprereq.ch2);
-            pc += ARG_LEN;
-
-            emitStateSP->nextAltFixup = pc;    /* offset to next alternate */
-            pc += OFFSET_LEN;
-
-            emitStateSP->continueNode = t;
-            emitStateSP->continueOp = REOP_JUMP;
-            emitStateSP->jumpToJumpFlag = JS_FALSE;
-            ++emitStateSP;
-            JS_ASSERT((size_t)(emitStateSP - emitStateStack) <= treeDepth);
-            t = (RENode *) t->kid;
-            op = t->op;
-            JS_ASSERT(op < REOP_LIMIT);
-            continue;
-
-          case REOP_JUMP:
-            emitStateSP->nextTermFixup = pc;    /* offset to following term */
-            pc += OFFSET_LEN;
-            if (!SetForwardJumpOffset(emitStateSP->nextAltFixup, pc))
-                goto jump_too_big;
-            emitStateSP->continueOp = REOP_ENDALT;
-            ++emitStateSP;
-            JS_ASSERT((size_t)(emitStateSP - emitStateStack) <= treeDepth);
-            t = (RENode *) t->u.kid2;
-            op = t->op;
-            JS_ASSERT(op < REOP_LIMIT);
-            continue;
-
-          case REOP_ENDALT:
-            /*
-             * If we already patched emitStateSP->nextTermFixup to jump to
-             * a nearer jump, to avoid 16-bit immediate offset overflow, we
-             * are done here.
-             */
-            if (emitStateSP->jumpToJumpFlag)
-                break;
-
-            /*
-             * Fix up the REOP_JUMP offset to go to the op after REOP_ENDALT.
-             * REOP_ENDALT is executed only on successful match of the last
-             * alternate in a group.
-             */
-            if (!SetForwardJumpOffset(emitStateSP->nextTermFixup, pc))
-                goto jump_too_big;
-            if (t->op != REOP_ALT) {
-                if (!SetForwardJumpOffset(emitStateSP->endTermFixup, pc))
-                    goto jump_too_big;
-            }
-
-            /*
-             * If the program is bigger than the REOP_JUMP offset range, then
-             * we must check for alternates before this one that are part of
-             * the same group, and fix up their jump offsets to target jumps
-             * close enough to fit in a 16-bit unsigned offset immediate.
-             */
-            if ((size_t)(pc - re->program) > OFFSET_MAX &&
-                emitStateSP > emitStateStack) {
-                EmitStateStackEntry *esp, *esp2;
-                jsbytecode *alt, *jump;
-                ptrdiff_t span, header;
-
-                esp2 = emitStateSP;
-                alt = esp2->altHead;
-                for (esp = esp2 - 1; esp >= emitStateStack; --esp) {
-                    if (esp->continueOp == REOP_ENDALT &&
-                        !esp->jumpToJumpFlag &&
-                        esp->nextTermFixup + OFFSET_LEN == alt &&
-                        (size_t)(pc - ((esp->continueNode->op != REOP_ALT)
-                                       ? esp->endTermFixup
-                                       : esp->nextTermFixup)) > OFFSET_MAX) {
-                        alt = esp->altHead;
-                        jump = esp->nextTermFixup;
-
-                        /*
-                         * The span must be 1 less than the distance from
-                         * jump offset to jump offset, so we actually jump
-                         * to a REOP_JUMP bytecode, not to its offset!
-                         */
-                        for (;;) {
-                            JS_ASSERT(jump < esp2->nextTermFixup);
-                            span = esp2->nextTermFixup - jump - 1;
-                            if ((size_t)span <= OFFSET_MAX)
-                                break;
-                            do {
-                                if (--esp2 == esp)
-                                    goto jump_too_big;
-                            } while (esp2->continueOp != REOP_ENDALT);
-                        }
-
-                        jump[0] = JUMP_OFFSET_HI(span);
-                        jump[1] = JUMP_OFFSET_LO(span);
-
-                        if (esp->continueNode->op != REOP_ALT) {
-                            /*
-                             * We must patch the offset at esp->endTermFixup
-                             * as well, for the REOP_ALTPREREQ{,2} opcodes.
-                             * If we're unlucky and endTermFixup is more than
-                             * OFFSET_MAX bytes from its target, we cheat by
-                             * jumping 6 bytes to the jump whose offset is at
-                             * esp->nextTermFixup, which has the same target.
-                             */
-                            jump = esp->endTermFixup;
-                            header = esp->nextTermFixup - jump;
-                            span += header;
-                            if ((size_t)span > OFFSET_MAX)
-                                span = header;
-
-                            jump[0] = JUMP_OFFSET_HI(span);
-                            jump[1] = JUMP_OFFSET_LO(span);
-                        }
-
-                        esp->jumpToJumpFlag = JS_TRUE;
-                    }
-                }
-            }
-            break;
-
-          case REOP_ALT:
-            JS_ASSERT(emitStateSP);
-            emitStateSP->altHead = pc - 1;
-            emitStateSP->nextAltFixup = pc;     /* offset to next alternate */
-            pc += OFFSET_LEN;
-            emitStateSP->continueNode = t;
-            emitStateSP->continueOp = REOP_JUMP;
-            emitStateSP->jumpToJumpFlag = JS_FALSE;
-            ++emitStateSP;
-            JS_ASSERT((size_t)(emitStateSP - emitStateStack) <= treeDepth);
-            t = (RENode *) t->kid;
-            op = t->op;
-            JS_ASSERT(op < REOP_LIMIT);
-            continue;
-
-          case REOP_FLAT:
-            /*
-             * Coalesce FLATs if possible and if it would not increase bytecode
-             * beyond preallocated limit. The latter happens only when bytecode
-             * size for coalesced string with offset p and length 2 exceeds 6
-             * bytes preallocated for 2 single char nodes, i.e. when
-             * 1 + GetCompactIndexWidth(p) + GetCompactIndexWidth(2) > 6 or
-             * GetCompactIndexWidth(p) > 4.
-             * Since when GetCompactIndexWidth(p) <= 4 coalescing of 3 or more
-             * nodes strictly decreases bytecode size, the check has to be
-             * done only for the first coalescing.
-             */
-            if (t->kid &&
-                GetCompactIndexWidth((jschar *)t->kid - state->cpbegin) <= 4)
-            {
-                while (t->next &&
-                       t->next->op == REOP_FLAT &&
-                       (jschar*)t->kid + t->u.flat.length ==
-                       (jschar*)t->next->kid) {
-                    t->u.flat.length += t->next->u.flat.length;
-                    t->next = t->next->next;
-                }
-            }
-            if (t->kid && t->u.flat.length > 1) {
-                pc[-1] = (state->flags & JSREG_FOLD) ? REOP_FLATi : REOP_FLAT;
-                pc = WriteCompactIndex(pc, (jschar *)t->kid - state->cpbegin);
-                pc = WriteCompactIndex(pc, t->u.flat.length);
-            } else if (t->u.flat.chr < 256) {
-                pc[-1] = (state->flags & JSREG_FOLD) ? REOP_FLAT1i : REOP_FLAT1;
-                *pc++ = (jsbytecode) t->u.flat.chr;
-            } else {
-                pc[-1] = (state->flags & JSREG_FOLD)
-                         ? REOP_UCFLAT1i
-                         : REOP_UCFLAT1;
-                SET_ARG(pc, t->u.flat.chr);
-                pc += ARG_LEN;
-            }
-            break;
-
-          case REOP_LPAREN:
-            JS_ASSERT(emitStateSP);
-            pc = WriteCompactIndex(pc, t->u.parenIndex);
-            emitStateSP->continueNode = t;
-            emitStateSP->continueOp = REOP_RPAREN;
-            ++emitStateSP;
-            JS_ASSERT((size_t)(emitStateSP - emitStateStack) <= treeDepth);
-            t = (RENode *) t->kid;
-            op = t->op;
-            continue;
-
-          case REOP_RPAREN:
-            pc = WriteCompactIndex(pc, t->u.parenIndex);
-            break;
-
-          case REOP_BACKREF:
-            pc = WriteCompactIndex(pc, t->u.parenIndex);
-            break;
-
-          case REOP_ASSERT:
-            JS_ASSERT(emitStateSP);
-            emitStateSP->nextTermFixup = pc;
-            pc += OFFSET_LEN;
-            emitStateSP->continueNode = t;
-            emitStateSP->continueOp = REOP_ASSERTTEST;
-            ++emitStateSP;
-            JS_ASSERT((size_t)(emitStateSP - emitStateStack) <= treeDepth);
-            t = (RENode *) t->kid;
-            op = t->op;
-            continue;
-
-          case REOP_ASSERTTEST:
-          case REOP_ASSERTNOTTEST:
-            if (!SetForwardJumpOffset(emitStateSP->nextTermFixup, pc))
-                goto jump_too_big;
-            break;
-
-          case REOP_ASSERT_NOT:
-            JS_ASSERT(emitStateSP);
-            emitStateSP->nextTermFixup = pc;
-            pc += OFFSET_LEN;
-            emitStateSP->continueNode = t;
-            emitStateSP->continueOp = REOP_ASSERTNOTTEST;
-            ++emitStateSP;
-            JS_ASSERT((size_t)(emitStateSP - emitStateStack) <= treeDepth);
-            t = (RENode *) t->kid;
-            op = t->op;
-            continue;
-
-          case REOP_QUANT:
-            JS_ASSERT(emitStateSP);
-            if (t->u.range.min == 0 && t->u.range.max == (uintN)-1) {
-                pc[-1] = (t->u.range.greedy) ? REOP_STAR : REOP_MINIMALSTAR;
-            } else if (t->u.range.min == 0 && t->u.range.max == 1) {
-                pc[-1] = (t->u.range.greedy) ? REOP_OPT : REOP_MINIMALOPT;
-            } else if (t->u.range.min == 1 && t->u.range.max == (uintN) -1) {
-                pc[-1] = (t->u.range.greedy) ? REOP_PLUS : REOP_MINIMALPLUS;
-            } else {
-                if (!t->u.range.greedy)
-                    pc[-1] = REOP_MINIMALQUANT;
-                pc = WriteCompactIndex(pc, t->u.range.min);
-                /*
-                 * Write max + 1 to avoid using size_t(max) + 1 bytes
-                 * for (uintN)-1 sentinel.
-                 */
-                pc = WriteCompactIndex(pc, t->u.range.max + 1);
-            }
-            emitStateSP->nextTermFixup = pc;
-            pc += OFFSET_LEN;
-            emitStateSP->continueNode = t;
-            emitStateSP->continueOp = REOP_ENDCHILD;
-            ++emitStateSP;
-            JS_ASSERT((size_t)(emitStateSP - emitStateStack) <= treeDepth);
-            t = (RENode *) t->kid;
-            op = t->op;
-            continue;
-
-          case REOP_ENDCHILD:
-            if (!SetForwardJumpOffset(emitStateSP->nextTermFixup, pc))
-                goto jump_too_big;
-            break;
-
-          case REOP_CLASS:
-            if (!t->u.ucclass.sense)
-                pc[-1] = REOP_NCLASS;
-            pc = WriteCompactIndex(pc, t->u.ucclass.index);
-            charSet = &re->classList[t->u.ucclass.index];
-            charSet->converted = JS_FALSE;
-            charSet->length = t->u.ucclass.bmsize;
-            charSet->u.src.startIndex = t->u.ucclass.startIndex;
-            charSet->u.src.length = t->u.ucclass.kidlen;
-            charSet->sense = t->u.ucclass.sense;
-            break;
-
-          default:
-            break;
-        }
-
-        t = t->next;
-        if (t) {
-            op = t->op;
-        } else {
-            if (emitStateSP == emitStateStack)
-                break;
-            --emitStateSP;
-            t = emitStateSP->continueNode;
-            op = (REOp) emitStateSP->continueOp;
-        }
-    }
-
-  cleanup:
-    if (emitStateStack)
-        JS_free(state->context, emitStateStack);
-    return pc;
-
-  jump_too_big:
-    ReportRegExpError(state, JSREPORT_ERROR, JSMSG_REGEXP_TOO_COMPLEX);
-    pc = NULL;
-    goto cleanup;
-}
-
-
-JSRegExp *
-js_NewRegExp(JSContext *cx, JSTokenStream *ts,
-             JSString *str, uintN flags, JSBool flat)
-{
-    JSRegExp *re;
-    void *mark;
-    CompilerState state;
-    size_t resize;
-    jsbytecode *endPC;
-    uintN i;
-    size_t len;
-
-    re = NULL;
-    mark = JS_ARENA_MARK(&cx->tempPool);
-    len = JSSTRING_LENGTH(str);
-
-    state.context = cx;
-    state.tokenStream = ts;
-    state.cp = js_UndependString(cx, str);
-    if (!state.cp)
-        goto out;
-    state.cpbegin = state.cp;
-    state.cpend = state.cp + len;
-    state.flags = flags;
-    state.parenCount = 0;
-    state.classCount = 0;
-    state.progLength = 0;
-    state.treeDepth = 0;
-    state.classBitmapsMem = 0;
-    for (i = 0; i < CLASS_CACHE_SIZE; i++)
-        state.classCache[i].start = NULL;
-
-    if (len != 0 && flat) {
-        state.result = NewRENode(&state, REOP_FLAT);
-        if (!state.result)
-            goto out;
-        state.result->u.flat.chr = *state.cpbegin;
-        state.result->u.flat.length = len;
-        state.result->kid = (void *) state.cpbegin;
-        /* Flat bytecode: REOP_FLAT compact(string_offset) compact(len). */
-        state.progLength += 1 + GetCompactIndexWidth(0)
-                          + GetCompactIndexWidth(len);
-    } else {
-        if (!ParseRegExp(&state))
-            goto out;
-    }
-    resize = offsetof(JSRegExp, program) + state.progLength + 1;
-    re = (JSRegExp *) JS_malloc(cx, resize);
-    if (!re)
-        goto out;
-
-    re->nrefs = 1;
-    JS_ASSERT(state.classBitmapsMem <= CLASS_BITMAPS_MEM_LIMIT);
-    re->classCount = state.classCount;
-    if (re->classCount) {
-        re->classList = (RECharSet *)
-            JS_malloc(cx, re->classCount * sizeof(RECharSet));
-        if (!re->classList) {
-            js_DestroyRegExp(cx, re);
-            re = NULL;
-            goto out;
-        }
-        for (i = 0; i < re->classCount; i++)
-            re->classList[i].converted = JS_FALSE;
-    } else {
-        re->classList = NULL;
-    }
-    endPC = EmitREBytecode(&state, re, state.treeDepth, re->program, state.result);
-    if (!endPC) {
-        js_DestroyRegExp(cx, re);
-        re = NULL;
-        goto out;
-    }
-    *endPC++ = REOP_END;
-    /*
-     * Check whether size was overestimated and shrink using realloc.
