Elimination of "assign to const" with += causes incorrect decompilation

VERIFIED FIXED in mozilla1.8.1

Status

()

Core
JavaScript Engine
P2
normal
VERIFIED FIXED
12 years ago
12 years ago

People

(Reporter: Jesse Ruderman, Assigned: brendan)

Tracking

({testcase, verified1.8.1})

Trunk
mozilla1.8.1
All
AIX
testcase, verified1.8.1
Points:
---
Bug Flags:
blocking1.8.1 +
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [181approval pending])

Attachments

(1 attachment)

(Reporter)

Description

12 years ago
In these two examples, the decompilation of a function does something different than the original function.  I'm guessing the problems are caused by an attempt to eliminate or optimize away assign-to-const.

> a = function () { const z = 3; g = 7; g = z += 1; return g }
function () { const z = 3; g = 7; g += 1; return g; }
> a()
4
> b = eval("" + a)
function () { const z = 3; g = 7; g += 1; return g; }
> b()
8

> a = function () { const z = 3; return z += 2 }
function () { const z = 3; return 2; }
> a()
5
> b = eval("" + a)
function () { const z = 3; return 2; }
> b()
2
(Reporter)

Comment 1

12 years ago
"assign to const" elimination also causes a minor problem with "=", a change during a toString round-trip.  

> function () { const z = 3; z = 4; }
function () { const z = 3; 4; }

> function () { const z = 3; 4; }
function () { const z = 3; }
(Assignee)

Comment 2

12 years ago
Good find -- keep 'em coming!

/be
Assignee: general → brendan
(Assignee)

Comment 3

12 years ago
Created attachment 234854 [details] [diff] [review]
now with extra context!
Attachment #234854 - Flags: review?(mrbkap)
(Assignee)

Comment 4

12 years ago
Another safe fix for 1.8.1.

/be
Status: NEW → ASSIGNED
Flags: blocking1.8.1?
OS: Mac OS X 10.4 → AIX
Priority: -- → P2
Hardware: Macintosh → All
Target Milestone: --- → mozilla1.8.1

Updated

12 years ago
Attachment #234854 - Flags: review?(mrbkap) → review+
(Assignee)

Updated

12 years ago
Attachment #234854 - Flags: review?
(Assignee)

Updated

12 years ago
Attachment #234854 - Flags: approval1.8.1?
(Assignee)

Updated

12 years ago
Attachment #234854 - Flags: review?
(Assignee)

Comment 5

12 years ago
Fixed on trunk.

/be
Status: ASSIGNED → RESOLVED
Last Resolved: 12 years ago
Resolution: --- → FIXED
Flags: blocking1.8.1? → blocking1.8.1+
Whiteboard: [181approval pending]

Comment 6

12 years ago
Comment on attachment 234854 [details] [diff] [review]
now with extra context!

a=schrep for drivers - approving all [181approval pending] bugs now that tree is open.
Attachment #234854 - Flags: approval1.8.1? → approval1.8.1+
(Assignee)

Comment 7

12 years ago
Fixed on the 1.8 branch.

/be
Keywords: fixed1.8.1

Comment 8

12 years ago
Checking in regress-349491.js;
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-349491.js,v  <--  regress-349491.js
initial revision: 1.1
Flags: in-testsuite+

Comment 9

12 years ago
verified fixed 1.8, 1.9 windows/mac*/linux
Status: RESOLVED → VERIFIED
Keywords: fixed1.8.1 → verified1.8.1
You need to log in before you can comment on or make changes to this bug.