3f8d6f6074
There were two separate bugs here. First, a signed/unsigned mismatch where we took the result of PositiveNumberToUint32 and treated it as a signed int. Second, AdvanceStringIndex did not handle large input values correctly. Both are fixed by using uint64_t consistently. Bug: chromium:799813, v8:7258 Change-Id: If2819f87986d0ca732bc24df290f6dc7614083e8 Reviewed-on: https://chromium-review.googlesource.com/854272 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by: Camillo Bruni <cbruni@chromium.org> Cr-Commit-Position: refs/heads/master@{#50432}
43 lines
1.3 KiB
JavaScript
43 lines
1.3 KiB
JavaScript
// Copyright 2017 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
function testAdvanceLastIndex(initial_last_index_value,
|
|
expected_final_last_index_value) {
|
|
let exec_call_count = 0;
|
|
let last_index_setter_call_count = 0;
|
|
let final_last_index_value;
|
|
|
|
var customRegexp = {
|
|
get global() { return true; },
|
|
get unicode() { return true; },
|
|
get lastIndex() {
|
|
return initial_last_index_value;
|
|
},
|
|
set lastIndex(v) {
|
|
last_index_setter_call_count++;
|
|
final_last_index_value = v;
|
|
},
|
|
exec() {
|
|
return (exec_call_count++ == 0) ? [""] : null;
|
|
}
|
|
};
|
|
|
|
RegExp.prototype[Symbol.replace].call(customRegexp);
|
|
|
|
assertEquals(2, exec_call_count);
|
|
assertEquals(2, last_index_setter_call_count);
|
|
assertEquals(expected_final_last_index_value, final_last_index_value);
|
|
}
|
|
|
|
testAdvanceLastIndex(-1, 1);
|
|
testAdvanceLastIndex( 0, 1);
|
|
testAdvanceLastIndex(2**31 - 2, 2**31 - 1);
|
|
testAdvanceLastIndex(2**31 - 1, 2**31 - 0);
|
|
testAdvanceLastIndex(2**32 - 3, 2**32 - 2);
|
|
testAdvanceLastIndex(2**32 - 2, 2**32 - 1);
|
|
testAdvanceLastIndex(2**32 - 1, 2**32 - 0);
|
|
testAdvanceLastIndex(2**53 - 2, 2**53 - 1);
|
|
testAdvanceLastIndex(2**53 - 1, 2**53 - 0);
|
|
testAdvanceLastIndex(2**53 - 0, 2**53 - 0);
|