202710 2019-10-08 16:05:01 -0700 Post increment/decrement should only call ToNumber once 2019-10-11 00:04:02 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED DUPLICATE 202711 P2 Normal --- 1 rmorisset rmorisset oldest_to_newest 1577997 0 rmorisset 2019-10-08 16:05:01 -0700 Currently they call it twice, see the following test case: ``` var o = {}; var counter = 0; o.valueOf = () => {counter ++; return 42}; o++; if (counter != 1) throw "valueOf was executed " + counter + " times during a post-increment instead of once!"; ``` As far as I can tell this is not spec-compliant: 12.4.4 Postfix Increment Operator requires a single call to ToNumeric. Then there is a single chain of ToNumeric -> ToNumber -> ToPrimitive -> OrdinaryToPrimitive -> valueOf with no reason for the call to be duplicated anywhere. The problem appears to be from: ``` static RegisterID* emitPostIncOrDec(BytecodeGenerator& generator, RegisterID* dst, RegisterID* srcDst, Operator oper) { if (dst == srcDst) return generator.emitToNumber(generator.finalDestination(dst), srcDst); RefPtr<RegisterID> tmp = generator.emitToNumber(generator.tempDestination(dst), srcDst); emitIncOrDec(generator, srcDst, oper); return generator.move(dst, tmp.get()); } ``` which uses an emitToNumber, but then does an emitIncOrDec on the original value, which itself can lead to a slow path that does ToNumber anew. 1579019 1 ap 2019-10-11 00:04:02 -0700 *** This bug has been marked as a duplicate of bug 202711 ***