352272 - Incorrect decompilation for "let" in argument to lvalue-returning function (involving post-increment)

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Jesse Ruderman]

Split from bug 352079.

./js -v 170

js> function() { f(let (y = 3) 4)++; }

function () {
    f(let (3 = 3) 4)++;
}

Comment 1

[Brendan Eich [:brendan]]

The patch for bug 350238 was wrong.  The code generator is a tree walker that emits postfix bytecode, so it should not elevate the stack model for that hidden GC root until after it was walked the TOK_INC/TOK_DEC node's kid.  That was how the code worked before the patch for bug 350238 went in.  Reverting that patch fixes this bug, but of course reopens that bug.

More in a bit.

/be

Comment 2

[Brendan Eich [:brendan]]

Attachment: fix

Comment 3

[Brendan Eich [:brendan]]

Comment on attachment 237924 [details] [diff] [review]
fix

This is important.

/be

Comment 4

[Brendan Eich [:brendan]]

Fixed on trunk.

Checking in jsemit.c;
/cvsroot/mozilla/js/src/jsemit.c,v  <--  jsemit.c
new revision: 3.208; previous revision: 3.207
done

/be

Comment 5

[Mike Schroepfer]

Comment on attachment 237924 [details] [diff] [review]
fix

a=schrep for 181drivers for JS decompiler fuzz bugs.

Comment 6

[Brendan Eich [:brendan]]

Fixed on the 1.8 branch.

/be

Comment 7

[Bob Clary [:bc] (inactive)]

Checking in regress-352272.js;
/cvsroot/mozilla/js/tests/js1_7/block/regress-352272.js,v  <--  regress-352272.js
initial revision: 1.1
done

Comment 8

[Bob Clary [:bc] (inactive)]

verified fixed 1.8 20060914 windows/linux 1.9 20060914 windows/mac*/linux