Index: test/mjsunit/string-oom-slow-replace-one-with-string.js |
diff --git a/test/mjsunit/regress/regress-store-global-proxy.js b/test/mjsunit/string-oom-slow-replace-one-with-string.js |
similarity index 57% |
copy from test/mjsunit/regress/regress-store-global-proxy.js |
copy to test/mjsunit/string-oom-slow-replace-one-with-string.js |
index c85531c5fd917daa67b54e87141a164b90f3729b..bfcbe0f7275efa60d3dda54d81fbc6c567395832 100644 |
--- a/test/mjsunit/regress/regress-store-global-proxy.js |
+++ b/test/mjsunit/string-oom-slow-replace-one-with-string.js |
@@ -2,11 +2,11 @@ |
// Use of this source code is governed by a BSD-style license that can be |
// found in the LICENSE file. |
-delete Object.prototype.__proto__; |
+var a = 'a'; |
+for (var i = 0; i < 27; i++) a += a; |
-function f() { |
- this.toString = 1; |
+function replace() { |
+ a.replace('a', a); |
} |
-f.apply({}); |
-f(); |
+assertThrows(replace, RangeError); |