mirror of
https://github.com/LadybirdBrowser/ladybird.git
synced 2025-06-08 05:27:14 +09:00
25e343464d
We cached the length identifier for GetLength, but not GetLengthWithThis. This caused an `has_value()` verification failure when accessing super.length. Found by Fuzzilli.
22 lines
345 B
JavaScript
22 lines
345 B
JavaScript
test("does not crash when accessing super.length", () => {
|
|
let result;
|
|
|
|
class A {
|
|
constructor() {}
|
|
|
|
get length() {
|
|
return 2;
|
|
}
|
|
}
|
|
|
|
class B extends A {
|
|
constructor() {
|
|
super();
|
|
result = super.length;
|
|
}
|
|
}
|
|
|
|
new B();
|
|
|
|
expect(result).toBe(2);
|
|
});
|