-     * This is safe since no pointers to newly parsed regexp or its parts
-     * besides re exist here.
-     */
-    if ((size_t)(endPC - re->program) != state.progLength + 1) {
-        JSRegExp *tmp;
-        JS_ASSERT((size_t)(endPC - re->program) < state.progLength + 1);
-        resize = offsetof(JSRegExp, program) + (endPC - re->program);
-        tmp = (JSRegExp *) JS_realloc(cx, re, resize);
-        if (tmp)
-            re = tmp;
-    }
-
-    re->flags = flags;
-    re->parenCount = state.parenCount;
-    re->source = str;
-
-out:
-    JS_ARENA_RELEASE(&cx->tempPool, mark);
-    return re;
-}
-
-JSRegExp *
-js_NewRegExpOpt(JSContext *cx, JSString *str, JSString *opt, JSBool flat)
-{
-    uintN flags;
-    jschar *s;
-    size_t i, n;
-    char charBuf[2];
-
-    flags = 0;
-    if (opt) {
-        JSSTRING_CHARS_AND_LENGTH(opt, s, n);
-        for (i = 0; i < n; i++) {
-            switch (s[i]) {
-              case 'g':
-                flags |= JSREG_GLOB;
-                break;
-              case 'i':
-                flags |= JSREG_FOLD;
-                break;
-              case 'm':
-                flags |= JSREG_MULTILINE;
-                break;
-              case 'y':
-                flags |= JSREG_STICKY;
-                break;
-              default:
-                charBuf[0] = (char)s[i];
-                charBuf[1] = '\0';
-                JS_ReportErrorFlagsAndNumber(cx, JSREPORT_ERROR,
-                                             js_GetErrorMessage, NULL,
-                                             JSMSG_BAD_FLAG, charBuf);
-                return NULL;
-            }
-        }
-    }
-    return js_NewRegExp(cx, NULL, str, flags, flat);
-}
-
-/*
- * Save the current state of the match - the position in the input
- * text as well as the position in the bytecode. The state of any
- * parent expressions is also saved (preceding state).
- * Contents of parenCount parentheses from parenIndex are also saved.
- */
-static REBackTrackData *
-PushBackTrackState(REGlobalData *gData, REOp op,
-                   jsbytecode *target, REMatchState *x, const jschar *cp,
-                   size_t parenIndex, size_t parenCount)
-{
-    size_t i;
-    REBackTrackData *result =
-        (REBackTrackData *) ((char *)gData->backTrackSP + gData->cursz);
-
-    size_t sz = sizeof(REBackTrackData) +
-                gData->stateStackTop * sizeof(REProgState) +
-                parenCount * sizeof(RECapture);
-
-    ptrdiff_t btsize = gData->backTrackStackSize;
-    ptrdiff_t btincr = ((char *)result + sz) -
-                       ((char *)gData->backTrackStack + btsize);
-
-    re_debug("\tBT_Push: %lu,%lu",
-             (unsigned long) parenIndex, (unsigned long) parenCount);
-
-    JS_COUNT_OPERATION(gData->cx, JSOW_JUMP * (1 + parenCount));
-    if (btincr > 0) {
-        ptrdiff_t offset = (char *)result - (char *)gData->backTrackStack;
-
-        JS_COUNT_OPERATION(gData->cx, JSOW_ALLOCATION);
-        btincr = JS_ROUNDUP(btincr, btsize);
-        JS_ARENA_GROW_CAST(gData->backTrackStack, REBackTrackData *,
-                           &gData->pool, btsize, btincr);
-        if (!gData->backTrackStack) {
-            js_ReportOutOfScriptQuota(gData->cx);
-            gData->ok = JS_FALSE;
-            return NULL;
-        }
-        gData->backTrackStackSize = btsize + btincr;
-        result = (REBackTrackData *) ((char *)gData->backTrackStack + offset);
-    }
-    gData->backTrackSP = result;
-    result->sz = gData->cursz;
-    gData->cursz = sz;
-
-    result->backtrack_op = op;
-    result->backtrack_pc = target;
-    result->cp = cp;
-    result->parenCount = parenCount;
-    result->parenIndex = parenIndex;
-
-    result->saveStateStackTop = gData->stateStackTop;
-    JS_ASSERT(gData->stateStackTop);
-    memcpy(result + 1, gData->stateStack,
-           sizeof(REProgState) * result->saveStateStackTop);
-
-    if (parenCount != 0) {
-        memcpy((char *)(result + 1) +
-               sizeof(REProgState) * result->saveStateStackTop,
-               &x->parens[parenIndex],
-               sizeof(RECapture) * parenCount);
-        for (i = 0; i != parenCount; i++)
-            x->parens[parenIndex + i].index = -1;
-    }
-
-    return result;
-}
-
-
-/*
- *   Consecutive literal characters.
- */
-#if 0
-static REMatchState *
-FlatNMatcher(REGlobalData *gData, REMatchState *x, jschar *matchChars,
-             size_t length)
-{
-    size_t i;
-    if (length > gData->cpend - x->cp)
-        return NULL;
-    for (i = 0; i != length; i++) {
-        if (matchChars[i] != x->cp[i])
-            return NULL;
-    }
-    x->cp += length;
-    return x;
-}
-#endif
-
-static JS_INLINE REMatchState *
-FlatNIMatcher(REGlobalData *gData, REMatchState *x, jschar *matchChars,
-              size_t length)
-{
-    size_t i;
-    JS_ASSERT(gData->cpend >= x->cp);
-    if (length > (size_t)(gData->cpend - x->cp))
-        return NULL;
-    for (i = 0; i != length; i++) {
-        if (upcase(matchChars[i]) != upcase(x->cp[i]))
-            return NULL;
-    }
-    x->cp += length;
-    return x;
-}
-
-/*
- * 1. Evaluate DecimalEscape to obtain an EscapeValue E.
- * 2. If E is not a character then go to step 6.
- * 3. Let ch be E's character.
- * 4. Let A be a one-element RECharSet containing the character ch.
- * 5. Call CharacterSetMatcher(A, false) and return its Matcher result.
- * 6. E must be an integer. Let n be that integer.
- * 7. If n=0 or n>NCapturingParens then throw a SyntaxError exception.
- * 8. Return an internal Matcher closure that takes two arguments, a State x
- *    and a Continuation c, and performs the following:
- *     1. Let cap be x's captures internal array.
- *     2. Let s be cap[n].
- *     3. If s is undefined, then call c(x) and return its result.
- *     4. Let e be x's endIndex.
- *     5. Let len be s's length.
- *     6. Let f be e+len.
- *     7. If f>InputLength, return failure.
- *     8. If there exists an integer i between 0 (inclusive) and len (exclusive)
- *        such that Canonicalize(s[i]) is not the same character as
- *        Canonicalize(Input [e+i]), then return failure.
- *     9. Let y be the State (f, cap).
- *     10. Call c(y) and return its result.
- */
-static REMatchState *
-BackrefMatcher(REGlobalData *gData, REMatchState *x, size_t parenIndex)
-{
-    size_t len, i;
-    const jschar *parenContent;
-    RECapture *cap = &x->parens[parenIndex];
-
-    if (cap->index == -1)
-        return x;
-
-    len = cap->length;
-    if (x->cp + len > gData->cpend)
-        return NULL;
-
-    parenContent = &gData->cpbegin[cap->index];
-    if (gData->regexp->flags & JSREG_FOLD) {
-        for (i = 0; i < len; i++) {
-            if (upcase(parenContent[i]) != upcase(x->cp[i]))
-                return NULL;
-        }
-    } else {
-        for (i = 0; i < len; i++) {
-            if (parenContent[i] != x->cp[i])
-                return NULL;
-        }
-    }
-    x->cp += len;
-    return x;
-}
-
-
-/* Add a single character to the RECharSet */
-static void
-AddCharacterToCharSet(RECharSet *cs, jschar c)
-{
-    uintN byteIndex = (uintN)(c >> 3);
-    JS_ASSERT(c <= cs->length);
-    cs->u.bits[byteIndex] |= 1 << (c & 0x7);
-}
-
-
-/* Add a character range, c1 to c2 (inclusive) to the RECharSet */
-static void
-AddCharacterRangeToCharSet(RECharSet *cs, uintN c1, uintN c2)
-{
-    uintN i;
-
-    uintN byteIndex1 = c1 >> 3;
-    uintN byteIndex2 = c2 >> 3;
-
-    JS_ASSERT(c2 <= cs->length && c1 <= c2);
-
-    c1 &= 0x7;
-    c2 &= 0x7;
-
-    if (byteIndex1 == byteIndex2) {
-        cs->u.bits[byteIndex1] |= ((uint8)0xFF >> (7 - (c2 - c1))) << c1;
-    } else {
-        cs->u.bits[byteIndex1] |= 0xFF << c1;
-        for (i = byteIndex1 + 1; i < byteIndex2; i++)
-            cs->u.bits[i] = 0xFF;
-        cs->u.bits[byteIndex2] |= (uint8)0xFF >> (7 - c2);
-    }
-}
-
-/* Compile the source of the class into a RECharSet */
-static JSBool
-ProcessCharSet(REGlobalData *gData, RECharSet *charSet)
-{
-    const jschar *src, *end;
-    JSBool inRange = JS_FALSE;
-    jschar rangeStart = 0;
-    uintN byteLength, n;
-    jschar c, thisCh;
-    intN nDigits, i;
-
-    JS_ASSERT(!charSet->converted);
-    /*
-     * Assert that startIndex and length points to chars inside [] inside
-     * source string.
