bug784385.js (215B)
1 Object.defineProperty(Object.prototype, "a", { 2 set: function(a) { eval(""); return 123; } 3 }); 4 var obj = {}; 5 var obj2 = {x: 1}; 6 for (var i = 0; i < 100; i++) { 7 var res = (obj.a = obj2); 8 res.x = 0xbeef; 9 }
tor-browserThe Tor Browser | |
| git clone https://git.dasho.dev/tor-browser.git | |
| Log | Files | Refs | README | LICENSE |