tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

getelem-bounds-hoist.js (1760B)

      1 var a = [1,2,3,4,5];
      2 
      3 // Basic overflow in hoisted condition.
      4 function foo(x, n) {
      5  var v = 0;
      6  for (var i = 0; i < n; i++)
      7    v += x[i];
      8  return v;
      9 }
     10 for (var i = 0; i < 15; i++)
     11  assertEq(foo(a, 5), 15);
     12 assertEq(foo(a, 6), NaN);
     13 
     14 // Basic underflow in hoisted condition.
     15 function foo2(x, m, n) {
     16  var v = 0;
     17  for (var i = m; i < n; i++)
     18    v += x[i];
     19  return v;
     20 }
     21 for (var i = 0; i < 15; i++)
     22  assertEq(foo2(a, 0, 5), 15);
     23 assertEq(foo2(a, -1, 5), NaN);
     24 
     25 // Overflow when hoisting consolidated condition.
     26 function foo3(x, m, n) {
     27  var v = 0;
     28  for (var i = m; i < n; i++)
     29    v += x[i] + x[i + 1] + x[i + 2];
     30  return v;
     31 }
     32 for (var i = 0; i < 15; i++)
     33  assertEq(foo3(a, 0, 3), 27);
     34 assertEq(foo3(a, 0, 4), NaN);
     35 
     36 // Underflow when hoisting consolidated condition.
     37 function foo4(x, m, n) {
     38  var v = 0;
     39  for (var i = m; i < n; i++)
     40    v += x[i] + x[i - 1] + x[i - 2];
     41  return v;
     42 }
     43 for (var i = 0; i < 15; i++)
     44  assertEq(foo4(a, 2, 5), 27);
     45 assertEq(foo4(a, 0, 5), NaN);
     46 
     47 // Underflow due to decreasing index.
     48 function foo5(x, n) {
     49  var v = 0;
     50  for (var i = 0; i < n; i++) {
     51    v += x[i];
     52    if (n == 4)
     53      i -= 2;
     54    if (i == -5)
     55      break;
     56  }
     57  return v;
     58 }
     59 for (var i = 0; i < 15; i++)
     60  assertEq(foo5(a, 5), 15);
     61 assertEq(foo5(a, 4), NaN);
     62 
     63 // Overflow after access at constant offset.
     64 function foo6(x, m, n) {
     65  var v = 0;
     66  for (var i = m; i < n; i++)
     67    v += x[i + 10];
     68  return v;
     69 }
     70 for (var i = 0; i < 15; i++)
     71  assertEq(foo6(a, -10, -5), 15);
     72 assertEq(foo6(a, -10, -4), NaN);
     73 
     74 // Underflow after access at constant offset.
     75 function foo7(x, m, n) {
     76  var v = 0;
     77  for (var i = m; i < n; i++)
     78    v += x[i + 10];
     79  return v;
     80 }
     81 for (var i = 0; i < 15; i++)
     82  assertEq(foo7(a, -10, -5), 15);
     83 assertEq(foo7(a, -11, -5), NaN);