mirror of
https://github.com/LadybirdBrowser/ladybird.git
synced 2025-06-08 05:27:14 +09:00
95e1ec4abc
Fixes a bug that reproduces with the following steps: 1. Create an object with a getter for property "a" in its prototype, where the getter adds an "a" property to the object itself. 2. Call the "a" getter in a loop for the first time. This triggers caching of metadata indicating that the "a" property is located in the prototype chain. 3. Call the "a" getter in a loop for the second time. Oops, the cache says the getter is in the prototype chain, but the object now also has its own "a" property that was added by the first getter call. |
||
|---|---|---|
| .. | ||
| add-property-with-the-same-from-getter-in-prototype.js | ||
| allow-await-in-a-func-def-assigned-to-default-param.js | ||
| async-generator-function-set-completion-type.js | ||
| bogus-program-counter.js | ||
| function-bind-arguments.js | ||
| proxied-constructor-leads-to-use-after-free.js | ||
| super-length-crash.js | ||