bug-1556155.js (174B)
1 a = []; 2 minorgc(); 3 Object.defineProperty(a, 12, {}).push(1); 4 toString = (function() { return a.reverse(); }); 5 oomTest(Date.prototype.toJSON); 6 oomTest(Date.prototype.toJSON);
tor-browserThe Tor Browser | |
| git clone https://git.dasho.dev/tor-browser.git | |
| Log | Files | Refs | README | LICENSE |