tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

array-proto-outofrange.js (300B)

      1 function f(obj) {
      2    return typeof obj[15];
      3 }
      4 
      5 function test() {
      6    var a = [1, 2];
      7    a.__proto__ = {15: 1337};
      8    var b = [1, 2, 3, 4];
      9 
     10    for (var i = 0; i < 1000; i++) {
     11        var r = f(i % 2 ? a : b);
     12        assertEq(r, i % 2 ? "number" : "undefined");
     13    }
     14 }
     15 
     16 test();
     17 test();
     18 test();