RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-05-16 19:15:07 +00:00
Code Issues Activity Actions

LibJS/Bytecode: Always evaluate LHS first in assignment expressions

Browse source 
This fixes an issue where expressions like `a[i] = a[++i]` could
evaluate `++i` before `a[i]`.
This commit is contained in:
Andreas Kling 2024-03-05 09:48:13 +01:00
parent 1986693edc
commit 0f8c6dc9ad
3 changed files with 27 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
Userland/Libraries/LibJS/Bytecode/Generator.cpp
View file

@ -256,11 +256,13 @@ CodeGenerationErrorOr<Generator::ReferenceOperands> Generator::emit_load_from_re
auto base = TRY(expression.object().generate_bytecode(*this)).value();
if (expression.is_computed()) {
auto property = TRY(expression.property().generate_bytecode(*this)).value();
auto saved_property = Operand(allocate_register());
emit<Bytecode::Op::Mov>(saved_property, property);
auto dst = preferred_dst.has_value() ? preferred_dst.value() : Operand(allocate_register());
emit<Bytecode::Op::GetByValue>(dst, base, property);
return ReferenceOperands {
.base = base,
.referenced_name = property,
.referenced_name = saved_property,
.this_value = base,
.loaded_value = dst,
};