v8/test/mjsunit/regress/regress-v8-10568.js
Jakob Gruber a305d2de5c [regexp] Fix integer overflows in TextNode::GetQuickCheckDetails
Several uc32 (= int32_t) fields were incorrectly treated as uc16
(= uint16_t):

CharacterRange::from()
CharacterRange::to()
QuickCheckDetails::Position::mask
QuickCheckDetails::Position::value

Bug: v8:10568
Change-Id: I9ea7d76e4a0cbc6ee681de2136c398cdc622bca2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2230527
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68290}
2020-06-10 12:22:47 +00:00

7 lines
283 B
JavaScript

// Copyright 2020 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
assertEquals(/[--𐀾]/u.exec("Hr3QoS3KCWXQ2yjBoDIK")[0], "H");
assertEquals(/[0-\u{10000}]/u.exec("A0")[0], "A");