Bug 159968
| Summary: | [JSC] Unary + changes evaluation order | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Yusuke Suzuki <ysuzuki> |
| Component: | JavaScriptCore | Assignee: | Yusuke Suzuki <ysuzuki> |
| Status: | NEW | ||
| Severity: | Normal | ||
| Priority: | P2 | ||
| Version: | WebKit Nightly Build | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
Yusuke Suzuki
Currently, we just strip the unary + in makeXXXNode. But unary + can change the evaluation order since it performs ToNumber.
Modified tests derived from the Rick Waldron's one.
let capture = [];
let leftValue = { valueOf() { capture.push("leftValue"); return 3; }};
let rightValue = { valueOf() { capture.push("rightValue"); return 2; }};
(capture.push("left"), leftValue) ${token} +(capture.push("right"), rightValue);
// ^
// Changes the order
// Expected per operator evaluation order: "left", "right", "rightValue", "leftValue"
shouldBe(capture[0], "left");
shouldBe(capture[1], "right");
shouldBe(capture[2], "rightValue");
shouldBe(capture[3], "leftValue");
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |