381196 - Incorrect decompilation for group assignment in |for| loop

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

js> (function() { for(; 0;) [] = [] })
function () {
    for (; 0;) {
    }
[] = []}

Found by jsfunfuzz because it causes a round-trip change.

Comment 1

[Ryan VanderMeulen [:RyanVM]]

Seems the behavior has changed.

js> (function() { for(; 0;) [] = [] })
(function () {for (; false;) {[] = [];}})

Comment 2

[Jesse Ruderman]

The new behavior looks correct. The group assignment stays inside the loop now.