2008-06-05 Cameron Zwarich <cwzwarich@uwaterloo.ca>

2008-06-05  Cameron Zwarich  <cwzwarich@uwaterloo.ca>

        Reviewed by Maciej.

        Bug 19400: subscript operator does not protect base when necessary
        <https://bugs.webkit.org/show_bug.cgi?id=19400>

        Use a temporary for the base in BracketAccessorNode if the subscript
        might possibly modify it.

        JavaScriptCore:

        * kjs/grammar.y:
        * kjs/nodes.cpp:
        (KJS::BracketAccessorNode::emitCode):
        * kjs/nodes.h:
        (KJS::BracketAccessorNode::):

        LayoutTests:

        * fast/js/codegen-temporaries-expected.txt:
        * fast/js/resources/codegen-temporaries.js:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34373 268f45cc-cd09-0410-ab3c-d52691b4dbfc