v8/test/mjsunit/regress/regress-791345.js
Daniel Clifford 6f6ca7301a Fix OOB access in Array.prototype.slice
Bug: chromium:791345
Change-Id: I81e5e23e2ddfc5e78a4ca922ceffda28516277c3
Reviewed-on: https://chromium-review.googlesource.com/806097
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49871}
2017-12-05 14:34:17 +00:00

16 lines
439 B
JavaScript

// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
(function(a) {
var len = 0x80000000;
arguments.length = len;
Array.prototype.slice.call(arguments, len - 1, len);
}('a'));
(function(a) {
var len = 0x40000000;
arguments.length = len;
Array.prototype.slice.call(arguments, len - 1, len);
}('a'));