LibJS/Bytecode: Always evaluate LHS first in assignment expressions

This fixes an issue where expressions like `a[i] = a[++i]` could evaluate `++i` before `a[i]`.
Author: https://github.com/awesomekling Commit: 0f8c6dc9ad Pull-request: https://github.com/SerenityOS/serenity/pull/23472
2025-08-08 01:00:05 +00:00 · 2024-03-05 09:48:13 +01:00 · 2024-03-05 09:48:13 +01:00 · 0f8c6dc9ad · 2024-07-17 08:43:11 +09:00
commit 0f8c6dc9ad
parent 1986693edc
3 changed files with 27 additions and 2 deletions
--- a/Userland/Libraries/LibJS/Tests/assignment-evaluation-order.js
+++ b/Userland/Libraries/LibJS/Tests/assignment-evaluation-order.js
@ -0,0 +1,21 @@
+test("Assignment should always evaluate LHS first", () => {
+    function go(a) {
+        let i = 0;
+        a[i] = a[++i];
+    }
+
+    let a = [1, 2, 3];
+    go(a);
+    expect(a).toEqual([2, 2, 3]);
+});
+
+test("Binary assignment should always evaluate LHS first", () => {
+    function go(a) {
+        let i = 0;
+        a[i] |= a[++i];
+    }
+
+    let a = [1, 2];
+    go(a);
+    expect(a).toEqual([3, 2]);
+});