[Webkit-unassigned] [Bug 207297] New: [JSC] Computed function properties compute their keys twice

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=207297

            Bug ID: 207297
           Summary: [JSC] Computed function properties compute their keys
                    twice
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: ross.kirsling at sony.com

Basic repro:

    ```
    let count1 = 0;
    let key1 = { toString() { count1++; return 'foo'; } };
    ({ [key1]: 'bar' });

    let count2 = 0;
    let key2 = { toString() { count2++; return 'foo'; } };
    ({ [key2]() { return 'bar'; } });

    print(count1, count2);
    ```

    λ eshost -s test.js
    #### ch, sm, v8, xs
    1 1

    #### jsc
    1 2

Notes:

- This also reproes if:
  - we write the function property as `[key]: function () { return 'bar'; }` or `[key]: () => 'bar'` instead
  - we set toString to null and use valueOf instead

- Relevant test262 failures:
  https://github.com/tc39/test262/blob/master/test/language/computed-property-names/to-name-side-effects/class.js
  https://github.com/tc39/test262/blob/master/test/language/computed-property-names/to-name-side-effects/numbers-class.js
  https://github.com/tc39/test262/blob/master/test/language/computed-property-names/to-name-side-effects/object.js

- Bug 170934 seems related but separate.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20200205/4086805c/attachment-0001.htm>