mirror of
https://github.com/tc39/test262.git
synced 2025-10-31 03:34:08 +01:00
7298a38552
sourceRevisionAtLastExport: 33f2fb0e53d135f0ee17cfccd9d993eb2a6f47de targetRevisionAtLastExport: 31340cbd9add103f586d501b0c3354b7b182abc0
22 lines
715 B
JavaScript
22 lines
715 B
JavaScript
// Copyright 2017 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
function newFastRegExp() { return new RegExp('.'); }
|
|
function toSlowRegExp(re) { re.exec = 42; }
|
|
|
|
let re = newFastRegExp();
|
|
const evil_nonstring = { [Symbol.toPrimitive]: () => toSlowRegExp(re) };
|
|
const empty_string = "";
|
|
|
|
String.prototype.replace.call(evil_nonstring, re, empty_string);
|
|
|
|
re = newFastRegExp();
|
|
String.prototype.match.call(evil_nonstring, re, empty_string);
|
|
|
|
re = newFastRegExp();
|
|
String.prototype.search.call(evil_nonstring, re, empty_string);
|
|
|
|
re = newFastRegExp();
|
|
String.prototype.split.call(evil_nonstring, re, empty_string);
|