haikuwebkit/LayoutTests/js/regress-146298.html

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
<html>
<head>
<script src="../resources/js-test-pre.js"></script>
</head>
<body>
<script src="script-tests/regress-146298.js"></script>
<script src="../resources/js-test-post.js"></script>
</body>
</html>
REGRESSION (r181889): basspro.com hangs on load under JSC::ErrorInstance::finishCreation(JSC::ExecState, JSC::VM&, WTF::String const&, bool) + 2801 (JavaScriptCore + 3560689) https://bugs.webkit.org/show_bug.cgi?id=146298 Reviewed by Mark Lam. Source/JavaScriptCore: We were underflowing in ExceptionHelpers.cpp::functionCallBase() with a right to left string index. Added checks that idx stays within the string. Also added a termination condition when idx is 0. runtime/ExceptionHelpers.cpp: (JSC::functionCallBase): LayoutTests: New regression test. * js/regress-146298-expected.txt: Added. * js/regress-146298.html: Added. * js/script-tests/regress-146298.js: Added. Canonical link: https://commits.webkit.org/164391@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@185954 268f45cc-cd09-0410-ab3c-d52691b4dbfc 2015-06-25 17:35:12 +00:00			`<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">`
			`<html>`
			`<head>`
			`<script src="../resources/js-test-pre.js"></script>`
			`</head>`
			`<body>`
			`<script src="script-tests/regress-146298.js"></script>`
			`<script src="../resources/js-test-post.js"></script>`
			`</body>`
			`</html>`