Andreas Kling c0f38c82d8 LibJS: Fix evaluation order in array destructuring assignment ...

Per AssignmentRestElement and AssignmentElement in the specification,
the DestructuringAssignmentTarget reference must be evaluated before
iterating or stepping the iterator. We were doing it in the wrong
order, which caused observable differences when the target evaluation
has side effects, and could lead to infinite loops when the iterator
never completes.

Add Generator::emit_evaluate_reference() to evaluate a member
expression's base and property into ReferenceOperands without performing
a load or store, then use the pre-evaluated reference for the store
after iteration completes.

2026-02-15 23:21:46 +01:00

82 KiB

Raw Blame History

View Raw