84a54c5c37
It's possible to build circular objects through the reviver function in JSON.parse. Recursion needs to check for stack overflows and throw as needed. BUG=chromium:729671 Change-Id: I52ccd9ed9fea5829810879f8dd8207043fa6d910 Reviewed-on: https://chromium-review.googlesource.com/525812 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Camillo Bruni <cbruni@chromium.org> Cr-Commit-Position: refs/heads/master@{#45752}
7 lines
274 B
JavaScript
7 lines
274 B
JavaScript
// Copyright 2017 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
var o = { 0: 11, 1: 9};
|
|
assertThrows(() => JSON.parse('[0,0]', function() { this[1] = o; }), RangeError);
|