v8/test/mjsunit/regress-v8-8445-2.js
Jaroslav Sevcik 3ca32e9828 [regexp] Introduce species constructor protector for regexps.
Bug: v8:8445
Change-Id: Iea69c65d0054b24b3f8c7234c4c556ebee2dd45f
Reviewed-on: https://chromium-review.googlesource.com/c/1335696
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57564}
2018-11-16 10:07:03 +00:00

28 lines
748 B
JavaScript

// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax --harmony-string-matchall
class MyRegExp {
exec() { return null; }
}
var r = /c/;
assertEquals(["ab", ""], "abc".split(r));
assertEquals([["c"]], [..."c".matchAll(r)]);
r.constructor = { [Symbol.species] : MyRegExp };
assertEquals(["abc"], "abc".split(r));
assertEquals([], [..."c".matchAll(r)]);
assertEquals(["ab", ""], "abc".split(/c/));
assertEquals([["c"]], [..."c".matchAll(/c/)]);
RegExp.prototype.constructor = { [Symbol.species] : MyRegExp };
assertEquals(["abc"], "abc".split(/c/));
assertEquals([], [..."c".matchAll(/c/)]);