mirror of
https://github.com/LadybirdBrowser/ladybird.git
synced 2025-10-17 13:39:25 +00:00
c3b0eabf18
- Capture PrototypeChainValidity before invoking `internal_get()`. A getter may mutate the prototype chain (e.g., delete itself). Capturing earlier ensures such mutations invalidate the cached entry and prevent stale GetById hits. - When caching, take PrototypeChainValidity from the base object (receiver), not from the prototype where the property was found. Otherwise, changes to an intermediate prototype between the base object and the cached prototype object go unnoticed, leading to incorrect cache hits.
34 lines
804 B
JavaScript
34 lines
804 B
JavaScript
test("Accessor removal during getter execution should bust GetById cache", () => {
|
|
function f(obj, expected) {
|
|
expect(obj.hm).toBe(expected);
|
|
}
|
|
|
|
const proto = {
|
|
get hm() {
|
|
delete proto.hm;
|
|
return 123;
|
|
},
|
|
};
|
|
const obj = Object.create(proto);
|
|
|
|
f(obj, 123);
|
|
f(obj, undefined);
|
|
});
|
|
|
|
test("Overriding an inherited getter with a data property on an intermediate prototype invalidates prototype-chain cache", () => {
|
|
function f(obj, expected) {
|
|
expect(obj.hm).toBe(expected);
|
|
}
|
|
|
|
const proto = {};
|
|
proto.__proto__ = {
|
|
get hm() {
|
|
return 123;
|
|
},
|
|
};
|
|
const obj = Object.create(proto);
|
|
|
|
f(obj, 123);
|
|
Object.defineProperty(proto, "hm", { value: 321 });
|
|
f(obj, 321);
|
|
});
|