In the example function f() { (-1)[0]; } f.toString() produces: function f() { -1[0]; } which is invalid JS
Hmm, it would appear we get it wrong for all of the bracket nodes..
Created attachment 18707 [details] Fixeration
Comment on attachment 18707 [details] Fixeration r=me
Created attachment 18710 [details] updated patch Since I broke Ollie's patch with a little cleanup, I went ahead and updated this patch to work with the new code.
Created attachment 18713 [details] Updated fix This is a minor update to the prior patch to ensure "new (1)()" will work
Comment on attachment 18713 [details] Updated fix r=me
Fixed in r29813