From 357174d8fdd5442b696f536ca0af657c50ea99c7 Mon Sep 17 00:00:00 2001
From: Luke Wilde <lukew@serenityos.org>
Date: Sat, 17 Jun 2023 18:42:32 +0100
Subject: [PATCH] LibJS/Bytecode: Actually get value from super base for
 computed property

---
 Userland/Libraries/LibJS/Bytecode/ASTCodegen.cpp | 5 ++++-
 Userland/Libraries/LibJS/Bytecode/Generator.cpp  | 5 ++++-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/Userland/Libraries/LibJS/Bytecode/ASTCodegen.cpp b/Userland/Libraries/LibJS/Bytecode/ASTCodegen.cpp
index 9f0526e2f3..e7da966100 100644
--- a/Userland/Libraries/LibJS/Bytecode/ASTCodegen.cpp
+++ b/Userland/Libraries/LibJS/Bytecode/ASTCodegen.cpp
@@ -1311,7 +1311,10 @@ static Bytecode::CodeGenerationErrorOr<void> get_base_and_value_from_member_expr
         if (computed_property_value_register.has_value()) {
             // 5. Let propertyKey be ? ToPropertyKey(propertyNameValue).
             // FIXME: This does ToPropertyKey out of order, which is observable by Symbol.toPrimitive!
-            generator.emit<Bytecode::Op::GetByValue>(*computed_property_value_register);
+            auto super_base_register = generator.allocate_register();
+            generator.emit<Bytecode::Op::Store>(super_base_register);
+            generator.emit<Bytecode::Op::Load>(*computed_property_value_register);
+            generator.emit<Bytecode::Op::GetByValue>(super_base_register);
         } else {
             // 3. Let propertyKey be StringValue of IdentifierName.
             auto identifier_table_ref = generator.intern_identifier(verify_cast<Identifier>(member_expression.property()).string());
diff --git a/Userland/Libraries/LibJS/Bytecode/Generator.cpp b/Userland/Libraries/LibJS/Bytecode/Generator.cpp
index 1c0897afde..8bb2d5443e 100644
--- a/Userland/Libraries/LibJS/Bytecode/Generator.cpp
+++ b/Userland/Libraries/LibJS/Bytecode/Generator.cpp
@@ -177,7 +177,10 @@ CodeGenerationErrorOr<void> Generator::emit_load_from_reference(JS::ASTNode cons
             if (computed_property_value_register.has_value()) {
                 // 5. Let propertyKey be ? ToPropertyKey(propertyNameValue).
                 // FIXME: This does ToPropertyKey out of order, which is observable by Symbol.toPrimitive!
-                emit<Bytecode::Op::GetByValue>(*computed_property_value_register);
+                auto super_base_register = allocate_register();
+                emit<Bytecode::Op::Store>(super_base_register);
+                emit<Bytecode::Op::Load>(*computed_property_value_register);
+                emit<Bytecode::Op::GetByValue>(super_base_register);
             } else {
                 // 3. Let propertyKey be StringValue of IdentifierName.
                 auto identifier_table_ref = intern_identifier(verify_cast<Identifier>(expression.property()).string());