Changeset 47338 in webkit for trunk/JavaScriptCore/yarr/RegexInterpreter.cpp

Timestamp:

Aug 16, 2009, 6:14:33 AM (16 years ago)

Author:

[email protected]

Message:

2009-08-16 Holger Hans Peter Freyther <​[email protected]>

Reviewed by Mark Rowe.

Fix crash on ./ecma_2/RegExp/exec-002.js.
​https://bugs.webkit.org/show_bug.cgi?id=28353

Change the order of freeParenthesesDisjunctionContext and
popParenthesesDisjunctionContext on all call sites as the pop
method is accessing backTrack->lastContext which is the context
that is about to be freed.

• yarr/RegexInterpreter.cpp: (JSC::Yarr::Interpreter::parenthesesDoBacktrack): (JSC::Yarr::Interpreter::backtrackParentheses):

File:

• trunk/JavaScriptCore/yarr/RegexInterpreter.cpp (modified) (3 diffs)

trunk/JavaScriptCore/yarr/RegexInterpreter.cpp

@@ -609 +609 @@
 
             resetMatches(term, context);
+            popParenthesesDisjunctionContext(backTrack);
             freeParenthesesDisjunctionContext(context);
-            popParenthesesDisjunctionContext(backTrack);
         }
 
@@ -911 +911 @@
             } else {
                 resetMatches(term, context);
+                popParenthesesDisjunctionContext(backTrack);
                 freeParenthesesDisjunctionContext(context);
-                popParenthesesDisjunctionContext(backTrack);
             }
 
@@ -950 +950 @@
                 // pop a match off the stack
                 resetMatches(term, context);
+                popParenthesesDisjunctionContext(backTrack);
                 freeParenthesesDisjunctionContext(context);
-                popParenthesesDisjunctionContext(backTrack);
             }