Changeset 267440 in webkit for trunk/Source/JavaScriptCore/bytecompiler

Timestamp:

Sep 22, 2020, 3:23:08 PM (5 years ago)

Author:

[email protected]

Message:

Coerce computed property before adding to |excludedList|
​https://bugs.webkit.org/show_bug.cgi?id=216437

Patch by HyeockJin Kim <​[email protected]> on 2020-09-22
Reviewed by Yusuke Suzuki.

JSTests:

• stress/object-rest-deconstruct.js:

(get 3):

Source/JavaScriptCore:

• bytecompiler/NodesCodegen.cpp:

(JSC::ObjectPatternNode::bindValue const):

File:

• trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp

@@ -5234 +5234 @@
             if (m_containsRestElement) {
                 if (m_containsComputedProperty) {
-                    if (!target.propertyExpression)
+                    if (target.propertyExpression)
+                        generator.emitToPropertyKey(propertyName.get(), propertyName.get());
+                    else
                         propertyName = generator.emitLoad(nullptr, target.propertyName);