tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

clone-sab.js (881B)

      1 // |reftest| skip-if(!xulRuntime.shell)
      2 /* -*- Mode: js2; tab-width: 40; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
      3 /*
      4 * Any copyright is dedicated to the Public Domain.
      5 * https://creativecommons.org/publicdomain/zero/1.0/
      6 */
      7 
      8 // Deserialize a serialization buffer containing a reference to a
      9 // SharedArrayBuffer buffer object enough times and we will crash because of a
     10 // reference counting bug.
     11 
     12 if (!this.SharedArrayBuffer) {
     13    reportCompare(true,true);
     14    quit(0);
     15 }
     16 
     17 let x = new SharedArrayBuffer(1);
     18 let y = serialize(x, [], {SharedArrayBuffer: 'allow'});
     19 x = null;
     20 
     21 // If the bug is present this loop usually crashes quickly during
     22 // deserialization because the memory has become unmapped.
     23 
     24 for (let i=0 ; i < 50 ; i++ ) {
     25    let obj = deserialize(y, {SharedArrayBuffer: 'allow'});
     26    let z = new Int8Array(obj);
     27    z[0] = 0;
     28 }
     29 
     30 reportCompare(true, true);