mirror of
https://github.com/nodejs/node.git
synced 2025-05-21 19:44:16 +00:00
14d24cc4d2
Refs: https://github.com/v8/v8/compare/6.2.414.32...6.2.414.44 PR-URL: https://github.com/nodejs/node/pull/16848 Reviewed-By: Ali Ijaz Sheikh <ofrobots@google.com> Reviewed-By: Franziska Hinkelmann <franziska.hinkelmann@gmail.com> Reviewed-By: Michaël Zasso <targos@protonmail.com> Reviewed-By: Gireesh Punathil <gpunathi@in.ibm.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
22 lines
715 B
JavaScript
22 lines
715 B
JavaScript
// Copyright 2017 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
function newFastRegExp() { return new RegExp('.'); }
|
|
function toSlowRegExp(re) { re.exec = 42; }
|
|
|
|
let re = newFastRegExp();
|
|
const evil_nonstring = { [Symbol.toPrimitive]: () => toSlowRegExp(re) };
|
|
const empty_string = "";
|
|
|
|
String.prototype.replace.call(evil_nonstring, re, empty_string);
|
|
|
|
re = newFastRegExp();
|
|
String.prototype.match.call(evil_nonstring, re, empty_string);
|
|
|
|
re = newFastRegExp();
|
|
String.prototype.search.call(evil_nonstring, re, empty_string);
|
|
|
|
re = newFastRegExp();
|
|
String.prototype.split.call(evil_nonstring, re, empty_string);
|