Sat, 03 Jan 2015 20:18:00 +0100
Conditionally enable double key logic according to:
private browsing mode or privacy.thirdparty.isolate preference and
implement in GetCookieStringCommon and FindCookie where it counts...
With some reservations of how to convince FindCookie users to test
condition and pass a nullptr when disabling double key logic.
michael@0 | 1 | var a = [1,2,3,4,5]; |
michael@0 | 2 | |
michael@0 | 3 | // Basic overflow in hoisted condition. |
michael@0 | 4 | function foo(x, n) { |
michael@0 | 5 | var v = 0; |
michael@0 | 6 | for (var i = 0; i < n; i++) |
michael@0 | 7 | v += x[i]; |
michael@0 | 8 | return v; |
michael@0 | 9 | } |
michael@0 | 10 | for (var i = 0; i < 15; i++) |
michael@0 | 11 | assertEq(foo(a, 5), 15); |
michael@0 | 12 | assertEq(foo(a, 6), NaN); |
michael@0 | 13 | |
michael@0 | 14 | // Basic underflow in hoisted condition. |
michael@0 | 15 | function foo2(x, m, n) { |
michael@0 | 16 | var v = 0; |
michael@0 | 17 | for (var i = m; i < n; i++) |
michael@0 | 18 | v += x[i]; |
michael@0 | 19 | return v; |
michael@0 | 20 | } |
michael@0 | 21 | for (var i = 0; i < 15; i++) |
michael@0 | 22 | assertEq(foo2(a, 0, 5), 15); |
michael@0 | 23 | assertEq(foo2(a, -1, 5), NaN); |
michael@0 | 24 | |
michael@0 | 25 | // Overflow when hoisting consolidated condition. |
michael@0 | 26 | function foo3(x, m, n) { |
michael@0 | 27 | var v = 0; |
michael@0 | 28 | for (var i = m; i < n; i++) |
michael@0 | 29 | v += x[i] + x[i + 1] + x[i + 2]; |
michael@0 | 30 | return v; |
michael@0 | 31 | } |
michael@0 | 32 | for (var i = 0; i < 15; i++) |
michael@0 | 33 | assertEq(foo3(a, 0, 3), 27); |
michael@0 | 34 | assertEq(foo3(a, 0, 4), NaN); |
michael@0 | 35 | |
michael@0 | 36 | // Underflow when hoisting consolidated condition. |
michael@0 | 37 | function foo4(x, m, n) { |
michael@0 | 38 | var v = 0; |
michael@0 | 39 | for (var i = m; i < n; i++) |
michael@0 | 40 | v += x[i] + x[i - 1] + x[i - 2]; |
michael@0 | 41 | return v; |
michael@0 | 42 | } |
michael@0 | 43 | for (var i = 0; i < 15; i++) |
michael@0 | 44 | assertEq(foo4(a, 2, 5), 27); |
michael@0 | 45 | assertEq(foo4(a, 0, 5), NaN); |
michael@0 | 46 | |
michael@0 | 47 | // Underflow due to decreasing index. |
michael@0 | 48 | function foo5(x, n) { |
michael@0 | 49 | var v = 0; |
michael@0 | 50 | for (var i = 0; i < n; i++) { |
michael@0 | 51 | v += x[i]; |
michael@0 | 52 | if (n == 4) |
michael@0 | 53 | i -= 2; |
michael@0 | 54 | if (i == -5) |
michael@0 | 55 | break; |
michael@0 | 56 | } |
michael@0 | 57 | return v; |
michael@0 | 58 | } |
michael@0 | 59 | for (var i = 0; i < 15; i++) |
michael@0 | 60 | assertEq(foo5(a, 5), 15); |
michael@0 | 61 | assertEq(foo5(a, 4), NaN); |
michael@0 | 62 | |
michael@0 | 63 | // Overflow after access at constant offset. |
michael@0 | 64 | function foo6(x, m, n) { |
michael@0 | 65 | var v = 0; |
michael@0 | 66 | for (var i = m; i < n; i++) |
michael@0 | 67 | v += x[i + 10]; |
michael@0 | 68 | return v; |
michael@0 | 69 | } |
michael@0 | 70 | for (var i = 0; i < 15; i++) |
michael@0 | 71 | assertEq(foo6(a, -10, -5), 15); |
michael@0 | 72 | assertEq(foo6(a, -10, -4), NaN); |
michael@0 | 73 | |
michael@0 | 74 | // Underflow after access at constant offset. |
michael@0 | 75 | function foo7(x, m, n) { |
michael@0 | 76 | var v = 0; |
michael@0 | 77 | for (var i = m; i < n; i++) |
michael@0 | 78 | v += x[i + 10]; |
michael@0 | 79 | return v; |
michael@0 | 80 | } |
michael@0 | 81 | for (var i = 0; i < 15; i++) |
michael@0 | 82 | assertEq(foo7(a, -10, -5), 15); |
michael@0 | 83 | assertEq(foo7(a, -11, -5), NaN); |