-     */
-    JS_ASSERT(1 <= charSet->u.src.startIndex);
-    JS_ASSERT(charSet->u.src.startIndex
-              < JSSTRING_LENGTH(gData->regexp->source));
-    JS_ASSERT(charSet->u.src.length <= JSSTRING_LENGTH(gData->regexp->source)
-                                       - 1 - charSet->u.src.startIndex);
-
-    charSet->converted = JS_TRUE;
-    src = JSSTRING_CHARS(gData->regexp->source) + charSet->u.src.startIndex;
-    end = src + charSet->u.src.length;
-    JS_ASSERT(src[-1] == '[');
-    JS_ASSERT(end[0] == ']');
-
-    byteLength = (charSet->length >> 3) + 1;
-    charSet->u.bits = (uint8 *)JS_malloc(gData->cx, byteLength);
-    if (!charSet->u.bits) {
-        JS_ReportOutOfMemory(gData->cx);
-        gData->ok = JS_FALSE;
-        return JS_FALSE;
-    }
-    memset(charSet->u.bits, 0, byteLength);
-
-    if (src == end)
-        return JS_TRUE;
-
-    if (*src == '^') {
-        JS_ASSERT(charSet->sense == JS_FALSE);
-        ++src;
-    } else {
-        JS_ASSERT(charSet->sense == JS_TRUE);
-    }
-
-    while (src != end) {
-        switch (*src) {
-          case '\\':
-            ++src;
-            c = *src++;
-            switch (c) {
-              case 'b':
-                thisCh = 0x8;
-                break;
-              case 'f':
-                thisCh = 0xC;
-                break;
-              case 'n':
-                thisCh = 0xA;
-                break;
-              case 'r':
-                thisCh = 0xD;
-                break;
-              case 't':
-                thisCh = 0x9;
-                break;
-              case 'v':
-                thisCh = 0xB;
-                break;
-              case 'c':
-                if (src < end && JS_ISWORD(*src)) {
-                    thisCh = (jschar)(*src++ & 0x1F);
-                } else {
-                    --src;
-                    thisCh = '\\';
-                }
-                break;
-              case 'x':
-                nDigits = 2;
-                goto lexHex;
-              case 'u':
-                nDigits = 4;
-            lexHex:
-                n = 0;
-                for (i = 0; (i < nDigits) && (src < end); i++) {
-                    uintN digit;
-                    c = *src++;
-                    if (!isASCIIHexDigit(c, &digit)) {
-                        /*
-                         * Back off to accepting the original '\'
-                         * as a literal
-                         */
-                        src -= i + 1;
-                        n = '\\';
-                        break;
-                    }
-                    n = (n << 4) | digit;
-                }
-                thisCh = (jschar)n;
-                break;
-              case '0':
-              case '1':
-              case '2':
-              case '3':
-              case '4':
-              case '5':
-              case '6':
-              case '7':
-                /*
-                 *  This is a non-ECMA extension - decimal escapes (in this
-                 *  case, octal!) are supposed to be an error inside class
-                 *  ranges, but supported here for backwards compatibility.
-                 */
-                n = JS7_UNDEC(c);
-                c = *src;
-                if ('0' <= c && c <= '7') {
-                    src++;
-                    n = 8 * n + JS7_UNDEC(c);
-                    c = *src;
-                    if ('0' <= c && c <= '7') {
-                        src++;
-                        i = 8 * n + JS7_UNDEC(c);
-                        if (i <= 0377)
-                            n = i;
-                        else
-                            src--;
-                    }
-                }
-                thisCh = (jschar)n;
-                break;
-
-              case 'd':
-                AddCharacterRangeToCharSet(charSet, '0', '9');
-                continue;   /* don't need range processing */
-              case 'D':
-                AddCharacterRangeToCharSet(charSet, 0, '0' - 1);
-                AddCharacterRangeToCharSet(charSet,
-                                           (jschar)('9' + 1),
-                                           (jschar)charSet->length);
-                continue;
-              case 's':
-                for (i = (intN)charSet->length; i >= 0; i--)
-                    if (JS_ISSPACE(i))
-                        AddCharacterToCharSet(charSet, (jschar)i);
-                continue;
-              case 'S':
-                for (i = (intN)charSet->length; i >= 0; i--)
-                    if (!JS_ISSPACE(i))
-                        AddCharacterToCharSet(charSet, (jschar)i);
-                continue;
-              case 'w':
-                for (i = (intN)charSet->length; i >= 0; i--)
-                    if (JS_ISWORD(i))
-                        AddCharacterToCharSet(charSet, (jschar)i);
-                continue;
-              case 'W':
-                for (i = (intN)charSet->length; i >= 0; i--)
-                    if (!JS_ISWORD(i))
-                        AddCharacterToCharSet(charSet, (jschar)i);
-                continue;
-              default:
-                thisCh = c;
-                break;
-
-            }
-            break;
-
-          default:
-            thisCh = *src++;
-            break;
-
-        }
-        if (inRange) {
-            if (gData->regexp->flags & JSREG_FOLD) {
-                int i;
-
-                JS_ASSERT(rangeStart <= thisCh);
-                for (i = rangeStart; i <= thisCh; i++) {
-                    jschar uch, dch;
-
-                    AddCharacterToCharSet(charSet, i);
-                    uch = upcase(i);
-                    dch = downcase(i);
-                    if (i != uch)
-                        AddCharacterToCharSet(charSet, uch);
-                    if (i != dch)
-                        AddCharacterToCharSet(charSet, dch);
-                }
-            } else {
-                AddCharacterRangeToCharSet(charSet, rangeStart, thisCh);
-            }
-            inRange = JS_FALSE;
-        } else {
-            if (gData->regexp->flags & JSREG_FOLD) {
-                AddCharacterToCharSet(charSet, upcase(thisCh));
-                AddCharacterToCharSet(charSet, downcase(thisCh));
-            } else {
-                AddCharacterToCharSet(charSet, thisCh);
-            }
-            if (src < end - 1) {
-                if (*src == '-') {
-                    ++src;
-                    inRange = JS_TRUE;
-                    rangeStart = thisCh;
-                }
-            }
-        }
-    }
-    return JS_TRUE;
-}
-
-void
-js_DestroyRegExp(JSContext *cx, JSRegExp *re)
-{
-    if (JS_ATOMIC_DECREMENT(&re->nrefs) == 0) {
-        if (re->classList) {
-            uintN i;
-            for (i = 0; i < re->classCount; i++) {
-                if (re->classList[i].converted)
-                    JS_free(cx, re->classList[i].u.bits);
-                re->classList[i].u.bits = NULL;
-            }
-            JS_free(cx, re->classList);
-        }
-        JS_free(cx, re);
-    }
-}
-
-static JSBool
-ReallocStateStack(REGlobalData *gData)
-{
-    size_t limit = gData->stateStackLimit;
-    size_t sz = sizeof(REProgState) * limit;
-
-    JS_ARENA_GROW_CAST(gData->stateStack, REProgState *, &gData->pool, sz, sz);
-    if (!gData->stateStack) {
-        js_ReportOutOfScriptQuota(gData->cx);
-        gData->ok = JS_FALSE;
-        return JS_FALSE;
-    }
-    gData->stateStackLimit = limit + limit;
-    return JS_TRUE;
-}
-
-#define PUSH_STATE_STACK(data)                                                \
-    JS_BEGIN_MACRO                                                            \
-        ++(data)->stateStackTop;                                              \
-        if ((data)->stateStackTop == (data)->stateStackLimit &&               \
-            !ReallocStateStack((data))) {                                     \
-            return NULL;                                                      \
-        }                                                                     \
-    JS_END_MACRO
-
-/*
- * Apply the current op against the given input to see if it's going to match
- * or fail. Return false if we don't get a match, true if we do. If updatecp is
- * true, then update the current state's cp. Always update startpc to the next
- * op.
- */
-static JS_INLINE REMatchState *
-SimpleMatch(REGlobalData *gData, REMatchState *x, REOp op,
-            jsbytecode **startpc, JSBool updatecp)
-{
-    REMatchState *result = NULL;
-    jschar matchCh;
-    size_t parenIndex;
-    size_t offset, length, index;
-    jsbytecode *pc = *startpc;  /* pc has already been incremented past op */
-    jschar *source;
-    const jschar *startcp = x->cp;
-    jschar ch;
-    RECharSet *charSet;
-
-#ifdef REGEXP_DEBUG
-    const char *opname = reop_names[op];
-    re_debug("\n%06d: %*s%s", pc - gData->regexp->program,
-             gData->stateStackTop * 2, "", opname);
-#endif
-    switch (op) {
-      case REOP_EMPTY:
-        result = x;
-        break;
-      case REOP_BOL:
-        if (x->cp != gData->cpbegin) {
-            if (!gData->cx->regExpStatics.multiline &&
-                !(gData->regexp->flags & JSREG_MULTILINE)) {
-                break;
-            }
-            if (!RE_IS_LINE_TERM(x->cp[-1]))
-                break;
-        }
-        result = x;
-        break;
-      case REOP_EOL:
-        if (x->cp != gData->cpend) {
-            if (!gData->cx->regExpStatics.multiline &&
-                !(gData->regexp->flags & JSREG_MULTILINE)) {
-                break;
-            }
-            if (!RE_IS_LINE_TERM(*x->cp))
-                break;
-        }
-        result = x;
-        break;
-      case REOP_WBDRY:
-        if ((x->cp == gData->cpbegin || !JS_ISWORD(x->cp[-1])) ^
-            !(x->cp != gData->cpend && JS_ISWORD(*x->cp))) {
-            result = x;
-        }
-        break;
-      case REOP_WNONBDRY:
-        if ((x->cp == gData->cpbegin || !JS_ISWORD(x->cp[-1])) ^
-            (x->cp != gData->cpend && JS_ISWORD(*x->cp))) {
-            result = x;
-        }
-        break;
-      case REOP_DOT:
-        if (x->cp != gData->cpend && !RE_IS_LINE_TERM(*x->cp)) {
-            result = x;
-            result->cp++;
-        }
-        break;
-      case REOP_DIGIT:
-        if (x->cp != gData->cpend && JS7_ISDEC(*x->cp)) {
-            result = x;
-            result->cp++;
-        }
-        break;
-      case REOP_NONDIGIT:
-        if (x->cp != gData->cpend && !JS7_ISDEC(*x->cp)) {
-            result = x;
-            result->cp++;
-        }
-        break;
-      case REOP_ALNUM:
-        if (x->cp != gData->cpend && JS_ISWORD(*x->cp)) {
-            result = x;
-            result->cp++;
-        }
-        break;
-      case REOP_NONALNUM:
-        if (x->cp != gData->cpend && !JS_ISWORD(*x->cp)) {
-            result = x;
-            result->cp++;
-        }
-        break;
-      case REOP_SPACE:
-        if (x->cp != gData->cpend && JS_ISSPACE(*x->cp)) {
-            result = x;
-            result->cp++;
-        }
-        break;
-      case REOP_NONSPACE:
-        if (x->cp != gData->cpend && !JS_ISSPACE(*x->cp)) {
-            result = x;
-            result->cp++;
-        }
-        break;
-      case REOP_BACKREF:
-        pc = ReadCompactIndex(pc, &parenIndex);
-        JS_ASSERT(parenIndex < gData->regexp->parenCount);
-        result = BackrefMatcher(gData, x, parenIndex);
-        break;
-      case REOP_FLAT:
-        pc = ReadCompactIndex(pc, &offset);
-        JS_ASSERT(offset < JSSTRING_LENGTH(gData->regexp->source));
-        pc = ReadCompactIndex(pc, &length);
-        JS_ASSERT(1 <= length);
-        JS_ASSERT(length <= JSSTRING_LENGTH(gData->regexp->source) - offset);
-        if (length <= (size_t)(gData->cpend - x->cp)) {
-            source = JSSTRING_CHARS(gData->regexp->source) + offset;
-            re_debug_chars(source, length);
-            for (index = 0; index != length; index++) {
-                if (source[index] != x->cp[index])
-                    return NULL;
-            }
-            x->cp += length;
-            result = x;
-        }
-        break;
-      case REOP_FLAT1:
-        matchCh = *pc++;
-        re_debug(" '%c' == '%c'", (char)matchCh, (char)*x->cp);
-        if (x->cp != gData->cpend && *x->cp == matchCh) {
-            result = x;
-            result->cp++;
-        }
-        break;
-      case REOP_FLATi:
-        pc = ReadCompactIndex(pc, &offset);
-        JS_ASSERT(offset < JSSTRING_LENGTH(gData->regexp->source));
-        pc = ReadCompactIndex(pc, &length);
-        JS_ASSERT(1 <= length);
-        JS_ASSERT(length <= JSSTRING_LENGTH(gData->regexp->source) - offset);
-        source = JSSTRING_CHARS(gData->regexp->source);
-        result = FlatNIMatcher(gData, x, source + offset, length);
-        break;
-      case REOP_FLAT1i:
-        matchCh = *pc++;
-        if (x->cp != gData->cpend && upcase(*x->cp) == upcase(matchCh)) {
-            result = x;
-            result->cp++;
-        }
-        break;
-      case REOP_UCFLAT1:
-        matchCh = GET_ARG(pc);
-        re_debug(" '%c' == '%c'", (char)matchCh, (char)*x->cp);
-        pc += ARG_LEN;
-        if (x->cp != gData->cpend && *x->cp == matchCh) {
-            result = x;
-            result->cp++;
-        }
-        break;
-      case REOP_UCFLAT1i:
-        matchCh = GET_ARG(pc);
-        pc += ARG_LEN;
-        if (x->cp != gData->cpend && upcase(*x->cp) == upcase(matchCh)) {
-            result = x;
-            result->cp++;
-        }
-        break;
-      case REOP_CLASS:
-        pc = ReadCompactIndex(pc, &index);
-        JS_ASSERT(index < gData->regexp->classCount);
-        if (x->cp != gData->cpend) {
-            charSet = &gData->regexp->classList[index];
-            JS_ASSERT(charSet->converted);
-            ch = *x->cp;
-            index = ch >> 3;
-            if (charSet->length != 0 &&
-                ch <= charSet->length &&
-                (charSet->u.bits[index] & (1 << (ch & 0x7)))) {
-                result = x;
-                result->cp++;
-            }
-        }
-        break;
-      case REOP_NCLASS:
-        pc = ReadCompactIndex(pc, &index);
-        JS_ASSERT(index < gData->regexp->classCount);
-        if (x->cp != gData->cpend) {
-            charSet = &gData->regexp->classList[index];
-            JS_ASSERT(charSet->converted);
-            ch = *x->cp;
-            index = ch >> 3;
-            if (charSet->length == 0 ||
-                ch > charSet->length ||
-                !(charSet->u.bits[index] & (1 << (ch & 0x7)))) {
-                result = x;
-                result->cp++;
-            }
-        }
-        break;
-
-      default:
-        JS_ASSERT(JS_FALSE);
-    }
-    if (result) {
-        if (!updatecp)
-            x->cp = startcp;
-        *startpc = pc;
-        re_debug(" * ");
-        return result;
-    }
-    x->cp = startcp;
-    return NULL;
-}
-
-static JS_INLINE REMatchState *
-ExecuteREBytecode(REGlobalData *gData, REMatchState *x)
-{
-    REMatchState *result = NULL;
-    REBackTrackData *backTrackData;
-    jsbytecode *nextpc, *testpc;
-    REOp nextop;
-    RECapture *cap;
-    REProgState *curState;
-    const jschar *startcp;
-    size_t parenIndex, k;
-    size_t parenSoFar = 0;
-
-    jschar matchCh1, matchCh2;
-    RECharSet *charSet;
-
-    JSBool anchor;
-    jsbytecode *pc = gData->regexp->program;
-    REOp op = (REOp) *pc++;
-
-    /*
-     * If the first node is a simple match, step the index into the string
-     * until that match is made, or fail if it can't be found at all.
