Aliaksandr Kalenik c3b0eabf18 LibJS: Capture PrototypeChainValidity before executing internal_get() ...

- Capture PrototypeChainValidity before invoking `internal_get()`. A
  getter may mutate the prototype chain (e.g., delete itself). Capturing
  earlier ensures such mutations invalidate the cached entry and prevent
  stale GetById hits.
- When caching, take PrototypeChainValidity from the base object
  (receiver), not from the prototype where the property was found.
  Otherwise, changes to an intermediate prototype between the base
  object and the cached prototype object go unnoticed, leading to
  incorrect cache hits.

2025-09-18 15:56:20 +02:00

186 KiB

Raw Blame History

View Raw