v8/test/mjsunit/regress/regress-crbug-967151.js
Toon Verwaest f58b7e1727 [json] Strings can lie to us about representation, so check what's underneath
Bug: chromium:967151
Change-Id: I54a856cfcc4b4b17bd282dd3eabe5a915e617ca5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1630683
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61846}
2019-05-27 10:56:44 +00:00

13 lines
408 B
JavaScript

// Copyright 2019 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --expose-externalize-string
__v_3 = "100 external string turned into two byte";
__v_2 = __v_3.substring(0, 28);
try {
externalizeString(__v_3, true);
} catch (e) {}
assertEquals(100, JSON.parse(__v_2));