ladybird/Libraries/LibJS/Tests/regress/proxied-constructor-leads-to-use-after-free.js

test("Proxied constructor should handle argument_buffer reallocation during prototype get()", () => {
    function foo() {}

    let handler = {
        get() {
            // prettier-ignore
            foo(
                // make extra sure we trigger a reallocation
                0x41,  0x41,  0x41,  0x41,  0x41,  0x41,
                0x41,  0x41,  0x41,  0x41,  0x41,  0x41,
                0x41,  0x41,  0x41,  0x41,  0x41,  0x41,
                0x41,  0x41,  0x41,  0x41,  0x41,  0x41,
                0x41,  0x41,  0x41,  0x41,  0x41,  0x41,
                0x41,  0x41,  0x41,  0x41,  0x41,  0x41,
                0x41,  0x41,  0x41,  0x41,  0x41,  0x41,
                0x41,  0x41,  0x41,  0x41,  0x41,  0x41,
                0x41,  0x41,  0x41,  0x41,  0x41,  0x41,
                0x41,  0x41,  0x41,  0x41,  0x41,  0x41
            );

            return null;
        },
    };

    function Construct() {
        // later use dangling pointer
        console.log(arguments);
    }

    let ConstructProxy = new Proxy(Construct, handler);

    new ConstructProxy(0x1);
});