Index: jsregexp.c
===================================================================
RCS file: anonymous@cvs-mirror.mozilla.org/cvsroot/mozilla/js/src/jsregexp.c,v
retrieving revision 3.121
diff -pU30 -r3.121 jsregexp.c
--- jsregexp.c
+++ jsregexp.c
@@ -2044,60 +2044,63 @@ js_NewRegExpOpt(JSContext *cx, JSTokenSt
  * Contents of parenCount parentheses from parenIndex are also saved.
  */
 static REBackTrackData *
 PushBackTrackState(REGlobalData *gData, REOp op,
                    jsbytecode *target, REMatchState *x, const jschar *cp,
                    size_t parenIndex, size_t parenCount)
 {
     size_t i;
     REBackTrackData *result =
         (REBackTrackData *) ((char *)gData->backTrackSP + gData->cursz);
 
     size_t sz = sizeof(REBackTrackData) +
                 gData->stateStackTop * sizeof(REProgState) +
                 parenCount * sizeof(RECapture);
 
     ptrdiff_t btsize = gData->backTrackStackSize;
     ptrdiff_t btincr = ((char *)result + sz) -
                        ((char *)gData->backTrackStack + btsize);
 
     if (btincr > 0) {
         ptrdiff_t offset = (char *)result - (char *)gData->backTrackStack;
 
         btincr = JS_ROUNDUP(btincr, btsize);
         JS_ARENA_GROW_CAST(gData->backTrackStack, REBackTrackData *,
                            &gData->pool, btsize, btincr);
         if (!gData->backTrackStack)
             return NULL;
         gData->backTrackStackSize = btsize + btincr;
         result = (REBackTrackData *) ((char *)gData->backTrackStack + offset);
     }
+    else if (!result) {
+        return NULL;
+    }
     gData->backTrackSP = result;
     result->sz = gData->cursz;
     gData->cursz = sz;
 
     result->backtrack_op = op;
     result->backtrack_pc = target;
     result->cp = cp;
     result->parenCount = parenCount;
 
     result->saveStateStackTop = gData->stateStackTop;
     JS_ASSERT(gData->stateStackTop);
     memcpy(result + 1, gData->stateStack,
            sizeof(REProgState) * result->saveStateStackTop);
 
     if (parenCount != 0) {
         result->parenIndex = parenIndex;
         memcpy((char *)(result + 1) +
                sizeof(REProgState) * result->saveStateStackTop,
                &x->parens[parenIndex],
                sizeof(RECapture) * parenCount);
         for (i = 0; i != parenCount; i++)
             x->parens[parenIndex + i].index = -1;
     }
 
     return result;
 }
 
 
 /*
  *   Consecutive literal characters.