Closed Bug 352272 Opened 16 years ago Closed 16 years ago

Incorrect decompilation for "let" in argument to lvalue-returning function (involving post-increment)

Categories

(Core :: JavaScript Engine, defect, P1)

defect

Tracking

()

VERIFIED FIXED
mozilla1.8.1

People

(Reporter: jruderman, Assigned: brendan)

References

Details

(Keywords: testcase, verified1.8.1)

Attachments

(1 file)

Split from bug 352079.

./js -v 170

js> function() { f(let (y = 3) 4)++; }

function () {
    f(let (3 = 3) 4)++;
}
The patch for bug 350238 was wrong.  The code generator is a tree walker that emits postfix bytecode, so it should not elevate the stack model for that hidden GC root until after it was walked the TOK_INC/TOK_DEC node's kid.  That was how the code worked before the patch for bug 350238 went in.  Reverting that patch fixes this bug, but of course reopens that bug.

More in a bit.

/be
Depends on: 350238
OS: Mac OS X 10.4 → All
Priority: -- → P1
Hardware: Macintosh → All
Target Milestone: --- → mozilla1.8.1
Attached patch fixSplinter Review
Assignee: general → brendan
Status: NEW → ASSIGNED
Attachment #237924 - Flags: review?(mrbkap)
Attachment #237924 - Flags: review?(mrbkap) → review+
Comment on attachment 237924 [details] [diff] [review]
fix

This is important.

/be
Attachment #237924 - Flags: approval1.8.1?
Fixed on trunk.

Checking in jsemit.c;
/cvsroot/mozilla/js/src/jsemit.c,v  <--  jsemit.c
new revision: 3.208; previous revision: 3.207
done

/be
Status: ASSIGNED → RESOLVED
Closed: 16 years ago
Resolution: --- → FIXED
Comment on attachment 237924 [details] [diff] [review]
fix

a=schrep for 181drivers for JS decompiler fuzz bugs.
Attachment #237924 - Flags: approval1.8.1? → approval1.8.1+
Fixed on the 1.8 branch.

/be
Keywords: fixed1.8.1
Checking in regress-352272.js;
/cvsroot/mozilla/js/tests/js1_7/block/regress-352272.js,v  <--  regress-352272.js
initial revision: 1.1
done
Flags: in-testsuite+
verified fixed 1.8 20060914 windows/linux 1.9 20060914 windows/mac*/linux
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.