v8/test/mjsunit/regress/regress-933776.js
Jakob Gruber c54bbd2c23 Remove invalid DCHECK in ReplacementStringBuilder
The DCHECK verified capacity just before the call to EnsureCapacity()
(which extends capacity if needed). This DCHECK can just be removed
since FixedArray::set() already checks the given index is in-bounds.

Drive-by: Remove similar duplicate DCHECKs in FixedArrayBuilder.

Bug: chromium:933776
Change-Id: I9f058548063a170ea6dce112a3877792887efcca
Reviewed-on: https://chromium-review.googlesource.com/c/1479955
Reviewed-by: Simon Zünd <szuend@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59753}
2019-02-21 09:41:06 +00:00

7 lines
237 B
JavaScript

// Copyright 2019 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
__v_51351 = /[^]$/gm;
"a\nb\rc\n\rd\r\ne".replace(__v_51351, "*$1");