Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

compiler: fix bytecode for logical assignments of properties #131

Merged
merged 1 commit into from
Nov 29, 2022

Conversation

jow-
Copy link
Owner

@jow- jow- commented Nov 29, 2022

The compiler emitted incorrect bytecode for logical assignment operations on property expressions. The generated instructions left the stack in an unclean state when the assignment condition was not fulfilled, causing a stack layout mismatch between compiler and vm, leading to undefined variable accesses and other non-deterministic behavior.

Solve this issue by rewriting the bytecode generation to yield an instruction sequence that does not leave garbage on the stack.

The implementation is not optimal yet, as an expression in the form obj.prop ||= val will load obj.prop twice. This is acceptable for now as the load operation has no side effect, but should be solved in a better way by introducing new instructions that allow for swapping stack slots, allowing the vm to operate on a copy of the loaded value.

Also rewrite the corresponding test case to trigger a runtime error on code versions before this fix.

Fixes: fdc9b6a ("compiler: fix ??=, ||= and &&= logical assignment semantics")
Signed-off-by: Jo-Philipp Wich jo@mein.io

The compiler emitted incorrect bytecode for logical assignment operations
on property expressions. The generated instructions left the stack in an
unclean state when the assignment condition was not fulfilled, causing a
stack layout mismatch between compiler and vm, leading to undefined
variable accesses and other non-deterministic behavior.

Solve this issue by rewriting the bytecode generation to yield an
instruction sequence that does not leave garbage on the stack.

The implementation is not optimal yet, as an expression in the form
`obj.prop ||= val` will load `obj.prop` twice. This is acceptable for
now as the load operation has no side effect, but should be solved in
a better way by introducing new instructions that allow for swapping
stack slots, allowing the vm to operate on a copy of the loaded value.

Also rewrite the corresponding test case to trigger a runtime error
on code versions before this fix.

Fixes: fdc9b6a ("compiler: fix `??=`, `||=` and `&&=` logical assignment semantics")
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
@jow- jow- merged commit cc8ae80 into master Nov 29, 2022
@jow- jow- deleted the fix-logical-assignment-operators-2 branch November 29, 2022 22:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant