Aliaksandr Kalenik c3b0eabf18 LibJS: Capture PrototypeChainValidity before executing internal_get() ... - Capture PrototypeChainValidity before invoking `internal_get()`. A getter may mutate the prototype chain (e.g., delete itself). Capturing earlier ensures such mutations invalidate the cached entry and prevent stale GetById hits. - When caching, take PrototypeChainValidity from the base object (receiver), not from the prototype where the property was found. Otherwise, changes to an intermediate prototype between the base object and the cached prototype object go unnoticed, leading to incorrect cache hits.		2025-09-18 15:56:20 +02:00
..
add-property-with-the-same-from-getter-in-prototype.js	LibJS: Skip caching get_by_id() if object's shape is changed by a getter	2025-05-20 19:10:56 -04:00
allow-await-in-a-func-def-assigned-to-default-param.js
async-generator-function-set-completion-type.js	LibJS: Make SetCompletionType bytecode instruction actually set type	2025-04-05 15:00:05 +02:00
bogus-program-counter.js
function-bind-arguments.js	LibJS: Avoid redundant ExecutionContext allocation for bound functions	2025-05-07 13:20:41 +02:00
inline-caching.js	LibJS: Capture PrototypeChainValidity before executing internal_get()	2025-09-18 15:56:20 +02:00
proxied-constructor-leads-to-use-after-free.js	LibJS: Fix UAF in ECMAScriptFunctionObject::internal_construct	2025-03-19 10:31:00 +01:00
super-length-crash.js	LibJS: Cache length identifier for GetLengthWithThis	2025-04-07 14:40:48 +02:00
using-this-in-default-value-of-arrow-function-parameter.js	LibJS: Don't use presence of function params to identify function scope	2025-06-17 20:48:45 +02:00