[njs] Fixed evaluation of computed property names with function expressions.

[Dmitry Volyntsev]

details:   https://hg.nginx.org/njs/rev/884100020b1b
branches:  
changeset: 2119:884100020b1b
user:      Dmitry Volyntsev <xeioex at nginx.com>
date:      Wed May 17 00:39:45 2023 -0700
description:
Fixed evaluation of computed property names with function expressions.

Previously, while evaluating a property name expression with a function
expression as the right side, the evaluation modified the value used to
compute the property name in-place.  The in-place modification changes
values not intended to be changed.

The issue was introduced in 74d30c2d70f3 (0.7.8).

This fixes #640 issue on Github.

diffstat:

 src/njs_generator.c      |  13 +++++++++++++
 src/test/njs_unit_test.c |   3 +++
 2 files changed, 16 insertions(+), 0 deletions(-)

diffs (43 lines):

diff -r 71fa2f4b6adb -r 884100020b1b src/njs_generator.c
--- a/src/njs_generator.c	Fri May 12 19:38:29 2023 -0400
+++ b/src/njs_generator.c	Wed May 17 00:39:45 2023 -0700
@@ -3247,6 +3247,12 @@ njs_generate_assignment_end(njs_vm_t *vm
                 njs_generate_code(generator, njs_vmcode_2addr_t, to_prop_key,
                                   NJS_VMCODE_TO_PROPERTY_KEY, 2, property);
 
+                prop_index = njs_generate_temp_index_get(vm, generator,
+                                                         property);
+                if (njs_slow_path(prop_index == NJS_INDEX_ERROR)) {
+                    return NJS_ERROR;
+                }
+
                 to_prop_key->src = property->index;
                 to_prop_key->dst = prop_index;
 
@@ -3277,6 +3283,13 @@ njs_generate_assignment_end(njs_vm_t *vm
     prop_set->object = object->index;
     prop_set->property = prop_index;
 
+    if (prop_index != property->index) {
+        ret = njs_generate_index_release(vm, generator, prop_index);
+        if (njs_slow_path(ret != NJS_OK)) {
+            return ret;
+        }
+    }
+
     node->index = expr->index;
     node->temporary = expr->temporary;
 
diff -r 71fa2f4b6adb -r 884100020b1b src/test/njs_unit_test.c
--- a/src/test/njs_unit_test.c	Fri May 12 19:38:29 2023 -0400
+++ b/src/test/njs_unit_test.c	Wed May 17 00:39:45 2023 -0700
@@ -3922,6 +3922,9 @@ static njs_unit_test_t  njs_test[] =
     { njs_str("var named = Symbol('xxx'); ({[named]: () => {}})[named].name"),
       njs_str("[xxx]") },
 
+    { njs_str("var obj = {}; ({[obj](){}}); typeof obj"),
+      njs_str("object") },
+
     { njs_str("var called = false;"
              "({"
              "   [{toString(){ if (called) throw 'OOps'; called = true; return 'a'}}](){}"