From 36d22d82aa202bb199967e9512281e9a53db42c9 Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Sun, 7 Apr 2024 21:33:14 +0200 Subject: Adding upstream version 115.7.0esr. Signed-off-by: Daniel Baumann --- js/src/tests/non262/RegExp/regress-617935.js | 42 ++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) create mode 100644 js/src/tests/non262/RegExp/regress-617935.js (limited to 'js/src/tests/non262/RegExp/regress-617935.js') diff --git a/js/src/tests/non262/RegExp/regress-617935.js b/js/src/tests/non262/RegExp/regress-617935.js new file mode 100644 index 0000000000..3764d81b0e --- /dev/null +++ b/js/src/tests/non262/RegExp/regress-617935.js @@ -0,0 +1,42 @@ +// |reftest| skip-if(!xulRuntime.shell&&(Android||xulRuntime.OS=="WINNT")) silentfail +/* + * Any copyright is dedicated to the Public Domain. + * http://creativecommons.org/licenses/publicdomain/ + * + * Author: Christian Holler + */ + +expectExitCode(0); +expectExitCode(5); + +/* Length of 32 */ +var foo = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"; + +/* Make len(foo) 32768 */ +for (i = 0; i < 10; ++i) { + foo += foo; +} + +/* Add one "a" to cause overflow later */ +foo += "a"; + +var bar = "bbbbbbbbbbbbbbbb"; + +/* Make len(bar) 8192 */ +for (i = 0; i < 9; ++i) { + bar += bar; +} + +/* + * Resulting string should be + * len(foo) * len(bar) = (2**10 * 32 + 1) * 8192 = 268443648 + * which will be larger than the max string length (2**28, or 268435456). + */ +try { + foo.replace(/[a]/g, bar); +} catch (e) { + reportCompare(e instanceof InternalError, true, "Internal error due to overallocation is ok."); +} +reportCompare(true, true, "No crash occurred."); + +print("Tests complete"); -- cgit v1.2.3