tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

Debugger-findObjects-classObj-dead-wrapper.js (2648B)

      1 const g1 = newGlobal({ newCompartment: true });
      2 const g2 = newGlobal({ newCompartment: true });
      3 
      4 g1.eval(`
      5 var liveCtor = function() {
      6 };
      7 var liveProtoWithLiveCtor = {
      8  constructor: liveCtor,
      9 };
     10 `);
     11 
     12 g2.liveCtor = g1.liveCtor;
     13 
     14 g2.eval(`
     15 var deadCtor = function () {
     16 };
     17 var deadProtoWithLiveCtor = {
     18  constructor: liveCtor,
     19 };
     20 var deadProtoWithDeadCtor = {
     21  constructor: liveCtor,
     22 };
     23 `);
     24 
     25 g1.deadCtor = g2.deadCtor;
     26 g1.deadProtoWithLiveCtor = g2.deadProtoWithLiveCtor;
     27 g1.deadProtoWithDeadCtor = g2.deadProtoWithDeadCtor;
     28 
     29 g1.eval(`
     30 var liveProtoWithDeadCtor = {
     31  constructor: deadCtor,
     32 };
     33 `);
     34 
     35 g1.eval(`
     36 var x1 = {
     37  __proto__: liveProtoWithLiveCtor,
     38 };
     39 var x2 = {
     40  __proto__: liveProtoWithDeadCtor,
     41 };
     42 var x3 = {
     43  __proto__: deadProtoWithLiveCtor,
     44 };
     45 var x4 = {
     46  __proto__: deadProtoWithDeadCtor,
     47 };
     48 
     49 nukeCCW(deadProtoWithDeadCtor);
     50 nukeCCW(deadProtoWithLiveCtor);
     51 nukeCCW(deadCtor);
     52 `);
     53 
     54 const dbg = new Debugger();
     55 const gDO = dbg.addDebuggee(g1);
     56 
     57 const x1DO = gDO.makeDebuggeeValue(g1.x1);
     58 const x2DO = gDO.makeDebuggeeValue(g1.x2);
     59 const x3DO = gDO.makeDebuggeeValue(g1.x3);
     60 const x4DO = gDO.makeDebuggeeValue(g1.x4);
     61 
     62 const liveCtorDO = gDO.makeDebuggeeValue(g1.liveCtor);
     63 
     64 // If both prototype and constructor is live, it should match.
     65 assertEq(dbg.findObjects({ class: liveCtorDO }).includes(x1DO), true);
     66 
     67 // If the prototype is dead wrapper, it shouldn't match.
     68 assertEq(dbg.findObjects({ class: liveCtorDO }).includes(x3DO), false);
     69 
     70 // If the query is a dead wrapper, it should throw.
     71 let caught = false;
     72 try {
     73  dbg.findObjects({ class: g1.deadCtor });
     74 } catch (e) {
     75  assertEq(e.message.includes("dead object"), true);
     76  caught = true;
     77 }
     78 assertEq(caught, true);
     79 
     80 // If the query is a debuggee value with dead wrapper, it should throw.
     81 const reallyDeadCtorDO = gDO.makeDebuggeeValue(g1.deadCtor);
     82 caught = false;
     83 try {
     84  dbg.findObjects({ class: reallyDeadCtorDO });
     85 } catch (e) {
     86  assertEq(e.message.includes("dead object"), true);
     87  caught = true;
     88 }
     89 assertEq(caught, true);
     90 
     91 // If the constructor is dead wrapper, it shouldn't match.
     92 const deadCtorDO = gDO.makeDebuggeeValue(g2.deadCtor);
     93 assertEq(dbg.findObjects({ class: deadCtorDO }).includes(x2DO), false);
     94 assertEq(dbg.findObjects({ class: deadCtorDO }).includes(x4DO), false);
     95 
     96 // If the prototype is dead wrapper, it shouldn't match.
     97 const deadProtoWithLiveCtorDO = gDO.makeDebuggeeValue(g2.deadProtoWithLiveCtor);
     98 assertEq(dbg.findObjects({ class: deadProtoWithLiveCtorDO }).includes(x3DO), false);
     99 const deadProtoWithDeadCtorDO = gDO.makeDebuggeeValue(g2.deadProtoWithDeadCtor);
    100 assertEq(dbg.findObjects({ class: deadProtoWithLiveCtorDO }).includes(x4DO), false);