423300 - delete f() -> SyntaxError: invalid assignment left-hand side

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P3)

Description

[x0]

User-Agent:       Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.8.1.12) Gecko/20080302 SeaMonkey/1.1.8
Build Identifier: js shell trunk

|delete f()| throws instead of returning true.


Reproducible: Always

Steps to Reproduce:
js> function f() {}
js> delete f()

Actual Results:  
typein:2: SyntaxError: invalid assignment left-hand side

Expected Results:  
true

Comment 1

[Christian :Biesinger (don't email me, ping me on IRC)]

try |delete f;|...

Comment 2

[Brendan Eich [:brendan]]

Biesi: no, x0 is right -- this apparently regressed on the 1.8 branch after 1.8.0 (js1.6), so during js1.7 development:

$ ../srcmoz180/Darwin_DBG.OBJ/js
js> function f(){}
js> delete f()
true
js> ^D
$ ../srcmoz18/Darwin_DBG.OBJ/js
js> function f(){}
js> delete f()
typein:2: SyntaxError: invalid assignment left-hand side
js> ^D

But what's happening is more subtle than a compile-time error being intoduced in contravention of ECMA-262:

js> function f(){}
js> function g(){delete f()}
js> dis(g)
main:
00000:  callname "f"
00003:  setcall 0
00006:  delelem
00007:  pop
00008:  stop

Source notes:
  0:     3 [   3] pcbase   offset 3
  2:     6 [   3] pcbase   offset 6

Indeed the exception comes from JSOP_SETCALL in js_Interpret:

(gdb) b js_ErrorToException 
Breakpoint 1 at 0x51aca: file jsexn.c, line 1173.
(gdb) r
Starting program: /Users/brendaneich/Hacking/trunk/mozilla/js/src/Darwin_DBG.OBJ/js 
functReading symbols for shared libraries . done
js> function f(){}
js> delete f()

Breakpoint 1, js_ErrorToException (cx=0x5001e0, message=0x501cf0 "invalid assignment left-hand side", reportp=0xbfffdf70) at jsexn.c:1173
1173        JS_ASSERT(reportp);
(gdb) bt
#0  js_ErrorToException (cx=0x5001e0, message=0x501cf0 "invalid assignment left-hand side", reportp=0xbfffdf70) at jsexn.c:1173
#1  0x00029e8b in ReportError (cx=0x5001e0, message=0x501cf0 "invalid assignment left-hand side", reportp=0xbfffdf70) at jscntxt.c:854
#2  0x0002aa71 in js_ReportErrorNumberVA (cx=0x5001e0, flags=0, callback=0x2af2f <js_GetErrorMessage>, userRef=0x0, errorNumber=129, charArgs=1, ap=0xbfffe000 "????????H???") at jscntxt.c:1187
#3  0x0001e085 in JS_ReportErrorNumber (cx=0x5001e0, errorCallback=0x2af2f <js_GetErrorMessage>, userRef=0x0, errorNumber=<incomplete type>) at jsapi.c:5462
#4  0x000f2f66 in js_Interpret (cx=0x5001e0) at jsinterp.c:4994

Confirming, and I'm giving x0 canconfirm and editbugs privs.

/be

Comment 3

[Brendan Eich [:brendan]]

Well, that was painful. Bugzilla kept trying to use [e-mail] as the real name for [e-mail]. x0, it would be great if you could give a nick or true name, but I think I managed to get your account back to the way it was -- plus, you should have canconfirm and editbugs privileges. Please mail me if you have any problems. Sorry for the excessive password resets.

/be

Comment 4

[x0]

Brendan, you have already given me the nick (and privileges), but that's ok.

In 1.6, delete f() didn't use setcall, so it didn't hit the code that throws:

js> function f() {}
js> function g() {delete f()}
js> dis(g)
main:
00000:  name "f"
00003:  pushobj
00004:  call 0
00007:  pop
00008:  true
00009:  pop

Source notes:
  0:     4 [   4] pcbase   offset 4

Probably bug 356693 changed that.

Comment 5

[Brendan Eich [:brendan]]

Attachment: fix

Comment 6

[Brendan Eich [:brendan]]

Fix is safe, but is it important to get into 1.9/Firefox 3? Does ACID3 test it? Or does something likewise marginal yet high-profile want a fix?

/be

Comment 7

[Brendan Eich [:brendan]]

Comment on attachment 310052 [details] [diff] [review]
fix

Trivial fix for ECMA-262 purity points. Would like to get it out of my patch queue.

/be

Comment 8

[Brendan Eich [:brendan]]

Makes testing bug 421864 patches hard, will roll up the fix there (it has to change trivially to track that bug's patch).

/be

Comment 9

[Mike Beltzner [:beltzner, not reading bugmail]]

Comment on attachment 310052 [details] [diff] [review]
fix

a1.9=beltzner

Comment 10

[Brendan Eich [:brendan]]

Fixed:

js/src/jsinterp.c 3.479

/be

Comment 11

[Bob Clary [:bc] (inactive)]

verified linux|windows|mac

/cvsroot/mozilla/js/tests/ecma_3/Operators/11.4.1-002.js,v  <--  11.4.1-002.js
initial revision: 1.1