Merge cherrypicks of [11569582, 11569838, 11569699, 11569700, 11569701, 11569703, 11569839, 11569840, 11569841, 11569842, 11569759, 11569760, 11569843, 11569938, 11569522, 11569642, 11569643, 11569644, 11569958, 11569959, 11569584, 11569585, 11569586, 11569587, 11569645, 11569646, 11570018] into qt-d4-release
Change-Id: Ifb104aeaf50e7f2cb87293ab6e507037e08af6cd
diff --git a/test/js-unittest/b_147664838.js b/test/js-unittest/b_147664838.js
new file mode 100644
index 0000000..d1d8b72
--- /dev/null
+++ b/test/js-unittest/b_147664838.js
@@ -0,0 +1,21 @@
+function FindProxyForURL(url, host){
+ let re = /x/y;
+ let cnt = 0;
+ let str = re[Symbol.replace]("x", {
+ toString: () => {
+ cnt++;
+ if (cnt == 2) {
+ re.lastIndex = {valueOf: () => {
+ re.x = 42;
+ return 0;
+ }};
+ }
+ return 'y$';
+ }
+ });
+ if (str != "y$") {
+ throw "regex mutated";
+ return "FAIL";
+ }
+ return "DIRECT";
+}
\ No newline at end of file
diff --git a/test/proxy_resolver_v8_unittest.cc b/test/proxy_resolver_v8_unittest.cc
index 3f6d20f..8469cab 100644
--- a/test/proxy_resolver_v8_unittest.cc
+++ b/test/proxy_resolver_v8_unittest.cc
@@ -657,6 +657,19 @@
EXPECT_EQ("DIRECT", proxies[0]);
}
+TEST(ProxyResolverV8Test, B_147664838) {
+ ProxyResolverV8WithMockBindings resolver(new MockJSBindings());
+ int result = resolver.SetPacScript(SCRIPT(B_147664838_JS));
+ EXPECT_EQ(OK, result);
+
+ // Execute FindProxyForURL().
+ result = resolver.GetProxyForURL(kQueryUrl, kQueryHost, &kResults);
+
+ EXPECT_EQ(OK, result);
+ std::vector<std::string> proxies = string16ToProxyList(kResults);
+ EXPECT_EQ(1U, proxies.size());
+ EXPECT_EQ("DIRECT", proxies[0]);
+}
} // namespace
} // namespace net
diff --git a/test/proxy_test_script.h b/test/proxy_test_script.h
index 500a57a..2a86491 100644
--- a/test/proxy_test_script.h
+++ b/test/proxy_test_script.h
@@ -35,6 +35,30 @@
" return \"DIRECT\";\n" \
"}\n" \
+#define B_147664838_JS \
+ u""\
+ "function FindProxyForURL(url, host){\n" \
+ " let re = /x/y;\n" \
+ " let cnt = 0;\n" \
+ " let str = re[Symbol.replace](\"x\", {\n" \
+ " toString: () => {\n" \
+ " cnt++;\n" \
+ " if (cnt == 2) {\n" \
+ " re.lastIndex = {valueOf: () => {\n" \
+ " re.x = 42;\n" \
+ " return 0;\n" \
+ " }};\n" \
+ " }\n" \
+ " return 'y$';\n" \
+ " }\n" \
+ " });\n" \
+ " if (str != \"y$\") {\n" \
+ " throw \"regex mutated\";\n" \
+ " return \"FAIL\";\n" \
+ " }\n" \
+ " return \"DIRECT\";\n" \
+ "}\n" \
+
#define BINDING_FROM_GLOBAL_JS \
u""\
"// Calls a bindings outside of FindProxyForURL(). This causes the code to\n" \
