Aliaksandr Kalenik 95e1ec4abc LibJS: Skip caching get_by_id() if object's shape is changed by a getter ... Fixes a bug that reproduces with the following steps: 1. Create an object with a getter for property "a" in its prototype, where the getter adds an "a" property to the object itself. 2. Call the "a" getter in a loop for the first time. This triggers caching of metadata indicating that the "a" property is located in the prototype chain. 3. Call the "a" getter in a loop for the second time. Oops, the cache says the getter is in the prototype chain, but the object now also has its own "a" property that was added by the first getter call.		2025-05-20 19:10:56 -04:00
..
add-property-with-the-same-from-getter-in-prototype.js	LibJS: Skip caching get_by_id() if object's shape is changed by a getter	2025-05-20 19:10:56 -04:00
allow-await-in-a-func-def-assigned-to-default-param.js
async-generator-function-set-completion-type.js	LibJS: Make SetCompletionType bytecode instruction actually set type	2025-04-05 15:00:05 +02:00
bogus-program-counter.js
function-bind-arguments.js	LibJS: Avoid redundant ExecutionContext allocation for bound functions	2025-05-07 13:20:41 +02:00
proxied-constructor-leads-to-use-after-free.js	LibJS: Fix UAF in ECMAScriptFunctionObject::internal_construct	2025-03-19 10:31:00 +01:00
super-length-crash.js	LibJS: Cache length identifier for GetLengthWithThis	2025-04-07 14:40:48 +02:00