Bug 19400 – subscript operator does not protect base when necessary

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Oliver Hunt]

in the expression
var  a = [-1];
print(a[++a])

the result should be '0', but instead is 'undefined', as the code emitted does
pre_inc a
get_by_val result, a, a
...

but should actually do
mov temp, a
pre_inc a
get_by_val result, temp, a

The issue is that we don't guard the base against potential modification by the subscript expression

[Cameron Zwarich (cpst)]

Created attachment 21506 [details]
Proposed patch

Here's a fix. It is a slight progression on SunSpider for me, and it doesn't affect very much codegen. I can post the diffs if anyone is interested.

[Maciej Stachowiak]

Comment on attachment 21506 [details]
Proposed patch

r=me but I suggest more tests of funny business in the bracket subscript.

[Cameron Zwarich (cpst)]

Landed in r34373.