array_splice4.js 1.2 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243
  1. //-------------------------------------------------------------------------------------------------------
  2. // Copyright (C) Microsoft. All rights reserved.
  3. // Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
  4. //-------------------------------------------------------------------------------------------------------
  5. // BLUE#5602: User Mode Write AV starting at Js::SparseArraySegment::EnsureSizeInBound+0x000000000000001a (Hash=0x3c06064b.0x23355e69)
  6. var echo=WScript.Echo
  7. function func2()
  8. {}
  9. // from bug BLUE 5602
  10. function func()
  11. {
  12. e="div".match(func2());
  13. echo("e = " + e + " ; e.length = " + e.length);
  14. e.length=58;
  15. echo("e = " + e + " ; e.length = " + e.length);
  16. e.splice(1);//es.splice(1,17); is OK too
  17. echo("e = " + e + " ; e.length = " + e.length);
  18. }
  19. // from bug BLUE 5602
  20. function func_test2()
  21. {
  22. e="div".match(func2());
  23. echo("e = " + e + " ; e.length = " + e.length);
  24. e.length=58;
  25. echo("e = " + e + " ; e.length = " + e.length);
  26. e.splice(1,17);
  27. echo("e = " + e + " ; e.length = " + e.length);
  28. }
  29. function start()
  30. {
  31. echo ("start- func()");
  32. func();
  33. echo ("start- func_test2()");
  34. func_test2();
  35. echo ("start- done");
  36. }
  37. start();