REGRESSION: JSC can't round trip an object literal

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Oliver Hunt]

JSC looses a pair of parenthesis when performing toString on a function, so that
  function f(){
   ({}).x;
  }
  f.toString()
produces
  function f(){
   {}.x;
  }
which is invalid.

This was found by jsfunfuzz

[Oliver Hunt]

I have a one line fix for this

[Sam Weinig]

This is a regression from shipping Safari.

[Jesse Ruderman]

toSource and uneval have to put parens around functions, but toString doesn't have to.  JSC's current behavior matches Spidermonkey.

[Jesse Ruderman]

Never mind, I misread the bug.

[Oliver Hunt]

this also occurs with function expressions

[Oliver Hunt]

I was wrong, it looks like our current funciton expression behaviour is sufficient

[Oliver Hunt]

Created attachment 18697 [details]
Patch to fix the bug

[Darin Adler]

Comment on attachment 18697 [details]
Patch to fix the bug

r=me

But is this a bug fix or not?

[Oliver Hunt]

Comment on attachment 18697 [details]
Patch to fix the bug

This is a bug fix -- the current code means Function.toString can produce incorrect code.

Maciej suggested an approach that would not use unnecessary ()'s for object literals.

[Oliver Hunt]

Created attachment 18699 [details]
New version of fix

No longer introduce unnecessary ()'s

[Maciej Stachowiak]

Comment on attachment 18699 [details]
New version of fix

r=me

[Oliver Hunt]

Landed r29802