Author: [email protected]
Date: Mon Feb 2 00:23:42 2009
New Revision: 1199
Modified:
branches/bleeding_edge/src/jsregexp.cc
Log:
Fix http://code.google.com/p/chromium/issues/detail?id=7258 crash in IsFlat.
You can't keep a StringShape across things that can cause GC.
Review URL: http://codereview.chromium.org/19749
Modified: branches/bleeding_edge/src/jsregexp.cc
==============================================================================
--- branches/bleeding_edge/src/jsregexp.cc (original)
+++ branches/bleeding_edge/src/jsregexp.cc Mon Feb 2 00:23:42 2009
@@ -672,8 +672,7 @@
JSRegExp::Flags flags = re->GetFlags();
Handle<String> pattern(re->Pattern());
- StringShape shape(*pattern);
- if (!pattern->IsFlat(shape)) {
+ if (!pattern->IsFlat(StringShape(*pattern))) {
FlattenString(pattern);
}
@@ -783,8 +782,7 @@
Handle<String> subject) {
ASSERT_EQ(regexp->TypeTag(), JSRegExp::IRREGEXP);
- StringShape shape(*subject);
- bool is_ascii = shape.IsAsciiRepresentation();
+ bool is_ascii = StringShape(*subject).IsAsciiRepresentation();
Handle<FixedArray> irregexp = GetCompiledIrregexp(regexp, is_ascii);
if (irregexp.is_null()) {
return Handle<Object>::null();
@@ -800,7 +798,7 @@
int i = 0;
Handle<Object> matches;
- if (!subject->IsFlat(shape)) {
+ if (!subject->IsFlat(StringShape(*subject))) {
FlattenString(subject);
}
--~--~---------~--~----~------------~-------~--~----~
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
-~----------~----~----~----~------~----~------~--~---
