From 1e95e50e4589dcd2f148e68e88dd2e998c0a196e Mon Sep 17 00:00:00 2001
From: "brendan@mozilla.org" <brendan@mozilla.org>
Date: Tue, 12 Jun 2007 01:26:26 -0700
Subject: [PATCH] Fix CheckSideEffects over-aggressiveness (383674, r=mrbkap).

---
 js/src/jsemit.c | 32 +++++++++++++-------------------
 1 file changed, 13 insertions(+), 19 deletions(-)

diff --git a/js/src/jsemit.c b/js/src/jsemit.c
index debb6f352f51..d3827965fe31 100644
--- a/js/src/jsemit.c
+++ b/js/src/jsemit.c
@@ -2212,28 +2212,18 @@ CheckSideEffects(JSContext *cx, JSTreeContext *tc, JSParseNode *pn,
                 if (!CheckSideEffects(cx, tc, pn->pn_right, answer))
                     return JS_FALSE;
                 if (!*answer &&
-                    (pn2->pn_slot < 0 || !(pn2->pn_attrs & JSPROP_READONLY))) {
+                    (pn->pn_op != JSOP_NOP ||
+                     pn2->pn_slot < 0 ||
+                     !(pn2->pn_attrs & JSPROP_READONLY))) {
                     *answer = JS_TRUE;
                 }
             }
         } else {
-            if (pn->pn_type == TOK_LB) {
-                pn2 = pn->pn_left;
-                if (pn2->pn_type == TOK_NAME &&
-                    !BindNameToSlot(cx, tc, pn2, 0)) {
-                    return JS_FALSE;
-                }
-                if (pn2->pn_op != JSOP_ARGUMENTS) {
-                    /*
-                     * Any indexed property reference could call a getter with
-                     * side effects, except for arguments[i] where arguments is
-                     * unambiguous.
-                     */
-                    *answer = JS_TRUE;
-                }
-            }
-            ok = CheckSideEffects(cx, tc, pn->pn_left, answer) &&
-                 CheckSideEffects(cx, tc, pn->pn_right, answer);
+            /*
+             * We can't easily prove that neither operand ever denotes an
+             * object with a toString or valueOf method.
+             */
+            *answer = JS_TRUE;
         }
         break;
 
@@ -2266,7 +2256,11 @@ CheckSideEffects(JSContext *cx, JSTreeContext *tc, JSParseNode *pn,
                 break;
             }
         } else {
-            ok = CheckSideEffects(cx, tc, pn->pn_kid, answer);
+            /*
+             * We can't easily prove that our operand never denotes an object
+             * with a toString or valueOf method.
+             */
+            *answer = JS_TRUE;
         }
         break;