tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

fontfaceset-worker-fontface-crash.html (907B)


      1 <!doctype html>
      2 <html class="test-wait">
      3 <iframe id="frame" srcdoc=""></iframe>
      4 <script id="worker1" type="javascript/worker">
      5 self.onmessage = async function(e) {
      6  let a = new MessageEvent('message')
      7  for (let e = 0; e < 255; e++) {
      8    new Uint8ClampedArray(2048).fill(e)
      9  }
     10  try { self.dispatchEvent(a) } catch (e) {}
     11  let x = new FontFace('foo', 'x')
     12 }
     13 </script>
     14 <script>
     15 function tick() {
     16  return new Promise(r => {
     17    requestAnimationFrame(() => requestAnimationFrame(r));
     18  });
     19 }
     20 onload = async () => {
     21  let win = document.querySelector("#frame").contentWindow;
     22  const blob = new win.Blob([document.querySelector('#worker1').textContent], { type: "text/javascript" })
     23  let worker = new win.Worker(win.URL.createObjectURL(blob))
     24  worker.postMessage([], [])
     25  await tick();
     26  await tick();
     27  win.location.reload(true)
     28  await tick();
     29  document.documentElement.className = "";
     30 };
     31 </script>