in the expression
var a = [-1];
the result should be '0', but instead is 'undefined', as the code emitted does
get_by_val result, a, a
but should actually do
mov temp, a
get_by_val result, temp, a
The issue is that we don't guard the base against potential modification by the subscript expression
Created attachment 21506 [details]
Here's a fix. It is a slight progression on SunSpider for me, and it doesn't affect very much codegen. I can post the diffs if anyone is interested.
Comment on attachment 21506 [details]
r=me but I suggest more tests of funny business in the bracket subscript.
Landed in r34373.