Changeset 34373 in webkit for trunk/JavaScriptCore/kjs/nodes.cpp

Timestamp:

Jun 5, 2008, 2:19:48 AM (17 years ago)

Author:

[email protected]

Message:

2008-06-05 Cameron Zwarich <​[email protected]>

Reviewed by Maciej.

Bug 19400: subscript operator does not protect base when necessary
<​https://bugs.webkit.org/show_bug.cgi?id=19400>

Use a temporary for the base in BracketAccessorNode if the subscript
might possibly modify it.

JavaScriptCore:

• kjs/grammar.y:
• kjs/nodes.cpp: (KJS::BracketAccessorNode::emitCode):
• kjs/nodes.h: (KJS::BracketAccessorNode::):

LayoutTests:

• fast/js/codegen-temporaries-expected.txt:
• fast/js/resources/codegen-temporaries.js:

File:

• trunk/JavaScriptCore/kjs/nodes.cpp (modified) (1 diff)

trunk/JavaScriptCore/kjs/nodes.cpp

@@ -410 +410 @@
 RegisterID* BracketAccessorNode::emitCode(CodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> base = generator.emitNode(m_base.get());
+    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base.get(), m_subscriptHasAssignments);
     RegisterID* property = generator.emitNode(m_subscript.get());