<html>
<head>
<base href="https://bugs.webkit.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - FunctionCallBracketNode should store the base value to the temporary when subscript has assignment"
href="https://bugs.webkit.org/show_bug.cgi?id=144678">144678</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>FunctionCallBracketNode should store the base value to the temporary when subscript has assignment
</td>
</tr>
<tr>
<th>Classification</th>
<td>Unclassified
</td>
</tr>
<tr>
<th>Product</th>
<td>WebKit
</td>
</tr>
<tr>
<th>Version</th>
<td>528+ (Nightly build)
</td>
</tr>
<tr>
<th>Hardware</th>
<td>Unspecified
</td>
</tr>
<tr>
<th>OS</th>
<td>Unspecified
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>Normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>P2
</td>
</tr>
<tr>
<th>Component</th>
<td>JavaScriptCore
</td>
</tr>
<tr>
<th>Assignee</th>
<td>webkit-unassigned@lists.webkit.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>utatane.tea@gmail.com
</td>
</tr></table>
<p>
<div>
<pre>Currently, FunctionCallBracketNode directly use the RegisterID returned by emitNode.
But if the base part is the local register and the subscript part has assignment to it, the base result is accidentally rewritten.
function t() { var ok = {null: function () { } }; ok[ok = null](); }
t(); // Should not throw error.
Seeing the code, we need to use emitNodeForLeftHandSide.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>