LibJS/Bytecode: Always evaluate LHS first in assignment expressions

This fixes an issue where expressions like `a[i] = a[++i]` could
evaluate `++i` before `a[i]`.

Userland/Libraries/LibJS/Bytecode/ASTCodegen.cpp

@@ -435,7 +435,9 @@ Bytecode::CodeGenerationErrorOr<Optional<Bytecode::Operand>> AssignmentExpressio
  }
 
  if (expression.is_computed()) {
- computed_property = TRY(expression.property().generate_bytecode(generator)).value();
+ auto property = TRY(expression.property().generate_bytecode(generator)).value();
+ computed_property = Bytecode::Operand(generator.allocate_register());
+ generator.emit<Bytecode::Op::Mov>(*computed_property, property);
 
  // To be continued later with PutByValue.
  } else if (expression.property().is_identifier()) {

Userland/Libraries/LibJS/Bytecode/Generator.cpp

@@ -256,11 +256,13 @@ CodeGenerationErrorOr<Generator::ReferenceOperands> Generator::emit_load_from_re
  auto base = TRY(expression.object().generate_bytecode(*this)).value();
  if (expression.is_computed()) {
  auto property = TRY(expression.property().generate_bytecode(*this)).value();
+ auto saved_property = Operand(allocate_register());
+ emit<Bytecode::Op::Mov>(saved_property, property);
  auto dst = preferred_dst.has_value() ? preferred_dst.value() : Operand(allocate_register());
  emit<Bytecode::Op::GetByValue>(dst, base, property);
  return ReferenceOperands {
  .base = base,
- .referenced_name = property,
+ .referenced_name = saved_property,
  .this_value = base,
  .loaded_value = dst,
  };

Userland/Libraries/LibJS/Tests/assignment-evaluation-order.js

@@ -0,0 +1,21 @@
+test("Assignment should always evaluate LHS first", () => {
+ function go(a) {
+ let i = 0;
+ a[i] = a[++i];
+ }
+
+ let a = [1, 2, 3];
+ go(a);
+ expect(a).toEqual([2, 2, 3]);
+});
+
+test("Binary assignment should always evaluate LHS first", () => {
+ function go(a) {
+ let i = 0;
+ a[i] |= a[++i];
+ }
+
+ let a = [1, 2];
+ go(a);
+ expect(a).toEqual([3, 2]);
+});