-     */
-    if (REOP_IS_SIMPLE(op) && !(gData->regexp->flags & JSREG_STICKY)) {
-        anchor = JS_FALSE;
-        while (x->cp <= gData->cpend) {
-            nextpc = pc;    /* reset back to start each time */
-            result = SimpleMatch(gData, x, op, &nextpc, JS_TRUE);
-            if (result) {
-                anchor = JS_TRUE;
-                x = result;
-                pc = nextpc;    /* accept skip to next opcode */
-                op = (REOp) *pc++;
-                JS_ASSERT(op < REOP_LIMIT);
-                break;
-            }
-            gData->skipped++;
-            x->cp++;
-        }
-        if (!anchor)
-            goto bad;
-    }
-
-    for (;;) {
-#ifdef REGEXP_DEBUG
-        const char *opname = reop_names[op];
-        re_debug("\n%06d: %*s%s", pc - gData->regexp->program,
-                 gData->stateStackTop * 2, "", opname);
-#endif
-        if (REOP_IS_SIMPLE(op)) {
-            result = SimpleMatch(gData, x, op, &pc, JS_TRUE);
-        } else {
-            curState = &gData->stateStack[gData->stateStackTop];
-            switch (op) {
-              case REOP_END:
-                goto good;
-              case REOP_ALTPREREQ2:
-                nextpc = pc + GET_OFFSET(pc);   /* start of next op */
-                pc += ARG_LEN;
-                matchCh2 = GET_ARG(pc);
-                pc += ARG_LEN;
-                k = GET_ARG(pc);
-                pc += ARG_LEN;
-
-                if (x->cp != gData->cpend) {
-                    if (*x->cp == matchCh2)
-                        goto doAlt;
-
-                    charSet = &gData->regexp->classList[k];
-                    if (!charSet->converted && !ProcessCharSet(gData, charSet))
-                        goto bad;
-                    matchCh1 = *x->cp;
-                    k = matchCh1 >> 3;
-                    if ((charSet->length == 0 ||
-                         matchCh1 > charSet->length ||
-                         !(charSet->u.bits[k] & (1 << (matchCh1 & 0x7)))) ^
-                        charSet->sense) {
-                        goto doAlt;
-                    }
-                }
-                result = NULL;
-                break;
-
-              case REOP_ALTPREREQ:
-                nextpc = pc + GET_OFFSET(pc);   /* start of next op */
-                pc += ARG_LEN;
-                matchCh1 = GET_ARG(pc);
-                pc += ARG_LEN;
-                matchCh2 = GET_ARG(pc);
-                pc += ARG_LEN;
-                if (x->cp == gData->cpend ||
-                    (*x->cp != matchCh1 && *x->cp != matchCh2)) {
-                    result = NULL;
-                    break;
-                }
-                /* else false thru... */
-
-              case REOP_ALT:
-              doAlt:
-                nextpc = pc + GET_OFFSET(pc);   /* start of next alternate */
-                pc += ARG_LEN;                  /* start of this alternate */
-                curState->parenSoFar = parenSoFar;
-                PUSH_STATE_STACK(gData);
-                op = (REOp) *pc++;
-                startcp = x->cp;
-                if (REOP_IS_SIMPLE(op)) {
-                    if (!SimpleMatch(gData, x, op, &pc, JS_TRUE)) {
-                        op = (REOp) *nextpc++;
-                        pc = nextpc;
-                        continue;
-                    }
-                    result = x;
-                    op = (REOp) *pc++;
-                }
-                nextop = (REOp) *nextpc++;
-                if (!PushBackTrackState(gData, nextop, nextpc, x, startcp, 0, 0))
-                    goto bad;
-                continue;
-
-              /*
-               * Occurs at (successful) end of REOP_ALT,
-               */
-              case REOP_JUMP:
-                /*
-                 * If we have not gotten a result here, it is because of an
-                 * empty match.  Do the same thing REOP_EMPTY would do.
-                 */
-                if (!result)
-                    result = x;
-
-                --gData->stateStackTop;
-                pc += GET_OFFSET(pc);
-                op = (REOp) *pc++;
-                continue;
-
-              /*
-               * Occurs at last (successful) end of REOP_ALT,
-               */
-              case REOP_ENDALT:
-                /*
-                 * If we have not gotten a result here, it is because of an
-                 * empty match.  Do the same thing REOP_EMPTY would do.
-                 */
-                if (!result)
-                    result = x;
-
-                --gData->stateStackTop;
-                op = (REOp) *pc++;
-                continue;
-
-              case REOP_LPAREN:
-                pc = ReadCompactIndex(pc, &parenIndex);
-                re_debug("[ %lu ]", (unsigned long) parenIndex);
-                JS_ASSERT(parenIndex < gData->regexp->parenCount);
-                if (parenIndex + 1 > parenSoFar)
-                    parenSoFar = parenIndex + 1;
-                x->parens[parenIndex].index = x->cp - gData->cpbegin;
-                x->parens[parenIndex].length = 0;
-                op = (REOp) *pc++;
-                continue;
-
-              case REOP_RPAREN:
-              {
-                ptrdiff_t delta;
-
-                pc = ReadCompactIndex(pc, &parenIndex);
-                JS_ASSERT(parenIndex < gData->regexp->parenCount);
-                cap = &x->parens[parenIndex];
-                delta = x->cp - (gData->cpbegin + cap->index);
-                cap->length = (delta < 0) ? 0 : (size_t) delta;
-                op = (REOp) *pc++;
-
-                if (!result)
-                    result = x;
-                continue;
-              }
-              case REOP_ASSERT:
-                nextpc = pc + GET_OFFSET(pc);  /* start of term after ASSERT */
-                pc += ARG_LEN;                 /* start of ASSERT child */
-                op = (REOp) *pc++;
-                testpc = pc;
-                if (REOP_IS_SIMPLE(op) &&
-                    !SimpleMatch(gData, x, op, &testpc, JS_FALSE)) {
-                    result = NULL;
-                    break;
-                }
-                curState->u.assertion.top =
-                    (char *)gData->backTrackSP - (char *)gData->backTrackStack;
-                curState->u.assertion.sz = gData->cursz;
-                curState->index = x->cp - gData->cpbegin;
-                curState->parenSoFar = parenSoFar;
-                PUSH_STATE_STACK(gData);
-                if (!PushBackTrackState(gData, REOP_ASSERTTEST,
-                                        nextpc, x, x->cp, 0, 0)) {
-                    goto bad;
-                }
-                continue;
-
-              case REOP_ASSERT_NOT:
-                nextpc = pc + GET_OFFSET(pc);
-                pc += ARG_LEN;
-                op = (REOp) *pc++;
-                testpc = pc;
-                if (REOP_IS_SIMPLE(op) /* Note - fail to fail! */ &&
-                    SimpleMatch(gData, x, op, &testpc, JS_FALSE) &&
-                    *testpc == REOP_ASSERTNOTTEST) {
-                    result = NULL;
-                    break;
-                }
-                curState->u.assertion.top
-                    = (char *)gData->backTrackSP -
-                      (char *)gData->backTrackStack;
-                curState->u.assertion.sz = gData->cursz;
-                curState->index = x->cp - gData->cpbegin;
-                curState->parenSoFar = parenSoFar;
-                PUSH_STATE_STACK(gData);
-                if (!PushBackTrackState(gData, REOP_ASSERTNOTTEST,
-                                        nextpc, x, x->cp, 0, 0)) {
-                    goto bad;
-                }
-                continue;
-
-              case REOP_ASSERTTEST:
-                --gData->stateStackTop;
-                --curState;
-                x->cp = gData->cpbegin + curState->index;
-                gData->backTrackSP =
-                    (REBackTrackData *) ((char *)gData->backTrackStack +
-                                         curState->u.assertion.top);
-                gData->cursz = curState->u.assertion.sz;
-                if (result)
-                    result = x;
-                break;
-
-              case REOP_ASSERTNOTTEST:
-                --gData->stateStackTop;
-                --curState;
-                x->cp = gData->cpbegin + curState->index;
-                gData->backTrackSP =
-                    (REBackTrackData *) ((char *)gData->backTrackStack +
-                                         curState->u.assertion.top);
-                gData->cursz = curState->u.assertion.sz;
-                result = (!result) ? x : NULL;
-                break;
-              case REOP_STAR:
-                curState->u.quantifier.min = 0;
-                curState->u.quantifier.max = (uintN)-1;
-                goto quantcommon;
-              case REOP_PLUS:
-                curState->u.quantifier.min = 1;
-                curState->u.quantifier.max = (uintN)-1;
-                goto quantcommon;
-              case REOP_OPT:
-                curState->u.quantifier.min = 0;
-                curState->u.quantifier.max = 1;
-                goto quantcommon;
-              case REOP_QUANT:
-                pc = ReadCompactIndex(pc, &k);
-                curState->u.quantifier.min = k;
-                pc = ReadCompactIndex(pc, &k);
-                /* max is k - 1 to use one byte for (uintN)-1 sentinel. */
-                curState->u.quantifier.max = k - 1;
-                JS_ASSERT(curState->u.quantifier.min
-                          <= curState->u.quantifier.max);
-              quantcommon:
-                if (curState->u.quantifier.max == 0) {
-                    pc = pc + GET_OFFSET(pc);
-                    op = (REOp) *pc++;
-                    result = x;
-                    continue;
-                }
-                /* Step over <next> */
-                nextpc = pc + ARG_LEN;
-                op = (REOp) *nextpc++;
-                startcp = x->cp;
-                if (REOP_IS_SIMPLE(op)) {
-                    if (!SimpleMatch(gData, x, op, &nextpc, JS_TRUE)) {
-                        if (curState->u.quantifier.min == 0)
-                            result = x;
-                        else
-                            result = NULL;
-                        pc = pc + GET_OFFSET(pc);
-                        break;
-                    }
-                    op = (REOp) *nextpc++;
-                    result = x;
-                }
-                curState->index = startcp - gData->cpbegin;
-                curState->continue_op = REOP_REPEAT;
-                curState->continue_pc = pc;
-                curState->parenSoFar = parenSoFar;
-                PUSH_STATE_STACK(gData);
-                if (curState->u.quantifier.min == 0 &&
-                    !PushBackTrackState(gData, REOP_REPEAT, pc, x, startcp,
-                                        0, 0)) {
-                    goto bad;
-                }
-                pc = nextpc;
-                continue;
-
-              case REOP_ENDCHILD: /* marks the end of a quantifier child */
-                pc = curState[-1].continue_pc;
-                op = (REOp) curState[-1].continue_op;
-
-                if (!result)
-                    result = x;
-                continue;
-
-              case REOP_REPEAT:
-                --curState;
-                do {
-                    --gData->stateStackTop;
-                    if (!result) {
-                        /* Failed, see if we have enough children. */
-                        if (curState->u.quantifier.min == 0)
-                            goto repeatDone;
-                        goto break_switch;
-                    }
-                    if (curState->u.quantifier.min == 0 &&
-                        x->cp == gData->cpbegin + curState->index) {
-                        /* matched an empty string, that'll get us nowhere */
-                        result = NULL;
-                        goto break_switch;
-                    }
-                    if (curState->u.quantifier.min != 0)
-                        curState->u.quantifier.min--;
-                    if (curState->u.quantifier.max != (uintN) -1)
-                        curState->u.quantifier.max--;
-                    if (curState->u.quantifier.max == 0)
