Bug 1263851 - Check lastIndex after loop in RegExp.prototype[@@split]. r=till
authorTooru Fujisawa <arai_a@mac.com>
Wed, 13 Apr 2016 08:48:49 +0900
changeset 292923 1fd59cb6c8686e0874fc99431e1032144605994c
parent 292922 72eb3fec4eb8284aa0ddb02480be79457f342813
child 292924 0dcdf655c75ef41fb4c2eca4dc62e88e48070deb
push id75026
push userarai_a@mac.com
push dateTue, 12 Apr 2016 23:50:38 +0000
treeherdermozilla-inbound@1fd59cb6c868 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerstill
bugs1263851
milestone48.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1263851 - Check lastIndex after loop in RegExp.prototype[@@split]. r=till
js/src/builtin/RegExp.js
js/src/tests/ecma_6/RegExp/split-invalid-lastIndex.js
--- a/js/src/builtin/RegExp.js
+++ b/js/src/builtin/RegExp.js
@@ -742,17 +742,20 @@ function RegExpSplit(string, limit) {
                 return A;
         }
 
         // Step 19.d.iv.11.
         q = p;
     }
 
     // Steps 20-22.
-    _DefineDataProperty(A, lengthA, Substring(S, p, size - p));
+    if (p >= size)
+        _DefineDataProperty(A, lengthA, "");
+    else
+        _DefineDataProperty(A, lengthA, Substring(S, p, size - p));
 
     // Step 23.
     return A;
 }
 
 // ES6 21.2.5.2.
 // NOTE: This is not RegExpExec (21.2.5.2.1).
 function RegExp_prototype_Exec(string) {
new file mode 100644
--- /dev/null
+++ b/js/src/tests/ecma_6/RegExp/split-invalid-lastIndex.js
@@ -0,0 +1,31 @@
+var BUGNUMBER = 1263851;
+var summary = "RegExp.prototype[@@split] should handle if lastIndex is out of bound.";
+
+print(BUGNUMBER + ": " + summary);
+
+var myRegExp = {
+    get constructor() {
+        return {
+            get [Symbol.species]() {
+                return function() {
+                    return {
+                        get lastIndex() {
+                            return 9;
+                        },
+                        set lastIndex(v) {},
+                        exec() {
+                            return [];
+                        }
+                    };
+                };
+            }
+        };
+    }
+};
+var result = RegExp.prototype[Symbol.split].call(myRegExp, "abcde");;
+assertEq(result.length, 2);
+assertEq(result[0], "");
+assertEq(result[1], "");
+
+if (typeof reportCompare === "function")
+    reportCompare(true, true);