tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

bug800179.js (458B)

      1 // |jit-test| error: TypeError
      2 
      3 try {
      4    x = []
      5    y = function() {}
      6    t = Uint8ClampedArray
      7    Object.defineProperty(x, 1, {
      8        get: (function() {
      9            for (v of t) {}
     10        })
     11    })
     12    Object.defineProperty(x, 8, {
     13        configurable: t
     14    }).reverse()
     15 } catch (e) {}
     16 Object.defineProperty([], 1, {
     17    configurable: true,
     18    get: (function() {
     19        for (j = 0; j < 50; ++j) {
     20            y()
     21        }
     22    })
     23 }).pop()
     24 x.map(y)