1 files changed, 13 insertions, 10 deletions
diff --git a/Source/JavaScriptCore/runtime/RegExpCache.cpp b/Source/JavaScriptCore/runtime/RegExpCache.cpp
index 36ea326e6..53a13a4b5 100644
--- a/Source/JavaScriptCore/runtime/RegExpCache.cpp
+++ b/Source/JavaScriptCore/runtime/RegExpCache.cpp
@@ -36,17 +36,15 @@ namespace JSC {
 RegExp* RegExpCache::lookupOrCreate(const UString& patternString, RegExpFlags flags)
 {
     RegExpKey key(flags, patternString);
-    RegExpCacheMap::iterator result = m_weakCache.find(key);
-    if (result != m_weakCache.end())
-        return result->second.get();
+    if (RegExp* regExp = m_weakCache.get(key))
+        return regExp;
+
     RegExp* regExp = RegExp::createWithoutCaching(*m_globalData, patternString, flags);
 #if ENABLE(REGEXP_TRACING)
     m_globalData->addRegExpToTrace(regExp);
 #endif
-    // We need to do a second lookup to add the RegExp as
-    // allocating it may have caused a gc cycle, which in
-    // turn may have removed items from the cache.
-    m_weakCache.add(key, PassWeak<RegExp>(regExp, this));
+
+    weakAdd(m_weakCache, key, PassWeak<RegExp>(regExp, this));
     return regExp;
 }
 
@@ -59,7 +57,7 @@ RegExpCache::RegExpCache(JSGlobalData* globalData)
 void RegExpCache::finalize(Handle<Unknown> handle, void*)
 {
     RegExp* regExp = static_cast<RegExp*>(handle.get().asCell());
-    m_weakCache.remove(regExp->key());
+    weakRemove(m_weakCache, regExp->key(), regExp);
     regExp->invalidateCode();
 }
 
@@ -79,9 +77,14 @@ void RegExpCache::invalidateCode()
     for (int i = 0; i < maxStrongCacheableEntries; i++)
         m_strongCache[i].clear();
     m_nextEntryInStrongCache = 0;
+
     RegExpCacheMap::iterator end = m_weakCache.end();
-    for (RegExpCacheMap::iterator ptr = m_weakCache.begin(); ptr != end; ++ptr)
-        ptr->second->invalidateCode();
+    for (RegExpCacheMap::iterator it = m_weakCache.begin(); it != end; ++it) {
+        RegExp* regExp = it->second.get();
+        if (!regExp) // Skip zombies.
+            continue;
+        regExp->invalidateCode();
+    }
 }
 
 }