Snap for 6461536 from 13bd15d8c5885ced27c0c1e9863272f195842d75 to rvc-d1-releaseandroid-11.0.0_r9android-11.0.0_r8android-11.0.0_r7android-11.0.0_r15android-11.0.0_r14android-11.0.0_r13android-11.0.0_r12android-11.0.0_r11android-11.0.0_r10android11-d1-s7-releaseandroid11-d1-s6-releaseandroid11-d1-s5-releaseandroid11-d1-s1-releaseandroid11-d1-release

Change-Id: I5445db3f6ca8b617b45631b1a80f41f05a2bb326

3 files changed, 58 insertions, 0 deletions

diff --git a/test/js-unittest/b_147664838.js b/test/js-unittest/b_147664838.js
new file mode 100644
index 0000000..d1d8b72
--- /dev/null
+++ b/test/js-unittest/b_147664838.js
@@ -0,0 +1,21 @@
+function FindProxyForURL(url, host){
+  let re = /x/y;
+  let cnt = 0;
+  let str = re[Symbol.replace]("x", {
+    toString: () => {
+      cnt++;
+      if (cnt == 2) {
+        re.lastIndex = {valueOf: () => {
+          re.x = 42;
+          return 0;
+        }};
+      }
+      return 'y$';
+    }
+  });
+  if (str != "y$") {
+    throw "regex mutated";
+    return "FAIL";
+  }
+  return "DIRECT";
+}
\ No newline at end of file
diff --git a/test/proxy_resolver_v8_unittest.cc b/test/proxy_resolver_v8_unittest.cc
index 3f6d20f..8469cab 100644
--- a/test/proxy_resolver_v8_unittest.cc
+++ b/test/proxy_resolver_v8_unittest.cc
@@ -657,6 +657,19 @@ TEST(ProxyResolverV8Test, B_139806216) {
   EXPECT_EQ("DIRECT", proxies[0]);
 }
 
+TEST(ProxyResolverV8Test, B_147664838) {
+  ProxyResolverV8WithMockBindings resolver(new MockJSBindings());
+  int result = resolver.SetPacScript(SCRIPT(B_147664838_JS));
+  EXPECT_EQ(OK, result);
+
+  // Execute FindProxyForURL().
+  result = resolver.GetProxyForURL(kQueryUrl, kQueryHost, &kResults);
+
+  EXPECT_EQ(OK, result);
+  std::vector<std::string> proxies = string16ToProxyList(kResults);
+  EXPECT_EQ(1U, proxies.size());
+  EXPECT_EQ("DIRECT", proxies[0]);
+}
 
 }  // namespace
 }  // namespace net
diff --git a/test/proxy_test_script.h b/test/proxy_test_script.h
index 500a57a..2a86491 100644
--- a/test/proxy_test_script.h
+++ b/test/proxy_test_script.h
@@ -35,6 +35,30 @@
   "    return \"DIRECT\";\n" \
   "}\n" \
 
+#define B_147664838_JS \
+  u""\
+  "function FindProxyForURL(url, host){\n" \
+  "  let re = /x/y;\n" \
+  "  let cnt = 0;\n" \
+  "  let str = re[Symbol.replace](\"x\", {\n" \
+  "    toString: () => {\n" \
+  "      cnt++;\n" \
+  "      if (cnt == 2) {\n" \
+  "        re.lastIndex = {valueOf: () => {\n" \
+  "          re.x = 42;\n" \
+  "          return 0;\n" \
+  "        }};\n" \
+  "      }\n" \
+  "      return 'y$';\n" \
+  "    }\n" \
+  "  });\n" \
+  "  if (str != \"y$\") {\n" \
+  "    throw \"regex mutated\";\n" \
+  "    return \"FAIL\";\n" \
+  "  }\n" \
+  "  return \"DIRECT\";\n" \
+  "}\n" \
+
 #define BINDING_FROM_GLOBAL_JS \
   u""\
   "// Calls a bindings outside of FindProxyForURL(). This causes the code to\n" \