Merge branch 'qtwebkit-4.6-staging' into qtscript-jsc-backend

Conflicts:
	src/corelib/tools/qregexp.cpp
	src/script/qscriptengine.cpp
	src/script/qscriptvalue.cpp

1 files changed, 14 insertions, 3 deletions

diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/AssemblerBuffer.h b/src/3rdparty/webkit/JavaScriptCore/assembler/AssemblerBuffer.h
index 7a5a8d3..073906a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/AssemblerBuffer.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/AssemblerBuffer.h
@@ -95,12 +95,14 @@ namespace JSC {
 
         void putIntUnchecked(int value)
         {
+            ASSERT(!(m_size > m_capacity - 4));
             *reinterpret_cast<int*>(&m_buffer[m_size]) = value;
             m_size += 4;
         }
 
         void putInt64Unchecked(int64_t value)
         {
+            ASSERT(!(m_size > m_capacity - 8));
             *reinterpret_cast<int64_t*>(&m_buffer[m_size]) = value;
             m_size += 8;
         }
@@ -137,10 +139,19 @@ namespace JSC {
             return memcpy(result, m_buffer, m_size);
         }
 
-    private:
-        void grow()
+    protected:
+        void append(const char* data, int size)
+        {
+            if (m_size > m_capacity - size)
+                grow(size);
+
+            memcpy(m_buffer + m_size, data, size);
+            m_size += size;
+        }
+
+        void grow(int extraCapacity = 0)
         {
-            m_capacity += m_capacity / 2;
+            m_capacity += m_capacity / 2 + extraCapacity;
 
             if (m_buffer == m_inlineBuffer) {
                 char* newBuffer = static_cast<char*>(fastMalloc(m_capacity));