Fix ToPropertyKey evaluation order for computed keys

[andreasrosdal]

Two places where a computed property key is converted at the wrong moment relative to the value expression. They pull in opposite directions, which is why they are in one PR.

1. obj[key] = val — convert after val

EvaluatePropertyAccessWithExpressionKey builds a Reference Record holding the raw property-name value and leaves ToPropertyKey to PutValue, with a note spelling out why:

NOTE: In most cases, ToPropertyKey will be performed on propertyNameValue immediately after this step. However, in the case of a[b] = c, it will not be performed until after evaluation of c.

get_lvalue() emits an eager OP_to_propkey2 / OP_to_propkey for OP_get_array_el and OP_get_super_value, so the key's toString() runs first:

const key = {toString() { log.push('key'); return 'k'; }};
const val = {valueOf()  { log.push('val'); return 1;   }};
({})[key] = +val;   // key,val — V8: val,key

js_parse_assign_expr2() already worked around this for OP_get_array_el with a run-time branch on whether the base is nullish, at the cost of converting the key twice on the happy path; the FIXME(bnoordhuis) on it asked for something less elaborate.

Undo the eager conversion right after get_lvalue() and redo it once, right before put_lvalue(), for both opcodes. Destructuring assignment targets get the same treatment, so [super[key]] = v no longer converts early either.

2. {[key]: val} — convert before val

PropertyDefinition : PropertyName : AssignmentExpression evaluates the property name first, and PropertyName : ComputedPropertyName ends in ToPropertyKey:

({[key]: +val});   // val,key — V8: key,val

js_parse_object_literal() leaves the key as-is and lets OP_define_array_el convert it once the value is on the stack. Emit OP_to_propkey right after the : instead; the later conversion then sees a string or symbol and is a no-op.

Testing

Six tests fixed, entries dropped from test262_errors.txt:

• expressions/assignment/target-member-computed-reference.js
• expressions/assignment/target-super-computed-reference.js
• expressions/assignment/destructuring/keyed-destructuring-property-reference-target-evaluation-order.js
• .../keyed-destructuring-property-reference-target-evaluation-order-with-bindings.js
• .../iterator-destructuring-property-reference-target-evaluation-order.js
• expressions/object/computed-property-name-topropertykey-before-value-evaluation.js

suite	before	after
language/expressions/assignment	5/483	0/483
language/expressions/object	1/1170	0/1170
language/expressions/super	0/94	0/94
language/destructuring	1/19	1/19
language/statements/class	2/4353	2/4353

Still divergent, before and after: undefined[key] = val converts the key before throwing, where V8 rejects the nullish base first. That needs OP_put_array_el to check the base ahead of the conversion — a separate change.

🤖 Generated with Claude Code

https://claude.ai/code/session_014mv33YvfHz7t9mmkituBnn

---

Generated by Claude Code