350666 - "delete y.(x)" in for's increment-expression expands to something containing a semicolon

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P2)

Description

[Jesse Ruderman]

> function () { for(;; delete y.(x)) { } }
function () { for (;; y.(x); true) { } }

Feeding that back into the JavaScript engine gives a syntax error:

"missing ) after for-loop control"

Comment 1

[Jesse Ruderman]

You don't need to use the new ".()" operator to trigger this bug; addition works too.

> function () { for(;; delete (y+x)) { } }
function () { for (;; y + x; true) { } }

This may or may not be the same bug:

> function () { let (y) delete (x+y); }
function () { x + y; let (y) true; }

Comment 2

[Brendan Eich [:brendan]]

Attachment: fix

We need a bytecode sequence that will decompile as an expression, not a statement.

/be

Comment 3

[Brendan Eich [:brendan]]

Fixed on trunk.

/be

Comment 4

[Brendan Eich [:brendan]]

Comment on attachment 237069 [details] [diff] [review]
fix

Another delete fix, this time to emit code that looks to the decompiler like an expression instead of a statement sequence.  Spot fix, easy to test, no non-local effects except to make the decompiler happy.

/be

Comment 5

[Mike Beltzner [:beltzner, not reading bugmail]]

Comment on attachment 237069 [details] [diff] [review]
fix

a=beltzner on behalf of 181drivers

Comment 6

[Brendan Eich [:brendan]]

Fixed on the 1.8 branch.

/be

Comment 7

[Bob Clary [:bc] (inactive)]

Checking in regress-350666.js;
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-350666.js,v  <--  regress-350666.js
initial revision: 1.1

Comment 8

[Bob Clary [:bc] (inactive)]

verified fixed 1.8 1.9 20060909 windows/mac*/linux