FunctionCallBracketNode should store the base value to the temporary when subscript...
authorutatane.tea@gmail.com <utatane.tea@gmail.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 7 May 2015 22:35:56 +0000 (22:35 +0000)
committerutatane.tea@gmail.com <utatane.tea@gmail.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 7 May 2015 22:35:56 +0000 (22:35 +0000)
commitcd728c65fc694fa317c96350a5f34d88a1169820
tree0d7c00266a28e3897bc71beb7315fb2865151ea6
parent8fab1c175bfd891d0740bbf636918024170a8b4b
FunctionCallBracketNode should store the base value to the temporary when subscript has assignment
https://bugs.webkit.org/show_bug.cgi?id=144678

Reviewed by Geoffrey Garen.

Currently, FunctionCallBracketNode directly use the RegisterID returned by emitNode.
But if the base part is the local register and the subscript part has assignment to it, the base result is accidentally rewritten.

function t() { var ok = {null: function () { } }; ok[ok = null](); }
t();  // Should not throw error.

This patch takes care about `subscriptHasAssignment`.
By using `emitNodeForLeftHandSide`, when there's assignment to local variables in RHS,
it correctly moves the LHS value to a temporary register.

* bytecompiler/NodesCodegen.cpp:
(JSC::FunctionCallBracketNode::emitBytecode):
* parser/ASTBuilder.h:
(JSC::ASTBuilder::makeFunctionCallNode):
* parser/NodeConstructors.h:
(JSC::FunctionCallBracketNode::FunctionCallBracketNode):
* parser/Nodes.h:
* tests/stress/assignment-in-function-call-bracket-node.js: Added.
(shouldBe):
(shouldBe.):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@183955 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
Source/JavaScriptCore/parser/ASTBuilder.h
Source/JavaScriptCore/parser/NodeConstructors.h
Source/JavaScriptCore/parser/Nodes.h
Source/JavaScriptCore/tests/stress/assignment-in-function-call-bracket-node.js [new file with mode: 0644]