OLD | NEW |
| (Empty) |
1 // Copyright 2016 the V8 project authors. All rights reserved. | |
2 // Use of this source code is governed by a BSD-style license that can be | |
3 // found in the LICENSE file. | |
4 | |
5 // Trigger an infinite loop through RegExp.prototype[@@match], which results | |
6 // in unbounded growth of the results array. | |
7 | |
8 // Limit the number of iterations to avoid OOM while still triggering large | |
9 // object space allocation. | |
10 const min_ptr_size = 4; | |
11 const max_regular_heap_object_size = 507136; | |
12 const num_iterations = max_regular_heap_object_size / min_ptr_size; | |
13 | |
14 const RegExpPrototypeExec = RegExp.prototype.exec; | |
15 | |
16 let i = 0; | |
17 | |
18 RegExp.prototype.__defineGetter__("global", () => true); | |
19 RegExp.prototype.exec = function(str) { | |
20 return (i++ < num_iterations) ? RegExpPrototypeExec.call(this, str) : null; | |
21 }; | |
22 | |
23 "a".match(); | |
OLD | NEW |