tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

Frame-eval-19.js (838B)

      1 // Eval-in-frame of optimized frames to break out of an infinite loop.
      2 
      3 load(libdir + "jitopts.js");
      4 
      5 if (!jitTogglesMatch(Opts_IonEagerNoOffthreadCompilation))
      6  quit(0);
      7 
      8 withJitOptions(Opts_IonEagerNoOffthreadCompilation, function () {
      9  var g = newGlobal({newCompartment: true});
     10  var dbg = new Debugger;
     11 
     12  g.eval("" + function f(d) { g(d); });
     13  g.eval("" + function g(d) { h(d); });
     14  g.eval("" + function h(d) {
     15    var i = 0;
     16    while (d)
     17      interruptIf(d && i++ == 4000);
     18  });
     19 
     20  setInterruptCallback(function () {
     21    dbg.addDebuggee(g);
     22    var frame = dbg.getNewestFrame();
     23    if (frame.callee.name != "h" || frame.implementation != "ion")
     24      return true;
     25    frame.eval("d = false;");
     26    return true;
     27  });
     28 
     29  g.eval("(" + function () {
     30    for (i = 0; i < 5; i++)
     31      f(false);
     32    f(true);
     33  } + ")();");
     34 });