bug1345160.js (175B)
1 function f() { 2 var o = [1, 2, 3]; 3 o.constructor = function() { 4 return new Uint8Array(3); 5 }; 6 for (var i=0; i<10; i++) 7 o.filter(x => true); 8 } 9 f();
tor-browserThe Tor Browser | |
| git clone https://git.dasho.dev/tor-browser.git | |
| Log | Files | Refs | README | LICENSE |