Closed Bug 492445 Opened 11 years ago Closed 2 years ago

Narcissus - invalid evaluation of nested ternaries

Categories

(Other Applications Graveyard :: Narcissus, defect)

x86
Windows XP
defect
Not set
normal

Tracking

(Not tracked)

RESOLVED WONTFIX

People

(Reporter: crisp, Unassigned)

Details

Attachments

(1 file, 1 obsolete file)

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.9.0.10) Gecko/2009042316 Firefox/3.0.10 (.NET CLR 3.5.30729)
Build Identifier: 

a?b?c:d:e; is actually evaluated as a?b:c?d:e;

Reproducible: Always




This bug was introduced by the fix in https://bugzilla.mozilla.org/show_bug.cgi?id=401405 but it goes back to https://bugzilla.mozilla.org/show_bug.cgi?id=330975

I'm not sure what the status of Narcissus is, but it is used in derivate works in which this should be a blocking issue
Attached patch Patch to jsparse.js (obsolete) — Splinter Review
Proposed patch
crisp, could you attach a unified diff (preferred arguments are -pU8)? Also, a testcase would be great, too. Tentatively confirming this, pending the testcase.
Status: UNCONFIRMED → NEW
Ever confirmed: true
testcase:

var b = true, c = false;
var a = b ? c ? 1 : 2 : 3;
alert(a);

should alert '2', but alerts 'false'
Attachment #376810 - Attachment is obsolete: true
Assignee: general → nobody
Component: JavaScript Engine → Narcissus
Product: Core → Other Applications
Closing as Narcissus isn't maintained anymore.
Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → WONTFIX
Product: Other Applications → Other Applications Graveyard
You need to log in before you can comment on or make changes to this bug.