Segfaults in increment and decrement operators have been fixed.

diff --git a/njs/njs_generator.c b/njs/njs_generator.c
index 72bc6e98102522edbae7b624e3833952d10fac15..a262638e275129f9470069286f8f3916886d2de0 100644 (file)
--- a/njs/njs_generator.c
+++ b/njs/njs_generator.c
@@ -21,6 +21,7 @@
 #include <njs_variable.h>
 #include <njs_parser.h>
 #include <string.h>
+#include <stdio.h>
 
 
 static nxt_int_t njs_generator(njs_vm_t *vm, njs_parser_t *parser,
@@ -1848,7 +1849,8 @@ njs_generate_inc_dec_operation(njs_vm_t *vm, njs_parser_t *parser,
     if (node->dest != NULL) {
         dest_index = node->dest->index;
 
-        if (dest_index != lvalue->left->index
+        if (dest_index != NJS_INDEX_NONE
+            && dest_index != lvalue->left->index
             && dest_index != lvalue->right->index)
         {
             node->index = dest_index;

diff --git a/njs/test/njs_unit_test.c b/njs/test/njs_unit_test.c
index c0e700fc2ffef071416ee3da16d0b202fde43543..f1e9fa86daf0dc96d8ee26d6c6b76f92617c319e 100644 (file)
--- a/njs/test/njs_unit_test.c
+++ b/njs/test/njs_unit_test.c
@@ -471,6 +471,9 @@ static njs_unit_test_t  njs_test[] =
     { nxt_string("[[]+[]]-[]+[[]-[]]"),
       nxt_string("00") },
 
+    { nxt_string("!--[][1]"),
+      nxt_string("true") },
+
     { nxt_string("'true' == true"),
       nxt_string("false") },