Fixed evaluation of computed property names with function expressions.

Previously, while evaluating a property name expression with a function
expression as the right side, the evaluation modified the value used to
compute the property name in-place.  The in-place modification changes
values not intended to be changed.

The issue was introduced in 74d30c2d70f3 (0.7.8).

This fixes #640 issue on Github.

diff --git a/src/njs_generator.c b/src/njs_generator.c
index 3b45f4efcc9933884df5dd3f4a067793730a89c6..b8f4e44de24270e4557105dfa20f307891e55826 100644 (file)
--- a/src/njs_generator.c
+++ b/src/njs_generator.c
@@ -3247,6 +3247,12 @@ njs_generate_assignment_end(njs_vm_t *vm, njs_generator_t *generator,
                 njs_generate_code(generator, njs_vmcode_2addr_t, to_prop_key,
                                   NJS_VMCODE_TO_PROPERTY_KEY, 2, property);
 
+                prop_index = njs_generate_temp_index_get(vm, generator,
+                                                         property);
+                if (njs_slow_path(prop_index == NJS_INDEX_ERROR)) {
+                    return NJS_ERROR;
+                }
+
                 to_prop_key->src = property->index;
                 to_prop_key->dst = prop_index;
 
@@ -3277,6 +3283,13 @@ njs_generate_assignment_end(njs_vm_t *vm, njs_generator_t *generator,
     prop_set->object = object->index;
     prop_set->property = prop_index;
 
+    if (prop_index != property->index) {
+        ret = njs_generate_index_release(vm, generator, prop_index);
+        if (njs_slow_path(ret != NJS_OK)) {
+            return ret;
+        }
+    }
+
     node->index = expr->index;
     node->temporary = expr->temporary;
 

diff --git a/src/test/njs_unit_test.c b/src/test/njs_unit_test.c
index 05d79830b9d7af3489a33c0d4b5371e1ac8c9776..aca3a520c5607341de9bff5e77229d2654b57224 100644 (file)
--- a/src/test/njs_unit_test.c
+++ b/src/test/njs_unit_test.c
@@ -3922,6 +3922,9 @@ static njs_unit_test_t  njs_test[] =
     { njs_str("var named = Symbol('xxx'); ({[named]: () => {}})[named].name"),
       njs_str("[xxx]") },
 
+    { njs_str("var obj = {}; ({[obj](){}}); typeof obj"),
+      njs_str("object") },
+
     { njs_str("var called = false;"
              "({"
              "   [{toString(){ if (called) throw 'OOps'; called = true; return 'a'}}](){}"