BBS:      TELESC.NET.BR
Assunto:  get_all_msg_headers(): cold *_NULL fields read undefined via dot-acces
De:       Rob Swindell
Data:     Sat, 23 May 2026 22:56:05 -0700
-----------------------------------------------------------
https://gitlab.synchro.net/main/sbbs/-/issues/1143#note_9040

**Fixed in `edf752429` (master)  option (1) from the discussion**

Took the minimum surgical fix: dropped `JSOPTION_JIT` from `JAVASCRIPT_OPTIONS` (`sbbsdefs.h:69`, `0x810`  `0x10`), and reverted the two prior workarounds (`ca448cb8b`, `666ff71ce`) since they were diagnosing the wrong cache. Kept `JSOPTION_COMPILE_N_GO`.

### Verified end-to-end on Windows/MSVC against the live VERT mail base

Build: Win32 Release `sbbs.dll` + `jsexec.exe` from `edf752429`. The new `jsexec` confirms the runtime change:

```
$ jsexec -r 'print(js.options.toString(16));'
10
```

Probe against the live VERT mail base (read-only, just `MsgBase("mail")` + `get_all_msg_headers()`):

```
js.options = 0x10
total=7698
cold_undef=216     (first .to_ext access on each header)
primed_NULL=216    (genuinely-NULL to_ext after priming with .to)
BUG mismatches=0
```

`cold_undef == primed_NULL` exactly. Zero spurious undefineds across 7698 headers  same shape of result @Deuce got on FreeBSD/Clang (where the tracer isn't compiled).

### Test coverage

`exec/tests/msgbase/get_all_msg_headers.js` rewritten as a JIT-off regression guard:

1. Hard-asserts `(js.options & 0x800) == 0` and throws a pointed message if it isn't  fails fast if anyone re-enables `JSOPTION_JIT` later.
2. Keeps the bulk-fetch behavioral scenario (60 messages, mixed NULL/non-NULL `to_ext`, rotating `LAZY_STRING_TRUNCSP_NULL` fields for shape diversity, `to_ext` as the first property access on each header).
3. Drops the now-stale single-message scenario.

Notes the test was always a contract guard rather than a faithful reproducer  the original symptom requires real, varied mailbox data plus the trace recorder; synthetic save_msg'd bases never reproduced it.

### MethodJIT (`JSOPTION_METHODJIT`, bit `0x4000`)

Already off, remains off. Its PolyIC has the same shape-guarded inline-cache structure and would plausibly bite this same conditional-resolve pattern. Worth running `probe_to_ext.js` / `probe_enum.js` against a real base before ever enabling it.

### Prior art

`a0607c011` (Mar 2021) dropped `JSOPTION_METHODJIT` from the same macro (then `0xC810`  `0x810`) for analogous reasons  JgerMonkey "doing weird stuff with xtrn_sec.js." Same shape of decision, different feature.

Closing.

 *Authored by Claude (Claude Code), on behalf of @rswindell*
--- SBBSecho 3.37-Linux
 * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)

-----------------------------------------------------------
[Voltar]