351597 - Incorrect decompilation with "new" operator and extra parens

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Jesse Ruderman]

js> function() { new ((x=a))(y) }     
function () {
    new x = a(y);
}

Attempting to compile the result gives me "invalid assignment left-hand side".

I suspect this is a regression from bug 350531.

Comment 1

[Brendan Eich [:brendan]]

Yes -- my exhaustive tester did not handle all operators.  It should, because untested == broken.  Fix coming up here, and I'll work on the test more today.

/be

Comment 2

[Brendan Eich [:brendan]]

Attachment: one-line (9 char!) fix

Two JSOP_GROUPs in a row (we should peephole optimize those away, in a future bug fix patch) meant that the stacked op for the callee was JSOP_GROUP instead of the low-precedence JSOP_SETNAME when we got to JSOP_NEW.

/be

Comment 3

[Brendan Eich [:brendan]]

Fixed on trunk.

/be

Comment 4

[Brendan Eich [:brendan]]

Comment on attachment 237008 [details] [diff] [review]
one-line (9 char!) fix

This is a completely safe fix to a regression from the patch for bug 350531.  It fulfills the intent of that bug's fix: to leave parenthesization to the postfix-to-infix precedence-based logic in the decompiler, instead of trying to guess which JSOP_GROUPs should turn into parens around their operand.

/be

Comment 5

[Bob Clary [:bc] (inactive)]

Checking in regress-351597.js;
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-351597.js,v  <--  regress-351597.js
initial revision: 1.1

Comment 6

[Mike Beltzner [:beltzner, not reading bugmail]]

Comment on attachment 237008 [details] [diff] [review]
one-line (9 char!) fix

a=beltzner on behalf of 181drivers

Comment 7

[Brendan Eich [:brendan]]

Fixed on the 1.8 branch.

/be

Comment 8

[Bob Clary [:bc] (inactive)]

verified fixed 1.9a1_2006090707 windows/mac*/linux

Comment 9

[Bob Clary [:bc] (inactive)]

verified fixed 1.8 1.9 20060909 windows/mac*/linux