Bug 59221

new RegExp("(?!(u|m{0,}g+)u{1,}|2{2,}!1%n|(?!K|(?=y)|(?=ip))+?)(?=(?=(((?:7))*?)*?))p", "m").exec("u55up") This triggers the following assertion (which implies a out of bounds read), it also blocks the fuzzer: ASSERTION FAILED: position < 0 /Volumes/BigData/git/WebKit/OpenSource/Source/JavaScriptCore/yarr/YarrInterpreter.cpp(205) : int JSC::Yarr::Interpreter::InputStream::readChecked(int) 1 JSC::Yarr::Interpreter::InputStream::readChecked(int) 2 JSC::Yarr::Interpreter::checkCharacter(int, int) 3 JSC::Yarr::Interpreter::matchDisjunction(JSC::Yarr::ByteDisjunction*, JSC::Yarr::Interpreter::DisjunctionContext*, bool, bool) 4 JSC::Yarr::Interpreter::interpret() 5 JSC::Yarr::interpret(JSC::Yarr::BytecodePattern*, unsigned short const*, unsigned int, unsigned int, int*) 6 JSC::RegExp::match(JSC::UString const&, int, WTF::Vector<int, 32ul>*) 7 JSC::RegExpConstructor::performMatch(JSC::RegExp*, JSC::UString const&, int, int&, int&, int**) 8 JSC::RegExpObject::match(JSC::ExecState*) 9 JSC::RegExpObject::exec(JSC::ExecState*)