Bug 19027 – SquirrelFish: Incorrect codegen for pre-increment

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Oliver Hunt]

This hideous URL results in bogus behaviour:
javascript:try {(valueThrower={valueOf:function(){throw "throw from valueOf"}}, function () { executedRHS = false; var result = 'PASS'; try { result = ++valueThrower; alert('FAIL: Did not throw exception') } catch (e) { if (result != 'PASS' && executedRHS) { alert('FAIL: "'+expr+'" threw exception, but modified assignment target and executed RHS'); } else if (result != 'PASS') { alert('FAIL: "'+expr+'" threw exception, but modified assignment target'); } else if (executedRHS) { alert('FAIL: "'+expr+'" threw exception, but executed right hand half of expression') } else { alert('PASS: handled correctly') } } })()}catch(e){alert("Shouldn't receive: "+e);}

[Oliver Hunt]

	M	JavaScriptCore/ChangeLog
	M	JavaScriptCore/VM/CodeBlock.cpp
	M	JavaScriptCore/VM/CodeGenerator.cpp
	M	JavaScriptCore/VM/CodeGenerator.h
	M	JavaScriptCore/VM/Machine.cpp
	M	JavaScriptCore/VM/Opcode.h
	M	JavaScriptCore/kjs/nodes.cpp
	M	LayoutTests/ChangeLog
	M	LayoutTests/fast/js/exception-sequencing-expected.txt
	M	LayoutTests/fast/js/exception-sequencing.html
Committed r33432