tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

species-fuse-arraybuffer-1.js (785B)

      1 function test() {
      2  // Mutating ArrayBuffer.prototype.constructor pops the fuse. A no-op change is fine.
      3  newGlobal().evaluate(`
      4    assertEq(getFuseState().OptimizeArrayBufferSpeciesFuse.intact, true);
      5    let p = ArrayBuffer.prototype.constructor;
      6    ArrayBuffer.prototype.constructor = p;
      7    assertEq(getFuseState().OptimizeArrayBufferSpeciesFuse.intact, true);
      8    ArrayBuffer.prototype.constructor = Object;
      9    assertEq(getFuseState().OptimizeArrayBufferSpeciesFuse.intact, false);
     10  `);
     11 
     12  // Mutating ArrayBuffer[Symbol.species] pops the fuse.
     13  newGlobal().evaluate(`
     14    assertEq(getFuseState().OptimizeArrayBufferSpeciesFuse.intact, true);
     15    delete ArrayBuffer[Symbol.species];
     16    assertEq(getFuseState().OptimizeArrayBufferSpeciesFuse.intact, false);
     17  `);
     18 }
     19 test();