tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

ion-error-gc-fakeexitframe.js (2040B)

      1 var lfLogBuffer = `
      2 //corefuzz-dcd-endofdata
      3 for (var i = 0; gczeal(4,10); g(buffer))
      4  assertEq(assignParameterGetElement(42), 17);
      5 //corefuzz-dcd-endofdata
      6 //corefuzz-dcd-endofdata
      7 //corefuzz-dcd-endofdata
      8 g = newGlobal({newCompartment: true});
      9 g.parent = this
     10 g.eval("Debugger(parent).onExceptionUnwind=(function(){})")
     11 `;
     12 lfLogBuffer = lfLogBuffer.split('\n');
     13 
     14 gcPreserveCode();
     15 
     16 var letext =`(module
     17  (type $type0 (func (param i32 i64)))
     18  (type $type1 (func (param i32) (result i64)))
     19  (type $type2 (func (result i32)))
     20  (memory 1)
     21  (export "store" (func $func0))
     22  (export "load" (func $func1))
     23  (export "assert_0" (func $func2))
     24  (func $func0 (param $var0 i32) (param $var1 i64)
     25    local.get $var0
     26    local.get $var1
     27    i64.store16 offset=16
     28  )
     29  (func $func1 (param $var0 i32) (result i64)
     30    local.get $var0
     31    i64.load16_s offset=16
     32  )
     33  (func $func2 (result i32)
     34    i32.const 65519
     35    i64.const -32768
     36    call $func0
     37    i32.const 1
     38  )
     39  (data (i32.const 0)
     40    "\\00\\01\\02\\03\\04\\05\\06\\07\\08\\t\\n\\0b\\0c\\0d\\0e\\0f"
     41  )
     42  (data (i32.const 16)
     43    "\\f0\\f1\\f2\\f3\\f4\\f5\\f6\\f7\\f8\\f9\\fa\\fb\\fc\\fd\\fe\\ff"
     44  )
     45 )`;
     46 
     47 var binary = wasmTextToBinary(letext);
     48 var module = new WebAssembly.Module(binary);
     49 
     50 var lfCodeBuffer = "";
     51 while (true) {
     52    var line = lfLogBuffer.shift();
     53    if (line == null) {
     54        break;
     55    } else if (line == "//corefuzz-dcd-endofdata") {
     56        processCode(lfCodeBuffer);
     57    } else {
     58        lfCodeBuffer += line + "\n";
     59    }
     60 }
     61 
     62 if (lfCodeBuffer) processCode(lfCodeBuffer);
     63 
     64 function processCode(code) {
     65    evaluate(code);
     66    while (true) {
     67        imports = {}
     68        try {
     69            instance = new WebAssembly.Instance(module, imports);
     70            break;
     71        } catch (exc) {}
     72    }
     73    for (let descriptor of WebAssembly.Module.exports(module)) {
     74        switch (descriptor.kind) {
     75            case "function":
     76                try {
     77                    print(instance.exports[descriptor.name]())
     78                } catch (exc1) {}
     79        }
     80    }
     81 }