Fuzzing bug: Undefined object type assertion when computing TypeBounds

XMLWordPrintable

    • Type: Sub-task
    • Resolution: Fixed
    • Priority: P3
    • 9
    • Affects Version/s: 8u60
    • Component/s: core-libs
    • None
    • b43
    • generic
    • generic

        jjs> function f() { void null + 0; } f()
        Exception in thread "main" java.lang.AssertionError: object<type=Undefined>
           at jdk.nashorn.internal.codegen.CodeGenerator$TypeBounds.<init>(CodeGenerator.java:627)
           at jdk.nashorn.internal.codegen.CodeGenerator$TypeBounds.maybeNew(CodeGenerator.java:650)
           at jdk.nashorn.internal.codegen.CodeGenerator$TypeBounds.notNarrowerThan(CodeGenerator.java:635)
           at jdk.nashorn.internal.codegen.CodeGenerator.loadBinaryOperands(CodeGenerator.java:575)
           at jdk.nashorn.internal.codegen.CodeGenerator.access$6800(CodeGenerator.java:183)
           at jdk.nashorn.internal.codegen.CodeGenerator$14.loadStack(CodeGenerator.java:3575)
           at jdk.nashorn.internal.codegen.CodeGenerator$OptimisticOperation.emit(CodeGenerator.java:4407)
           at jdk.nashorn.internal.codegen.CodeGenerator$OptimisticOperation.emit(CodeGenerator.java:4392)
           at jdk.nashorn.internal.codegen.CodeGenerator.loadADD(CodeGenerator.java:3582)
           at jdk.nashorn.internal.codegen.CodeGenerator$1.enterADD(CodeGenerator.java:872)
           ...

              Assignee:
              Attila Szegedi
              Reporter:
              Marcus Lagergren
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: