Bug 1916260 - Part 6: Evaluate SuperBase before ToPropertyKey. r=spid…

…ermonkey-reviewers,jandem

The spec PR reordered the `ToPropertyKey` call to happen in `GetValue` resp.
`PutValue`, which means it has to happen after `GetSuperBase`.

Tests are included in <tc39/test262#4216>.

Differential Revision: https://phabricator.services.mozilla.com/D220825

UltraBlame original commit: c4fbbb9b19cc19b8836de939b5561964b4058030

js/src/frontend/ElemOpEmitter.cpp

@@ -200,12 +200,7 @@ Key
 ;
 if
 (
-isIncDec
-(
-)
-|
-|
-isCompoundAssignment
+isSuper
 (
 )
 )
@@ -216,12 +211,8 @@ if
 bce_
 -
 >
-emit1
+emitSuperBase
 (
-JSOp
-:
-:
-ToPropertyKey
 )
 )
 {
@@ -232,6 +223,18 @@ false
 }
 if
 (
+isIncDec
+(
+)
+|
+|
+isCompoundAssignment
+(
+)
+)
+{
+if
+(
 isSuper
 (
 )
@@ -243,35 +246,57 @@ if
 bce_
 -
 >
-emitSuperBase
+emit1
 (
+JSOp
+:
+:
+Swap
 )
 )
 {
 return
 false
 ;
 }
-}
 if
 (
-isIncDec
-(
-)
-|
-|
-isCompoundAssignment
+!
+bce_
+-
+>
+emit1
 (
+JSOp
+:
+:
+ToPropertyKey
 )
 )
 {
+return
+false
+;
+}
 if
 (
-isSuper
+!
+bce_
+-
+>
+emit1
 (
+JSOp
+:
+:
+Swap
 )
 )
 {
+return
+false
+;
+}
 if
 (
 !
@@ -303,6 +328,25 @@ emit1
 JSOp
 :
 :
+ToPropertyKey
+)
+)
+{
+return
+false
+;
+}
+if
+(
+!
+bce_
+-
+>
+emit1
+(
+JSOp
+:
+:
 Dup2
 )
 )