1 files changed, 38 insertions, 0 deletions
diff --git a/js/src/tests/non262/String/replace-math.js b/js/src/tests/non262/String/replace-math.js
new file mode 100644
index 0000000000..bfe3ec0282
--- /dev/null
+++ b/js/src/tests/non262/String/replace-math.js
@@ -0,0 +1,38 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
+var BUGNUMBER = 805121;
+var summary = "Be more careful with string math to avoid wrong results";
+
+print(BUGNUMBER + ": " + summary);
+
+/******************************************************************************/
+
+function puff(x, n)
+{
+  while(x.length < n)
+    x += x;
+  return x.substring(0, n);
+}
+
+var x = puff("1", 1 << 20);
+var rep = puff("$1", 1 << 16);
+
+try
+{
+  var y = x.replace(/(.+)/g, rep);
+  assertEq(y.length, Math.pow(2, 36));
+}
+catch (e)
+{
+  // OOM also acceptable
+}
+
+/******************************************************************************/
+
+if (typeof reportCompare === "function")
+  reportCompare(true, true);
+
+print("Tests complete");