[SCM] WebKit Debian packaging branch, debian/experimental, updated. upstream/1.3.3-10851-g50815da

[msaboff at apple.com]

The following commit has been merged in the debian/experimental branch:
commit 39a26872546002169d3f35716214b47a8a8501ba
Author: msaboff at apple.com <msaboff at apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Sat Dec 18 02:01:13 2010 +0000

    2010-12-17  Michael Saboff  <msaboff at apple.com>
    
            Reviewed by Oliver Hunt.
    
            RegExp Jit'ed expression crashes clicking link on yelp.com
            https://bugs.webkit.org/show_bug.cgi?id=51284
    
            When transitioning between an non-repeating beginning of line
            anchored expression and the remaining refactored repeating
            expression, we should not clear any residual datalabel in
            state's m_backtrack.  It will be resolved and cleared in subsequent
            code when linkAlternativeBacktracks() is called for the repeating
            alternative(s).
    
            * yarr/RegexJIT.cpp:
            (JSC::Yarr::RegexGenerator::BacktrackDestination::clear):
            (JSC::Yarr::RegexGenerator::TermGenerationState::clearBacktrack):
    2010-12-17  Michael Saboff  <msaboff at apple.com>
    
            Reviewed by Oliver Hunt.
    
            RegExp Jit'ed expression crashes clicking link on yelp.com
            https://bugs.webkit.org/show_bug.cgi?id=51284
    
            New tests to validate changes made in regex JIT.
    
            * fast/regex/parentheses-expected.txt:
            * fast/regex/script-tests/parentheses.js:
    
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@74309 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/JavaScriptCore/ChangeLog b/JavaScriptCore/ChangeLog
index de28531..64316bb 100644
--- a/JavaScriptCore/ChangeLog
+++ b/JavaScriptCore/ChangeLog
@@ -1,3 +1,21 @@
+2010-12-17  Michael Saboff  <msaboff at apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        RegExp Jit'ed expression crashes clicking link on yelp.com
+        https://bugs.webkit.org/show_bug.cgi?id=51284
+
+        When transitioning between an non-repeating beginning of line
+        anchored expression and the remaining refactored repeating 
+        expression, we should not clear any residual datalabel in 
+        state's m_backtrack.  It will be resolved and cleared in subsequent
+        code when linkAlternativeBacktracks() is called for the repeating
+        alternative(s).
+
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::BacktrackDestination::clear):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::clearBacktrack):
+
 2010-12-17  Dan Bernstein  <mitz at apple.com>
 
         Rubber-stamped by Mark Rowe.
diff --git a/JavaScriptCore/yarr/RegexJIT.cpp b/JavaScriptCore/yarr/RegexJIT.cpp
index 9e562f7..63e8a26 100644
--- a/JavaScriptCore/yarr/RegexJIT.cpp
+++ b/JavaScriptCore/yarr/RegexJIT.cpp
@@ -486,10 +486,11 @@ class RegexGenerator : private MacroAssembler {
         {
         }
 
-        void clear()
+        void clear(bool doDataLabelClear = true)
         {
             m_backtrackType = NoBacktrack;
-            clearDataLabel();
+            if (doDataLabelClear)
+                clearDataLabel();
             m_nextBacktrack = 0;
         }
 
@@ -867,7 +868,7 @@ class RegexGenerator : private MacroAssembler {
 
         void clearBacktrack()
         {
-            m_backtrack.clear();
+            m_backtrack.clear(false);
             m_linkedBacktrack = 0;
         }
 
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 3b68f45..5139a37 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,15 @@
+2010-12-17  Michael Saboff  <msaboff at apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        RegExp Jit'ed expression crashes clicking link on yelp.com
+        https://bugs.webkit.org/show_bug.cgi?id=51284
+
+        New tests to validate changes made in regex JIT.
+
+        * fast/regex/parentheses-expected.txt:
+        * fast/regex/script-tests/parentheses.js:
+
 2010-12-17  Jessie Berlin  <jberlin at apple.com>
 
         Add expected results for Windows XP to get the bot green for
diff --git a/LayoutTests/fast/regex/parentheses-expected.txt b/LayoutTests/fast/regex/parentheses-expected.txt
index 3151aff..e6915f7 100644
--- a/LayoutTests/fast/regex/parentheses-expected.txt
+++ b/LayoutTests/fast/regex/parentheses-expected.txt
@@ -38,6 +38,11 @@ PASS regexp30.exec('Committer:') is null
 PASS regexp31.exec('Committer:') is null
 PASS regexp32.exec('Committer:') is null
 PASS regexp33.exec('> <head>') is ['>',undefined,undefined,'>']
+PASS regexp34.exec('xyz123') is null
+PASS regexp34.exec('btn-abc') is ['btn-abc']
+PASS regexp34.exec('btn- abc') is null
+PASS regexp34.exec('XXbtn-abc') is null
+PASS regexp34.exec('XX btn-abc') is ['btn-abc']
 PASS 'Hi Bob'.match(/(Rob)|(Bob)|(Robert)|(Bobby)/) is ['Bob',undefined,'Bob',undefined,undefined]
 PASS successfullyParsed is true
 
diff --git a/LayoutTests/fast/regex/script-tests/parentheses.js b/LayoutTests/fast/regex/script-tests/parentheses.js
index e7b5eb0..3f0017c 100644
--- a/LayoutTests/fast/regex/script-tests/parentheses.js
+++ b/LayoutTests/fast/regex/script-tests/parentheses.js
@@ -140,6 +140,13 @@ shouldBeNull("regexp32.exec('Committer:')");
 var regexp33 = RegExp('^(?:(?:(a)(xyz|[^>"\'\s]*)?)|(/?>)|.[^\w\s>]*)');
 shouldBe("regexp33.exec('> <head>')","['>',undefined,undefined,'>']");
 
+var regexp34 = /(?:^|\b)btn-\S+/;
+shouldBeNull("regexp34.exec('xyz123')");
+shouldBe("regexp34.exec('btn-abc')","['btn-abc']");
+shouldBeNull("regexp34.exec('btn- abc')");
+shouldBeNull("regexp34.exec('XXbtn-abc')");
+shouldBe("regexp34.exec('XX btn-abc')","['btn-abc']");
+
 shouldBe("'Hi Bob'.match(/(Rob)|(Bob)|(Robert)|(Bobby)/)", "['Bob',undefined,'Bob',undefined,undefined]");
 
 var successfullyParsed = true;

-- 
WebKit Debian packaging