Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: e14851d085d342b16e9b2ed95abaf77957d21f06
https://github.com/WebKit/WebKit/commit/e14851d085d342b16e9b2ed95abaf77957d21f06
Author: Alexey Shvayka <[email protected]>
Date: 2024-07-16 (Tue, 16 Jul 2024)
Changed paths:
A
JSTests/stress/destructuring-evaluation-order-array-bracket-accessor-iterator-done.js
A JSTests/stress/destructuring-evaluation-order-array-bracket-accessor.js
A
JSTests/stress/destructuring-evaluation-order-array-dot-accessor-iterator-done.js
A JSTests/stress/destructuring-evaluation-order-array-dot-accessor.js
A
JSTests/stress/destructuring-evaluation-order-array-rest-element-iterator-done.js
A JSTests/stress/destructuring-evaluation-order-array-rest-element.js
A JSTests/stress/destructuring-evaluation-order-object-bracket-accessor.js
A JSTests/stress/destructuring-evaluation-order-object-dot-accessor.js
A JSTests/stress/destructuring-evaluation-order-object-rest-element.js
M JSTests/test262/expectations.yaml
M Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
M Source/JavaScriptCore/parser/Nodes.h
Log Message:
-----------
[JSC] DestructuringAssignmentTarget should be evaluated prior to calling
[[Get]] / stepping iterator
https://bugs.webkit.org/show_bug.cgi?id=268272
<rdar://problem/121960976>
Reviewed by Keith Miller and Yusuke Suzuki.
ECMA-262 specifies left-to-right evaluation order of expressions, which is
maintained by evaluating
a DestructuringAssignmentTarget (unless it is a destructuring pattern) prior to
calling [[Get]] [1] or
stepping the iterator [2] or evaluating the Initializer. The same applies
[3][4] to a ...rest parameter.
This patch makes a copy of AssignmentElementNode::bindValue() for cases except
ResolveNode and
divides it into emitNodesForDestructuring() / bindValueWithEmittedNodes().
A few implementation notes:
a) AssignmentElementNode is guaranteed not to be a destructuring pattern;
b) when binding to a ResolveNode, all errors occur in PutValue [5] rather
then during evaluation
of DestructuringAssignmentTarget;
c) in order to prevent register clash when emitting an op_call to
@copyDataProperties(),
emitNodesForDestructuring() accepts temporary registers created before
CallArguments.
To achieve complete spec compatibility, emitToPropertyKeyOrNumber() is called
for computed property
names before evaluating DestructuringAssignmentTarget [6] regardless of ...rest
parameter presence,
and is skipped only for commonly known types (string, number) to preserve
performance.
Aligns JSC with the spec, V8, and SpiderMonkey. Proven to be perf-neutral on
JS2 and SP3.
[1]:
https://tc39.es/ecma262/#sec-runtime-semantics-keyeddestructuringassignmentevaluation
(step 1)
[2]:
https://tc39.es/ecma262/#sec-runtime-semantics-iteratordestructuringassignmentevaluation
(production before last, step 1)
[3]:
https://tc39.es/ecma262/#sec-runtime-semantics-restdestructuringassignmentevaluation
(step 1)
[4]:
https://tc39.es/ecma262/#sec-runtime-semantics-iteratordestructuringassignmentevaluation
(last production, step 1)
[5]: https://tc39.es/ecma262/#sec-putvalue
[6]:
https://tc39.es/ecma262/#sec-runtime-semantics-propertydestructuringassignmentevaluation
(last production, step 1)
*
JSTests/stress/destructuring-evaluation-order-array-bracket-accessor-iterator-done.js:
Added.
* JSTests/stress/destructuring-evaluation-order-array-bracket-accessor.js:
Added.
*
JSTests/stress/destructuring-evaluation-order-array-dot-accessor-iterator-done.js:
Added.
* JSTests/stress/destructuring-evaluation-order-array-dot-accessor.js: Added.
*
JSTests/stress/destructuring-evaluation-order-array-rest-element-iterator-done.js:
Added.
* JSTests/stress/destructuring-evaluation-order-array-rest-element.js: Added.
* JSTests/stress/destructuring-evaluation-order-object-bracket-accessor.js:
Added.
* JSTests/stress/destructuring-evaluation-order-object-dot-accessor.js: Added.
* JSTests/stress/destructuring-evaluation-order-object-rest-element.js: Added.
* JSTests/test262/expectations.yaml: Mark 5 tests as passing, progress 56 tests.
* Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp:
(JSC::ArrayPatternNode::bindValue const):
(JSC::ObjectPatternNode::bindValue const):
(JSC::AssignmentElementNode::emitNodesForDestructuring const):
(JSC::AssignmentElementNode::bindValueWithEmittedNodes const):
* Source/JavaScriptCore/parser/Nodes.h:
Canonical link: https://commits.webkit.org/281013@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
