Sign in
webkit
/
WebKit
/
f4126aaf4746a8f8af8c9b0d292a75a3563b2348
/
.
/
JSTests
/
stress
/
toctou-having-a-bad-time-new-array.js
blob: f1f4059c7be4ee38c1f4c3b377d8f2ebae20d438 [
file
] [
log
] [
blame
]
//@ skip if $buildType == "debug"
let code
=
`
function
foo
()
{
return
[
Date
.
prototype
];
}
for
(
let i
=
0
;
i
<
50
;
++
i
)
{
foo
();
}
let
[
proto
]
=
foo
();
Object
.
defineProperty
(
proto
,
'0'
,
{});
`;
for
(
let i
=
0
;
i
<
2000
;
i
++)
{
runString
(
code
);
}