352261 - Decompilation does not preserve explicit right-associativity

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Jesse Ruderman]

Example 1:

js> g = function(a,b,c) { return a - (b + c) }
function (a, b, c) {
    return a - b + c;
}
js> g(1, 10, 100)
-109

js> h = eval(uneval(g))
function (a, b, c) {
    return a - b + c;
}
js> h(1, 10, 100)
91


Example 2:

js> p = function (a,b,c) { return a + (b - c) }
function (a, b, c) {
    return a + b - c;
}
js> p(3, "4", "5")
2
js> q = eval(uneval(p))
function (a, b, c) {
    return a + b - c;
}

js> q(3, "4", "5")
29

Comment 1

[Brendan Eich [:brendan]]

Attachment: fix

Comment 2

[Brendan Eich [:brendan]]

Fixed on trunk.

/be

Comment 3

[Brendan Eich [:brendan]]

*** Bug 352277 has been marked as a duplicate of this bug. ***

Comment 4

[Mike Schroepfer]

Comment on attachment 237897 [details] [diff] [review]
fix

a=schrep for 181drivers for JS decompiler fuzz bugs.

Comment 5

[Brendan Eich [:brendan]]

Fixed on the 1.8 branch.

/be

Comment 6

[Bob Clary [:bc] (inactive)]

Checking in regress-352261.js;
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-352261.js,v  <--  regress-352261.js
initial revision: 1.1
done

Comment 7

[Bob Clary [:bc] (inactive)]

verified fixed 1.8 20060914 windows/linux 1.9 20060914 windows/mac*/linux