349648 - Extra "[" in decompilation of nested array comprehensions

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Jesse Ruderman]

> function(){ [[0 for (x in [])] for (y in []) ]; }

function () { [[0 for (x in [])] for (y in [])[]; }
                                              ^---- does not belong

This causes a syntax error if I try to use the decompiled function.

Comment 1

[Robert Sayre]

Attachment: trim xval a little differently

I understand enough of jsopcode.c to be dangerous.


> function(){ [[0 for (x in [])] for (y in []) ]; }
function () { [[0 for (x in [])] for (y in [])]; }

> function(){ [[0 for (x in [])] for (yyyyyyyyyyy in []) ]; }
function () { [[0 for (x in [])] for (yyyyyyyyyyy in [])]; }

> function(){ [0 for (x in [])]; }
function () { [0 for (x in [])]; }

> function(){ [[[0 for (x in [])] for (yyyyyyyyyyy in []) ] for (zzz in [])]; }
function () { [[[0 for (x in [])] for (yyyyyyyyyyy in [])] for (zzz in [])]; }

Comment 2

[Brendan Eich [:brendan]]

Brave to dive into the bytecode-resugaring hack that is the decompiler!

The patch fixes the testcase in comment 0, but not a variation that makes the initializing expression longer:

js> function(){ [[0 for (x in [])] for (y in []) ]; }
function () {
    [[0 for (x in [])] for (y in [])];
}
js> function(){ [[11 for (x in [])] for (y in []) ]; }
function () {
    [[11 for (x in [])1] for (y in [])];
}

More in a bit.

/be

Comment 3

[Brendan Eich [:brendan]]

Attachment: fix: retract to the point we're overwriting with Sprint

Typo, really -- when you get intermediate decompiler results replayed in the final result, it usually means a failure to pop or retract.

/be

Comment 4

[Brendan Eich [:brendan]]

Safe one character (!) fix for js1.7.

/be

Comment 5

[Robert Sayre]

Comment on attachment 235624 [details] [diff] [review]
fix: retract to the point we're overwriting with Sprint

> The patch fixes the testcase in comment 0, but not a variation that makes the
> initializing expression longer:
> 

yeah, I cancelled review when I figured that out. :)

r=sayrer

Comment 6

[Brendan Eich [:brendan]]

Fixed on trunk.

/be

Comment 7

[Mike Schroepfer]

Comment on attachment 235624 [details] [diff] [review]
fix: retract to the point we're overwriting with Sprint

a=schrep/beltnzer for drivers.

Comment 8

[Brendan Eich [:brendan]]

Fixed on the 1.8 branch.

/be

Comment 9

[Bob Clary [:bc] (inactive)]

Checking in regress-349648.js;
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-349648.js,v  <--  regress-349648.js
initial revision: 1.1

Comment 10

[Bob Clary [:bc] (inactive)]

verified fixed 1.8 20060828 windows/mac*/linux

Comment 11

[Bob Clary [:bc] (inactive)]

verified fixed 1.9 20060830 windows/mac*/linux