Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8024971 Fuzzing results on nashorn by Andre
  3. JDK-8080385

eval("function " + Array.apply(null,Array(0x10000)).join("a") + "(){}") crashes in codegen

XMLWordPrintable

    • Icon: Sub-task Sub-task
    • Resolution: Duplicate
    • Icon: P3 P3
    • None
    • 8u60
    • core-libs
    • None

       eval("function " + Array.apply(null,Array(0x10000)).join("a") + "(){}")

      works fine in jdk9-dev nashorn.

      Crashes with exception on jdk8u-dev nashorn:

      jjs> eval("function " + Array.apply(null,Array(0x10000)).join("a") + "(){}")
      Exception in thread "main" java.lang.AssertionError: Failed generating bytecode for <shell>#1:1<eval>:1
      at jdk.nashorn.internal.codegen.CompilationPhase$13.transform(CompilationPhase.java:485)
      at jdk.nashorn.internal.codegen.CompilationPhase.apply(CompilationPhase.java:716)
      at jdk.nashorn.internal.codegen.Compiler.compile(Compiler.java:620)
      at jdk.nashorn.internal.runtime.RecompilableScriptFunctionData.compileTypeSpecialization(RecompilableScriptFunctionData.java:511)
      at jdk.nashorn.internal.runtime.RecompilableScriptFunctionData.getBest(RecompilableScriptFunctionData.java:685)
      at jdk.nashorn.internal.runtime.ScriptFunctionData.getBestInvoker(ScriptFunctionData.java:233)
      at jdk.nashorn.internal.runtime.ScriptFunction.findCallMethod(ScriptFunction.java:592)
      at jdk.nashorn.internal.runtime.ScriptObject.lookup(ScriptObject.java:1855)
      at jdk.nashorn.internal.runtime.linker.NashornLinker.getGuardedInvocation(NashornLinker.java:100)
      at jdk.nashorn.internal.runtime.linker.NashornLinker.getGuardedInvocation(NashornLinker.java:94)
      at jdk.internal.dynalink.support.CompositeTypeBasedGuardingDynamicLinker.getGuardedInvocation(CompositeTypeBasedGuardingDynamicLinker.java:176)
      at jdk.internal.dynalink.support.CompositeGuardingDynamicLinker.getGuardedInvocation(CompositeGuardingDynamicLinker.java:124)
      at jdk.internal.dynalink.support.LinkerServicesImpl.getGuardedInvocation(LinkerServicesImpl.java:154)
      at jdk.nashorn.internal.runtime.ScriptFunction.createApplyOrCallCall(ScriptFunction.java:772)
      at jdk.nashorn.internal.runtime.ScriptFunction.findCallMethod(ScriptFunction.java:583)
      at jdk.nashorn.internal.runtime.ScriptObject.lookup(ScriptObject.java:1855)
      at jdk.nashorn.internal.runtime.linker.NashornLinker.getGuardedInvocation(NashornLinker.java:100)
      at jdk.nashorn.internal.runtime.linker.NashornLinker.getGuardedInvocation(NashornLinker.java:94)
      at jdk.internal.dynalink.support.CompositeTypeBasedGuardingDynamicLinker.getGuardedInvocation(CompositeTypeBasedGuardingDynamicLinker.java:176)
      at jdk.internal.dynalink.support.CompositeGuardingDynamicLinker.getGuardedInvocation(CompositeGuardingDynamicLinker.java:124)
      at jdk.internal.dynalink.support.LinkerServicesImpl.getGuardedInvocation(LinkerServicesImpl.java:154)
      at jdk.internal.dynalink.DynamicLinker.relink(DynamicLinker.java:234)
      at jdk.nashorn.internal.scripts.Script$1$\^shell\_#1\!1\^eval\_.:program(<shell>#1:1<eval>)
      at jdk.nashorn.internal.runtime.ScriptFunctionData.invoke(ScriptFunctionData.java:636)
      at jdk.nashorn.internal.runtime.ScriptFunction.invoke(ScriptFunction.java:228)
      at jdk.nashorn.internal.runtime.ScriptRuntime.apply(ScriptRuntime.java:393)
      at jdk.nashorn.internal.runtime.Context.eval(Context.java:745)
      at jdk.nashorn.internal.objects.Global.directEval(Global.java:1258)
      at jdk.nashorn.internal.scripts.Script$\^shell\_.:program(<shell>:1)
      at jdk.nashorn.internal.runtime.ScriptFunctionData.invoke(ScriptFunctionData.java:636)
