217754 - Optimized stand-alone version doesn't work when built with js.mdp

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Steve Teale]

User-Agent:       Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)
Build Identifier: Spidermonkey 1.5

I built js32.dll using VC6. VC5 is problematic, it's difficult to find a copy 
of it these days. Everything seemed to build OK in debug and release 
configurations (I've indluded the .dsp and .dsw files). However, with the 
release version I immediately ran into problems with a script. I chopped  back 
to something pretty minimal:

function foo(a, b)
{
   return a+b;
}
print(foo(1, 2));

Problem:

With a release version built with VC6 and optimization, the script fails with 
error

bug.js:3: ReferenceError: a is not defined

It works OK without optimization. In that case it passes twice through the 
JSOP_NAME opcode, which is followed by opcodes 57, 63, 88, 58, 84, 84, 27, 5, 
58 (... call, getarg, getarg, add, return, call) - seems reasonable). In the 
optimized case it goes much the same until after the second JSOP_NAME, but then 
the sequence is 57, 63, 88, 58, 59. This last JSOP_NAME (59) fails to find a 
property, and the interpreter quits with the ReferenceError message.

I put some debug printf statements into jsobj.c (js_FindProperty()) and 
jsinterp.c (case JSOP_NAME:) which produced the following output. Hope this 
helps.

Release Default optimization

D:\js\src\Release>jsshell bug.js
pc = 412e94, endpc = 412eab
op = 125
pc = 412e97, endpc = 412eab
op = 0
pc = 412e98, endpc = 412eab
op = 59
JSOP_NAME
Finding property
prop = 2fbc18, obj = 2f7b40, entry-obj = 2f7b40 3140808 3140808
prop = 2fbc18
A
B
Valid slot 10
SPROP_HAS_VALID_SLOT slot = 10, rval = 3112272
depth = 6, rval = 3112272
pc = 412e9b, endpc = 412eab
op = 57
pc = 412e9c, endpc = 412eab
op = 59
JSOP_NAME
Finding property
prop = 2fc094, obj = 2f7b40, entry-obj = 2f7b40 4268136 4268136
prop = 2fc094
A
B
Valid slot 27
SPROP_HAS_VALID_SLOT slot = 27, rval = 3112792
depth = 6, rval = 3112792
pc = 412e9f, endpc = 412eab
op = 57
pc = 412ea0, endpc = 412eab
op = 63
pc = 412ea1, endpc = 412eab
op = 88
pc = 412ea4, endpc = 412eab
op = 58
pc = 2ffeec, endpc = 2ffef4
op = 84
pc = 2ffeef, endpc = 2ffef4
op = 84
pc = 2ffef2, endpc = 2ffef4
op = 27
pc = 2ffef3, endpc = 2ffef4
op = 5
pc = 412ea7, endpc = 412eab
op = 58
3
pc = 412eaa, endpc = 412eab
op = 2

Release Maximize speed optimization

D:\js\src\Release>jsshell bug.js
pc = 412eac, endpc = 412ec3
op = 125
pc = 412eaf, endpc = 412ec3
op = 0
pc = 412eb0, endpc = 412ec3
op = 59
JSOP_NAME
Finding property
prop = 2fbc18, obj = 2f7b40, entry-obj = 2f7b40 3140808 3140808
prop = 2fbc18
A
B
Valid slot 10
SPROP_HAS_VALID_SLOT slot = 10, rval = 3112272
depth = 6, rval = 3112272
pc = 412eb3, endpc = 412ec3
op = 57
pc = 412eb4, endpc = 412ec3
op = 59
JSOP_NAME
Finding property
prop = 2fc094, obj = 2f7b40, entry-obj = 2f7b40 4268136 4268136
prop = 2fc094
A
B
Valid slot 27
SPROP_HAS_VALID_SLOT slot = 27, rval = 3112792
depth = 6, rval = 3112792
pc = 412eb7, endpc = 412ec3
op = 57
pc = 412eb8, endpc = 412ec3
op = 63
pc = 412eb9, endpc = 412ec3
op = 88
pc = 412ebc, endpc = 412ec3
op = 58
pc = 2ffeec, endpc = 2ffef4
op = 59
JSOP_NAME
Finding property
prop = 0, obj = 2f7b40, entry-obj = 0 4268280 0
prop = 0
bug.js:3: ReferenceError: a is not defined


Reproducible: Always

Steps to Reproduce:
As details
Actual Results:  
As details

Comment 1

[Phil Schwartau]

We've fixed several bugs affecting optimized builds on Windows. See:

bug 140852  "String(819187200000) == '8191871:0000' in xpcshell, browser"
bug 160602  "Large integers, e.g. getTime(), causing crash at 0x39393929"
bug 151066  "Crash calling 'Variables' in jsparse.c"
bug 160592  "Need to update js.mak, Makefile.ref, etc. for opt builds"


In particular, the last two were solved by adding /OPT:REF /OPT:NOICF
to the linker flags for optimized builds on Win32. 

I don't know if that has any bearing here, since I believe we've 
added those flags into all the Win32 build systems (bug 160592).

Comment 2

[Phil Schwartau]

Compare bug 217890, "SpiderMonkey engine interprets JavaScript differently
in a release vs debug build in 1.5RC5 and 1.5RC5a"

Comment 3

[Steve Teale]

Attachment: ZIP file - .dsw and .dsp files with linker optimization flags

Optimized release build with the flags suggested by pschwartau fixes the
reported problem.

Comment 4

[Steve Teale]

I built project files from js.mdp. So it looks like the /OPT:REF and /OPT/NOICF 
changes didn't make it through to the .mdp file. Maybe VC4 is a bit old, and 
Spidermonkey should be using VC5/VC6 .dsw/.dsp files.

Comment 5

[Phil Schwartau]

Updating Summary

from: "Optimized stand-alone version doesn't work when built with VC6"
  to: "Optimized stand-alone version doesn't work when built with js.mdp"

and Status Whiteboard to 

      "need to add /OPT:REF /OPT:NOICF to linker flags; see Comment #1"

Comment 6

[Phil Schwartau]

*** Bug 217890 has been marked as a duplicate of this bug. ***

Comment 7

[Brendan Eich [:brendan]]

No longer needed due to fix for bug 398609.

/be