-                        goto repeatDone;
-                    nextpc = pc + ARG_LEN;
-                    nextop = (REOp) *nextpc;
-                    startcp = x->cp;
-                    if (REOP_IS_SIMPLE(nextop)) {
-                        nextpc++;
-                        if (!SimpleMatch(gData, x, nextop, &nextpc, JS_TRUE)) {
-                            if (curState->u.quantifier.min == 0)
-                                goto repeatDone;
-                            result = NULL;
-                            goto break_switch;
-                        }
-                        result = x;
-                    }
-                    curState->index = startcp - gData->cpbegin;
-                    PUSH_STATE_STACK(gData);
-                    if (curState->u.quantifier.min == 0 &&
-                        !PushBackTrackState(gData, REOP_REPEAT,
-                                            pc, x, startcp,
-                                            curState->parenSoFar,
-                                            parenSoFar -
-                                            curState->parenSoFar)) {
-                        goto bad;
-                    }
-                } while (*nextpc == REOP_ENDCHILD);
-                pc = nextpc;
-                op = (REOp) *pc++;
-                parenSoFar = curState->parenSoFar;
-                continue;
-
-              repeatDone:
-                result = x;
-                pc += GET_OFFSET(pc);
-                goto break_switch;
-
-              case REOP_MINIMALSTAR:
-                curState->u.quantifier.min = 0;
-                curState->u.quantifier.max = (uintN)-1;
-                goto minimalquantcommon;
-              case REOP_MINIMALPLUS:
-                curState->u.quantifier.min = 1;
-                curState->u.quantifier.max = (uintN)-1;
-                goto minimalquantcommon;
-              case REOP_MINIMALOPT:
-                curState->u.quantifier.min = 0;
-                curState->u.quantifier.max = 1;
-                goto minimalquantcommon;
-              case REOP_MINIMALQUANT:
-                pc = ReadCompactIndex(pc, &k);
-                curState->u.quantifier.min = k;
-                pc = ReadCompactIndex(pc, &k);
-                /* See REOP_QUANT comments about k - 1. */
-                curState->u.quantifier.max = k - 1;
-                JS_ASSERT(curState->u.quantifier.min
-                          <= curState->u.quantifier.max);
-              minimalquantcommon:
-                curState->index = x->cp - gData->cpbegin;
-                curState->parenSoFar = parenSoFar;
-                PUSH_STATE_STACK(gData);
-                if (curState->u.quantifier.min != 0) {
-                    curState->continue_op = REOP_MINIMALREPEAT;
-                    curState->continue_pc = pc;
-                    /* step over <next> */
-                    pc += OFFSET_LEN;
-                    op = (REOp) *pc++;
-                } else {
-                    if (!PushBackTrackState(gData, REOP_MINIMALREPEAT,
-                                            pc, x, x->cp, 0, 0)) {
-                        goto bad;
-                    }
-                    --gData->stateStackTop;
-                    pc = pc + GET_OFFSET(pc);
-                    op = (REOp) *pc++;
-                }
-                continue;
-
-              case REOP_MINIMALREPEAT:
-                --gData->stateStackTop;
-                --curState;
-
-                re_debug("{%d,%d}", curState->u.quantifier.min,
-                         curState->u.quantifier.max);
-#define PREPARE_REPEAT()                                                      \
-    JS_BEGIN_MACRO                                                            \
-        curState->index = x->cp - gData->cpbegin;                             \
-        curState->continue_op = REOP_MINIMALREPEAT;                           \
-        curState->continue_pc = pc;                                           \
-        pc += ARG_LEN;                                                        \
-        for (k = curState->parenSoFar; k < parenSoFar; k++)                   \
-            x->parens[k].index = -1;                                          \
-        PUSH_STATE_STACK(gData);                                              \
-        op = (REOp) *pc++;                                                    \
-        JS_ASSERT(op < REOP_LIMIT);                                           \
-    JS_END_MACRO
-
-                if (!result) {
-                    re_debug(" - ");
-                    /*
-                     * Non-greedy failure - try to consume another child.
-                     */
-                    if (curState->u.quantifier.max == (uintN) -1 ||
-                        curState->u.quantifier.max > 0) {
-                        PREPARE_REPEAT();
-                        continue;
-                    }
-                    /* Don't need to adjust pc since we're going to pop. */
-                    break;
-                }
-                if (curState->u.quantifier.min == 0 &&
-                    x->cp == gData->cpbegin + curState->index) {
-                    /* Matched an empty string, that'll get us nowhere. */
-                    result = NULL;
-                    break;
-                }
-                if (curState->u.quantifier.min != 0)
-                    curState->u.quantifier.min--;
-                if (curState->u.quantifier.max != (uintN) -1)
-                    curState->u.quantifier.max--;
-                if (curState->u.quantifier.min != 0) {
-                    PREPARE_REPEAT();
-                    continue;
-                }
-                curState->index = x->cp - gData->cpbegin;
-                curState->parenSoFar = parenSoFar;
-                PUSH_STATE_STACK(gData);
-                if (!PushBackTrackState(gData, REOP_MINIMALREPEAT,
-                                        pc, x, x->cp,
-                                        curState->parenSoFar,
-                                        parenSoFar - curState->parenSoFar)) {
-                    goto bad;
-                }
-                --gData->stateStackTop;
-                pc = pc + GET_OFFSET(pc);
-                op = (REOp) *pc++;
-                JS_ASSERT(op < REOP_LIMIT);
-                continue;
-              default:
-                JS_ASSERT(JS_FALSE);
-                result = NULL;
-            }
-          break_switch:;
-        }
-
-        /*
-         *  If the match failed and there's a backtrack option, take it.
-         *  Otherwise this is a complete and utter failure.
-         */
-        if (!result) {
-            if (gData->cursz == 0)
-                return NULL;
-            if (!JS_CHECK_OPERATION_LIMIT(gData->cx, JSOW_JUMP)) {
-                gData->ok = JS_FALSE;
-                return NULL;
-            }
-
-            /* Potentially detect explosive regex here. */
-            gData->backTrackCount++;
-            if (gData->backTrackLimit &&
-                gData->backTrackCount >= gData->backTrackLimit) {
-                JS_ReportErrorNumber(gData->cx, js_GetErrorMessage, NULL,
-                                     JSMSG_REGEXP_TOO_COMPLEX);
-                gData->ok = JS_FALSE;
-                return NULL;
-            }
-
-            backTrackData = gData->backTrackSP;
-            gData->cursz = backTrackData->sz;
-            gData->backTrackSP =
-                (REBackTrackData *) ((char *)backTrackData - backTrackData->sz);
-            x->cp = backTrackData->cp;
-            pc = backTrackData->backtrack_pc;
-            op = (REOp) backTrackData->backtrack_op;
-            JS_ASSERT(op < REOP_LIMIT);
-            gData->stateStackTop = backTrackData->saveStateStackTop;
-            JS_ASSERT(gData->stateStackTop);
-
-            memcpy(gData->stateStack, backTrackData + 1,
-                   sizeof(REProgState) * backTrackData->saveStateStackTop);
-            curState = &gData->stateStack[gData->stateStackTop - 1];
-
-            if (backTrackData->parenCount) {
-                memcpy(&x->parens[backTrackData->parenIndex],
-                       (char *)(backTrackData + 1) +
-                       sizeof(REProgState) * backTrackData->saveStateStackTop,
-                       sizeof(RECapture) * backTrackData->parenCount);
-                parenSoFar = backTrackData->parenIndex + backTrackData->parenCount;
-            } else {
-                for (k = curState->parenSoFar; k < parenSoFar; k++)
-                    x->parens[k].index = -1;
-                parenSoFar = curState->parenSoFar;
-            }
-
-            re_debug("\tBT_Pop: %ld,%ld",
-                     (unsigned long) backTrackData->parenIndex,
-                     (unsigned long) backTrackData->parenCount);
-            continue;
-        }
-        x = result;
-
-        /*
-         *  Continue with the expression.
-         */
-        op = (REOp)*pc++;
-        JS_ASSERT(op < REOP_LIMIT);
-    }
-
-bad:
-    re_debug("\n");
-    return NULL;
-
-good:
-    re_debug("\n");
-    return x;
-}
-
-static REMatchState *
-MatchRegExp(REGlobalData *gData, REMatchState *x)
-{
-    REMatchState *result;
-    const jschar *cp = x->cp;
-    const jschar *cp2;
-    uintN j;
-
-    /*
-     * Have to include the position beyond the last character
-     * in order to detect end-of-input/line condition.
-     */
-    for (cp2 = cp; cp2 <= gData->cpend; cp2++) {
-        gData->skipped = cp2 - cp;
-        x->cp = cp2;
-        for (j = 0; j < gData->regexp->parenCount; j++)
-            x->parens[j].index = -1;
-        result = ExecuteREBytecode(gData, x);
-        if (!gData->ok || result || (gData->regexp->flags & JSREG_STICKY))
-            return result;
-        gData->backTrackSP = gData->backTrackStack;
-        gData->cursz = 0;
-        gData->stateStackTop = 0;
-        cp2 = cp + gData->skipped;
-    }
-    return NULL;
-}
-
-#define MIN_BACKTRACK_LIMIT 400000
-
-static REMatchState *
-InitMatch(JSContext *cx, REGlobalData *gData, JSRegExp *re, size_t length)
-{
-    REMatchState *result;
-    uintN i;
-
-    gData->backTrackStackSize = INITIAL_BACKTRACK;
-    JS_ARENA_ALLOCATE_CAST(gData->backTrackStack, REBackTrackData *,
-                           &gData->pool,
-                           INITIAL_BACKTRACK);
-    if (!gData->backTrackStack)
-        goto bad;
-
-    gData->backTrackSP = gData->backTrackStack;
-    gData->cursz = 0;
-    gData->backTrackCount = 0;
-    gData->backTrackLimit = 0;
-    if (JS_GetOptions(cx) & JSOPTION_RELIMIT) {
-        gData->backTrackLimit = length * length * length; /* O(n^3) */
-        if (gData->backTrackLimit < MIN_BACKTRACK_LIMIT)
-            gData->backTrackLimit = MIN_BACKTRACK_LIMIT;
-    }
-
-    gData->stateStackLimit = INITIAL_STATESTACK;
-    JS_ARENA_ALLOCATE_CAST(gData->stateStack, REProgState *,
-                           &gData->pool,
-                           sizeof(REProgState) * INITIAL_STATESTACK);
-    if (!gData->stateStack)
-        goto bad;
-
-    gData->stateStackTop = 0;
-    gData->cx = cx;
-    gData->regexp = re;
-    gData->ok = JS_TRUE;
-
-    JS_ARENA_ALLOCATE_CAST(result, REMatchState *,
-                           &gData->pool,
-                           offsetof(REMatchState, parens)
-                           + re->parenCount * sizeof(RECapture));
-    if (!result)
-        goto bad;
-
-    for (i = 0; i < re->classCount; i++) {
-        if (!re->classList[i].converted &&
-            !ProcessCharSet(gData, &re->classList[i])) {
-            return NULL;
-        }
-    }
-
-    return result;
-
-bad:
-    js_ReportOutOfScriptQuota(cx);
-    gData->ok = JS_FALSE;
-    return NULL;
-}
-
-JSBool
-js_ExecuteRegExp(JSContext *cx, JSRegExp *re, JSString *str, size_t *indexp,
-                 JSBool test, jsval *rval)
-{
-    REGlobalData gData;
-    REMatchState *x, *result;
-
-    const jschar *cp, *ep;
-    size_t i, length, start;
-    JSSubString *morepar;
-    JSBool ok;
-    JSRegExpStatics *res;
-    ptrdiff_t matchlen;
-    uintN num, morenum;
-    JSString *parstr, *matchstr;
-    JSObject *obj;
-
-    RECapture *parsub = NULL;
-
-    /*
-     * It's safe to load from cp because JSStrings have a zero at the end,
-     * and we never let cp get beyond cpend.
