The Tor Browser: js/xpconnect/crashtests/453935-1.html@6474c204b198

Cloned upstream origin tor-browser at tor-browser-31.3.0esr-4.5-1-build1
revision ID fc1c9ff7c1b2defdbc039f12214767608f46423f for hacking purpose.

     1 <!DOCTYPE html>

     2 <html>

     3 <head>

     4 <script type="text/javascript">

     6 function boom()

7 {

     8   var a = [];

     9   a[31] = undefined;

    10   a[40] = undefined;

    11   a[44] = {};

    12   a[45] = new XMLHttpRequest();

    13   a[48] = new XMLHttpRequest();

    14   a[53] = XMLHttpRequest.prototype;

    15   a[53].__proto__ = {};

    16   a[53].nodeType = 100;

    17   search(a, 41);

    18 }

    21 function search(a, start)

    22 {

    23   var N = a.length;

    25   for (var j = start; j < N; ++j) {

    26     var e = a[j];

    27     if (typeof e == "object" && "nodeType" in e && e.nodeType == 99)

    28       return j;

    29   }

    31   return null;

    32 }

    34 </script>

    35 </head>

    36 <body onload="boom();"></body>

    37 </html>

The Tor Browser / file revision