321757 - Compound assignment operators (+= etc.) prematurely bind LHS of assignment

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Brendan Eich [:brendan]]

Reported by Joaquin Cuenca Abela in news://news.mozilla.org/netscape.public.mozilla.jseng.  Primordial bug.

/be

Comment 1

[Aiko]

To answer your question from the newsgroup post, Navigator versions 2.02, 3.01 and 4.04 all say "x is not defined", 4.08 says "NaN". See, this bug is not _that_ ancient. :-)

Comment 2

[Brendan Eich [:brendan]]

Ok, primordial to the dawn of SpiderMonkey, then.  SpiderMonkey was written by me in the fall of 1996, based on the Mocha runtime I'd written way too quickly (with Ken Smith transcribing the fatally flawed java.util.Date into the Date class's native implementation) in Spring 1995.  So Netscape 2 and 3 used the Mocha runtime while Netscape 4 and of course the Mozilla-based 6 and 7 series used SpiderMonkey.

/be

Comment 3

[Bob Clary [:bc] (inactive)]

/cvsroot/mozilla/js/tests/js1_5/Regress/regress-321757.js,v  <--  regress-321757.js

Comment 4

[Brendan Eich [:brendan]]

Attachment: proposed fix

Straightforward fix, minimized by virtue of existing strict warning check in js_GetProperty.

Note that SpiderMonkey already requires the global object to be native (to satisfy OBJ_IS_NATIVE).  This patch ups the ante slightly by requiring the global object's JSObjectOp.getProperty to be js_GetProperty or a wrapper around js_GetProperty, or else to contain this kind of extant property op check and error code.

/be

Comment 5

[Blake Kaplan (:mrbkap) (inactive)]

Comment on attachment 210210 [details] [diff] [review]
proposed fix

r=mrbkap

Comment 6

[Brendan Eich [:brendan]]

Fixed, with the extra "not" in the jsopcode.tbl comment removed.

/be

Comment 7

[Bob Clary [:bc] (inactive)]

verified fixed trunk 20060328 win/mac/linux

Comment 8

[Bob Clary [:bc] (inactive)]

fixed by Bug 336373 on the 1.8.1 branch. 
verified fixed 1.8.1 with windows/macppc/linux 20060707