-     */
-    start = *indexp;
-    JSSTRING_CHARS_AND_LENGTH(str, cp, length);
-    if (start > length)
-        start = length;
-    gData.cpbegin = cp;
-    gData.cpend = cp + length;
-    cp += start;
-    gData.start = start;
-    gData.skipped = 0;
-
-    /*
-     * To avoid multiple allocations in InitMatch(), the arena size parameter
-     * should be at least as big as:
-     * INITIAL_BACKTRACK
-     * + (sizeof(REProgState) * INITIAL_STATESTACK)
-     * + (offsetof(REMatchState, parens) + avgParanSize * sizeof(RECapture))
-     */
-    JS_INIT_ARENA_POOL(&gData.pool, "RegExpPool", 12288, 4,
-                       &cx->scriptStackQuota);
-    x = InitMatch(cx, &gData, re, length);
-
-    if (!x) {
-        ok = JS_FALSE;
-        goto out;
-    }
-    x->cp = cp;
-
-    /*
-     * Call the recursive matcher to do the real work.  Return null on mismatch
-     * whether testing or not.  On match, return an extended Array object.
-     */
-    result = MatchRegExp(&gData, x);
-    ok = gData.ok;
-    if (!ok)
-        goto out;
-    if (!result) {
-        *rval = JSVAL_NULL;
-        goto out;
-    }
-    cp = result->cp;
-    i = cp - gData.cpbegin;
-    *indexp = i;
-    matchlen = i - (start + gData.skipped);
-    ep = cp;
-    cp -= matchlen;
-
-    if (test) {
-        /*
-         * Testing for a match and updating cx->regExpStatics: don't allocate
-         * an array object, do return true.
-         */
-        *rval = JSVAL_TRUE;
-
-        /* Avoid warning.  (gcc doesn't detect that obj is needed iff !test); */
-        obj = NULL;
-    } else {
-        /*
-         * The array returned on match has element 0 bound to the matched
-         * string, elements 1 through state.parenCount bound to the paren
-         * matches, an index property telling the length of the left context,
-         * and an input property referring to the input string.
-         */
-        obj = js_NewSlowArrayObject(cx);
-        if (!obj) {
-            ok = JS_FALSE;
-            goto out;
-        }
-        *rval = OBJECT_TO_JSVAL(obj);
-
-#define DEFVAL(val, id) {                                                     \
-    ok = js_DefineProperty(cx, obj, id, val,                                  \
-                           JS_PropertyStub, JS_PropertyStub,                  \
-                           JSPROP_ENUMERATE, NULL);                           \
-    if (!ok) {                                                                \
-        cx->weakRoots.newborn[GCX_OBJECT] = NULL;                             \
-        cx->weakRoots.newborn[GCX_STRING] = NULL;                             \
-        goto out;                                                             \
-    }                                                                         \
-}
-
-        matchstr = js_NewStringCopyN(cx, cp, matchlen);
-        if (!matchstr) {
-            cx->weakRoots.newborn[GCX_OBJECT] = NULL;
-            ok = JS_FALSE;
-            goto out;
-        }
-        DEFVAL(STRING_TO_JSVAL(matchstr), INT_TO_JSID(0));
-    }
-
-    res = &cx->regExpStatics;
-    res->input = str;
-    res->parenCount = re->parenCount;
-    if (re->parenCount == 0) {
-        res->lastParen = js_EmptySubString;
-    } else {
-        for (num = 0; num < re->parenCount; num++) {
-            parsub = &result->parens[num];
-            if (num < 9) {
-                if (parsub->index == -1) {
-                    res->parens[num].chars = NULL;
-                    res->parens[num].length = 0;
-                } else {
-                    res->parens[num].chars = gData.cpbegin + parsub->index;
-                    res->parens[num].length = parsub->length;
-                }
-            } else {
-                morenum = num - 9;
-                morepar = res->moreParens;
-                if (!morepar) {
-                    res->moreLength = 10;
-                    morepar = (JSSubString*)
-                        JS_malloc(cx, 10 * sizeof(JSSubString));
-                } else if (morenum >= res->moreLength) {
-                    res->moreLength += 10;
-                    morepar = (JSSubString*)
-                        JS_realloc(cx, morepar,
-                                   res->moreLength * sizeof(JSSubString));
-                }
-                if (!morepar) {
-                    cx->weakRoots.newborn[GCX_OBJECT] = NULL;
-                    cx->weakRoots.newborn[GCX_STRING] = NULL;
-                    ok = JS_FALSE;
-                    goto out;
-                }
-                res->moreParens = morepar;
-                if (parsub->index == -1) {
-                    morepar[morenum].chars = NULL;
-                    morepar[morenum].length = 0;
-                } else {
-                    morepar[morenum].chars = gData.cpbegin + parsub->index;
-                    morepar[morenum].length = parsub->length;
-                }
-            }
-            if (test)
-                continue;
-            if (parsub->index == -1) {
-                ok = js_DefineProperty(cx, obj, INT_TO_JSID(num + 1),
-                                       JSVAL_VOID, NULL, NULL,
-                                       JSPROP_ENUMERATE, NULL);
-            } else {
-                parstr = js_NewStringCopyN(cx, gData.cpbegin + parsub->index,
-                                           parsub->length);
-                if (!parstr) {
-                    cx->weakRoots.newborn[GCX_OBJECT] = NULL;
-                    cx->weakRoots.newborn[GCX_STRING] = NULL;
-                    ok = JS_FALSE;
-                    goto out;
-                }
-                ok = js_DefineProperty(cx, obj, INT_TO_JSID(num + 1),
-                                       STRING_TO_JSVAL(parstr), NULL, NULL,
-                                       JSPROP_ENUMERATE, NULL);
-            }
-            if (!ok) {
-                cx->weakRoots.newborn[GCX_OBJECT] = NULL;
-                cx->weakRoots.newborn[GCX_STRING] = NULL;
-                goto out;
-            }
-        }
-        if (parsub->index == -1) {
-            res->lastParen = js_EmptySubString;
-        } else {
-            res->lastParen.chars = gData.cpbegin + parsub->index;
-            res->lastParen.length = parsub->length;
-        }
-    }
-
-    if (!test) {
-        /*
-         * Define the index and input properties last for better for/in loop
-         * order (so they come after the elements).
-         */
-        DEFVAL(INT_TO_JSVAL(start + gData.skipped),
-               ATOM_TO_JSID(cx->runtime->atomState.indexAtom));
-        DEFVAL(STRING_TO_JSVAL(str),
-               ATOM_TO_JSID(cx->runtime->atomState.inputAtom));
-    }
-
-#undef DEFVAL
-
-    res->lastMatch.chars = cp;
-    res->lastMatch.length = matchlen;
-
-    /*
-     * For JS1.3 and ECMAv2, emulate Perl5 exactly:
-     *
-     * js1.3        "hi", "hi there"            "hihitherehi therebye"
-     */
-    res->leftContext.chars = JSSTRING_CHARS(str);
-    res->leftContext.length = start + gData.skipped;
-    res->rightContext.chars = ep;
-    res->rightContext.length = gData.cpend - ep;
-
-out:
-    JS_FinishArenaPool(&gData.pool);
-    return ok;
-}
-
-/************************************************************************/
-
-enum regexp_tinyid {
-    REGEXP_SOURCE       = -1,
-    REGEXP_GLOBAL       = -2,
-    REGEXP_IGNORE_CASE  = -3,
-    REGEXP_LAST_INDEX   = -4,
-    REGEXP_MULTILINE    = -5,
-    REGEXP_STICKY       = -6
-};
-
-#define REGEXP_PROP_ATTRS     (JSPROP_PERMANENT | JSPROP_SHARED)
-#define RO_REGEXP_PROP_ATTRS  (REGEXP_PROP_ATTRS | JSPROP_READONLY)
-
-static JSPropertySpec regexp_props[] = {
-    {"source",     REGEXP_SOURCE,      RO_REGEXP_PROP_ATTRS,0,0},
-    {"global",     REGEXP_GLOBAL,      RO_REGEXP_PROP_ATTRS,0,0},
-    {"ignoreCase", REGEXP_IGNORE_CASE, RO_REGEXP_PROP_ATTRS,0,0},
-    {"lastIndex",  REGEXP_LAST_INDEX,  REGEXP_PROP_ATTRS,0,0},
-    {"multiline",  REGEXP_MULTILINE,   RO_REGEXP_PROP_ATTRS,0,0},
-    {"sticky",     REGEXP_STICKY,      RO_REGEXP_PROP_ATTRS,0,0},
-    {0,0,0,0,0}
-};
-
-static JSBool
-regexp_getProperty(JSContext *cx, JSObject *obj, jsval id, jsval *vp)
-{
-    jsint slot;
-    JSRegExp *re;
-
-    if (!JSVAL_IS_INT(id))
-        return JS_TRUE;
-    while (OBJ_GET_CLASS(cx, obj) != &js_RegExpClass) {
-        obj = OBJ_GET_PROTO(cx, obj);
-        if (!obj)
-            return JS_TRUE;
-    }
-    slot = JSVAL_TO_INT(id);
-    if (slot == REGEXP_LAST_INDEX)
-        return JS_GetReservedSlot(cx, obj, 0, vp);
-
-    JS_LOCK_OBJ(cx, obj);
-    re = (JSRegExp *) JS_GetPrivate(cx, obj);
-    if (re) {
-        switch (slot) {
-          case REGEXP_SOURCE:
-            *vp = STRING_TO_JSVAL(re->source);
-            break;
-          case REGEXP_GLOBAL:
-            *vp = BOOLEAN_TO_JSVAL((re->flags & JSREG_GLOB) != 0);
-            break;
-          case REGEXP_IGNORE_CASE:
-            *vp = BOOLEAN_TO_JSVAL((re->flags & JSREG_FOLD) != 0);
-            break;
-          case REGEXP_MULTILINE:
-            *vp = BOOLEAN_TO_JSVAL((re->flags & JSREG_MULTILINE) != 0);
-            break;
-          case REGEXP_STICKY:
-            *vp = BOOLEAN_TO_JSVAL((re->flags & JSREG_STICKY) != 0);
-            break;
-        }
-    }
-    JS_UNLOCK_OBJ(cx, obj);
-    return JS_TRUE;
-}
-
-static JSBool
-regexp_setProperty(JSContext *cx, JSObject *obj, jsval id, jsval *vp)
-{
-    JSBool ok;
-    jsint slot;
-    jsdouble lastIndex;
-
-    ok = JS_TRUE;
-    if (!JSVAL_IS_INT(id))
-        return ok;
-    while (OBJ_GET_CLASS(cx, obj) != &js_RegExpClass) {
-        obj = OBJ_GET_PROTO(cx, obj);
-        if (!obj)
-            return JS_TRUE;
-    }
-    slot = JSVAL_TO_INT(id);
-    if (slot == REGEXP_LAST_INDEX) {
-        if (!JS_ValueToNumber(cx, *vp, &lastIndex))
-            return JS_FALSE;
-        lastIndex = js_DoubleToInteger(lastIndex);
-        ok = JS_NewNumberValue(cx, lastIndex, vp) &&
-             JS_SetReservedSlot(cx, obj, 0, *vp);
-    }
-    return ok;
-}
-
-/*
- * RegExp class static properties and their Perl counterparts:
- *
- *  RegExp.input                $_
- *  RegExp.multiline            $*
- *  RegExp.lastMatch            $&
