tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

bug1791968.js (720B)


      1 function opaqueThrow() { with ({}) {} throw 3; }
      2 
      3 function* foo(n) {
      4  try {
      5    // Get into the catch block.
      6    opaqueThrow();
      7  } catch(v12) {
      8    // Yield a value.
      9    yield 1;
     10  } finally {
     11    // OSR into Warp with JS_GENERATOR_CLOSING
     12    // as the pushed exception.
     13    for (let i = 0; i < 100; i++) { }
     14 
     15    // Create an RPow.
     16    var x = Math.pow(1,n);
     17 
     18    // When the finally block terminates, we re-throw
     19    // JS_GENERATOR_CLOSING, and rematerialize the frame
     20    // for HandleClosingGeneratorReturn, triggering
     21    // recovery of the RPow.
     22  }
     23 }
     24 
     25 for (let i = 0; i < 30; i++) {
     26  let gen = foo(1);
     27 
     28  // Advance to the yield in the catch block.
     29  gen.next();
     30 
     31  // Close the generator.
     32  gen.return();
     33 }