[SCM] WebKit Debian packaging branch, webkit-1.2, updated. upstream/1.1.90-6072-g9a69373

[Gustavo Noronha Silva]

The following commit has been merged in the webkit-1.2 branch:
commit 6f0ab470d98c1c046a0beece8ce56f5d15a24c51
Author: barraclough at apple.com <barraclough at apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Tue Mar 16 23:14:31 2010 +0000

    Bug 36083 - REGRESSION (r55772-r55834): Crash in JavaScriptCore RegExp code on PowerPC
    
    Reviewed by Oliver Hunt, Darin Adler.
    
    The problem is a bug in our port of PCRE - that a read may take place from the first character in an
    empty string.  For the time being, revert to using a valid pointer in the data segment rather than
    an invalid non-null pointer into the zero-page for the empty string's data pointer.  A better fix for
    this will be to remove PCRE.
    
    * runtime/UStringImpl.cpp:
    (JSC::UStringImpl::empty):
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@56092 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/JavaScriptCore/ChangeLog b/JavaScriptCore/ChangeLog
index bd17f85..df0ad58 100644
--- a/JavaScriptCore/ChangeLog
+++ b/JavaScriptCore/ChangeLog
@@ -1,3 +1,17 @@
+2010-03-16  Gavin Barraclough  <barraclough at apple.com>
+
+        Reviewed by Oliver Hunt, Darin Adler.
+
+        Bug 36083 - REGRESSION (r55772-r55834): Crash in JavaScriptCore RegExp code on PowerPC
+
+        The problem is a bug in our port of PCRE - that a read may take place from the first character in an
+        empty string.  For the time being, revert to using a valid pointer in the data segment rather than
+        an invalid non-null pointer into the zero-page for the empty string's data pointer.  A better fix for
+        this will be to remove PCRE.
+
+        * runtime/UStringImpl.cpp:
+        (JSC::UStringImpl::empty):
+
 2010-03-16  Darin Adler  <darin at apple.com>
 
         Reviewed by Sam Weinig.
diff --git a/JavaScriptCore/runtime/UStringImpl.cpp b/JavaScriptCore/runtime/UStringImpl.cpp
index dd3eb51..aba63ad 100644
--- a/JavaScriptCore/runtime/UStringImpl.cpp
+++ b/JavaScriptCore/runtime/UStringImpl.cpp
@@ -64,10 +64,15 @@ UStringImpl::~UStringImpl()
 
 UStringImpl* UStringImpl::empty()
 {
-    // A non-null pointer at an invalid address (in page zero) so that if it were to be accessed we
-    // should catch the error with fault (however it should be impossible to access, since length is zero).
-    static const UChar* invalidNonNullUCharPtr = reinterpret_cast<UChar*>(static_cast<intptr_t>(1));
-    DEFINE_STATIC_LOCAL(UStringImpl, emptyString, (invalidNonNullUCharPtr, 0, ConstructStaticString));
+    // FIXME: This works around a bug in our port of PCRE, that a regular expression
+    // run on the empty string may still perform a read from the first element, and
+    // as such we need this to be a valid pointer. No code should ever be reading
+    // from a zero length string, so this should be able to be a non-null pointer
+    // into the zero-page.
+    // Replace this with 'reinterpret_cast<UChar*>(static_cast<intptr_t>(1))' once
+    // PCRE goes away.
+    static UChar emptyUCharData = 0;
+    DEFINE_STATIC_LOCAL(UStringImpl, emptyString, (&emptyUCharData, 0, ConstructStaticString));
     return &emptyString;
 }
 

-- 
WebKit Debian packaging