- *  RegExp.lastParen            $+
- *  RegExp.leftContext          $`
- *  RegExp.rightContext         $'
- */
-enum regexp_static_tinyid {
-    REGEXP_STATIC_INPUT         = -1,
-    REGEXP_STATIC_MULTILINE     = -2,
-    REGEXP_STATIC_LAST_MATCH    = -3,
-    REGEXP_STATIC_LAST_PAREN    = -4,
-    REGEXP_STATIC_LEFT_CONTEXT  = -5,
-    REGEXP_STATIC_RIGHT_CONTEXT = -6
-};
-
-JSBool
-js_InitRegExpStatics(JSContext *cx, JSRegExpStatics *res)
-{
-    JS_ClearRegExpStatics(cx);
-    return js_AddRoot(cx, &res->input, "res->input");
-}
-
-void
-js_FreeRegExpStatics(JSContext *cx, JSRegExpStatics *res)
-{
-    if (res->moreParens) {
-        JS_free(cx, res->moreParens);
-        res->moreParens = NULL;
-    }
-    js_RemoveRoot(cx->runtime, &res->input);
-}
-
-static JSBool
-regexp_static_getProperty(JSContext *cx, JSObject *obj, jsval id, jsval *vp)
-{
-    jsint slot;
-    JSRegExpStatics *res;
-    JSString *str;
-    JSSubString *sub;
-
-    res = &cx->regExpStatics;
-    if (!JSVAL_IS_INT(id))
-        return JS_TRUE;
-    slot = JSVAL_TO_INT(id);
-    switch (slot) {
-      case REGEXP_STATIC_INPUT:
-        *vp = res->input ? STRING_TO_JSVAL(res->input)
-                         : JS_GetEmptyStringValue(cx);
-        return JS_TRUE;
-      case REGEXP_STATIC_MULTILINE:
-        *vp = BOOLEAN_TO_JSVAL(res->multiline);
-        return JS_TRUE;
-      case REGEXP_STATIC_LAST_MATCH:
-        sub = &res->lastMatch;
-        break;
-      case REGEXP_STATIC_LAST_PAREN:
-        sub = &res->lastParen;
-        break;
-      case REGEXP_STATIC_LEFT_CONTEXT:
-        sub = &res->leftContext;
-        break;
-      case REGEXP_STATIC_RIGHT_CONTEXT:
-        sub = &res->rightContext;
-        break;
-      default:
-        sub = REGEXP_PAREN_SUBSTRING(res, slot);
-        break;
-    }
-    str = js_NewStringCopyN(cx, sub->chars, sub->length);
-    if (!str)
-        return JS_FALSE;
-    *vp = STRING_TO_JSVAL(str);
-    return JS_TRUE;
-}
-
-static JSBool
-regexp_static_setProperty(JSContext *cx, JSObject *obj, jsval id, jsval *vp)
-{
-    JSRegExpStatics *res;
-
-    if (!JSVAL_IS_INT(id))
-        return JS_TRUE;
-    res = &cx->regExpStatics;
-    /* XXX use if-else rather than switch to keep MSVC1.52 from crashing */
-    if (JSVAL_TO_INT(id) == REGEXP_STATIC_INPUT) {
-        if (!JSVAL_IS_STRING(*vp) &&
-            !JS_ConvertValue(cx, *vp, JSTYPE_STRING, vp)) {
-            return JS_FALSE;
-        }
-        res->input = JSVAL_TO_STRING(*vp);
-    } else if (JSVAL_TO_INT(id) == REGEXP_STATIC_MULTILINE) {
-        if (!JSVAL_IS_BOOLEAN(*vp) &&
-            !JS_ConvertValue(cx, *vp, JSTYPE_BOOLEAN, vp)) {
-            return JS_FALSE;
-        }
-        res->multiline = JSVAL_TO_BOOLEAN(*vp);
-    }
-    return JS_TRUE;
-}
-#define REGEXP_STATIC_PROP_ATTRS    (REGEXP_PROP_ATTRS | JSPROP_ENUMERATE)
-#define RO_REGEXP_STATIC_PROP_ATTRS (REGEXP_STATIC_PROP_ATTRS | JSPROP_READONLY)
-
-static JSPropertySpec regexp_static_props[] = {
-    {"input",
-     REGEXP_STATIC_INPUT,
-     REGEXP_STATIC_PROP_ATTRS,
-     regexp_static_getProperty,    regexp_static_setProperty},
-    {"multiline",
-     REGEXP_STATIC_MULTILINE,
-     REGEXP_STATIC_PROP_ATTRS,
-     regexp_static_getProperty,    regexp_static_setProperty},
-    {"lastMatch",
-     REGEXP_STATIC_LAST_MATCH,
-     RO_REGEXP_STATIC_PROP_ATTRS,
-     regexp_static_getProperty,    regexp_static_getProperty},
-    {"lastParen",
-     REGEXP_STATIC_LAST_PAREN,
-     RO_REGEXP_STATIC_PROP_ATTRS,
-     regexp_static_getProperty,    regexp_static_getProperty},
-    {"leftContext",
-     REGEXP_STATIC_LEFT_CONTEXT,
-     RO_REGEXP_STATIC_PROP_ATTRS,
-     regexp_static_getProperty,    regexp_static_getProperty},
-    {"rightContext",
-     REGEXP_STATIC_RIGHT_CONTEXT,
-     RO_REGEXP_STATIC_PROP_ATTRS,
-     regexp_static_getProperty,    regexp_static_getProperty},
-
-    /* XXX should have block scope and local $1, etc. */
-    {"$1", 0, RO_REGEXP_STATIC_PROP_ATTRS,
-     regexp_static_getProperty,    regexp_static_getProperty},
-    {"$2", 1, RO_REGEXP_STATIC_PROP_ATTRS,
-     regexp_static_getProperty,    regexp_static_getProperty},
-    {"$3", 2, RO_REGEXP_STATIC_PROP_ATTRS,
-     regexp_static_getProperty,    regexp_static_getProperty},
-    {"$4", 3, RO_REGEXP_STATIC_PROP_ATTRS,
-     regexp_static_getProperty,    regexp_static_getProperty},
-    {"$5", 4, RO_REGEXP_STATIC_PROP_ATTRS,
-     regexp_static_getProperty,    regexp_static_getProperty},
-    {"$6", 5, RO_REGEXP_STATIC_PROP_ATTRS,
-     regexp_static_getProperty,    regexp_static_getProperty},
-    {"$7", 6, RO_REGEXP_STATIC_PROP_ATTRS,
-     regexp_static_getProperty,    regexp_static_getProperty},
-    {"$8", 7, RO_REGEXP_STATIC_PROP_ATTRS,
-     regexp_static_getProperty,    regexp_static_getProperty},
-    {"$9", 8, RO_REGEXP_STATIC_PROP_ATTRS,
-     regexp_static_getProperty,    regexp_static_getProperty},
-
-    {0,0,0,0,0}
-};
-
-static void
-regexp_finalize(JSContext *cx, JSObject *obj)
-{
-    JSRegExp *re;
-
-    re = (JSRegExp *) JS_GetPrivate(cx, obj);
-    if (!re)
-        return;
-    js_DestroyRegExp(cx, re);
-}
-
-/* Forward static prototype. */
-static JSBool
-regexp_exec_sub(JSContext *cx, JSObject *obj, uintN argc, jsval *argv,
-                JSBool test, jsval *rval);
-
-static JSBool
-regexp_call(JSContext *cx, JSObject *obj, uintN argc, jsval *argv, jsval *rval)
-{
-    return regexp_exec_sub(cx, JSVAL_TO_OBJECT(argv[-2]), argc, argv,
-                           JS_FALSE, rval);
-}
-
-#if JS_HAS_XDR
-
-#include "jsxdrapi.h"
-
-static JSBool
-regexp_xdrObject(JSXDRState *xdr, JSObject **objp)
-{
-    JSRegExp *re;
-    JSString *source;
-    uint32 flagsword;
-    JSObject *obj;
-
-    if (xdr->mode == JSXDR_ENCODE) {
-        re = (JSRegExp *) JS_GetPrivate(xdr->cx, *objp);
-        if (!re)
-            return JS_FALSE;
-        source = re->source;
-        flagsword = (uint32)re->flags;
-    }
-    if (!JS_XDRString(xdr, &source) ||
-        !JS_XDRUint32(xdr, &flagsword)) {
-        return JS_FALSE;
-    }
-    if (xdr->mode == JSXDR_DECODE) {
-        obj = js_NewObject(xdr->cx, &js_RegExpClass, NULL, NULL, 0);
-        if (!obj)
-            return JS_FALSE;
-        STOBJ_SET_PARENT(obj, NULL);
-        STOBJ_SET_PROTO(obj, NULL);
-        re = js_NewRegExp(xdr->cx, NULL, source, (uint8)flagsword, JS_FALSE);
-        if (!re)
-            return JS_FALSE;
-        if (!JS_SetPrivate(xdr->cx, obj, re) ||
-            !js_SetLastIndex(xdr->cx, obj, 0)) {
-            js_DestroyRegExp(xdr->cx, re);
-            return JS_FALSE;
-        }
-        *objp = obj;
-    }
-    return JS_TRUE;
-}
-
-#else  /* !JS_HAS_XDR */
-
-#define regexp_xdrObject NULL
-
-#endif /* !JS_HAS_XDR */
-
-static void
-regexp_trace(JSTracer *trc, JSObject *obj)
-{
-    JSRegExp *re;
-
-    re = (JSRegExp *) JS_GetPrivate(trc->context, obj);
-    if (re && re->source)
-        JS_CALL_STRING_TRACER(trc, re->source, "source");
-}
-
-JSClass js_RegExpClass = {
-    js_RegExp_str,
-    JSCLASS_HAS_PRIVATE | JSCLASS_HAS_RESERVED_SLOTS(1) |
-    JSCLASS_MARK_IS_TRACE | JSCLASS_HAS_CACHED_PROTO(JSProto_RegExp),
-    JS_PropertyStub,    JS_PropertyStub,
-    regexp_getProperty, regexp_setProperty,
-    JS_EnumerateStub,   JS_ResolveStub,
-    JS_ConvertStub,     regexp_finalize,
-    NULL,               NULL,
-    regexp_call,        NULL,
-    regexp_xdrObject,   NULL,
-    JS_CLASS_TRACE(regexp_trace), 0
-};
-
-static const jschar empty_regexp_ucstr[] = {'(', '?', ':', ')', 0};
-
-JSBool
-js_regexp_toString(JSContext *cx, JSObject *obj, jsval *vp)
-{
-    JSRegExp *re;
-    const jschar *source;
-    jschar *chars;
-    size_t length, nflags;
-    uintN flags;
-    JSString *str;
-
-    if (!JS_InstanceOf(cx, obj, &js_RegExpClass, vp + 2))
-        return JS_FALSE;
-    JS_LOCK_OBJ(cx, obj);
-    re = (JSRegExp *) JS_GetPrivate(cx, obj);
-    if (!re) {
-        JS_UNLOCK_OBJ(cx, obj);
-        *vp = STRING_TO_JSVAL(cx->runtime->emptyString);
-        return JS_TRUE;
-    }
-
-    JSSTRING_CHARS_AND_LENGTH(re->source, source, length);
-    if (length == 0) {
-        source = empty_regexp_ucstr;
-        length = JS_ARRAY_LENGTH(empty_regexp_ucstr) - 1;
-    }
-    length += 2;
-    nflags = 0;
-    for (flags = re->flags; flags != 0; flags &= flags - 1)
-        nflags++;
-    chars = (jschar*) JS_malloc(cx, (length + nflags + 1) * sizeof(jschar));
-    if (!chars) {
-        JS_UNLOCK_OBJ(cx, obj);
-        return JS_FALSE;
-    }
-
-    chars[0] = '/';
-    js_strncpy(&chars[1], source, length - 2);
-    chars[length-1] = '/';
-    if (nflags) {
-        if (re->flags & JSREG_GLOB)
-            chars[length++] = 'g';
-        if (re->flags & JSREG_FOLD)
-            chars[length++] = 'i';
-        if (re->flags & JSREG_MULTILINE)
-            chars[length++] = 'm';
-        if (re->flags & JSREG_STICKY)
-            chars[length++] = 'y';
-    }
-    JS_UNLOCK_OBJ(cx, obj);
-    chars[length] = 0;
-
-    str = js_NewString(cx, chars, length);
-    if (!str) {
-        JS_free(cx, chars);
-        return JS_FALSE;
-    }
-    *vp = STRING_TO_JSVAL(str);
-    return JS_TRUE;
-}
-
-static JSBool
-regexp_toString(JSContext *cx, uintN argc, jsval *vp)
-{
-    JSObject *obj;
-
-    obj = JS_THIS_OBJECT(cx, vp);
-    return obj && js_regexp_toString(cx, obj, vp);
-}
-
-static JSBool
-regexp_compile_sub(JSContext *cx, JSObject *obj, uintN argc, jsval *argv,
-                   jsval *rval)
-{
-    JSString *opt, *str;
-    JSRegExp *oldre, *re;
-    JSBool ok, ok2;
-    JSObject *obj2;
-    size_t length, nbytes;
-    const jschar *cp, *start, *end;
-    jschar *nstart, *ncp, *tmp;
-
-    if (!JS_InstanceOf(cx, obj, &js_RegExpClass, argv))
-        return JS_FALSE;
-    opt = NULL;
-    if (argc == 0) {
-        str = cx->runtime->emptyString;
-    } else {
-        if (JSVAL_IS_OBJECT(argv[0])) {
-            /*
-             * If we get passed in a RegExp object we construct a new
-             * RegExp that is a duplicate of it by re-compiling the
-             * original source code. ECMA requires that it be an error
-             * here if the flags are specified. (We must use the flags
-             * from the original RegExp also).
