tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

regress-290575.js (1391B)


      1 /* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
      2 /* This Source Code Form is subject to the terms of the Mozilla Public
      3 * License, v. 2.0. If a copy of the MPL was not distributed with this
      4 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
      5 
      6 //-----------------------------------------------------------------------------
      7 var BUGNUMBER = 290575;
      8 var summary = 'Do not crash calling function with more than 32768 arguments';
      9 var actual = 'No Crash';
     10 var expect = 'No Crash';
     11 printBugNumber(BUGNUMBER);
     12 printStatus (summary);
     13 
     14 function crashMe(n) {
     15  var nasty, fn;
     16 
     17  nasty = [];
     18  while (n--)
     19    nasty.push("a"+n);   // Function arguments
     20  nasty.push("void 0");  // Function body
     21  fn = Function.apply(null, nasty);
     22  fn.toString();
     23 }
     24 
     25 printStatus('crashMe(0x8001)');
     26 
     27 crashMe(0x8001);
     28 
     29 reportCompare(expect, actual, summary);
     30 
     31 function crashMe2(n) {
     32  var nasty = [], fn
     33 
     34    while (n--) nasty[n] = "a"+n
     35      fn = Function(nasty.join(), "void 0")
     36      fn.toString()
     37      }
     38 
     39 printStatus('crashMe2(0x10000)');
     40 
     41 summary = 'No Syntax Error Function to string when more than 65536 arguments';
     42 expect = 'Error';
     43 try
     44 {
     45  crashMe2(0x10000);
     46  actual = 'No Error';
     47  reportCompare(expect, actual, summary);
     48 }
     49 catch(e)
     50 {
     51  actual = 'Error';
     52  reportCompare(expect, actual, summary);
     53  expect = 'SyntaxError';
     54  actual = e.name;
     55  reportCompare(expect, actual, summary);
     56 }