492445 - Narcissus - invalid evaluation of nested ternaries

Status: RESOLVED WONTFIX

(Other Applications Graveyard :: Narcissus, defect)

Description

[crisp]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.9.0.10) Gecko/2009042316 Firefox/3.0.10 (.NET CLR 3.5.30729)
Build Identifier: 

a?b?c:d:e; is actually evaluated as a?b:c?d:e;

Reproducible: Always




This bug was introduced by the fix in https://bugzilla.mozilla.org/show_bug.cgi?id=401405 but it goes back to https://bugzilla.mozilla.org/show_bug.cgi?id=330975

I'm not sure what the status of Narcissus is, but it is used in derivate works in which this should be a blocking issue

Comment 1

[crisp]

Attachment: Patch to jsparse.js

Proposed patch

Comment 2

[Blake Kaplan (:mrbkap) (inactive)]

crisp, could you attach a unified diff (preferred arguments are -pU8)? Also, a testcase would be great, too. Tentatively confirming this, pending the testcase.

Comment 3

[crisp]

testcase:

var b = true, c = false;
var a = b ? c ? 1 : 2 : 3;
alert(a);

should alert '2', but alerts 'false'

Comment 4

[crisp]

Attachment: Proposed patch (unified diff)

Comment 5

[Sylvestre Ledru [:Sylvestre]]

Closing as Narcissus isn't maintained anymore.