Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8066239 Fuzzing bug umbrella CR for issues reported by André Bargull
  3. JDK-8066220

Fuzzing bug: MethodHandle bug (Object,Object) != (boolean)Object

XMLWordPrintable

    • Icon: Sub-task Sub-task
    • Resolution: Fixed
    • Icon: P3 P3
    • 8u60
    • 8u60
    • core-libs
    • None
    • b20
    • generic
    • generic

        Needs warmup to manifest itself


        function tryItOut(c) {
         var f = tryCompiling(c);
         if (f !== null && c.indexOf('infloop') === -1) {
           tryRunning(f);
         }
        }

        function tryCompiling(c) {
         try { return Function(c); } catch(e) { return null; }
        }

        function tryRunning(f) {
         try {
           return f();
         } catch (e) {
           if (e instanceof java.lang.Throwable) e.printStackTrace();
         }
        }

        tryItOut("x = 1e-81;");
        tryItOut("y = x;");
        tryItOut("for(x in (((new Function).call)(true))){}");
        tryItOut("(x.constructor = new (new Function)(y));");

        java.lang.IllegalArgumentException: target and combiner types must match: (Object,Object)Object != (boolean)Object
           at java.lang.invoke.MethodHandleStatics.newIllegalArgumentException(MethodHandleStatics.java:109)
           at java.lang.invoke.MethodHandles.misMatchedTypes(MethodHandles.java:2775)
           at java.lang.invoke.MethodHandles.foldArguments(MethodHandles.java:2714)
           at jdk.nashorn.internal.lookup.MethodHandleFactory$StandardMethodHandleFunctionality.foldArguments(MethodHandleFactory.java:430)
           at jdk.nashorn.internal.runtime.CompiledFunction.createConstructorFromInvoker(CompiledFunction.java:265)
           at jdk.nashorn.internal.runtime.CompiledFunction.getConstructor(CompiledFunction.java:224)
           at jdk.nashorn.internal.runtime.CompiledFunction.access$300(CompiledFunction.java:61)
           at jdk.nashorn.internal.runtime.CompiledFunction$3.get(CompiledFunction.java:680)
           at jdk.nashorn.internal.runtime.CompiledFunction$3.get(CompiledFunction.java:677)
           at jdk.nashorn.internal.runtime.CompiledFunction.getValidOptimisticInvocation(CompiledFunction.java:606)
           ...

              hannesw Hannes Wallnoefer
              lagergren Marcus Lagergren
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

                Created:
                Updated:
                Resolved: