mirror of
https://repo.dactyloidae.xyz/Dactyloidae/UXP.git
synced 2026-11-01 03:57:30 +09:00
Improve graph edge resolution code.
This is a follow-up to ca7ecd37c94e268972697a37eec4e46771c6e6f2 further improving the DiD resolution for CVE-2018-12386.
This commit is contained in:
parent
56963761a3
commit
f592b614d0
4 changed files with 48 additions and 17 deletions
17
js/src/jit-test/tests/ion/bug1493900-1.js
Normal file
17
js/src/jit-test/tests/ion/bug1493900-1.js
Normal file
|
|
@ -0,0 +1,17 @@
|
|||
function f() {
|
||||
var objs = [];
|
||||
for (var i = 0; i < 100; i++) {
|
||||
objs[i] = {};
|
||||
}
|
||||
var o = objs[0];
|
||||
var a = new Float64Array(1024);
|
||||
function g(a, b) {
|
||||
let p = b;
|
||||
for (; p.x < 0; p = p.x) {
|
||||
while (p === p) {}
|
||||
}
|
||||
for (var i = 0; i < 10000; ++i) {}
|
||||
}
|
||||
g(a, o);
|
||||
}
|
||||
f();
|
||||
7
js/src/jit-test/tests/ion/bug1493900-2.js
Normal file
7
js/src/jit-test/tests/ion/bug1493900-2.js
Normal file
|
|
@ -0,0 +1,7 @@
|
|||
function f(a, b) {
|
||||
for (; b.x < 0; b = b.x) {
|
||||
while (b === b) {};
|
||||
}
|
||||
for (var i = 0; i < 99999; ++i) {}
|
||||
}
|
||||
f(0, 0);
|
||||
Loading…
Add table
Add a link
Reference in a new issue