The Tor Browser: js/src/tests/js1_5/extensions/regress-390597.js@129ffea94266

Conditionally enable double key logic according to:
private browsing mode or privacy.thirdparty.isolate preference and
implement in GetCookieStringCommon and FindCookie where it counts...
With some reservations of how to convince FindCookie users to test
condition and pass a nullptr when disabling double key logic.

     1 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */

     2 /* This Source Code Form is subject to the terms of the Mozilla Public

     3  * License, v. 2.0. If a copy of the MPL was not distributed with this

     4  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

     6 //-----------------------------------------------------------------------------

     7 var BUGNUMBER = 390597;

     8 var summary = 'watch point + eval-as-setter allows access to dead JSStackFrame';

     9 var actual = 'No Crash';

    10 var expect = 'No Crash';

    13 //-----------------------------------------------------------------------------

    14 test();

    15 //-----------------------------------------------------------------------------

    17 function test()

    18 {

    19   enterFunc ('test');

    20   printBugNumber(BUGNUMBER);

    21   printStatus (summary);

    23   function exploit() {

    24     try

    25     {

    26     var obj = this, args = null;

    27     obj.__defineSetter__("evil", eval);

    28     obj.watch("evil", function() { return "args = arguments;"; });

    29     obj.evil = null;

    30     eval("print(args[0]);");

    31     }

    32     catch(ex)

    33     {

    34       print('Caught ' + ex);

    35     }

    36   }

    37   exploit();

    39   reportCompare(expect, actual, summary);

    41   exitFunc ('test');

    42 }

The Tor Browser / file revision

js/src/tests/js1_5/extensions/regress-390597.js@129ffea94266

js/src/tests/js1_5/extensions/regress-390597.js