396969 - bitwise and shift ops evaluate operands in reverse order, contrary to ECMA-262

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P3)

Description

[Brendan Eich [:brendan]]

js> o = {valueOf:function (){print('o.valueOf');return this.value}, value:42}
[object Object]
js> p = {valueOf:function (){print('p.valueOf');return this.value}, value:2}  
[object Object]
js> print(o >> p)
p.valueOf
o.valueOf
10

etc. for <<, >>>, &, ^, and |. Patch next.

/be

Comment 1

[Brendan Eich [:brendan]]

Attachment: fix

Comment 2

[Igor Bukanov]

Comment on attachment 281726 [details] [diff] [review]
fix

FETCH_INT looks so innocent, but since it can run arbitrary JS, the ordering is important.

Comment 3

[Brendan Eich [:brendan]]

Fixed on trunk:

js/src/jsinterp.c 3.376

/be

Comment 4

[Bob Clary [:bc] (inactive)]

/cvsroot/mozilla/js/tests/ecma_3/Expressions/11.10-01.js,v  <--  11.10-01.js
initial revision: 1.1

/cvsroot/mozilla/js/tests/ecma_3/Expressions/11.10-02.js,v  <--  11.10-02.js
initial revision: 1.1

/cvsroot/mozilla/js/tests/ecma_3/Expressions/11.7.1-01.js,v  <--  11.7.1-01.js
initial revision: 1.1

/cvsroot/mozilla/js/tests/ecma_3/Expressions/11.7.2-01.js,v  <--  11.7.2-01.js
initial revision: 1.1

/cvsroot/mozilla/js/tests/ecma_3/Expressions/11.7.3-01.js,v  <--  11.7.3-01.js
initial revision: 1.1

Comment 5

[Bob Clary [:bc] (inactive)]

fix ecma section
/cvsroot/mozilla/js/tests/ecma_3/Expressions/11.7.3-01.js,v  <--  11.7.3-01.js
new revision: 1.2; previous revision: 1.1

Comment 6

[Bob Clary [:bc] (inactive)]

verified fixed 1.9.0 linux|mac|win

Comment 7

[Bob Clary [:bc] (inactive)]

I somehow managed to miss checking this test in, but have been running it locally none the less. 

Checking in 11.10-03.js;
/cvsroot/mozilla/js/tests/ecma_3/Expressions/11.10-03.js,v  <--  11.10-03.js
initial revision: 1.1