Changeset 45904 in webkit for trunk/JavaScriptCore

Timestamp:

Jul 15, 2009, 5:16:38 AM (16 years ago)

Author:

[email protected]

Message:

REGRESSION: fast/js/postfix-syntax.html fails with interpreter
​https://bugs.webkit.org/show_bug.cgi?id=27294

Reviewed by Simon Hausmann.

When postfix operators operating on locals assign to the same local
the order of operations has to be to store the incremented value, then
store the unmodified number. Rather than implementing this subtle
semantic in the interpreter I've just made the logic explicit in the
bytecode generator, so x=x++ effectively becomes x=ToNumber(x) (for a
local var x).

Location:

trunk/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• parser/Nodes.cpp (modified) (1 diff)

trunk/JavaScriptCore/ChangeLog

@@ +1 @@
+2009-07-15  Oliver Hunt  <[email protected]>
+
+        Reviewed by Simon Hausmann.
+
+        REGRESSION: fast/js/postfix-syntax.html fails with interpreter
+        https://bugs.webkit.org/show_bug.cgi?id=27294
+
+        When postfix operators operating on locals assign to the same local
+        the order of operations has to be to store the incremented value, then
+        store the unmodified number.  Rather than implementing this subtle
+        semantic in the interpreter I've just made the logic explicit in the
+        bytecode generator, so x=x++ effectively becomes x=ToNumber(x) (for a
+        local var x).
+
+        * parser/Nodes.cpp:
+        (JSC::emitPostIncOrDec):
+
 2009-07-15  Oliver Hunt  <[email protected]>
 

trunk/JavaScriptCore/parser/Nodes.cpp

@@ -496 +496 @@
 static RegisterID* emitPostIncOrDec(BytecodeGenerator& generator, RegisterID* dst, RegisterID* srcDst, Operator oper)
 {
+    if (srcDst == dst)
+        return generator.emitToJSNumber(dst, srcDst);
     return (oper == OpPlusPlus) ? generator.emitPostInc(dst, srcDst) : generator.emitPostDec(dst, srcDst);
 }