109438 - parser wrong

Status: VERIFIED DUPLICATE of bug 94257

(Rhino Graveyard :: Core, defect)

Description

[Yang Liu]

First post, don't know which component should I post this

I had a script as:
a[x>>2] |= 100

And when I run this script, will get a NullPointException.

I tried to trace the code, and found in IRFactory.createSetProp(), it tries to 
use Node.cloneNode() to duplicate the (>>) node, while in Node.cloneNode(), do 
not do deep clone, this result in the duplicated (>>) node do not have the 
first and last child. Which later will cause a NullPointException.

thanks
yang

Comment 1

[Phil Schwartau]

[e-mail]: can you attach a reduced testcase to this bug
via the "Create a New Attachment" link above? That will help us -

Comment 2

[Yang Liu]

just try:
java -classpath js.jar org.mozilla.javascript.tools.Shell

At the js> prompt, input
a[x>>2] |= 100

Then you will see the exception stack trace:
        at org.mozilla.javascript.Interpreter.generateICode
(Interpreter.java:258)
        at org.mozilla.javascript.Interpreter.generateICode
(Interpreter.java:579)
        at org.mozilla.javascript.Interpreter.generateICode
(Interpreter.java:660)
        at org.mozilla.javascript.Interpreter.generateICode
(Interpreter.java:810)
        at org.mozilla.javascript.Interpreter.generateICode
(Interpreter.java:279)
        at org.mozilla.javascript.Interpreter.generateICodeFromTree
(Interpreter.java:89)
        at org.mozilla.javascript.Interpreter.generateScriptICode
(Interpreter.java:134)
        at org.mozilla.javascript.Interpreter.compile(Interpreter.java:78)
        at org.mozilla.javascript.Context.compile(Context.java:1810)
        at org.mozilla.javascript.Context.compile(Context.java:1735)
        at org.mozilla.javascript.Context.compileReader(Context.java:852)
        at org.mozilla.javascript.Context.evaluateReader(Context.java:770)
        at org.mozilla.javascript.tools.shell.Main.evaluateReader(Main.java:293)
        at org.mozilla.javascript.tools.shell.Main.processSource(Main.java:217)
        at org.mozilla.javascript.tools.shell.Main.exec(Main.java:104)
        at org.mozilla.javascript.tools.shell.Main.main(Main.java:66)

Comment 3

[Phil Schwartau]

If I do exactly what you say, here's what I get:

$ java org.mozilla.javascript.tools.shell.Main
js> a[x>>2] |= 100
js: uncaught JavaScript exception: ReferenceError: "a" is not defined.


If I define variables |a| and |x|, this is what I get:

js> var a = ['a','b','c','d','e','f','g'];
js> var x = 10;
js> a[x>>2] |= 100
100

In more detail:

js> var a = ['a','b','c','d','e','f','g'];
js> var x = 10;
js> a[x>>2];
c
js> a[x>>2] |= 100;
100

A numeric example:

js> var a = [1,2,3,4,5,6,7,8,9,0];
js> a[x>>2] |= 100
103


Am I missing something?

Comment 4

[Yang Liu]

I am using the version directly downloaded from 
ftp://ftp.mozilla.org/pub/js/rhino15R2.zip

Don't know whether this is the up-to-date version.
And I just tried to download again, still same.

Can you tell me which version are you using? Should me get the most up to date 
source from CVS?

Comment 5

[Norris Boyd]

Dup. This is fixed in the latest rhino.

Get rhinoLatest.zip at ftp://ftp.mozilla.org/pub/js/

*** This bug has been marked as a duplicate of 94257 ***

Comment 6

[Phil Schwartau]

Verified Duplicate - [e-mail] : thank you for this report

Comment 7

[Igor Bukanov]

Targeting as resolved against 1.5R3