      at jdk.nashorn.internal.runtime.ScriptFunction.invoke(ScriptFunction.java:228)
      at jdk.nashorn.internal.runtime.ScriptRuntime.apply(ScriptRuntime.java:393)
      at jdk.nashorn.internal.runtime.Context.eval(Context.java:745)
      at jdk.nashorn.internal.runtime.Context.eval(Context.java:675)
      at jdk.nashorn.tools.Shell.readEvalPrint(Shell.java:442)
      at jdk.nashorn.tools.Shell.run(Shell.java:161)
      at jdk.nashorn.tools.Shell.main(Shell.java:136)
      at jdk.nashorn.tools.Shell.main(Shell.java:112)
      Caused by: java.lang.IllegalArgumentException
      at jdk.internal.org.objectweb.asm.ByteVector.putUTF8(ByteVector.java:242)
      at jdk.internal.org.objectweb.asm.ClassWriter.newUTF8(ClassWriter.java:1121)
      at jdk.internal.org.objectweb.asm.ClassWriter.newNameTypeItem(ClassWriter.java:1591)
      at jdk.internal.org.objectweb.asm.ClassWriter.newNameType(ClassWriter.java:1574)
      at jdk.internal.org.objectweb.asm.ClassWriter.newInvokeDynamicItem(ClassWriter.java:1345)
      at jdk.internal.org.objectweb.asm.MethodWriter.visitInvokeDynamicInsn(MethodWriter.java:969)
      at jdk.nashorn.internal.codegen.MethodEmitter.dynamicSet(MethodEmitter.java:2218)
      at jdk.nashorn.internal.codegen.CodeGenerator.storeFastScopeVar(CodeGenerator.java:522)
      at jdk.nashorn.internal.codegen.CodeGenerator.access$8000(CodeGenerator.java:180)
      at jdk.nashorn.internal.codegen.CodeGenerator$Store$2.enterIdentNode(CodeGenerator.java:4454)
      at jdk.nashorn.internal.ir.IdentNode.accept(IdentNode.java:136)
      at jdk.nashorn.internal.codegen.CodeGenerator$Store.epilogue(CodeGenerator.java:4441)
      at jdk.nashorn.internal.codegen.CodeGenerator$Store.store(CodeGenerator.java:4497)
      at jdk.nashorn.internal.codegen.CodeGenerator.loadASSIGN(CodeGenerator.java:3880)
      at jdk.nashorn.internal.codegen.CodeGenerator.access$800(CodeGenerator.java:180)
      at jdk.nashorn.internal.codegen.CodeGenerator$1.enterASSIGN(CodeGenerator.java:922)
      at jdk.nashorn.internal.ir.visitor.NodeOperatorVisitor.enterBinaryNode(NodeOperatorVisitor.java:113)
      at jdk.nashorn.internal.ir.BinaryNode.accept(BinaryNode.java:339)
      at jdk.nashorn.internal.codegen.CodeGenerator.loadExpression(CodeGenerator.java:860)
      at jdk.nashorn.internal.codegen.CodeGenerator.loadExpression(CodeGenerator.java:836)
      at jdk.nashorn.internal.codegen.CodeGenerator.loadAndDiscard(CodeGenerator.java:3671)
      at jdk.nashorn.internal.codegen.CodeGenerator.enterExpressionStatement(CodeGenerator.java:1727)
      at jdk.nashorn.internal.ir.ExpressionStatement.accept(ExpressionStatement.java:63)
      at jdk.nashorn.internal.ir.Node.accept(Node.java:261)
      at jdk.nashorn.internal.ir.Block.accept(Block.java:154)
      at jdk.nashorn.internal.ir.LexicalContextNode$Acceptor.accept(LexicalContextNode.java:57)
      at jdk.nashorn.internal.ir.Block.accept(Block.java:409)
      at jdk.nashorn.internal.ir.FunctionNode.accept(FunctionNode.java:374)
      at jdk.nashorn.internal.ir.LexicalContextNode$Acceptor.accept(LexicalContextNode.java:57)
      at jdk.nashorn.internal.ir.LexicalContextExpression.accept(LexicalContextExpression.java:47)
      at jdk.nashorn.internal.ir.FunctionNode.accept(FunctionNode.java:57)
      at jdk.nashorn.internal.codegen.CompilationPhase.transformFunction(CompilationPhase.java:720)
      at jdk.nashorn.internal.codegen.CompilationPhase.access$100(CompilationPhase.java:68)
      at jdk.nashorn.internal.codegen.CompilationPhase$13.transform(CompilationPhase.java:472)
      ... 37 more

            hannesw Hannes Wallnoefer
            sundar Sundararajan Athijegannathan
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated:
              Resolved: