The Tor Browser / file comparison
comparison: js/src/tests/js1_5/Regress/regress-366122.js
js/src/tests/js1_5/Regress/regress-366122.js
- branch
- TOR_BUG_3246
- changeset 7
- 129ffea94266
equal
deleted
inserted
replaced
| -1:000000000000 | 0:f5df8f294e64 |
|---|---|
| 1 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ | |
| 2 /* This Source Code Form is subject to the terms of the Mozilla Public | |
| 3 * License, v. 2.0. If a copy of the MPL was not distributed with this | |
| 4 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ | |
| 5 | |
| 6 //----------------------------------------------------------------------------- | |
| 7 var BUGNUMBER = 366122; | |
| 8 var summary = 'Compile large script'; | |
| 9 var actual = 'No Crash'; | |
| 10 var expect = 'No Crash'; | |
| 11 | |
| 12 | |
| 13 //----------------------------------------------------------------------------- | |
| 14 test(); | |
| 15 //----------------------------------------------------------------------------- | |
| 16 | |
| 17 function test() | |
| 18 { | |
| 19 enterFunc ('test'); | |
| 20 printBugNumber(BUGNUMBER); | |
| 21 printStatus (summary); | |
| 22 | |
| 23 function exploit() { | |
| 24 var code = "", obj = {}; | |
| 25 for(var i = 0; i < 0x10000; i++) { | |
| 26 if(i == 10242) { | |
| 27 code += "void 0x10000050505050;\n"; | |
| 28 } else { | |
| 29 code += "void 'x" + i + "';\n"; | |
| 30 } | |
| 31 } | |
| 32 code += "export undefined;\n"; | |
| 33 code += "void 125;\n"; | |
| 34 eval(code); | |
| 35 } | |
| 36 try | |
| 37 { | |
| 38 exploit(); | |
| 39 } | |
| 40 catch(ex) | |
| 41 { | |
| 42 } | |
| 43 reportCompare(expect, actual, summary); | |
| 44 | |
| 45 exitFunc ('test'); | |
| 46 } |
