tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

oomInArrayProtoTest.js (403B)

      1 function arrayProtoOutOfRange() {
      2    function f(obj) {
      3        return typeof obj[15];
      4    }
      5 
      6    function test() {
      7        var a = [1, 2];
      8        a.__proto__ = {15: 1337};
      9        var b = [1, 2, 3, 4];
     10 
     11        for (var i = 0; i < 200; i++) {
     12            var r = f(i % 2 ? a : b);
     13            assertEq(r, i % 2 ? "number" : "undefined");
     14        }
     15    }
     16 
     17    test();
     18 }
     19 
     20 oomTest(arrayProtoOutOfRange);