355023 - destructuring assignment (group assignment) optimized too much

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P2)

Description

[shutdown]

$ js -v 170
js> Array.prototype[0] = 1024;
1024
js> (function(){ var a=[],[x]=a; print(x); })();
1024
js> (function(){ var [x]=[]; print(x); })();
undefined

Comment 1

[Jesse Ruderman]

The special, optimized case of [...] = [...] is called "group assignment", so I added that phrase to the summary.

Comment 2

[Brendan Eich [:brendan]]

This can wait for 1.8.1.1.

/be

Comment 3

[Brendan Eich [:brendan]]

Attachment: simple but suboptimal fix

With more work and more code, EmitGroupAssignment could budget more stack and emit more code.  Worth it for this hard case?  I think not.

/be

Comment 4

[Brendan Eich [:brendan]]

Fixed on trunk:

Checking in jsemit.c;
/cvsroot/mozilla/js/src/jsemit.c,v  <--  jsemit.c
new revision: 3.223; previous revision: 3.222
done

/be

Comment 5

[Bob Clary [:bc] (inactive)]

Checking in regress-355023.js;
/cvsroot/mozilla/js/tests/js1_7/regress/regress-355023.js,v  <--  regress-355023.js
initial revision: 1.1
done

Comment 6

[Bob Clary [:bc] (inactive)]

verified fixed 1.9 20061007 windows/linux

Comment 7

[Daniel Veditz [:dveditz]]

Comment on attachment 240839 [details] [diff] [review]
simple but suboptimal fix

approved for 1.8 branch, a=dveditz for drivers

Comment 8

[Brendan Eich [:brendan]]

Fixed on the 1.8 branch:

Checking in jsemit.c;
/cvsroot/mozilla/js/src/jsemit.c,v  <--  jsemit.c
new revision: 3.128.2.56; previous revision: 3.128.2.55
done

/be

Comment 9

[Bob Clary [:bc] (inactive)]

verified fixed 20061122 1.8.1.1 windows/linux/mac, 1.9 windows/linux