tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

bug1353356.js (1742B)

      1 // |jit-test| allow-oom; --fuzzing-safe
      2 
      3 var lfLogBuffer = `
      4 //corefuzz-dcd-endofdata
      5 //corefuzz-dcd-endofdata
      6 //corefuzz-dcd-endofdata
      7    setJitCompilerOption("ion.warmup.trigger", 4);
      8    var g = newGlobal();
      9    g.debuggeeGlobal = this;
     10    g.eval("(" + function () {
     11        dbg = new Debugger(debuggeeGlobal);
     12        dbg.onExceptionUnwind = function (frame, exc) {
     13            var s = '!';
     14            for (var f = frame; f; f = f.older)
     15            debuggeeGlobal.log += s;
     16        };
     17    } + ")();");
     18      j('Number.prototype.toString.call([])');
     19 //corefuzz-dcd-endofdata
     20 //corefuzz-dcd-endofdata
     21 //corefuzz-dcd-endofdata
     22 //corefuzz-dcd-selectmode 4
     23 //corefuzz-dcd-endofdata
     24 }
     25 //corefuzz-dcd-endofdata
     26 //corefuzz-dcd-selectmode 5
     27 //corefuzz-dcd-endofdata
     28 oomTest(() => i({
     29    new  : (true  ),
     30    thisprops: true
     31 }));
     32 `;
     33 lfLogBuffer = lfLogBuffer.split('\n');
     34 var lfRunTypeId = -1;
     35 var lfCodeBuffer = "";
     36 while (true) {
     37    var line = lfLogBuffer.shift();
     38    if (line == null) {
     39        break;
     40    } else if (line == "//corefuzz-dcd-endofdata") {
     41        loadFile(lfCodeBuffer);
     42        lfCodeBuffer = "";
     43        loadFile(line);
     44    } else {
     45        lfCodeBuffer += line + "\n";
     46    }
     47 }
     48 if (lfCodeBuffer) loadFile(lfCodeBuffer);
     49 function loadFile(lfVarx) {
     50    try {
     51        if (lfVarx.indexOf("//corefuzz-dcd-selectmode ") === 0) {
     52            lfRunTypeId = parseInt(lfVarx.split(" ")[1]) % 6;
     53        } else {
     54            switch (lfRunTypeId) {
     55                case 4:
     56                    oomTest(function() {
     57                        let m = parseModule(lfVarx);
     58                    });
     59                    break;
     60                default:
     61                    evaluate(lfVarx);
     62            }
     63        }
     64    } catch (lfVare) {}
     65 }