bug1497107.js (694B)
1 function makeChain(n, base) { 2 var curr = base; 3 for (var i = 0; i < n; i++) { 4 curr = Object.create(curr); 5 var propname = "level" + i; 6 curr[propname] = true; 7 } 8 return curr; 9 } 10 11 function BaseClass() { 12 this.base = true; 13 } 14 15 Object.defineProperty(BaseClass.prototype, "getter", {get: function() { with({}){}; return this.base; }}); 16 17 function victim(arg) { 18 if (arg.getter) { 19 return 3; 20 } else { 21 return 4; 22 } 23 } 24 25 let root = new BaseClass(); 26 let chains = []; 27 for (var i = 0; i < 6; i++) { 28 chains.push(makeChain(500, root)); 29 } 30 31 with({}){}; 32 for (var i = 0; i < 1000 / 6; i++) { 33 with({}){}; 34 for (var j = 0; j < chains.length; j++) { 35 victim(chains[j]); 36 } 37 }