Bug 17027 – Incorrect Function.toString behaviour with read/modify/write operators performed on negative numbers

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Oliver Hunt]

Function.toString loses necessary parentheses when performing read/modify/write operations like >>>=, etc on *negative* numbers.

eg.
function f() {
   (-1) >>>= 1;
}
becomes
function f() {
  -1 >>>= 1;
}

[Darin Adler]

I think the trick here is that in SourceStream::operator<<(double) we need to treat the "-" sign from the negative number as an operator, since that's how the lexer is going to treat it.

Thus we need to check the precedence against the precedence of unary minus and set needParens in that case. This can all be fixed on the first line of that function where we initialize a needParens bool.

Assigning to myself, assuming that if Ollie was going to fix this he'd have assigned it to himself.

[Darin Adler]

I found an even better way to fix this, by just returning the appropriate precedence. I'll make the test exhaustive now.

[Oliver Hunt]

That's basically what i was thinking :D

However i decided to get food :D

[Darin Adler]

Created attachment 18715 [details]
patch

[Oliver Hunt]

Comment on attachment 18715 [details]
patch

r=m1, with the additional tests i requested on irc

[Darin Adler]

Committed revision 29815.