69559 - function f(o,s,x) {with(o) eval(s); return z;} not parsing correctly

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Phil Schwartau]

This bug evolved from bug 69441 (INVALID) against Rhino. This testcase
is currently passing in Rhino, but failing in SpiderMonkey: 

           js/tests/js1_5/Regress/regress-68498-004.js


FAILED!: Testing self.eval(str) inside a function; currently at expect[1]
FAILED!: Type mismatch, expected type number, actual type boolean
FAILED!: Expected value '44', Actual value 'true'


The core of the testcase is as follows: 

// Capture a reference to the global object -
var self = this;

// You shouldn't see this global variable's value in any printout -
var x = 'outer';

// This function is the heart of the test - 
function f(o,s,x) {with(o) eval(s); return z;};


// Run-time statements to pass to the eval inside f
sToEval += 'actual[0] = typeof g;'
sToEval += 'function g(){actual[1]=(typeof w == "undefined" || w); return x};'
sToEval += 'actual[2] = w;'
sToEval += 'actual[3] = typeof g;'
sToEval += 'var z=g();'


// Set the actual-results array. The next line will set actual[0] - actual[4]
actual[4] = f({w:44}, sToEval, 'inner');
actual[5] = 'z' in self && z;


/* Set the expected-results array.
expect[0] = 'function';
expect[1] = 44;
expect[2] = 44;
expect[3] = 'function';
expect[4] = 'inner';
expect[5] = false;


The test is failing because expect[1]=44, but actual[1]=true.
As Brendan explained in bug 69441, 

  "The reference in g to (typeof w) should search the activation  
  of g's scope chain, which is [Call(g), With(o), Call(f), global].  
  So (typeof w) should evaluate to 'number', because o.w is a number." 


But (typeof w) is evaluating to 'undefined'...

Comment 1

[Brendan Eich [:brendan]]

Need a fix today, so we can think about doing a SpiderMonkey JS1.5 RC3 by end of
week (Friday or Sunday, maybe Monday ;-).

/be

Comment 2

[Brendan Eich [:brendan]]

Attachment: proposed fix

Comment 3

[Brendan Eich [:brendan]]

Pretty straightforward, comments say most of what's going on.  There is some
diff "jitter" due to my moving assignments such as to fun under JSOP_CLOSURE
down to just before their first uses.  Reviewers, please give this patch some
quick love.

/be

Comment 4

[rogerl (gone)]

r=rogerl.

Comment 5

[John Bandhauer]

sr=jband

Comment 6

[Brendan Eich [:brendan]]

Fixed.

/be

Comment 7

[Phil Schwartau]

VERIFIED FIXED using JS shell built 2001-02-23 20:30 on Linux, Mac, and WinNT.