tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

nuking.js (1237B)


      1 // Ensure nuking happens on a single target realm instead of compartment.
      2 
      3 var g1 = newGlobal({newCompartment: true});
      4 var g2 = newGlobal({sameCompartmentAs: g1});
      5 g2.other = g1;
      6 
      7 var o1 = g1.Math;
      8 var o2 = g2.Math;
      9 
     10 g1.nukeAllCCWs();
     11 
     12 // o1 is now dead.
     13 ex = null;
     14 try {
     15    assertEq(o1.abs(1), 1);
     16 } catch (e) {
     17    ex = e;
     18 }
     19 assertEq(ex.toString().includes("dead object"), true);
     20 
     21 // o2 still works.
     22 assertEq(o2.abs(1), 1);
     23 
     24 // g2 can still access g1 because they're same-compartment.
     25 assertEq(g2.evaluate("other.Math.abs(-2)"), 2);
     26 
     27 // Attempting to create a new wrapper targeting nuked realm g1 should return a
     28 // dead wrapper now. Note that we can't use g1 directly because that's now a
     29 // dead object, so we try to get to g1 via g2.
     30 ex = null;
     31 try {
     32    g2.other.toString();
     33 } catch (e) {
     34    ex = e;
     35 }
     36 assertEq(ex.toString().includes("dead object"), true);
     37 
     38 // Nuke g2 too. We have nuked all realms in its compartment so we should now
     39 // throw if we try to create a new outgoing wrapper.
     40 g2.evaluate("(" + function() {
     41    nukeAllCCWs();
     42    var ex = null;
     43    try {
     44        newGlobal({newCompartment: true}).Array();
     45    } catch (e) {
     46        ex = e;
     47    }
     48    assertEq(ex.toString().includes('dead object'), true);
     49 } + ")()");