191276 - this[name] gives unexpected undefined with optimizer

Status: VERIFIED FIXED

(Rhino Graveyard :: Compiler, defect)

Description

[Igor Bukanov]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.0.1) Gecko/20021003
Build Identifier: Rhino CVS 2003-01-30

The following scripts when run in Rhino shell prints unexpected false, while the
interpreter mode prints correct true. Note that presence of never called
unused_function with test("a") line is essential, scripts work OK without it.
The bug presents at least since 1.5R3.

function test(name) { return this[name]; }

function unused_function() { test("a"); }

var result = test.call({ a: "aaa" }, "a");

var ok = (result === "aaa")

print(ok)


Reproducible: Always

Steps to Reproduce:
Run the test script against Rhino shell
Actual Results:  
false

Expected Results:  
true

Comment 1

[Igor Bukanov]

Attachment: The test case as a separated file

Comment 2

[Phil Schwartau]

Testcase added to JS testsuite:

      mozilla/js/tests/js1_5/Scope/regress-191276.js

However, I must say I do not get a failure when I run the testcase,
nor the above script. In both Rhino compiled and interpreted modes,
I get "true":

[ ] java org.mozilla.javascript.tools.shell.Main -f 191276.js
true
[ ] java org.mozilla.javascript.tools.shell.Main -opt -1 -f 191276.js
true

I am using this version of Java:

[ ] java -fullversion
java full version "1.4.1-b21"

However, it looks like my Ant compiler is using Java 1.3 to compile Rhino.
This is my $CLASSPATH variable:

D:\JS_trunk\mozilla\js\rhino\build\rhino1_5R4\js.jar;
D:\JS_TRUNK\mozilla\js\tests\src\jstests.jar;
D:\Ant\jakarta-ant-1.3\lib\ant.jar;
D:\Ant\jakarta-ant-1.3\lib\parser.jar;
D:\Ant\jakarta-ant-1.3\lib\jaxp.jar;
D:\jdk1.3.0_02\lib\tools.jar

I recently tried to change that last one to my jdk1.4.1 directory
(D:\jdk1.4.1\lib\tools.jar), but Ant did not recognize it, and I
had to change it back to jdk1.3.0_02 in order to compile Rhino.

Do you think I'm not seeing the bug because of compiler differences
like that? I am on WinNT4.0, by the way -

Comment 3

[Igor Bukanov]

For test to fail it is necessary to use an optimization level greater then 0.
This what I got when the test fails when run jsDriver with the rhino9 engine:



-*- executing: .../java org.mozilla.javascript.tools.shell.Main -opt 9  -f
./js1_5/shell.js -f ./js1_5/Scope/regress-191276.js
*-* Testcase js1_5/Scope/regress-191276.js failed:
Bug Number 191276
STATUS: Testing |this[name]| via Function.prototype.call(), apply()
Failure messages were:
FAILED!: [reported from test()] Section 1 of test -
FAILED!: [reported from test()] Type mismatch, expected type string, actual type
undefined
FAILED!: [reported from test()] Expected value 'aaa', Actual value 'undefined'
FAILED!: [reported from test()] 
FAILED!: [reported from test()] Section 2 of test -
FAILED!: [reported from test()] Type mismatch, expected type string, actual type
undefined
FAILED!: [reported from test()] Expected value 'aaa', Actual value 'undefined'
FAILED!: [reported from test()] 
FAILED!: [reported from test()] Section 3 of test -
FAILED!: [reported from test()] Type mismatch, expected type string, actual type
undefined
FAILED!: [reported from test()] Expected value 'aaa', Actual value 'undefined'
FAILED!: [reported from test()] 
FAILED!: [reported from test()] Section 4 of test -
FAILED!: [reported from test()] Type mismatch, expected type string, actual type
undefined
FAILED!: [reported from test()] Expected value 'aaa', Actual value 'undefined'
FAILED!: [reported from test()] 

Comment 4

[Igor Bukanov]

The reason for the bug is that omj/optimizer/Optimizer.java when optimizing code
for this[name] (see GETELEM switch, line 665,
http://lxr.mozilla.org/mozilla/source/js/rhino/src/org/mozilla/javascript/optimizer/Optimizer.java#665
) assumes a number context for GETELEM index node which is wrong.

Comment 5

[Igor Bukanov]

Attachment: Do not assume number context for index in x[i]

With the patch applied the test case passes and the number of the tests failing
with VerifyError with optimization level > 0 remains the same.

Comment 6

[Igor Bukanov]

CC to Roger: hopefully I did not miss something in the above patch.

Comment 7

[Igor Bukanov]

I commited the fix

Comment 8

[Igor Bukanov]

Marking fixed

Comment 9

[Phil Schwartau]

Verified FIXED. The above testcase now passes in the Rhino shell.
I tested with optimization levels set to -1, 0, 1, and 9.

Comment 10

[Igor Bukanov]

Targeting as resolved against 1.5R5