620567 - Function.prototype.toString relocates parentheses, changing syntax tree

Status: RESOLVED DUPLICATE of bug 559438

(Core :: JavaScript Engine, defect)

Description

[Matthew Flaschen]

User-Agent:       Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; CMNTDF; .NET4.0C; InfoPath.3; AskTbARS/5.8.0.12304)
Build Identifier: 3.6.13

This simple example demonstrates that Function.prototype.toString returns a string with a different syntax tree from the original:

function f() { var a = '', b = '1', c = '2'; return a + '(' + (+b + +c) + ')'; }; 
f.toString(); 

The parentheses are relocated.  This caused a real problem in a Greasemonkey script, as explained at http://stackoverflow.com/questions/4469044/problem-with-type-coercion-and-string-concatenation-in-javascript-in-greasemonkey

Reproducible: Always

Comment 1

[Boris Zbarsky [:bzbarsky]]

So what apparently happened here is that bug was fixed on m-c back in Sept 2009, then merged to the 1.9.2 release branch.  This had a bug that caused us to drop those parens altogether.  Then there was a bogo-fix for that in bug 530537 which apparently made us put the parens in the wrong place (though maybe only on branch?  I don't see that behavior with trunk builds that I tested.

Finally, things were fixed correctly in bug 559438.

Marking duplicate of bug 559438, which is where the patch that would need backporting to 1.9.2 lives.