tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

bad-regexp-data-clone.js (758B)

      1 // |reftest| skip-if(!xulRuntime.shell)
      2 // -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
      3 // Any copyright is dedicated to the Public Domain.
      4 // http://creativecommons.org/licenses/publicdomain/
      5 
      6 let data = new Uint8Array([
      7  104,97,108,101,6,0,255,255,95,98,
      8  0,0,0,0,0,104,97,108,101,9,0,255,
      9  255,95,98,115,0,0,0,0,0,0,65,0,0,
     10  0,0,0,0,0,0,0,0,0,0,0,0,0
     11 ]);
     12 let cloneBuffer = serialize(null);
     13 cloneBuffer.clonebuffer = data.buffer;
     14 
     15 // One of the bytes above encodes a JS::RegExpFlags, but that byte contains bits
     16 // outside of JS::RegExpFlag::AllFlags and so will trigger an error.
     17 assertThrowsInstanceOf(() => deserialize(cloneBuffer), InternalError);
     18 
     19 if (typeof reportCompare === "function")
     20  reportCompare(0, 0, 'ok');