v8/test/mjsunit/regress/regress-crbug-831943.js
peterwmwong 7bdbe77a3f [builtins] Fix missing ToString in RegExp.p.match
It is not safe to assume the first match is a string just
because the RegExp result is fast.

Bug: chromium:831943
Change-Id: Idd40f8b75312f0be54f45f626dc017339033abc6
Reviewed-on: https://chromium-review.googlesource.com/1009325
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Peter Wong <peter.wm.wong@gmail.com>
Cr-Commit-Position: refs/heads/master@{#52578}
2018-04-12 14:54:54 +00:00

15 lines
382 B
JavaScript

// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
class MyRegExp extends RegExp {
exec(str) {
const r = super.exec.call(this, str);
if (r) r[0] = 0;
return r;
}
}
const result = 'a'.match(new MyRegExp('.', 'g'));
assertArrayEquals(result, ['0']);