tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

Environment-getVariable-15.js (1166B)


      1 // Don't hand out internal function objects via Debugger.Environment.prototype.getVariable.
      2 
      3 // When the real scope chain object holding the binding for 'f' in 'function f()
      4 // { ... }' is optimized out because it's never used, we whip up fake scope
      5 // chain objects for Debugger to use, if it looks. However, the value of the
      6 // variable f will be an internal function object, not a live function object,
      7 // since the latter was not recorded. Internal function objects should not be
      8 // exposed via Debugger.
      9 
     10 var g = newGlobal({newCompartment: true});
     11 var dbg = new Debugger(g);
     12 
     13 dbg.onDebuggerStatement = function (frame) {
     14  var g_call_env = frame.older.environment;     // g's locals
     15  var g_decl_env = g_call_env.parent;           // 'function g' binding
     16  var f_call_env = g_decl_env.parent;           // f's locals
     17  var f_decl_env = f_call_env.parent;           // 'function f' binding
     18  assertEq(f_decl_env.getVariable('f').optimizedOut, true);
     19 }
     20 
     21 g.evaluate(`
     22 
     23           function h() { debugger; }
     24           (function f() {
     25             return function g() {
     26               h();
     27               return 1;
     28             }
     29           })()();
     30 
     31           `);