Diff
Modified: branches/safari-537.73-branch/LayoutTests/ChangeLog (157964 => 157965)
--- branches/safari-537.73-branch/LayoutTests/ChangeLog 2013-10-25 00:06:57 UTC (rev 157964)
+++ branches/safari-537.73-branch/LayoutTests/ChangeLog 2013-10-25 00:14:35 UTC (rev 157965)
@@ -1,5 +1,22 @@
2013-10-24 Lucas Forschler <[email protected]>
+ Merge r154346
+
+ 2013-08-20 Michael Saboff <[email protected]>
+
+ https://bugs.webkit.org/show_bug.cgi?id=120075
+ REGRESSION (r128400): BBC4 website not displaying pictures
+
+ Reviewed by Oliver Hunt.
+
+ Added regression tests for fix.
+
+ * fast/js/regress/regexp-match-reify-before-putbyval-expected.txt: Added.
+ * fast/js/regress/regexp-match-reify-before-putbyval.html: Added.
+ * fast/js/regress/script-tests/regexp-match-reify-before-putbyval.js: Added.
+
+2013-10-24 Lucas Forschler <[email protected]>
+
Merge r154308
2013-08-19 Ryosuke Niwa <[email protected]>
Copied: branches/safari-537.73-branch/LayoutTests/fast/js/regress/regexp-match-reify-before-putbyval-expected.txt (from rev 154346, trunk/LayoutTests/fast/js/regress/regexp-match-reify-before-putbyval-expected.txt) (0 => 157965)
--- branches/safari-537.73-branch/LayoutTests/fast/js/regress/regexp-match-reify-before-putbyval-expected.txt (rev 0)
+++ branches/safari-537.73-branch/LayoutTests/fast/js/regress/regexp-match-reify-before-putbyval-expected.txt 2013-10-25 00:14:35 UTC (rev 157965)
@@ -0,0 +1,11 @@
+JSRegress/regexp-match-reify-before-putbyval
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS matches is ['http://www.dummy.com/images/123x456/image.jpg','http://www.dummy.com/images/',111,'x',222,'/image.jpg']
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Copied: branches/safari-537.73-branch/LayoutTests/fast/js/regress/regexp-match-reify-before-putbyval.html (from rev 154346, trunk/LayoutTests/fast/js/regress/regexp-match-reify-before-putbyval.html) (0 => 157965)
--- branches/safari-537.73-branch/LayoutTests/fast/js/regress/regexp-match-reify-before-putbyval.html (rev 0)
+++ branches/safari-537.73-branch/LayoutTests/fast/js/regress/regexp-match-reify-before-putbyval.html 2013-10-25 00:14:35 UTC (rev 157965)
@@ -0,0 +1,12 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<script src=""
+<script src=""
+<script src=""
+<script src=""
+</body>
+</html>
Copied: branches/safari-537.73-branch/LayoutTests/fast/js/regress/script-tests/regexp-match-reify-before-putbyval.js (from rev 154346, trunk/LayoutTests/fast/js/regress/script-tests/regexp-match-reify-before-putbyval.js) (0 => 157965)
--- branches/safari-537.73-branch/LayoutTests/fast/js/regress/script-tests/regexp-match-reify-before-putbyval.js (rev 0)
+++ branches/safari-537.73-branch/LayoutTests/fast/js/regress/script-tests/regexp-match-reify-before-putbyval.js 2013-10-25 00:14:35 UTC (rev 157965)
@@ -0,0 +1,7 @@
+var src = '';
+
+var matches = src.match("^(.*/)([0-9]+)(x)([0-9]+)(/.*)$");
+matches[2] = 111;
+matches[4] = 222;
+
+shouldBe("matches", "['http://www.dummy.com/images/123x456/image.jpg','http://www.dummy.com/images/',111,'x',222,'/image.jpg']");
Modified: branches/safari-537.73-branch/Source/_javascript_Core/ChangeLog (157964 => 157965)
--- branches/safari-537.73-branch/Source/_javascript_Core/ChangeLog 2013-10-25 00:06:57 UTC (rev 157964)
+++ branches/safari-537.73-branch/Source/_javascript_Core/ChangeLog 2013-10-25 00:14:35 UTC (rev 157965)
@@ -1,5 +1,20 @@
2013-10-24 Lucas Forschler <[email protected]>
+ Merge r154346
+
+ 2013-08-20 Michael Saboff <[email protected]>
+
+ https://bugs.webkit.org/show_bug.cgi?id=120075
+ REGRESSION (r128400): BBC4 website not displaying pictures
+
+ Reviewed by Oliver Hunt.
+
+ * runtime/RegExpMatchesArray.h:
+ (JSC::RegExpMatchesArray::createStructure): Changed the array IndexingType to be ArrayWithSlowPutArrayStorage
+ so that the match results will be reified before any other modification to the results array.
+
+2013-10-24 Lucas Forschler <[email protected]>
+
Merge r154303
2013-08-18 Gavin Barraclough <[email protected]>
Modified: branches/safari-537.73-branch/Source/_javascript_Core/runtime/RegExpMatchesArray.h (157964 => 157965)
--- branches/safari-537.73-branch/Source/_javascript_Core/runtime/RegExpMatchesArray.h 2013-10-25 00:06:57 UTC (rev 157964)
+++ branches/safari-537.73-branch/Source/_javascript_Core/runtime/RegExpMatchesArray.h 2013-10-25 00:14:35 UTC (rev 157965)
@@ -44,7 +44,7 @@
static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
{
- return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), &s_info, ArrayWithArrayStorage);
+ return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), &s_info, ArrayWithSlowPutArrayStorage);
}
static void visitChildren(JSCell*, SlotVisitor&);
