1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
|
// Second testPropagatedFunArgs test -- this is a crash-test.
(function () {
var escapee;
function testPropagatedFunArgs()
{
const magic = 42;
var win = this;
var res = [], q = [];
function addEventListener(name, func, flag) {
q.push(func);
}
var pageInfo = "pageInfo", obs;
addEventListener("load", handleLoad, true);
var observer = {
observe: function(win, topic, data) {
// obs.removeObserver(observer, "page-info-dialog-loaded");
handlePageInfo();
}
};
function handleLoad() {
//pageInfo = { toString: function() { return "pageInfo"; } };
obs = { addObserver: function (obs, topic, data) { obs.observe(win, topic, data); } };
obs.addObserver(observer, "page-info-dialog-loaded", false);
}
function handlePageInfo() {
res.push(pageInfo);
function $(aId) {
function notSafe() {
return magic;
}
notSafe();
res.push(pageInfo);
};
var feedTab = $("feedTab");
}
escapee = q[0];
return res.join(',');
}
testPropagatedFunArgs();
escapee();
})();
function testStringLengthNoTinyId()
{
var x = "unset";
var t = new String("");
for (var i = 0; i < 5; i++)
x = t["-1"];
var r = "t['-1'] is " + x;
t["-1"] = "foo";
r += " when unset, '" + t["-1"] + "' when set";
return r;
}
assertEq(testStringLengthNoTinyId(), "t['-1'] is undefined when unset, 'foo' when set");
|