-             */
-            obj2 = JSVAL_TO_OBJECT(argv[0]);
-            if (obj2 && OBJ_GET_CLASS(cx, obj2) == &js_RegExpClass) {
-                if (argc >= 2 && !JSVAL_IS_VOID(argv[1])) { /* 'flags' passed */
-                    JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL,
-                                         JSMSG_NEWREGEXP_FLAGGED);
-                    return JS_FALSE;
-                }
-                JS_LOCK_OBJ(cx, obj2);
-                re = (JSRegExp *) JS_GetPrivate(cx, obj2);
-                if (!re) {
-                    JS_UNLOCK_OBJ(cx, obj2);
-                    return JS_FALSE;
-                }
-                re = js_NewRegExp(cx, NULL, re->source, re->flags, JS_FALSE);
-                JS_UNLOCK_OBJ(cx, obj2);
-                goto created;
-            }
-        }
-        str = js_ValueToString(cx, argv[0]);
-        if (!str)
-            return JS_FALSE;
-        argv[0] = STRING_TO_JSVAL(str);
-        if (argc > 1) {
-            if (JSVAL_IS_VOID(argv[1])) {
-                opt = NULL;
-            } else {
-                opt = js_ValueToString(cx, argv[1]);
-                if (!opt)
-                    return JS_FALSE;
-                argv[1] = STRING_TO_JSVAL(opt);
-            }
-        }
-
-        /* Escape any naked slashes in the regexp source. */
-        JSSTRING_CHARS_AND_LENGTH(str, start, length);
-        end = start + length;
-        nstart = ncp = NULL;
-        for (cp = start; cp < end; cp++) {
-            if (*cp == '/' && (cp == start || cp[-1] != '\\')) {
-                nbytes = (++length + 1) * sizeof(jschar);
-                if (!nstart) {
-                    nstart = (jschar *) JS_malloc(cx, nbytes);
-                    if (!nstart)
-                        return JS_FALSE;
-                    ncp = nstart + (cp - start);
-                    js_strncpy(nstart, start, cp - start);
-                } else {
-                    tmp = (jschar *) JS_realloc(cx, nstart, nbytes);
-                    if (!tmp) {
-                        JS_free(cx, nstart);
-                        return JS_FALSE;
-                    }
-                    ncp = tmp + (ncp - nstart);
-                    nstart = tmp;
-                }
-                *ncp++ = '\\';
-            }
-            if (nstart)
-                *ncp++ = *cp;
-        }
-
-        if (nstart) {
-            /* Don't forget to store the backstop after the new string. */
-            JS_ASSERT((size_t)(ncp - nstart) == length);
-            *ncp = 0;
-            str = js_NewString(cx, nstart, length);
-            if (!str) {
-                JS_free(cx, nstart);
-                return JS_FALSE;
-            }
-            argv[0] = STRING_TO_JSVAL(str);
-        }
-    }
-
-    re = js_NewRegExpOpt(cx, str, opt, JS_FALSE);
-created:
-    if (!re)
-        return JS_FALSE;
-    JS_LOCK_OBJ(cx, obj);
-    oldre = (JSRegExp *) JS_GetPrivate(cx, obj);
-    ok = JS_SetPrivate(cx, obj, re);
-    ok2 = js_SetLastIndex(cx, obj, 0);
-    JS_UNLOCK_OBJ(cx, obj);
-    if (!ok) {
-        js_DestroyRegExp(cx, re);
-        return JS_FALSE;
-    }
-    if (oldre)
-        js_DestroyRegExp(cx, oldre);
-    *rval = OBJECT_TO_JSVAL(obj);
-    return ok2;
-}
-
-static JSBool
-regexp_compile(JSContext *cx, uintN argc, jsval *vp)
-{
-    JSObject *obj;
-
-    obj = JS_THIS_OBJECT(cx, vp);
-    return obj && regexp_compile_sub(cx, obj, argc, vp + 2, vp);
-}
-
-static JSBool
-regexp_exec_sub(JSContext *cx, JSObject *obj, uintN argc, jsval *argv,
-                JSBool test, jsval *rval)
-{
-    JSBool ok, sticky;
-    JSRegExp *re;
-    jsdouble lastIndex;
-    JSString *str;
-    size_t i;
-
-    ok = JS_InstanceOf(cx, obj, &js_RegExpClass, argv);
-    if (!ok)
-        return JS_FALSE;
-    JS_LOCK_OBJ(cx, obj);
-    re = (JSRegExp *) JS_GetPrivate(cx, obj);
-    if (!re) {
-        JS_UNLOCK_OBJ(cx, obj);
-        return JS_TRUE;
-    }
-
-    /* NB: we must reach out: after this paragraph, in order to drop re. */
-    HOLD_REGEXP(cx, re);
-    sticky = (re->flags & JSREG_STICKY) != 0;
-    if (re->flags & (JSREG_GLOB | JSREG_STICKY)) {
-        ok = js_GetLastIndex(cx, obj, &lastIndex);
-    } else {
-        lastIndex = 0;
-    }
-    JS_UNLOCK_OBJ(cx, obj);
-    if (!ok)
-        goto out;
-
-    /* Now that obj is unlocked, it's safe to (potentially) grab the GC lock. */
-    if (argc == 0) {
-        str = cx->regExpStatics.input;
-        if (!str) {
-            const char *bytes = js_GetStringBytes(cx, re->source);
-
-            if (bytes) {
-                JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL,
-                                     JSMSG_NO_INPUT,
-                                     bytes,
-                                     (re->flags & JSREG_GLOB) ? "g" : "",
-                                     (re->flags & JSREG_FOLD) ? "i" : "",
-                                     (re->flags & JSREG_MULTILINE) ? "m" : "",
-                                     (re->flags & JSREG_STICKY) ? "y" : "");
-            }
-            ok = JS_FALSE;
-            goto out;
-        }
-    } else {
-        str = js_ValueToString(cx, argv[0]);
-        if (!str) {
-            ok = JS_FALSE;
-            goto out;
-        }
-        argv[0] = STRING_TO_JSVAL(str);
-    }
-
-    if (lastIndex < 0 || JSSTRING_LENGTH(str) < lastIndex) {
-        ok = js_SetLastIndex(cx, obj, 0);
-        *rval = JSVAL_NULL;
-    } else {
-        i = (size_t) lastIndex;
-        ok = js_ExecuteRegExp(cx, re, str, &i, test, rval);
-        if (ok &&
-            ((re->flags & JSREG_GLOB) || (*rval != JSVAL_NULL && sticky))) {
-            ok = js_SetLastIndex(cx, obj, (*rval == JSVAL_NULL) ? 0 : i);
-        }
-    }
-
-out:
-    DROP_REGEXP(cx, re);
-    return ok;
-}
-
-static JSBool
-regexp_exec(JSContext *cx, uintN argc, jsval *vp)
-{
-    return regexp_exec_sub(cx, JS_THIS_OBJECT(cx, vp), argc, vp + 2, JS_FALSE,
-                           vp);
-}
-
-static JSBool
-regexp_test(JSContext *cx, uintN argc, jsval *vp)
-{
-    if (!regexp_exec_sub(cx, JS_THIS_OBJECT(cx, vp), argc, vp + 2, JS_TRUE, vp))
-        return JS_FALSE;
-    if (*vp != JSVAL_TRUE)
-        *vp = JSVAL_FALSE;
-    return JS_TRUE;
-}
-
-static JSFunctionSpec regexp_methods[] = {
-#if JS_HAS_TOSOURCE
-    JS_FN(js_toSource_str,  regexp_toString,    0,0,0),
-#endif
-    JS_FN(js_toString_str,  regexp_toString,    0,0,0),
-    JS_FN("compile",        regexp_compile,     0,2,0),
-    JS_FN("exec",           regexp_exec,        0,1,0),
-    JS_FN("test",           regexp_test,        0,1,0),
-    JS_FS_END
-};
-
-static JSBool
-RegExp(JSContext *cx, JSObject *obj, uintN argc, jsval *argv, jsval *rval)
-{
-    if (!(cx->fp->flags & JSFRAME_CONSTRUCTING)) {
-        /*
-         * If first arg is regexp and no flags are given, just return the arg.
-         * (regexp_compile_sub detects the regexp + flags case and throws a
-         * TypeError.)  See 10.15.3.1.
-         */
-        if ((argc < 2 || JSVAL_IS_VOID(argv[1])) &&
-            !JSVAL_IS_PRIMITIVE(argv[0]) &&
-            OBJ_GET_CLASS(cx, JSVAL_TO_OBJECT(argv[0])) == &js_RegExpClass) {
-            *rval = argv[0];
-            return JS_TRUE;
-        }
-
-        /* Otherwise, replace obj with a new RegExp object. */
-        obj = js_NewObject(cx, &js_RegExpClass, NULL, NULL, 0);
-        if (!obj)
-            return JS_FALSE;
-
-        /*
-         * regexp_compile_sub does not use rval to root its temporaries so we
-         * can use it to root obj.
-         */
-        *rval = OBJECT_TO_JSVAL(obj);
-    }
-    return regexp_compile_sub(cx, obj, argc, argv, rval);
-}
-
-JSObject *
-js_InitRegExpClass(JSContext *cx, JSObject *obj)
-{
-    JSObject *proto, *ctor;
-    jsval rval;
-
-    proto = JS_InitClass(cx, obj, NULL, &js_RegExpClass, RegExp, 1,
-                         regexp_props, regexp_methods,
-                         regexp_static_props, NULL);
-
-    if (!proto || !(ctor = JS_GetConstructor(cx, proto)))
-        return NULL;
-    if (!JS_AliasProperty(cx, ctor, "input",        "$_") ||
-        !JS_AliasProperty(cx, ctor, "multiline",    "$*") ||
-        !JS_AliasProperty(cx, ctor, "lastMatch",    "$&") ||
-        !JS_AliasProperty(cx, ctor, "lastParen",    "$+") ||
-        !JS_AliasProperty(cx, ctor, "leftContext",  "$`") ||
-        !JS_AliasProperty(cx, ctor, "rightContext", "$'")) {
-        goto bad;
-    }
-
-    /* Give RegExp.prototype private data so it matches the empty string. */
-    if (!regexp_compile_sub(cx, proto, 0, NULL, &rval))
-        goto bad;
-    return proto;
-
-bad:
-    JS_DeleteProperty(cx, obj, js_RegExpClass.name);
-    return NULL;
-}
-
-JSObject *
-js_NewRegExpObject(JSContext *cx, JSTokenStream *ts,
-                   jschar *chars, size_t length, uintN flags)
-{
-    JSString *str;
-    JSObject *obj;
-    JSRegExp *re;
-    JSTempValueRooter tvr;
-
-    str = js_NewStringCopyN(cx, chars, length);
-    if (!str)
-        return NULL;
-    JS_PUSH_TEMP_ROOT_STRING(cx, str, &tvr);
-    re = js_NewRegExp(cx, ts,  str, flags, JS_FALSE);
-    if (!re) {
-        JS_POP_TEMP_ROOT(cx, &tvr);
-        return NULL;
-    }
-    obj = js_NewObject(cx, &js_RegExpClass, NULL, NULL, 0);
-    if (!obj || !JS_SetPrivate(cx, obj, re)) {
-        js_DestroyRegExp(cx, re);
-        obj = NULL;
-    }
-    if (obj && !js_SetLastIndex(cx, obj, 0))
-        obj = NULL;
-    JS_POP_TEMP_ROOT(cx, &tvr);
-    return obj;
-}
-
-JSObject *
-js_CloneRegExpObject(JSContext *cx, JSObject *obj, JSObject *parent)
-{
-    JSObject *clone;
-    JSRegExp *re;
-
-    JS_ASSERT(OBJ_GET_CLASS(cx, obj) == &js_RegExpClass);
-    clone = js_NewObject(cx, &js_RegExpClass, NULL, parent, 0);
-    if (!clone)
-        return NULL;
-    re = (JSRegExp *) JS_GetPrivate(cx, obj);
-    if (!JS_SetPrivate(cx, clone, re) || !js_SetLastIndex(cx, clone, 0)) {
-        cx->weakRoots.newborn[GCX_OBJECT] = NULL;
-        return NULL;
-    }
-    HOLD_REGEXP(cx, re);
-    return clone;
-}
-
-JSBool
-js_GetLastIndex(JSContext *cx, JSObject *obj, jsdouble *lastIndex)
-{
-    jsval v;
-
-    return JS_GetReservedSlot(cx, obj, 0, &v) &&
-           JS_ValueToNumber(cx, v, lastIndex);
-}
-
-JSBool
-js_SetLastIndex(JSContext *cx, JSObject *obj, jsdouble lastIndex)
-{
-    jsval v;
-
-    return JS_NewNumberValue(cx, lastIndex, &v) &&
-           JS_SetReservedSlot(cx, obj, 0, v);
-}
-