blob: fc8ceba9c58ce48c48691882f9f71b383889caba (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
|
JSON.__proto__[1] = new Uint8ClampedArray().buffer
f = (function() {
function g(c) {
Object.freeze(c).__proto__ = c
}
for each(b in []) {
try {
g(b)
} catch (e) {}
}
})
f()
f()
|