380506 - bug 349650 regressed nested-for and for-if comprehension decompilation

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Brendan Eich [:brendan]]

The patch for bug 349650 broke cases like these:

js> function (){return [i*i for(i in [0]) if (i%2)]}
function () {
    return [i * i for (i in [0]) if (i % 2)];
}
js> function (){return [i*j for(i in [0]) for (j in [1])]}
function () {
    return [i * j for (i in [0]) for (j in [1])];
}

This shows correct behavior. With the bug, nothing after the for (i in [0]) survives inside the comprehension.

/be

Comment 1

[Brendan Eich [:brendan]]

I thought we had testcases covering for-for and for-if comprehensions, and fuzzer coverage to boot -- Jesse, can you add these cases to the fuzzer?

/be

Comment 2

[Jesse Ruderman]

I'll make sure that jsfunfuzz tests for-for and for-if comprehensions.  But it wouldn't have found this bug, because its testing of decompilation is limited to making sure the decompiled code compiles and does not change during a round trip.

Comment 3

[Jesse Ruderman]

This is all good now that bug 380237 is fixed.

Comment 4

[Bob Clary [:bc] (inactive)]

/cvsroot/mozilla/js/tests/js1_7/decompilation/regress-380506.js,v  <--  regress-380506.js
initial revision: 1.1

Comment 5

[Bob Clary [:bc] (inactive)]

verified fixed 1.9.0 linux/mac*/windows.