v8/test/mjsunit/regress/regress-crbug-843022.js
jgruber 5999f8f1fc [regexp] Do not assume fast regexp results are non-empty
It is possible for user code to modify fast regexp result objects
before they are used e.g. by RegExp.p.match, so we may not make any
assumptions about their contents. The only exception is when the
RegExp itself is fast.

Bug: chromium:843022
Change-Id: I14eafbdfb2b2ced609da1391b57c73cbe167f7fb
Reviewed-on: https://chromium-review.googlesource.com/1061455
Reviewed-by: Peter Wong <peter.wm.wong@gmail.com>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53210}
2018-05-16 13:06:14 +00:00

22 lines
851 B
JavaScript

// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Produce an fast, but empty result.
const fast_regexp_result = /./g.exec("a");
fast_regexp_result.length = 0;
class RegExpWithFastResult extends RegExp {
constructor() { super(".", "g"); this.number_of_runs = 0; }
exec(str) { return (this.number_of_runs++ == 0) ? fast_regexp_result : null; }
}
// A slow empty result.
const slow_regexp_result = [];
class RegExpWithSlowResult extends RegExp {
constructor() { super(".", "g"); this.number_of_runs = 0; }
exec(str) { return (this.number_of_runs++ == 0) ? slow_regexp_result : null; }
}
assertEquals(["undefined"], "a".match(new RegExpWithFastResult()));
assertEquals(["undefined"], "a".match(new RegExpWithSlowResult()));