import of lcamtuf's tests from browser security handbook