in the expression var a = [-1]; print(a[++a]) the result should be '0', but instead is 'undefined', as the code emitted does pre_inc a get_by_val result, a, a ... but should actually do mov temp, a pre_inc a get_by_val result, temp, a The issue is that we don't guard the base against potential modification by the subscript expression
Created attachment 21506 [details] Proposed patch Here's a fix. It is a slight progression on SunSpider for me, and it doesn't affect very much codegen. I can post the diffs if anyone is interested.
Comment on attachment 21506 [details] Proposed patch r=me but I suggest more tests of funny business in the bracket subscript.
Landed in r34373.