Bug 831658 - Handle multiple RegExpShareds in the same compartment. r=dvander
authorSean Stangl <sstangl@mozilla.com>
Thu, 17 Jan 2013 18:03:34 -0800
changeset 119224 4e7658d7727cd57f6cce532d420d2cdb4a92d14d
parent 119223 4f0b7a4daacf6405c06030b303e25e1d4ed82c7e
child 119225 6c9d47ecf49c21815748d636b804d9bdbc7e9ddf
push id24195
push userMs2ger@gmail.com
push dateSat, 19 Jan 2013 16:10:11 +0000
treeherdermozilla-central@02e12a80aef9 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersdvander
bugs831658
milestone21.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 831658 - Handle multiple RegExpShareds in the same compartment. r=dvander
js/src/jit-test/tests/basic/bug831658.js
js/src/vm/RegExpObject.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/basic/bug831658.js
@@ -0,0 +1,4 @@
+// Don't assert.
+String.prototype.search = evalcx('').String.prototype.search
+x = /./.test()
+''.search(/()/)
--- a/js/src/vm/RegExpObject.cpp
+++ b/js/src/vm/RegExpObject.cpp
@@ -647,18 +647,17 @@ RegExpCompartment::RegExpCompartment(JSR
 RegExpCompartment::~RegExpCompartment()
 {
     JS_ASSERT(map_.empty());
 
     /*
      * RegExpStatics may have prevented a single RegExpShared from
      * being collected during RegExpCompartment::sweep().
      */
-    if (!inUse_.empty()) {
-        PendingSet::Enum e(inUse_);
+    for (PendingSet::Enum e(inUse_); !e.empty(); e.popFront()) {
         RegExpShared *shared = e.front();
         JS_ASSERT(shared->activeUseCount == 0);
         js_delete(shared);
         e.removeFront();
     }
     JS_ASSERT(inUse_.empty());
 }