tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

Frame-arguments-07.js (691B)

      1 // When argument[x] is assigned, where x > callee.length, frame.arguments reflects the change.
      2 
      3 var g = newGlobal({newCompartment: true});
      4 g.eval("function f(a, b) {\n" +
      5       "    for (var i = 0; i < arguments.length; i++)\n" +
      6       "        arguments[i] = i;\n" +
      7       "    eval(\"\");\n" +
      8       "    debugger;\n" +
      9       "}\n");
     10 
     11 var dbg = Debugger(g);
     12 var hits = 0;
     13 dbg.onDebuggerStatement = function (frame) {
     14    var argc = frame.eval("arguments.length").return;
     15    var args = frame.arguments;
     16    assertEq(args.length, argc);
     17    for (var i = 0; i < argc; i++)
     18        assertEq(args[i], i);
     19    hits++;
     20 }
     21 
     22 g.f(9);
     23 g.f(9, 9, 9, 9, 9, 9, 9, 9, 9, 9, 9, 9);
     24 assertEq(hits, 2);