763313 - Braceless functions have their destructuring-args bytecode duplicated

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jesse Ruderman]

js> (function ([]) 1)
(function ([]) let [] = arguments[0];1)

jsfunfuzz noticed this bug because it makes decompilation introduce a syntax error in some contexts:

js> (function () {for (var x in (function ([]) 1)) {}})
(function () {for (var x in (function ([]) let [] = arguments[0];1)) {}})

Comment 1

[Jesse Ruderman]

js> dis(function ([]) 1)   
flags: LAMBDA EXPR_CLOSURE NULL_CLOSURE
loc     op
-----   --
main:
00000:  getarg 0
00003:  dup
00004:  pop
00005:  pop
00006:  getarg 0
00009:  dup
00010:  pop
00011:  pop
00012:  one
00013:  return
00014:  stop

Source notes:
 ofs  line    pc  delta desc     args
---- ---- ----- ------ -------- ------
  0:   14     3 [   3] decl     offset 2
  2:   14     9 [   6] decl     offset 2

Comment 2

[Jesse Ruderman]

Regression from bug 759498.

Comment 3

[:Benjamin Peterson]

Attachment: fix

Comment 4

[Jason Orendorff [:jorendorff]]

Comment on attachment 631769 [details] [diff] [review]
fix

Nice work. I dig the test.

Feel free to rename PNK_SEQ to something else. (If you want to clean this up more I'd be happy to review, but that's totally optional.)

Is PNX_DESTRUCT always set in this case? Can you assert it instead of checking?

Comment 5

[:Benjamin Peterson]

(In reply to Jason Orendorff [:jorendorff] from comment #4)
> Comment on attachment 631769 [details] [diff] [review]
> fix
> 
> Nice work. I dig the test.
> 
> Feel free to rename PNK_SEQ to something else. (If you want to clean this up
> more I'd be happy to review, but that's totally optional.)

What would I rename it to? I think PNK_SEQ is supposed to be a generic sequence of statements. It's also used somewhere in for loops, too.

> 
> Is PNX_DESTRUCT always set in this case? Can you assert it instead of
> checking?

No, PNK_SEQ appears in for loops, too.

Comment 6

[David Zbarsky (:dzbarsky)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/2bcd13a8efb3

Comment 7

[Matt Brubeck (:mbrubeck)]

https://hg.mozilla.org/mozilla-central/rev/2bcd13a8efb3