346904 - uneval turns double negation into decrement, and negation+decrement into syntax error

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P2)

Description

[Jesse Ruderman]

http://www.squarefree.com/shell/shell.html, Mac trunk nightly.

> function () { return - --x; }
function () { return ---x; }

> function () { return ---x; }
SyntaxError on line 1: syntax error

Either
(1) uneval needs to leave a space between the negation and decrement operators, or
(2) the tokenizer needs to tokenize --- in a way that doesn't lead to a syntax error.  

I'm guessing based on "The source text is scanned from left to right , repeatedly taking the longest possible sequence of characters as the next input element." in the Ecmascript spec that (2) would be incorrect, so (1) is probably the right fix.

And here's something that's even worse, because it changes the meaning of the function without causing a syntax error:

> function () { - - x }
function () { --x; }

The same things happen with unary + and increment.  (What is unary + for, anyway?)

Comment 1

[Jesse Ruderman]

> (What is unary + for, anyway?)

It coerces its argument to be a number, at least.

Comment 2

[Brendan Eich [:brendan]]

Also worth fixing in 1.8.1.

/be

Comment 3

[Brendan Eich [:brendan]]

Attachment: simple fix: make the decompiler token be "- " / "+ "

This is a super-safe and simple patch to fix a toString/eval round-trip bug.

/be

Comment 4

[Brendan Eich [:brendan]]

Fixed on trunk.

/be

Comment 5

[Bob Clary [:bc] (inactive)]

Checking in regress-346904.js;
/cvsroot/mozilla/js/tests/js1_5/Expressions/regress-346904.js,v  <--  regress-346904.js
initial revision: 1.1

note this assumes +++x is a syntax error however, IE6 thinks +++x is ok.

Comment 6

[Brendan Eich [:brendan]]

(In reply to comment #5)
> note this assumes +++x is a syntax error however, IE6 thinks +++x is ok.

What value does it compute if x is 0 before-hand?  How about -1?

It's clearly violating ECMA-262 -- news at 11.

/be

Comment 7

[Bob Clary [:bc] (inactive)]

(In reply to comment #6)

IE throws a runtime error that the number can't be assigned to:
x = 0
+++x
ReferenceError: Cannot assign to '[number: 0]'

Comment 8

[Brendan Eich [:brendan]]

(In reply to comment #7)
> (In reply to comment #6)
> 
> IE throws a runtime error that the number can't be assigned to:
> x = 0
> +++x
> ReferenceError: Cannot assign to '[number: 0]'

Oh, I thought by "IE thinks +++x is ok" you meant no error was thrown at runtime or compile-time.  ECMA-262 allows such errors to be reported early, but they must be reported some time (see chapter 16).  So IE is ok, news at 11:30.

/be

Comment 9

[Bob Clary [:bc] (inactive)]

verified fixed 1.9 20060818 windows/mac(ppc|tel)/linux

Comment 10

[Mike Schroepfer]

Comment on attachment 234270 [details] [diff] [review]
simple fix: make the decompiler token be "- " / "+ "

a=schrep for drivers - approving all [181approval pending] bugs now that the tree is open.

Comment 11

[Brendan Eich [:brendan]]

Fixed on the 1.8 branch.

/be

Comment 12

[Bob Clary [:bc] (inactive)]

verified fixed 1.8, 1.9 20060824 windows/mac*/linux