Last Comment Bug 620567 - Function.prototype.toString relocates parentheses, changing syntax tree
: Function.prototype.toString relocates parentheses, changing syntax tree
Status: RESOLVED DUPLICATE of bug 559438
:
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: unspecified
: x86 All
: -- normal (vote)
: ---
Assigned To: general
:
Mentors:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2010-12-20 16:10 PST by Matthew Flaschen
Modified: 2010-12-20 18:19 PST (History)
1 user (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments

Description Matthew Flaschen 2010-12-20 16:10:49 PST
User-Agent:       Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; CMNTDF; .NET4.0C; InfoPath.3; AskTbARS/5.8.0.12304)
Build Identifier: 3.6.13

This simple example demonstrates that Function.prototype.toString returns a string with a different syntax tree from the original:

function f() { var a = '', b = '1', c = '2'; return a + '(' + (+b + +c) + ')'; }; 
f.toString(); 

The parentheses are relocated.  This caused a real problem in a Greasemonkey script, as explained at http://stackoverflow.com/questions/4469044/problem-with-type-coercion-and-string-concatenation-in-javascript-in-greasemonkey

Reproducible: Always
Comment 1 Boris Zbarsky [:bz] 2010-12-20 18:19:42 PST
So what apparently happened here is that bug was fixed on m-c back in Sept 2009, then merged to the 1.9.2 release branch.  This had a bug that caused us to drop those parens altogether.  Then there was a bogo-fix for that in bug 530537 which apparently made us put the parens in the wrong place (though maybe only on branch?  I don't see that behavior with trunk builds that I tested.

Finally, things were fixed correctly in bug 559438.

Marking duplicate of bug 559438, which is where the patch that would need backporting to 1.9.2 lives.

*** This bug has been marked as a duplicate of bug 559438 ***

Note You need to log in before you can comment on or make changes to this bug.