tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

bug1789821.js (207B)

      1 function foo(x) {
      2  Math.max(...[x]);
      3 }
      4 
      5 with ({}) {}
      6 for (let i = 0; i < 100; i++) {
      7  foo(0);
      8 }
      9 
     10 let called = false;
     11 const evil = { valueOf: () => { called = true; } };
     12 foo(evil);
     13 
     14 assertEq(called, true);