Fix GC related crash bug in search-replace.

src/runtime.cc

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 1128 matching lines @@
     ASSERT(from >= 0);
     int length = to - from;
     ASSERT(length >= 0);
     if (length > 0) {
       // Can we encode the slice in 11 bits for length and 19 bits for
       // start position - as used by StringBuilderConcatHelper?
       if (StringBuilderSubstringLength::is_valid(length) &&
           StringBuilderSubstringPosition::is_valid(from)) {
         int encoded_slice = StringBuilderSubstringLength::encode(length) |
             StringBuilderSubstringPosition::encode(from);
-        AddElement(Smi::FromInt(encoded_slice));
+        AddElement(Handle<Object>(Smi::FromInt(encoded_slice)));
       } else {
         Handle<String> slice = Factory::NewStringSlice(subject_, from, to);
-        AddElement(*slice);
+        AddElement(slice);
       }
       IncrementCharacterCount(length);
     }
   }
 
 
   void AddString(Handle<String> string) {
     StringShape shape(*string);
     int length = string->length(shape);
     if (length > 0) {
-      AddElement(*string);
+      AddElement(string);
       if (!shape.IsAsciiRepresentation()) {
         is_ascii_ = false;
       }
       IncrementCharacterCount(length);
     }
   }
 
 
   Handle<String> ToString() {
     if (part_count_ == 0) {
@@ skipping 39 matching lines @@
   Handle<String> NewRawAsciiString(int size) {
     CALL_HEAP_FUNCTION(Heap::AllocateRawAsciiString(size), String);
   }
 
 
   Handle<String> NewRawTwoByteString(int size) {
     CALL_HEAP_FUNCTION(Heap::AllocateRawTwoByteString(size), String);
   }
 
 
-  void AddElement(Object* element) {
+  void AddElement(Handle<Object> element) {
     ASSERT(element->IsSmi() || element->IsString());
     // Extend parts_ array if necessary.
     if (parts_->length() == part_count_) {
       Handle<FixedArray> extended_array =
           Factory::NewFixedArray(part_count_ * 2);
       parts_->CopyTo(0, *extended_array, 0, part_count_);
       parts_ = extended_array;
     }
-    parts_->set(part_count_, element);
+    parts_->set(part_count_, *element);
     part_count_++;
   }
 
   Handle<String> subject_;
   Handle<FixedArray> parts_;
   int part_count_;
   int character_count_;
   bool is_ascii_;
 };
 
@@ skipping 301 matching lines @@
   // conservatively.
   int expected_parts =
       (compiled_replacement.parts() + 1) * (is_global ? 4 : 1) + 1;
   ReplacementStringBuilder builder(subject_handle, expected_parts);
 
   // Index of end of last match.
   int prev = 0;
 
   do {
     ASSERT(last_match_info_handle->HasFastElements());
-    FixedArray* match_info_array = last_match_info_handle->elements();
+    int start, end;
+    {
+      AssertNoAllocation a;
+      FixedArray* match_info_array = last_match_info_handle->elements();
 
-    ASSERT_EQ(capture_count * 2 + 2,
-              RegExpImpl::GetLastCaptureCount(match_info_array));
-    int start = RegExpImpl::GetCapture(match_info_array, 0);
-    int end = RegExpImpl::GetCapture(match_info_array, 1);
+      ASSERT_EQ(capture_count * 2 + 2,
+                RegExpImpl::GetLastCaptureCount(match_info_array));
+      start = RegExpImpl::GetCapture(match_info_array, 0);
+      end = RegExpImpl::GetCapture(match_info_array, 1);
+    }
 
     if (prev < start) {
       builder.AddSubjectSlice(prev, start);
     }
     compiled_replacement.Apply(&builder,
                                start,
                                end,
                                last_match_info_handle);
     prev = end;
 
@@ skipping 5082 matching lines @@
   } else {
     // Handle last resort GC and make sure to allow future allocations
     // to grow the heap without causing GCs (if possible).
     Counters::gc_last_resort_from_js.Increment();
     Heap::CollectAllGarbage();
   }
 }
 
 
 } }  // namespace v8::internal