f738c6c4c3
The result of Object::ToInteger is a number rounded to an integer value, but not necessarily in the range of what a C++ "int" can represent. Doing the 2 <= radix <= 36 range check first makes the subsequent cast safe. Bug: chromium:927212 Change-Id: I49f115140f6dc1f951cbc08a3025b3ac92ec8628 Reviewed-on: https://chromium-review.googlesource.com/c/1449040 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#59303}
20 lines
545 B
JavaScript
20 lines
545 B
JavaScript
// Copyright 2019 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// crbug.com/923466
|
|
__v_5 = [ -1073741825, -2147483648];
|
|
__v_5.sort();
|
|
|
|
// crbug.com/923642
|
|
new RegExp("(abcd){2148473648,}", "");
|
|
|
|
// crbug.com/923626
|
|
new Date(2146399200000).toString();
|
|
new Date(2146940400000).toString();
|
|
new Date(2147481600000).toString();
|
|
new Date(2148022800000).toString();
|
|
|
|
// crbug.com/927212
|
|
assertThrows(() => (2n).toString(-2147483657), RangeError);
|