v8/test/unittests/regress/regress-crbug-938251-unittest.cc
Simon Zünd 4edcc86054 [heap] Throw OOM when allocating FixedDoubleArrays with negative length
Bug: chromium:938251
Change-Id: I336765c894cc78ca822904a32356db43feadea07
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1505312
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60051}
2019-03-06 10:55:42 +00:00

21 lines
607 B
C++

// Copyright 2019 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "src/heap/factory.h"
#include "src/isolate.h"
#include "test/unittests/test-utils.h"
namespace v8 {
namespace internal {
using NewFixedDoubleArrayTest = TestWithIsolateAndZone;
TEST_F(NewFixedDoubleArrayTest, ThrowOnNegativeLength) {
ASSERT_DEATH_IF_SUPPORTED({ factory()->NewFixedDoubleArray(-1); },
"Fatal javascript OOM in invalid array length");
}
} // namespace internal
} // namespace v8