Removed some unsafe uses of StringShape....

src/jsregexp.cc

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 114 matching lines @@
   return two_byte_string;
 }
 
 
 // Converts a source string to a 16 bit flat string or a SlicedString containing
 // a 16 bit flat string).
 Handle<String> RegExpImpl::StringToTwoByte(Handle<String> pattern) {
   StringShape shape(*pattern);
   if (!pattern->IsFlat(shape)) {
     FlattenString(pattern);
+    shape = StringShape(*pattern);
   }
   Handle<String> flat_string(shape.IsCons() ?
     String::cast(ConsString::cast(*pattern)->first()) :
     *pattern);
   ASSERT(flat_string->IsString());
   StringShape flat_shape(*flat_string);
   ASSERT(!flat_shape.IsCons());
   ASSERT(flat_shape.IsSequential() ||
          flat_shape.IsSliced() ||
          flat_shape.IsExternal());
@@ skipping 421 matching lines @@
   return Smi::cast(value->get(CAPTURE_INDEX))->value();
 }
 
 
 ByteArray* RegExpImpl::JsreInternal(Handle<JSRegExp> re) {
   FixedArray* value = FixedArray::cast(re->DataAt(JSRegExp::kJscreDataIndex));
   return ByteArray::cast(value->get(INTERNAL_INDEX));
 }
 
 }}  // namespace v8::internal