tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

species-fuse-sharedarraybuffer-1.js (851B)

      1 function test() {
      2  // Mutating SharedArrayBuffer.prototype.constructor pops the fuse. A no-op change is fine.
      3  newGlobal().evaluate(`
      4    assertEq(getFuseState().OptimizeSharedArrayBufferSpeciesFuse.intact, true);
      5    let p = SharedArrayBuffer.prototype.constructor;
      6    SharedArrayBuffer.prototype.constructor = p;
      7    assertEq(getFuseState().OptimizeSharedArrayBufferSpeciesFuse.intact, true);
      8    SharedArrayBuffer.prototype.constructor = Object;
      9    assertEq(getFuseState().OptimizeSharedArrayBufferSpeciesFuse.intact, false);
     10  `);
     11 
     12  // Mutating SharedArrayBuffer[Symbol.species] pops the fuse.
     13  newGlobal().evaluate(`
     14    assertEq(getFuseState().OptimizeSharedArrayBufferSpeciesFuse.intact, true);
     15    delete SharedArrayBuffer[Symbol.species];
     16    assertEq(getFuseState().OptimizeSharedArrayBufferSpeciesFuse.intact, false);
     17  `);
     18 }
     19 test();