Linus Groh a5bf6cfff9 LibJS: Don't change offset when reconfiguring property in unique shape ... When changing the attributes of an existing property of an object with unique shape we must not change the PropertyMetadata offset. Doing so without resizing the underlying storage vector caused an OOB write crash. Fixes #3735.		2020-10-10 23:25:00 +02:00
..
builtins	LibJS: Don't change offset when reconfiguring property in unique shape	2020-10-10 23:25:00 +02:00
classes
functions
iterators
loops
operators
add-values-to-primitive.js
automatic-semicolon-insertion.js
break-continue-syntax-errors.js
comments-basic.js
computed-property-throws.js
const-reassignment.js
custom-@@hasInstance.js
custom-@@toStringTag.js
debugger-statement.js
empty-statements.js
exception-in-catch-block.js
exception-ReferenceError.js
exponentiation-basic.js
indexed-access-string-object.js
invalid-lhs-in-assignment.js
labels.js
let-scoping.js
new-expression.js
numeric-literals-basic.js
object-basic.js
object-expression-computed-property.js
object-getter-setter-shorthand.js
object-method-shorthand.js
object-spread.js
parser-unary-associativity.js
program-strict-mode.js
return.js
strict-mode-blocks.js
strict-mode-errors.js
string-escapes.js
string-spread.js
switch-basic.js
switch-break.js
tagged-template-literals.js
template-literals.js
test-common-tests.js
test-common.js
throw-basic.js
to-number-basic.js
to-number-exception.js
try-catch-finally-nested.js
try-catch-finally.js
update-expression-on-member-expression.js
update-expressions-basic.js
var-multiple-declarator.js
var-scoping.js
variable-undefined.js