tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

array-push-length-overflow.js (308B)

      1 function maybeSetLength(arr, b) {
      2    with(this) {};
      3    if (b)
      4        arr.length = 0x7fffffff;
      5 }
      6 function test() {
      7    var arr = [];
      8    for (var i=0; i<2000; i++) {
      9        maybeSetLength(arr, i > 1500);
     10        var res = arr.push(2);
     11        assertEq(res, i > 1500 ? 0x80000000 : i + 1);
     12    }
     13 }
     14 test();