Bug 1916260 - Part 6: Evaluate SuperBase before ToPropertyKey. r=spid…

…ermonkey-reviewers,jandem

The spec PR reordered the `ToPropertyKey` call to happen in `GetValue` resp.
`PutValue`, which means it has to happen after `GetSuperBase`.

Tests are included in <tc39/test262#4216>.

Differential Revision: https://phabricator.services.mozilla.com/D220825

UltraBlame original commit: e7e456e896ff809e6883f37dc5ba8c6a30e0c3d6

js/src/frontend/ElemOpEmitter.cpp

@@ -340,6 +340,39 @@ State
 Key
 )
 ;
+if
+(
+isSuper
+(
+)
+)
+{
+if
+(
+!
+bce_
+-
+>
+emitSuperBase
+(
+)
+)
+{
+/
+/
+[
+stack
+]
+THIS
+?
+THIS
+KEY
+SUPERBASE
+return
+false
+;
+}
+}
 /
 /
 Inc
@@ -365,6 +398,7 @@ it
 must
 be
 converted
+by
 ToPropertyKey
 only
 once
@@ -385,6 +419,13 @@ isCompoundAssignment
 {
 if
 (
+isSuper
+(
+)
+)
+{
+if
+(
 !
 bce_
 -
@@ -394,7 +435,7 @@ emit1
 JSOp
 :
 :
-ToPropertyKey
+Swap
 )
 )
 {
@@ -403,50 +444,52 @@ ToPropertyKey
 [
 stack
 ]
-#
-if
-Super
-/
-/
-[
-stack
-]
 THIS
-KEY
-/
-/
-[
-stack
-]
-#
-otherwise
-/
-/
-[
-stack
-]
-OBJ
+SUPERBASE
 KEY
 return
 false
 ;
 }
-}
 if
 (
-isSuper
+!
+bce_
+-
+>
+emit1
 (
+JSOp
+:
+:
+ToPropertyKey
 )
 )
 {
+/
+/
+[
+stack
+]
+THIS
+SUPERBASE
+KEY
+return
+false
+;
+}
 if
 (
 !
 bce_
 -
 >
-emitSuperBase
+emit1
 (
+JSOp
+:
+:
+Swap
 )
 )
 {
@@ -456,34 +499,12 @@ emitSuperBase
 stack
 ]
 THIS
-?
-THIS
 KEY
 SUPERBASE
 return
 false
 ;
 }
-}
-if
-(
-isIncDec
-(
-)
-|
-|
-isCompoundAssignment
-(
-)
-)
-{
-if
-(
-isSuper
-(
-)
-)
-{
 if
 (
 !
@@ -526,6 +547,32 @@ emit1
 JSOp
 :
 :
+ToPropertyKey
+)
+)
+{
+/
+/
+[
+stack
+]
+OBJ
+KEY
+return
+false
+;
+}
+if
+(
+!
+bce_
+-
+>
+emit1
+(
+JSOp
+:
+:
 Dup2
 )
 )