Fix delayed loading of arguments in binary expressions

Consider the following functions:
    function f(x) {
        return x + (++x)
    }

    function g(x) {
        return x + x
    }

In f() it is not correct to delay the load of x on the left-hand side of
the + operator, while in g() it is. The reason is that calculating the
right-hand side of the + operator in f() will change the value of x.

So, if an argument is written to in an expression in a statement, it
cannot be delay-loaded. The same is true for member/field accesses,
because the accessors can be overwritten and do anything.

Change-Id: I5bed4b0d03919edc1c94a82127e2dd705fc1d9b1
Reviewed-by: Lars Knoll <lars.knoll@qt.io>
Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>

1 files changed, 8 insertions, 0 deletions

diff --git a/tests/auto/qml/qqmlecmascript/tst_qqmlecmascript.cpp b/tests/auto/qml/qqmlecmascript/tst_qqmlecmascript.cpp
index 5f6b0a056e..7583579de6 100644
--- a/tests/auto/qml/qqmlecmascript/tst_qqmlecmascript.cpp
+++ b/tests/auto/qml/qqmlecmascript/tst_qqmlecmascript.cpp
@@ -343,6 +343,7 @@ private slots:
     void freeze_empty_object();
     void singleBlockLoops();
     void qtbug_60547();
+    void delayLoadingArgs();
 
 private:
 //    static void propertyVarWeakRefCallback(v8::Persistent<v8::Value> object, void* parameter);
@@ -8371,6 +8372,13 @@ void tst_qqmlecmascript::qtbug_60547()
     QCOMPARE(object->property("counter"), QVariant(int(1)));
 }
 
+void tst_qqmlecmascript::delayLoadingArgs()
+{
+    QJSEngine engine;
+    QJSValue ret = engine.evaluate("(function(x){return x + (x+=2)})(20)");
+    QCOMPARE(ret.toInt(), 42); // esp. not 44.
+}
+
 QTEST_MAIN(tst_qqmlecmascript)
 
 #include "tst_qqmlecmascript.moc"