Diff
Modified: trunk/LayoutTests/ChangeLog (154345 => 154346)
--- trunk/LayoutTests/ChangeLog 2013-08-20 18:24:27 UTC (rev 154345)
+++ trunk/LayoutTests/ChangeLog 2013-08-20 18:47:23 UTC (rev 154346)
@@ -1,3 +1,16 @@
+2013-08-20 Michael Saboff <[email protected]>
+
+ https://bugs.webkit.org/show_bug.cgi?id=120075
+ REGRESSION (r128400): BBC4 website not displaying pictures
+
+ Reviewed by Oliver Hunt.
+
+ Added regression tests for fix.
+
+ * fast/js/regress/regexp-match-reify-before-putbyval-expected.txt: Added.
+ * fast/js/regress/regexp-match-reify-before-putbyval.html: Added.
+ * fast/js/regress/script-tests/regexp-match-reify-before-putbyval.js: Added.
+
2013-08-19 Filip Pizlo <[email protected]>
Incorrect behavior on emscripten-compiled cube2hash
Added: trunk/LayoutTests/fast/js/regress/regexp-match-reify-before-putbyval-expected.txt (0 => 154346)
--- trunk/LayoutTests/fast/js/regress/regexp-match-reify-before-putbyval-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/js/regress/regexp-match-reify-before-putbyval-expected.txt 2013-08-20 18:47:23 UTC (rev 154346)
@@ -0,0 +1,11 @@
+JSRegress/regexp-match-reify-before-putbyval
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS matches is ['http://www.dummy.com/images/123x456/image.jpg','http://www.dummy.com/images/',111,'x',222,'/image.jpg']
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/fast/js/regress/regexp-match-reify-before-putbyval.html (0 => 154346)
--- trunk/LayoutTests/fast/js/regress/regexp-match-reify-before-putbyval.html (rev 0)
+++ trunk/LayoutTests/fast/js/regress/regexp-match-reify-before-putbyval.html 2013-08-20 18:47:23 UTC (rev 154346)
@@ -0,0 +1,12 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<script src=""
+<script src=""
+<script src=""
+<script src=""
+</body>
+</html>
Added: trunk/LayoutTests/fast/js/regress/script-tests/regexp-match-reify-before-putbyval.js (0 => 154346)
--- trunk/LayoutTests/fast/js/regress/script-tests/regexp-match-reify-before-putbyval.js (rev 0)
+++ trunk/LayoutTests/fast/js/regress/script-tests/regexp-match-reify-before-putbyval.js 2013-08-20 18:47:23 UTC (rev 154346)
@@ -0,0 +1,7 @@
+var src = '';
+
+var matches = src.match("^(.*/)([0-9]+)(x)([0-9]+)(/.*)$");
+matches[2] = 111;
+matches[4] = 222;
+
+shouldBe("matches", "['http://www.dummy.com/images/123x456/image.jpg','http://www.dummy.com/images/',111,'x',222,'/image.jpg']");
Modified: trunk/Source/_javascript_Core/ChangeLog (154345 => 154346)
--- trunk/Source/_javascript_Core/ChangeLog 2013-08-20 18:24:27 UTC (rev 154345)
+++ trunk/Source/_javascript_Core/ChangeLog 2013-08-20 18:47:23 UTC (rev 154346)
@@ -1,3 +1,14 @@
+2013-08-20 Michael Saboff <[email protected]>
+
+ https://bugs.webkit.org/show_bug.cgi?id=120075
+ REGRESSION (r128400): BBC4 website not displaying pictures
+
+ Reviewed by Oliver Hunt.
+
+ * runtime/RegExpMatchesArray.h:
+ (JSC::RegExpMatchesArray::createStructure): Changed the array IndexingType to be ArrayWithSlowPutArrayStorage
+ so that the match results will be reified before any other modification to the results array.
+
2013-08-19 Filip Pizlo <[email protected]>
Incorrect behavior on emscripten-compiled cube2hash
Modified: trunk/Source/_javascript_Core/runtime/RegExpMatchesArray.h (154345 => 154346)
--- trunk/Source/_javascript_Core/runtime/RegExpMatchesArray.h 2013-08-20 18:24:27 UTC (rev 154345)
+++ trunk/Source/_javascript_Core/runtime/RegExpMatchesArray.h 2013-08-20 18:47:23 UTC (rev 154346)
@@ -44,7 +44,7 @@
static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
{
- return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info(), ArrayWithArrayStorage);
+ return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info(), ArrayWithSlowPutArrayStorage);
}
static void visitChildren(JSCell*, SlotVisitor&);
