tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

property-mutation-1.js (649B)

      1 function test() {
      2  assertEq(getFuseState().ArrayPrototypeIteratorFuse.intact, true);
      3 
      4  // Re-assign Array.prototype properties but don't change the values.
      5  // This shouldn't pop the fuse.
      6  let proto = Array.prototype;
      7  for (let i = 0; i < 3; i++) {
      8    proto[Symbol.iterator] = proto[Symbol.iterator];
      9    for (let p of Reflect.ownKeys(proto)) {
     10      let v = proto[p];
     11      proto[p] = v;
     12    }
     13  }
     14  assertEq(getFuseState().ArrayPrototypeIteratorFuse.intact, true);
     15 
     16  // Now actually change the value. This pops the fuse.
     17  proto[Symbol.iterator] = proto.push;
     18  assertEq(getFuseState().ArrayPrototypeIteratorFuse.intact, false);
     19 }
     20 test();