From d51003180822fbfc71faba5d1275a29ebb3b0fd1 Mon Sep 17 00:00:00 2001
From: Hannes Verschore <hv1989@gmail.com>
Date: Thu, 14 Mar 2013 23:15:50 +0100
Subject: [PATCH] Backed out changeset 9f39547cfab3 (bug 850534) for yarr
 crashes on a CLOSED TREE

---
 js/src/yarr/YarrInterpreter.cpp |  1 -
 js/src/yarr/YarrInterpreter.h   | 19 +++++++------------
 js/src/yarr/YarrPattern.cpp     |  3 +--
 js/src/yarr/wtfbridge.h         |  9 ---------
 4 files changed, 8 insertions(+), 24 deletions(-)

diff --git a/js/src/yarr/YarrInterpreter.cpp b/js/src/yarr/YarrInterpreter.cpp
index 296e7d5c9559..a2ab28532a84 100644
--- a/js/src/yarr/YarrInterpreter.cpp
+++ b/js/src/yarr/YarrInterpreter.cpp
@@ -1734,7 +1734,6 @@ public:
         unsigned numSubpatterns = lastSubpatternId - subpatternId + 1;
         ByteDisjunction* parenthesesDisjunction = js_new<ByteDisjunction>(numSubpatterns, callFrameSize);
 
-        parenthesesDisjunction->terms.reserve(endTerm - beginTerm + 1);
         parenthesesDisjunction->terms.append(ByteTerm::SubpatternBegin());
         for (unsigned termInParentheses = beginTerm + 1; termInParentheses < endTerm; ++termInParentheses)
             parenthesesDisjunction->terms.append(m_bodyDisjunction->terms[termInParentheses]);
diff --git a/js/src/yarr/YarrInterpreter.h b/js/src/yarr/YarrInterpreter.h
index ae40fa7d1cac..2efb68a782b0 100644
--- a/js/src/yarr/YarrInterpreter.h
+++ b/js/src/yarr/YarrInterpreter.h
@@ -341,7 +341,7 @@ public:
 struct BytecodePattern {
     WTF_MAKE_FAST_ALLOCATED;
 public:
-    BytecodePattern(PassOwnPtr<ByteDisjunction> body, Vector<ByteDisjunction*> &allParenthesesInfo, YarrPattern& pattern, BumpPointerAllocator* allocator)
+    BytecodePattern(PassOwnPtr<ByteDisjunction> body, const Vector<ByteDisjunction*> &allParenthesesInfo, YarrPattern& pattern, BumpPointerAllocator* allocator)
         : m_body(body)
         , m_ignoreCase(pattern.m_ignoreCase)
         , m_multiline(pattern.m_multiline)
@@ -350,17 +350,12 @@ public:
         newlineCharacterClass = pattern.newlineCharacterClass();
         wordcharCharacterClass = pattern.wordcharCharacterClass();
 
-        // Trick: 'Steal' the YarrPattern's ParenthesesInfo!
-        // The input vector isn't used afterwards anymore,
-        // that way we don't have to copy the input.
-        JS_ASSERT(m_allParenthesesInfo.size() == 0);
-        m_allParenthesesInfo.swap(allParenthesesInfo);
-
-        // Trick: 'Steal' the YarrPattern's CharacterClasses!
-        // The input vector isn't used afterwards anymore,
-        // that way we don't have to copy the input.
-        JS_ASSERT(m_userCharacterClasses.size() == 0);
-        m_userCharacterClasses.swap(pattern.m_userCharacterClasses);
+        m_allParenthesesInfo.append(allParenthesesInfo);
+        m_userCharacterClasses.append(pattern.m_userCharacterClasses);
+        // 'Steal' the YarrPattern's CharacterClasses!  We clear its
+        // array, so that it won't delete them on destruction.  We'll
+        // take responsibility for that.
+        pattern.m_userCharacterClasses.clear();
     }
 
     ~BytecodePattern()
diff --git a/js/src/yarr/YarrPattern.cpp b/js/src/yarr/YarrPattern.cpp
index f091b984884c..50f110ee4e1c 100644
--- a/js/src/yarr/YarrPattern.cpp
+++ b/js/src/yarr/YarrPattern.cpp
@@ -491,12 +491,11 @@ public:
                     newDisjunction->m_parent = disjunction->m_parent;
                 }
                 PatternAlternative* newAlternative = newDisjunction->addNewAlternative();
-                newAlternative->m_terms.reserve(alternative->m_terms.size());
                 for (unsigned i = 0; i < alternative->m_terms.size(); ++i)
                     newAlternative->m_terms.append(copyTerm(alternative->m_terms[i], filterStartsWithBOL));
             }
         }
-
+        
         if (newDisjunction)
             m_pattern.m_disjunctions.append(newDisjunction);
         return newDisjunction;
diff --git a/js/src/yarr/wtfbridge.h b/js/src/yarr/wtfbridge.h
index 23a20dc3ba74..53c0161fb14f 100644
--- a/js/src/yarr/wtfbridge.h
+++ b/js/src/yarr/wtfbridge.h
@@ -204,10 +204,6 @@ class Vector {
         for (T *p = impl.begin(); p != impl.end(); ++p)
             js_delete(*p);
     }
-
-    bool reserve(size_t capacity) {
-        return impl.reserve(capacity);
-    }
 };
 
 template<typename T>
@@ -235,11 +231,6 @@ class Vector<OwnPtr<T> > {
             delete_(*p);
         return impl.clear();
     }
-
-    void reserve(size_t capacity) {
-        // XXX yarr-oom
-        (void) impl.reserve(capacity);
-    }
 };
 
 template <typename T, size_t N>