tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

bug1420910.js (807B)


      1 // Testing InstanceOf IC.
      2 
      3 Array.prototype.sum = function() {
      4    return this.reduce(( acc, cur ) => acc + cur, 0);
      5 }
      6 
      7 
      8 Iters = 20;
      9 
     10 function resultArray(fn, obj) {
     11    res = new Array();
     12    for (var x = 0; x < Iters; x++) {
     13        res.push(fn(obj) ? 1 : 0);
     14    }
     15    return res;
     16 }
     17 
     18 // Ensure alteration of .prototype invalidates IC
     19 function basic() {};
     20 
     21 protoA = { prop1: "1"};
     22 basic.prototype = protoA;
     23 
     24 io1 = x => { return x instanceof basic; }
     25 
     26 var x = new basic();
     27 beforePrototypeModification = resultArray(io1,x).sum(); //Attach and test IC
     28 assertEq(beforePrototypeModification,Iters);
     29 
     30 basic.prototype = {}; // Invalidate IC
     31 afterPrototypeModification  = resultArray(io1,x).sum(); //Test
     32 assertEq(afterPrototypeModification,0);
     33 
     34 //Primitive LHS returns false.
     35 assertEq(resultArray(io1,0).sum(),0);