tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

bug706692.js (425B)

      1 // |jit-test| error: TypeError
      2 
      3 // Bailout from a stack with multiple ion frames of different flavors.
      4 function f(obj,b,c) {
      5 return obj(); // Throw error.
      6 }
      7 
      8 function g(f,obj) {
      9 return f(obj); // Call f() with insufficient arguments, generating a RectifierFrame.
     10 }
     11 
     12 function h(f, g, obj) {
     13 return g(f, obj); // EntryFrame. Generate a JSFrame.
     14 }
     15 
     16 f(); // Prime f().
     17 g(); // Prime g().
     18 var obj = new Object();
     19 
     20 h(f,g,obj);