tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

shape-teleporting-transplant-2.js (500B)

      1 // Put DOM object on prototype chain
      2 let x = new FakeDOMObject;
      3 let y = Object.create(x);
      4 
      5 // Transplant the DOM object while it is still a prototype
      6 let g = newGlobal({newCompartment: true});
      7 let { transplant } = transplantableObject({ object: x });
      8 
      9 // JIT an IC to access Object.prototype.toString
     10 function f(o) { return o.toString; }
     11 for (var i = 0; i < 20; ++i) { f(y) }
     12 
     13 // Transplanting should not interfere with teleporting
     14 transplant(g);
     15 x.toString = "override";
     16 assertEq(f(y), "override");