[Webkit-unassigned] [Bug 144678] New: FunctionCallBracketNode should store the base value to the temporary when subscript has assignment

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=144678

            Bug ID: 144678
           Summary: FunctionCallBracketNode should store the base value to
                    the temporary when subscript has assignment
    Classification: Unclassified
           Product: WebKit
           Version: 528+ (Nightly build)
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: utatane.tea at gmail.com

Currently, FunctionCallBracketNode directly use the RegisterID returned by emitNode.
But if the base part is the local register and the subscript part has assignment to it, the base result is accidentally rewritten.

function t() { var ok = {null: function () { } }; ok[ok = null](); }
t();  // Should not throw error.

Seeing the code, we need to use emitNodeForLeftHandSide.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20150506/87c1c9ea/attachment.html>