Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8042304 Fuzzing jdk9/dev/nashorn
  3. JDK-8047067

eval("23", ({})[/x/]) crashes with ArrayIndexOutOfBoundsException with optimistic compilation

XMLWordPrintable

    • Icon: Sub-task Sub-task
    • Resolution: Fixed
    • Icon: P3 P3
    • 9
    • 9
    • core-libs
    • b23
    • generic
    • generic

         jjs -J-Djav../dist
        jjs> eval("23", ({})[/x/])
        java.lang.ArrayIndexOutOfBoundsException: 5
        jjs> sundar@sundar-TravelMate-5720:~/src/jdk9-dev/nashorn/bin$ jjs -J-Djava.ext.../dist -doe
        jjs -J-Djava.ext.dirs=$jdk9_dev/nashorn/dist

        jjs> eval("23", ({})[/x/])
        java.lang.ArrayIndexOutOfBoundsException: 5
        java.lang.ArrayIndexOutOfBoundsException: 5
        at jdk.nashorn.internal.scripts.Script$Recompilation$2$\^shell\_$cu2$restOf.:program(<shell>:0)
        at jdk.nashorn.internal.runtime.ScriptFunctionData.invoke(ScriptFunctionData.java:567)
        at jdk.nashorn.internal.runtime.ScriptFunction.invoke(ScriptFunction.java:221)
        at jdk.nashorn.internal.runtime.ScriptRuntime.apply(ScriptRuntime.java:374)
        at jdk.nashorn.internal.runtime.Context.eval(Context.java:620)
        at jdk.nashorn.tools.Shell.readEvalPrint(Shell.java:448)
        at jdk.nashorn.tools.Shell.run(Shell.java:158)
        at jdk.nashorn.tools.Shell.main(Shell.java:133)
        at jdk.nashorn.tools.Shell.main(Shell.java:112)

        The same test runs fine when optimistic compilation is turned off.

        jjs -J-Djava.ext.dirs=$jdk9_dev/nashorn/dist --optimistic-types=false
        jjs> eval("23", ({})[/x/])
        23

              attila Attila Szegedi
              sundar Sundararajan Athijegannathan
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

                Created:
                Updated:
                Resolved: