tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

bug1448582-2.js (915B)


      1 // Overview:
      2 // - The outer function is an IIFE which gets marked as a singleton.
      3 // - The |o[index]| inner function is then also marked as a singleton.
      4 // - The |o[index]| inner function has a dynamic name from a computed property name.
      5 // - The |self| inner function uses |Function.prototype.caller| to reinvoke the outer function.
      6 //
      7 // When we reinvoke outer, we end up cloning a previously reused, i.e. non-cloned,
      8 // function which triggered an assertion in js::SetFunctionNameIfNoOwnName().
      9 
     10 (function(index) {
     11    var o = {
     12        [index]: function() {}
     13    };
     14 
     15    // Accessing |.name| sets the resolved-name flag, which triggered yet
     16    // another assertion when compared to bug1448582-1.js
     17    assertEq(o[index].name, String(index));
     18 
     19    // Reinvoke the IIFE through |Function.prototype.caller|.
     20    if (index === 0) {
     21        (function self() {
     22            self.caller(1);
     23        })();
     24    }
     25 })(0);