regress-390598.js - mozsearch

Enable keyboard shortcuts

/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */

/* This Source Code Form is subject to the terms of the Mozilla Public

 * License, v. 2.0. If a copy of the MPL was not distributed with this

 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

//-----------------------------------------------------------------------------

var BUGNUMBER = 390598;

var summary = 'array_length_setter is exploitable';

var actual = 'No Crash';

var expect = 'No Crash';

//-----------------------------------------------------------------------------

test();

//-----------------------------------------------------------------------------

function test()

  printBugNumber(BUGNUMBER);

  printStatus (summary);

  function exploit() {

    var fun = function () {};

    fun.__proto__ = [];

    fun.length = 0x50505050 >> 1;

    fun();

  exploit();

  reportCompare(expect, actual, summary);