tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

create-out-of-bounds-ccw.js (448B)

      1 // RangeError is from the correct global when resizable ArrayBuffer gets out-of-bounds.
      2 
      3 let g = newGlobal();
      4 
      5 let rab = new g.ArrayBuffer(10, {maxByteLength: 10});
      6 
      7 let newTarget = Object.defineProperty(function(){}.bind(), "prototype", {
      8  get() {
      9    rab.resize(0);
     10    return DataView.prototype;
     11  }
     12 });
     13 
     14 let err;
     15 try {
     16  Reflect.construct(DataView, [rab, 10], newTarget);
     17 } catch (e) {
     18  err = e;
     19 }
     20 
     21 assertEq(err instanceof RangeError, true);