The Tor Browser / file diff

     1.1 --- /dev/null	Thu Jan 01 00:00:00 1970 +0000
     1.2 +++ b/js/src/tests/ecma_5/RegExp/regress-617935.js	Wed Dec 31 06:09:35 2014 +0100
     1.3 @@ -0,0 +1,42 @@
     1.4 +// |reftest| skip-if(!xulRuntime.shell&&(Android||xulRuntime.OS=="WINNT")) silentfail
     1.5 +/*
     1.6 + * Any copyright is dedicated to the Public Domain.
     1.7 + * http://creativecommons.org/licenses/publicdomain/
     1.8 + *
     1.9 + * Author: Christian Holler <decoder@own-hero.net>
    1.10 + */
    1.11 +
    1.12 +expectExitCode(0);
    1.13 +expectExitCode(5);
    1.14 +
    1.15 +/* Length of 32 */
    1.16 +var foo = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
    1.17 +
    1.18 +/* Make len(foo) 32768 */
    1.19 +for (i = 0; i < 10; ++i) {
    1.20 +    foo += foo;
    1.21 +}
    1.22 +
    1.23 +/* Add one "a" to cause overflow later */
    1.24 +foo += "a";
    1.25 +
    1.26 +var bar = "bbbbbbbbbbbbbbbb";
    1.27 +
    1.28 +/* Make len(bar) 8192 */
    1.29 +for (i = 0; i < 9; ++i) {
    1.30 +    bar += bar;
    1.31 +}
    1.32 +
    1.33 +/* 
    1.34 + * Resulting string should be 
    1.35 + * len(foo) * len(bar) = (2**10 * 32 + 1) * 8192 = 268443648
    1.36 + * which will be larger than the max string length (2**28, or 268435456).
    1.37 + */
    1.38 +try {
    1.39 +    foo.replace(/[a]/g, bar);
    1.40 +} catch (e) {
    1.41 +    reportCompare(e instanceof InternalError, true, "Internal error due to overallocation is ok.");
    1.42 +}
    1.43 +reportCompare(true, true, "No crash occurred.");
    1.44 +
    1.45 +print("Tests complete");