argument before crash
counts the number of arguments you can apply to a function
JavaScript
Array.prototype.pushBlock = function(value, count) {
while(count--)
{
this.push(value);
}
}
function test()
{
return false;
}
var broke = false;
var arr = [];
while (!broke)
{
arr.pushBlock(0x20, 256);
try
{
test.apply(window, arr);
}
catch (e) { broke = true; }
}
while (broke)
{
arr.pop();
try
{
broke = test.apply(window, arr);
}
catch (e) {}
}
alert(arr.length);