Changeset 45904 in webkit for trunk/JavaScriptCore/parser

Timestamp:

Jul 15, 2009, 5:16:38 AM (16 years ago)

Author:

[email protected]

Message:

REGRESSION: fast/js/postfix-syntax.html fails with interpreter
​https://bugs.webkit.org/show_bug.cgi?id=27294

Reviewed by Simon Hausmann.

When postfix operators operating on locals assign to the same local
the order of operations has to be to store the incremented value, then
store the unmodified number. Rather than implementing this subtle
semantic in the interpreter I've just made the logic explicit in the
bytecode generator, so x=x++ effectively becomes x=ToNumber(x) (for a
local var x).

File:

• trunk/JavaScriptCore/parser/Nodes.cpp (modified) (1 diff)

trunk/JavaScriptCore/parser/Nodes.cpp

@@ -496 +496 @@
 static RegisterID* emitPostIncOrDec(BytecodeGenerator& generator, RegisterID* dst, RegisterID* srcDst, Operator oper)
 {
+    if (srcDst == dst)
+        return generator.emitToJSNumber(dst, srcDst);
     return (oper == OpPlusPlus) ? generator.emitPostInc(dst, srcDst) : generator.emitPostDec(dst, srcDst);
 }