tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

depended-on-bit-1.js (1221B)


      1 var dependedOnStrings = [];
      2 
      3 var length = 50;
      4 
      5 function getSubstr(src, i) {
      6  return src.substring(i, i + 50);
      7 }
      8 
      9 function checkProp(o, prop) {
     10  return o[prop];
     11 }
     12 
     13 var substrs = [];
     14 var objs = [];
     15 
     16 with({})
     17 for (var i = 0; i < 1000; i++) {
     18  var pieces = [];
     19  for (var j = 0; j < 99; j++) {
     20    pieces.push("a");
     21    pieces.push(Math.floor(Math.random() * 10));
     22  }
     23  dependedOnStrings.push(pieces.join(""));
     24 }
     25 
     26 for (var i = 0; i < 1000; i++) {
     27  // Create a bunch of substrings depending on strings in dependedOnStrings
     28  substrs.push(getSubstr(dependedOnStrings[i], (i * 2) % 50));
     29  objs.push({});
     30 }
     31 
     32 for (var i = 0; i < 1000; i++) {
     33  // Use the depended on strings as keys to get them replaced with
     34  // JSAtomRefStrings
     35  checkProp(objs[i], dependedOnStrings[i]);
     36 }
     37 
     38 // Use a bunch of memory to try to ensure that we overwrite the buffers
     39 // that could have erroneously been freed
     40 for (var i = 0; i < 1000; i++) {
     41  var pieces = [];
     42  for (var j = 0; j < 99; j++) {
     43    pieces.push("b");
     44    pieces.push(Math.floor(Math.random() * 10));
     45  }
     46  dependedOnStrings.push(pieces.join(""));
     47 }
     48 
     49 // Ensure the buffers were not in fact freed
     50 for (var i = 0; i < 1000; i++) {
     51  assertEq(substrs[i].startsWith("a"), true);
     52 }