fix delete + optional chain jump condition

devsnek · Commit Bot · commit 5d4ca7ba8608 · 2019-08-19T15:21:20.000Z
The optional chaining bytecode in delete expressions was unconditionally jumping if the receiver was nullish, instead of just when the property was an actual optional chain link. This change adds the missing check around the jump. Change-Id: Ic7bed58be4ae62d157e63e4f77666b1abd1f802d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1755264 Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/master@{#63251}
diff --git a/src/interpreter/bytecode-generator.cc b/src/interpreter/bytecode-generator.cc
@@ -4860,11 +4860,14 @@ void BytecodeGenerator::VisitDelete(UnaryOperation* unary) {
       BytecodeLabel done;
       OptionalChainNullLabelScope label_scope(this);
       VisitForAccumulatorValue(property->obj());
-      builder()->JumpIfUndefinedOrNull(label_scope.labels()->New());
+      if (property->is_optional_chain_link()) {
+        builder()->JumpIfUndefinedOrNull(label_scope.labels()->New());
+      }
       Register object = register_allocator()->NewRegister();
       builder()->StoreAccumulatorInRegister(object);
       VisitForAccumulatorValue(property->key());
-      builder()->Delete(object, language_mode()).Jump(&done);
+      builder()->Delete(object, language_mode());
+      builder()->Jump(&done);
       label_scope.labels()->Bind(builder());
       builder()->LoadTrue();
       builder()->Bind(&done);
diff --git a/test/mjsunit/harmony/optional-chaining.js b/test/mjsunit/harmony/optional-chaining.js
@@ -88,6 +88,7 @@ assertEquals(delete o1?.['y'], true);
 assertEquals(o1.y, undefined);
 assertEquals(delete o1?.['y'], true);
 assertEquals(delete o1.z?.(), true);
+assertThrows(() => { delete ({})?.foo.bar; });
 
 shouldThrowSyntaxError('class C {} class D extends C { foo() { return super?.bar; } }');
 shouldThrowSyntaxError('class C {} class D extends C { foo() { return super?.["bar"]; } }');
