Fix http://code.google.com/p/chromium/issues/detail?id=7258 crash in IsFlat....

src/jsregexp.cc

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 654 matching lines @@
   if (!entry->IsNull()) {
     return Handle<FixedArray>(FixedArray::cast(entry));
   }
 
   // Compile the RegExp.
   ZoneScope zone_scope(DELETE_ON_EXIT);
 
   JSRegExp::Flags flags = re->GetFlags();
 
   Handle<String> pattern(re->Pattern());
-  StringShape shape(*pattern);
-  if (!pattern->IsFlat(shape)) {
+  if (!pattern->IsFlat(StringShape(*pattern))) {
     FlattenString(pattern);
   }
 
   RegExpCompileData compile_data;
   FlatStringReader reader(pattern);
   if (!ParseRegExp(&reader, flags.is_multiline(), &compile_data)) {
     // Throw an exception if we fail to parse the pattern.
     // THIS SHOULD NOT HAPPEN. We already parsed it successfully once.
     ThrowRegExpException(re,
                          pattern,
@@ skipping 89 matching lines @@
                           previous_index,
                           offsets.vector(),
                           offsets.length());
 }
 
 
 Handle<Object> RegExpImpl::IrregexpExecGlobal(Handle<JSRegExp> regexp,
                                               Handle<String> subject) {
   ASSERT_EQ(regexp->TypeTag(), JSRegExp::IRREGEXP);
 
-  StringShape shape(*subject);
-  bool is_ascii = shape.IsAsciiRepresentation();
+  bool is_ascii = StringShape(*subject).IsAsciiRepresentation();
   Handle<FixedArray> irregexp = GetCompiledIrregexp(regexp, is_ascii);
   if (irregexp.is_null()) {
     return Handle<Object>::null();
   }
 
   // Prepare space for the return values.
   int number_of_registers = IrregexpNumberOfRegisters(irregexp);
   OffsetsVector offsets(number_of_registers);
 
   int previous_index = 0;
 
   Handle<JSArray> result = Factory::NewJSArray(0);
   int i = 0;
   Handle<Object> matches;
 
-  if (!subject->IsFlat(shape)) {
+  if (!subject->IsFlat(StringShape(*subject))) {
     FlattenString(subject);
   }
 
   while (true) {
     if (previous_index > subject->length() || previous_index < 0) {
       // Per ECMA-262 15.10.6.2, if the previous index is greater than the
       // string length, there is no match.
       matches = Factory::null_value();
       return result;
     } else {
@@ skipping 3984 matching lines @@
   EmbeddedVector<byte, 1024> codes;
   RegExpMacroAssemblerIrregexp macro_assembler(codes);
   return compiler.Assemble(&macro_assembler,
                            node,
                            data->capture_count,
                            pattern);
 }
 
 
 }}  // namespace v8::internal