tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

shape-guard-for-extensible-global-lex-env-1.js (1063B)


      1 this.a = 0;
      2 
      3 function f(y) {
      4  // Direct eval to make an extensible environment. Variables lookups within
      5  // nested environments are now dynamic.
      6  eval("");
      7 
      8  {
      9    // Block lexical environment whose shape guard we want to omit.
     10    let w = y;
     11 
     12    function g() {
     13      // BindName "a"                # ENV
     14      // Dup                         # ENV ENV
     15      // GetBoundName "a"            # ENV ENV.a
     16      // GetAliasedVar "w" (hops = 0, slot = 2) # ENV ENV.a w
     17      // CheckAliasedLexical "w" (hops = 0, slot = 2) # ENV ENV.a w
     18      // Add                         # ENV (ENV.a += w)
     19      // NopIsAssignOp               # ENV (ENV.a += w)
     20      // SetName "a"                 # (ENV.a += w)
     21      // Pop                         #
     22      a += w;
     23    }
     24 
     25    for (var i = 0; i < 150; ++i) {
     26      // Introduce a new binding in the global lexical environment which
     27      // shadows the global property "a".
     28      if (i === 100) {
     29        evaluate("let a = 1000");
     30      }
     31      g();
     32    }
     33 
     34    assertEq(a, 1050);
     35    assertEq(globalThis.a, 100);
     36  }
     37 }
     38 f(1);