686c37839c
Fixes a crash found by clusterfuzz caused by a call to std::vector::reserve with a huge capacity, and reverts to ZoneList handling as a tentative fix for performance regressions on the slow @@replace path. BUG=chromium:707187,chromium:706748,v8:5437 Review-Url: https://codereview.chromium.org/2787343002 Cr-Commit-Position: refs/heads/master@{#44311}
13 lines
294 B
JavaScript
13 lines
294 B
JavaScript
// Copyright 2017 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
let i = 0;
|
|
let re = /./g;
|
|
re.exec = () => {
|
|
if (i++ == 0) return { length: 2147483648 };
|
|
return null;
|
|
};
|
|
|
|
"".replace(re);
|