Merge r175372 - Unreviewed assertion fix.

RegExpCachedResult::m_reified is now the dedicated member that knows whether
the result was reified into an array or not. Check that instead of m_result
which is now single-purpose.

* runtime/RegExpCachedResult.cpp:
(JSC::RegExpCachedResult::setInput):

Canonical link: https://commits.webkit.org/154760.176@webkitgtk/2.6
git-svn-id: https://svn.webkit.org/repository/webkit/releases/WebKitGTK/webkit-2.6@175929 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/JavaScriptCore/ChangeLog

@@ -1,3 +1,14 @@
+2014-10-30  Andreas Kling  <akling@apple.com>
+
+        Unreviewed assertion fix.
+
+        RegExpCachedResult::m_reified is now the dedicated member that knows whether
+        the result was reified into an array or not. Check that instead of m_result
+        which is now single-purpose.
+
+        * runtime/RegExpCachedResult.cpp:
+        (JSC::RegExpCachedResult::setInput):
+
 2014-10-29  Andreas Kling  <akling@apple.com>
 
         Use plain JSArray for RegExp matches instead of a lazily populated custom object.

Source/JavaScriptCore/runtime/RegExpCachedResult.cpp

@@ -75,7 +75,7 @@ void RegExpCachedResult::setInput(ExecState* exec, JSObject* owner, JSString* in
 {
     // Make sure we're reified, otherwise m_reifiedInput will be ignored.
     lastResult(exec, owner);
-    ASSERT(!m_result);
+    ASSERT(m_reified);
     m_reifiedInput.set(exec->vm(), owner, input);
 }