blob: 65464e23cd763607f4c66587181e18b4f41d517e (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
|
// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function newFastRegExp() { return new RegExp('.'); }
function toSlowRegExp(re) { re.exec = 42; }
let re = newFastRegExp();
const evil_nonstring = { [Symbol.toPrimitive]: () => toSlowRegExp(re) };
const empty_string = "";
String.prototype.replace.call(evil_nonstring, re, empty_string);
re = newFastRegExp();
String.prototype.match.call(evil_nonstring, re, empty_string);
re = newFastRegExp();
String.prototype.search.call(evil_nonstring, re, empty_string);
re = newFastRegExp();
String.prototype.split.call(evil_nonstring, re, empty_string);
|
