22 lines
715 B
JavaScript
22 lines
715 B
JavaScript
|
// Copyright 2017 the V8 project authors. All rights reserved.
|
||
|
|
// Use of this source code is governed by a BSD-style license that can be
|
||
|
|
// found in the LICENSE file.
|
||
|
|
|
||
|
|
function newFastRegExp() { return new RegExp('.'); }
|
||
|
|
function toSlowRegExp(re) { re.exec = 42; }
|
||
|
|
|
||
|
|
let re = newFastRegExp();
|
||
|
|
const evil_nonstring = { [Symbol.toPrimitive]: () => toSlowRegExp(re) };
|
||
|
|
const empty_string = "";
|
||
|
|
|
||
|
|
String.prototype.replace.call(evil_nonstring, re, empty_string);
|
||
|
|
|
||
|
|
re = newFastRegExp();
|
||
|
|
String.prototype.match.call(evil_nonstring, re, empty_string);
|
||
|
|
|
||
|
|
re = newFastRegExp();
|
||
|
|
String.prototype.search.call(evil_nonstring, re, empty_string);
|
||
|
|
|
||
|
|
re = newFastRegExp();
|
||
|
|
String.prototype.split.call(evil_nonstring, re, empty_string);
|