tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

cross-realm.js (1468B)


      1 // |jit-test|
      2 
      3 function f(x) {
      4    let [a, b, c] = x;
      5    return a + b + c;
      6 }
      7 
      8 function intact(name) {
      9    let state = getFuseState();
     10    if (!(name in state)) {
     11        throw "No such fuse " + name;
     12    }
     13    return state[name].intact
     14 }
     15 
     16 let didIt = false;
     17 ([])[Symbol.iterator]().__proto__['return'] = () => { didIt = true; return { done: true, value: undefined } };
     18 assertEq(intact("ArrayIteratorPrototypeHasNoReturnProperty"), false);
     19 
     20 assertEq(f([1, 2, 3, 0]), 6);
     21 assertEq(didIt, true);
     22 
     23 didIt = false;
     24 g = newGlobal();
     25 g.evaluate(f.toString());
     26 // Passing in an array from this realm should mean that the return is triggered.
     27 g.long = [1, 2, 3, 0];
     28 g.evaluate("assertEq(f(long),6)")
     29 g.evaluate(intact.toString());
     30 // ensure fuse isn't popped inside g.
     31 g.evaluate(`assertEq(intact("ArrayIteratorPrototypeHasNoReturnProperty"), true)`)
     32 assertEq(didIt, true);
     33 
     34 didIt = false;
     35 g = newGlobal();
     36 g.evaluate(f.toString());
     37 // Passing in an array from this realm should mean that the return is triggered.
     38 g.long = [1, 2, 3, 0];
     39 
     40 // Warm up this global's f.
     41 g.evaluate(`
     42 for (let i = 0; i < 100; i++) {
     43    assertEq(f([1, 2, 3, 0]), 6);
     44 }
     45 `);
     46 
     47 assertEq(didIt, false);
     48 g.evaluate("assertEq(f(long), 6)");
     49 assertEq(didIt, true);
     50 
     51 delete Array.prototype[Symbol.iterator]
     52 let success = false;
     53 try { f([1, 2, 3, 4]); success = true } catch (e) { }
     54 assertEq(success, false);
     55 
     56 try { g.evaluate("assertEq(f(long), 6)"); success = true } catch (e) { }
     57 assertEq(success, false);