Changeset 127666 in webkit for trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp

Timestamp:

Sep 5, 2012, 5:55:46 PM (13 years ago)

Author:

[email protected]

Message:

Bug, assignment within subscript of prefix/postfix increment of bracket access
​https://bugs.webkit.org/show_bug.cgi?id=95913

Reviewed by Oliver Hunt.

Source/JavaScriptCore:

javascript:alert((function(){ var a = { x:1 }; var b = { x:1 }; a[a=b,"x"]++; return a.x; })())

• bytecompiler/NodesCodegen.cpp:

(JSC::PostfixNode::emitBracket):
(JSC::PrefixNode::emitBracket):

• Should check for assigments in the subscript when loading the base.

• parser/Nodes.h:

(JSC::BracketAccessorNode::subscriptHasAssignments):
(BracketAccessorNode):

• Used by emitBracket methods.

LayoutTests:

Added test cases.

• fast/js/inc-bracket-assign-subscript-expected.txt: Added.
• fast/js/inc-bracket-assign-subscript.html: Added.
• fast/js/script-tests/inc-bracket-assign-subscript.js: Added.

(testPreIncBracketAccessWithAssignSubscript):
(testPostIncBracketAccessWithAssignSubscript):

• Tests a pre/post increment to a bracket access, where subscript contains assignment.

File:

• trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp

@@ -657 +657 @@
     ExpressionNode* subscript = bracketAccessor->subscript();
 
-    RefPtr<RegisterID> base = generator.emitNode(baseNode);
+    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(baseNode, bracketAccessor->subscriptHasAssignments(), subscript->isPure(generator));
     RefPtr<RegisterID> property = generator.emitNode(subscript);
 
@@ -849 +849 @@
     ExpressionNode* subscript = bracketAccessor->subscript();
 
-    RefPtr<RegisterID> base = generator.emitNode(baseNode);
+    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(baseNode, bracketAccessor->subscriptHasAssignments(), subscript->isPure(generator));
     RefPtr<RegisterID> property = generator.emitNode(subscript);
     RefPtr<RegisterID> propDst = generator.tempDestination(dst);