2008-06-05 Cameron Zwarich <cwzwarich@uwaterloo.ca>
authorcwzwarich@webkit.org <cwzwarich@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 5 Jun 2008 09:19:48 +0000 (09:19 +0000)
committercwzwarich@webkit.org <cwzwarich@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 5 Jun 2008 09:19:48 +0000 (09:19 +0000)
commitbe8e909afecff9953a269bffb60098140feeed1a
tree3c5ce4c73a6fd644f7dd1efcc387ba97f427dee4
parent698d84515a6ac1e2965d5487650705cb7c526af3
2008-06-05  Cameron Zwarich  <cwzwarich@uwaterloo.ca>

        Reviewed by Maciej.

        Bug 19400: subscript operator does not protect base when necessary
        <https://bugs.webkit.org/show_bug.cgi?id=19400>

        Use a temporary for the base in BracketAccessorNode if the subscript
        might possibly modify it.

        JavaScriptCore:

        * kjs/grammar.y:
        * kjs/nodes.cpp:
        (KJS::BracketAccessorNode::emitCode):
        * kjs/nodes.h:
        (KJS::BracketAccessorNode::):

        LayoutTests:

        * fast/js/codegen-temporaries-expected.txt:
        * fast/js/resources/codegen-temporaries.js:

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@34373 268f45cc-cd09-0410-ab3c-d52691b4dbfc
JavaScriptCore/ChangeLog
JavaScriptCore/kjs/grammar.y
JavaScriptCore/kjs/nodes.cpp
JavaScriptCore/kjs/nodes.h
LayoutTests/ChangeLog
LayoutTests/fast/js/codegen-temporaries-expected.txt
LayoutTests/fast/js/resources/codegen-temporaries.js