diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog index 9aa913d7a6e30d691e56780f1cf44c1084ffefbb..ca20ca85432be348fa14be7d4d46965edcb9000b 100644 --- a/LayoutTests/ChangeLog +++ b/LayoutTests/ChangeLog @@ -1,3 +1,16 @@ +2013-08-20 Michael Saboff + + https://bugs.webkit.org/show_bug.cgi?id=120075 + REGRESSION (r128400): BBC4 website not displaying pictures + + Reviewed by Oliver Hunt. + + Added regression tests for fix. + + * fast/js/regress/regexp-match-reify-before-putbyval-expected.txt: Added. + * fast/js/regress/regexp-match-reify-before-putbyval.html: Added. + * fast/js/regress/script-tests/regexp-match-reify-before-putbyval.js: Added. + 2013-08-19 Filip Pizlo Incorrect behavior on emscripten-compiled cube2hash diff --git a/LayoutTests/fast/js/regress/regexp-match-reify-before-putbyval-expected.txt b/LayoutTests/fast/js/regress/regexp-match-reify-before-putbyval-expected.txt new file mode 100644 index 0000000000000000000000000000000000000000..eebdb4a833fed94449a672e5b3c2f7ed2bd2f3db --- /dev/null +++ b/LayoutTests/fast/js/regress/regexp-match-reify-before-putbyval-expected.txt @@ -0,0 +1,11 @@ +JSRegress/regexp-match-reify-before-putbyval + +On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE". + + +PASS matches is ['http://www.dummy.com/images/123x456/image.jpg','http://www.dummy.com/images/',111,'x',222,'/image.jpg'] +PASS no exception thrown +PASS successfullyParsed is true + +TEST COMPLETE + diff --git a/LayoutTests/fast/js/regress/regexp-match-reify-before-putbyval.html b/LayoutTests/fast/js/regress/regexp-match-reify-before-putbyval.html new file mode 100644 index 0000000000000000000000000000000000000000..25933fa4a80b78ce3a4bcf6c9b7ff495a673593c --- /dev/null +++ b/LayoutTests/fast/js/regress/regexp-match-reify-before-putbyval.html @@ -0,0 +1,12 @@ + + + + + + + + + + + + diff --git a/LayoutTests/fast/js/regress/script-tests/regexp-match-reify-before-putbyval.js b/LayoutTests/fast/js/regress/script-tests/regexp-match-reify-before-putbyval.js new file mode 100644 index 0000000000000000000000000000000000000000..90c2a42efbb2f34aec7ebe0fe3405e0f6b5c00c2 --- /dev/null +++ b/LayoutTests/fast/js/regress/script-tests/regexp-match-reify-before-putbyval.js @@ -0,0 +1,7 @@ +var src = 'http://www.dummy.com/images/123x456/image.jpg'; + +var matches = src.match("^(.*/)([0-9]+)(x)([0-9]+)(/.*)$"); +matches[2] = 111; +matches[4] = 222; + +shouldBe("matches", "['http://www.dummy.com/images/123x456/image.jpg','http://www.dummy.com/images/',111,'x',222,'/image.jpg']"); diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog index 853d089b07f9fefc993c38802a78c4eeea9ecaea..6ffeb9361ed4b6be5fa69aeb705ea7903af2f170 100644 --- a/Source/JavaScriptCore/ChangeLog +++ b/Source/JavaScriptCore/ChangeLog @@ -1,3 +1,14 @@ +2013-08-20 Michael Saboff + + https://bugs.webkit.org/show_bug.cgi?id=120075 + REGRESSION (r128400): BBC4 website not displaying pictures + + Reviewed by Oliver Hunt. + + * runtime/RegExpMatchesArray.h: + (JSC::RegExpMatchesArray::createStructure): Changed the array IndexingType to be ArrayWithSlowPutArrayStorage + so that the match results will be reified before any other modification to the results array. + 2013-08-19 Filip Pizlo Incorrect behavior on emscripten-compiled cube2hash diff --git a/Source/JavaScriptCore/runtime/RegExpMatchesArray.h b/Source/JavaScriptCore/runtime/RegExpMatchesArray.h index 072838ee932601828c86402c3262dc6774537ccb..9406d9a7c52a5a85e5570f43c4ac97ab5034a0e1 100644 --- a/Source/JavaScriptCore/runtime/RegExpMatchesArray.h +++ b/Source/JavaScriptCore/runtime/RegExpMatchesArray.h @@ -44,7 +44,7 @@ namespace JSC { static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype) { - return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info(), ArrayWithArrayStorage); + return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info(), ArrayWithSlowPutArrayStorage); } static void visitChildren(JSCell*, SlotVisitor&);