351496 - "let (y = 3)" in "case" expression decompiles as "let (3 = 3)"

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P2)

Description

[Jesse Ruderman]

js> function() { switch(0) { case let(y = 3) 6: } }

function () {
    switch (0) {
      case let (3 = 3) 6:
      default:;
    }
}

Comment 1

[Brendan Eich [:brendan]]

Attachment: fix

Comment 2

[Brendan Eich [:brendan]]

Fixed on trunk.

/be

Comment 3

[Brendan Eich [:brendan]]

Comment on attachment 237276 [details] [diff] [review]
fix

This is a safe fix for a failure to model the stack accurately.  It causes the model to have fewer items on it than expected, which could lead to bad memory conditions.  In the specific testcase given in this bug, the only result is a mis-decompilation.  But I would rather not take changes, and the fix correctly matches the code generator's stack model.

/be

Comment 4

[Brendan Eich [:brendan]]

Comment on attachment 237276 [details] [diff] [review]
fix

Something's bad, this patch leads to decompiler string stack overflow.

/be

Comment 5

[Brendan Eich [:brendan]]

Attachment: fix, v2

Two bugs:
1.  EmitSwitch failed to link the SRC_PCDELTA of the last case to the implicit JSOP_DEFAULT it generated after all the cases.  This made switch(x){case y:z} decompile with default: labeling z along with case y: !

2.  Fixed DecompileSwitch to manage the stack model correctly for the case label / statements order in which it processes bytecode, which does not match the code genartion order (case labels before any case statements -- the JSOP_CASE stack balance of -1 for mismatch instead of -2 for match favors the code gen order, relieving it of the need to fiddle with cg->stackDepth -- the decompiler loses).

/be

Comment 6

[Brendan Eich [:brendan]]

Fixed on trunk.

/be

Comment 7

[Brendan Eich [:brendan]]

Comment on attachment 237297 [details] [diff] [review]
fix, v2

Straight-up fixes, local to their containing functions except for the good effects of the EmitSwitch fix on the decompilation of switch statements that use variables in case labels and have no explicit default case.

/be

Comment 8

[Mike Schroepfer]

Comment on attachment 237297 [details] [diff] [review]
fix, v2

a=schrep for drivers.

Comment 9

[Brendan Eich [:brendan]]

Fixed on the 1.8 branch.

/be

Comment 10

[Bob Clary [:bc] (inactive)]

Checking in regress-351496.js;
/cvsroot/mozilla/js/tests/js1_7/block/regress-351496.js,v  <--  regress-351496.js
initial revision: 1.1
done

Comment 11

[Bob Clary [:bc] (inactive)]

verified fixed 1.8 1.9 20060909 windows/mac*/linux