Bug 19027 - SquirrelFish: Incorrect codegen for pre-increment
Summary: SquirrelFish: Incorrect codegen for pre-increment
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Mac OS X 10.5
: P1 Blocker
Assignee: Nobody
URL: javascript:try {(valueThrower={valueO...
Keywords:
Depends on:
Blocks:
 
Reported: 2008-05-13 04:05 PDT by Oliver Hunt
Modified: 2008-05-13 22:26 PDT (History)
3 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Oliver Hunt 2008-05-13 04:05:58 PDT
This hideous URL results in bogus behaviour:
javascript:try {(valueThrower={valueOf:function(){throw "throw from valueOf"}}, function () { executedRHS = false; var result = 'PASS'; try { result = ++valueThrower; alert('FAIL: Did not throw exception') } catch (e) { if (result != 'PASS' && executedRHS) { alert('FAIL: "'+expr+'" threw exception, but modified assignment target and executed RHS'); } else if (result != 'PASS') { alert('FAIL: "'+expr+'" threw exception, but modified assignment target'); } else if (executedRHS) { alert('FAIL: "'+expr+'" threw exception, but executed right hand half of expression') } else { alert('PASS: handled correctly') } } })()}catch(e){alert("Shouldn't receive: "+e);}
Comment 1 Oliver Hunt 2008-05-13 22:26:12 PDT
	M	JavaScriptCore/ChangeLog
	M	JavaScriptCore/VM/CodeBlock.cpp
	M	JavaScriptCore/VM/CodeGenerator.cpp
	M	JavaScriptCore/VM/CodeGenerator.h
	M	JavaScriptCore/VM/Machine.cpp
	M	JavaScriptCore/VM/Opcode.h
	M	JavaScriptCore/kjs/nodes.cpp
	M	LayoutTests/ChangeLog
	M	LayoutTests/fast/js/exception-sequencing-expected.txt
	M	LayoutTests/fast/js/exception-sequencing.html
Committed r33432