tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

shape-guard-for-extensible-global-lex-env-3.js (2277B)


      1 this.a = 0;
      2 
      3 function f(y) {
      4  // Direct eval to make an extensible environment. Variables lookups within
      5  // nested environments are now dynamic.
      6  eval("");
      7 
      8  let w = y;
      9 
     10  // Function with NamedLambdaObject environment whose shape guard we want to omit.
     11  let g = function lambda() {
     12    // Eval to introduce a NamedLambdaObject environment.
     13    eval("");
     14 
     15    // BindName "a"                # ENV                                                                                                                                                                                         
     16    // Dup                         # ENV ENV                                                                                                                                                                                     
     17    // GetBoundName "a"            # ENV ENV.a                                                                                                                                                                                   
     18    // GetName "w"                 # ENV ENV.a w                                                                                                                                                                                 
     19    // Add                         # ENV (ENV.a += w)                                                                                                                                                                            
     20    // NopIsAssignOp               # ENV (ENV.a += w)                                                                                                                                                                            
     21    // SetName "a"                 # (ENV.a += w)                                                                                                                                                                                
     22    // Pop                         #
     23    a += w;
     24  };
     25 
     26  for (var i = 0; i < 150; ++i) {
     27    // Introduce a new binding in the global lexical environment which
     28    // shadows the global property "a".
     29    if (i === 100) {
     30      evaluate("let a = 1000");
     31    }
     32    g();
     33  }
     34 
     35  assertEq(a, 1050);
     36  assertEq(globalThis.a, 100);
     37 }
     38 f(1);