tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

replacer-array-proxy-revoked-realm.js (1034B)


      1 // Copyright (C) 2019 Aleksey Shvayka. All rights reserved.
      2 // This code is governed by the BSD license found in the LICENSE file.
      3 /*---
      4 esid: sec-json.stringify
      5 description: >
      6  Revoked proxy of array as replacer produces a TypeError
      7  (honoring the realm of the current execution context).
      8 info: |
      9  JSON.stringify ( value [ , replacer [ , space ] ] )
     10 
     11  [...]
     12  4. If Type(replacer) is Object, then
     13     a. If IsCallable(replacer) is true, then
     14        i. Let ReplacerFunction be replacer.
     15     b. Else,
     16        i. Let isArray be ? IsArray(replacer).
     17 
     18  IsArray ( argument )
     19 
     20  [...]
     21  3. If argument is a Proxy exotic object, then
     22     a. If argument.[[ProxyHandler]] is null, throw a TypeError exception.
     23     b. Let target be argument.[[ProxyTarget]].
     24     c. Return ? IsArray(target).
     25 features: [cross-realm, Proxy]
     26 ---*/
     27 
     28 var OProxy = $262.createRealm().global.Proxy;
     29 var handle = OProxy.revocable([], {});
     30 
     31 handle.revoke();
     32 
     33 assert.throws(TypeError, function() {
     34  JSON.stringify({}, handle.proxy);
     35 });
     36 
     37 reportCompare(0, 0);