Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: b985a89bbd4e08ff09947898ab5c52068b0750e1
https://github.com/WebKit/WebKit/commit/b985a89bbd4e08ff09947898ab5c52068b0750e1
Author: Sosuke Suzuki <[email protected]>
Date: 2026-10-05 (Mon, 05 Oct 2026)
Changed paths:
A JSTests/stress/unary-plus-operand-evaluation-order.js
M Source/JavaScriptCore/parser/ASTBuilder.h
M Source/JavaScriptCore/parser/Nodes.h
Log Message:
-----------
[JSC] Unary `+` changes evaluation order
https://bugs.webkit.org/show_bug.cgi?id=159968
Reviewed by Yusuke Suzuki.
const a = { valueOf() { print("a"); return 2; } };
function b() { print("b"); return 3; }
+a * b(); // should print a, b. printed b, a
+1n * 2n; // should throw a TypeError. was 2n
ASTBuilder stripped the unary plus from the operands of `*`, `/`, `%` and `-`,
because these operators convert their operands anyway. But the unary plus
converts its operand when it is evaluated [1], and throws a TypeError for a
BigInt.
This patch stops stripping it in these operators. Instead, createUnaryPlus
returns the operand itself when its ResultType is definitely Number, so
`+2 * x` is compiled as before. This also folds `+1 + +2` and lets `case +1:`
use op_switch_imm.
[1]:
https://tc39.es/ecma262/#sec-unary-plus-operator-runtime-semantics-evaluation
Test: JSTests/stress/unary-plus-operand-evaluation-order.js
* JSTests/stress/unary-plus-operand-evaluation-order.js: Added.
(shouldBe):
(const.operator.of.operators.const.expected.eval):
(const.operator.of.operators.shouldBe):
(const.operator.of.operators.return):
(const.operator.of.operators.valueOf):
(const.operator.of.operators.shouldThrow.new.Function.return):
(const.operator.of.operators.shouldThrow.new.Function):
(const.operator.of.operators.shouldBe.new.Function.return):
(const.value.valueOf):
(plusInSwitch):
(multiply):
(divide):
(remainder):
(subtract):
(power):
(multiplyRight):
(subtractBoth):
(noInline):
* Source/JavaScriptCore/parser/ASTBuilder.h:
(JSC::ASTBuilder::createUnaryPlus):
(JSC::ASTBuilder::makePowNode):
(JSC::ASTBuilder::makeMultNode):
(JSC::ASTBuilder::makeDivNode):
(JSC::ASTBuilder::makeModNode):
(JSC::ASTBuilder::makeSubNode):
* Source/JavaScriptCore/parser/Nodes.h:
(JSC::ExpressionNode::stripUnaryPlus): Deleted.
Canonical link: https://commits.webkit.org/322817@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
