Incorrect decompilation with "new" operator and extra parens

VERIFIED FIXED in mozilla1.8.1

Status

()

Product:
Core
Component:
JavaScript Engine
Importance:
P1
normal
Status:
VERIFIED FIXED
Reported:
13 years ago
Modified:
13 years ago

People

(Reporter: jruderman, Assigned: brendan)

Tracking

(Blocks: 1 bug, {regression, testcase, verified1.8.1})

Version:
Trunk
Target:
mozilla1.8.1
Keywords:
regression, testcase, verified1.8.1
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(1 attachment)

one-line (9 char!) fix
1.07 KB, patch
mrbkap
: review+
beltzner
: approval1.8.1+
Details | Diff | Splinter Review
(Reporter)

Description

•
13 years ago 
js> function() { new ((x=a))(y) }     
function () {
    new x = a(y);
}

Attempting to compile the result gives me "invalid assignment left-hand side".

I suspect this is a regression from bug 350531.
 (Assignee)

Comment 1

•
13 years ago 
Yes -- my exhaustive tester did not handle all operators.  It should, because untested == broken.  Fix coming up here, and I'll work on the test more today.

/be
Assignee: general → brendan
Depends on: 350531
OS: Mac OS X 10.4 → All
Priority: -- → P1
Hardware: Macintosh → All
Target Milestone: --- → mozilla1.8.1
 (Assignee)

Updated

•
13 years ago
Status: NEW → ASSIGNED
 (Assignee)

Comment 2

•
13 years ago 
Created attachment 237008 [details] [diff] [review]
one-line (9 char!) fix

Two JSOP_GROUPs in a row (we should peephole optimize those away, in a future bug fix patch) meant that the stacked op for the callee was JSOP_GROUP instead of the low-precedence JSOP_SETNAME when we got to JSOP_NEW.

/be
Attachment #237008 - Flags: review?(mrbkap)
Attachment #237008 - Flags: review?(mrbkap) → review+
 (Assignee)

Comment 3

•
13 years ago 
Fixed on trunk.

/be
Status: ASSIGNED → RESOLVED
Last Resolved: 13 years ago
Resolution: --- → FIXED
 (Assignee)

Comment 4

•
13 years ago 
Comment on attachment 237008 [details] [diff] [review]
one-line (9 char!) fix

This is a completely safe fix to a regression from the patch for bug 350531.  It fulfills the intent of that bug's fix: to leave parenthesization to the postfix-to-infix precedence-based logic in the decompiler, instead of trying to guess which JSOP_GROUPs should turn into parens around their operand.

/be
Attachment #237008 - Flags: approval1.8.1?

Comment 5

•
13 years ago 
Checking in regress-351597.js;
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-351597.js,v  <--  regress-351597.js
initial revision: 1.1
Flags: in-testsuite+

Comment 6

•
13 years ago 
Comment on attachment 237008 [details] [diff] [review]
one-line (9 char!) fix

a=beltzner on behalf of 181drivers
Attachment #237008 - Flags: approval1.8.1? → approval1.8.1+
 (Assignee)

Comment 7

•
13 years ago 
Fixed on the 1.8 branch.

/be
Keywords: fixed1.8.1

Comment 8

•
13 years ago 
verified fixed 1.9a1_2006090707 windows/mac*/linux
Status: RESOLVED → VERIFIED

Comment 9

•
13 years ago 
verified fixed 1.8 1.9 20060909 windows/mac*/linux
Keywords: fixed1.8.1 → verified1.8.1
You need to log in before you can comment on or make changes to this bug.