-
Bug
-
Resolution: Fixed
-
P3
-
8, 9
-
b22
-
generic
-
generic
FULL PRODUCT VERSION :
java version "1.8.0_131"
Java(TM) SE Runtime Environment (build 1.8.0_131-b11)
Java HotSpot(TM) 64-Bit Server VM (build 25.131-b11, mixed mode)
ADDITIONAL OS VERSION INFORMATION :
Microsoft Windows [Version 6.3.9600] (windows 8 64 bit)
A DESCRIPTION OF THE PROBLEM :
Under certain conditions (described below) jdk.nashorn.internal.runtime.linker.JSObjectLinker.callToApply is called with the 4th argument being an Object array of length=1, which causes an AssertionError when the jvm argument "-ea" is present.
This is an erroneous assertion as it is not illegal to pass such an argument value.
This is reproducible when "apply(anyArg, arguments);" is called in the nashorn engine from inside a function body, when called on a custom implementation of JSObject.
Example:
engine.put("a", cusomJSObject);
engine.eval("function b(){a.apply(null, arguments);};b();");
Conditions:
- The jvm argument "-ea" is present
- Calling getMember("apply") on the custom JSObject implementation has to also return a custom JSObject implementation (can be the same, could even be the same instance, it doesn't matter)
STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
Run the provided source code (required JVM argument "-ea)
EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
No output.
ACTUAL -
Thrown AssertionError
ERROR MESSAGES/STACK TRACES THAT OCCUR :
Exception in thread "main" java.lang.AssertionError
at jdk.nashorn.internal.runtime.linker.JSObjectLinker.callToApply(JSObjectLinker.java:204)
at jdk.nashorn.internal.scripts.Script$Recompilation$1$12$\^eval\_.b(<eval>:1)
at jdk.nashorn.internal.scripts.Script$\^eval\_.:program(<eval>:1)
at jdk.nashorn.internal.runtime.ScriptFunctionData.invoke(ScriptFunctionData.java:637)
at jdk.nashorn.internal.runtime.ScriptFunction.invoke(ScriptFunction.java:494)
at jdk.nashorn.internal.runtime.ScriptRuntime.apply(ScriptRuntime.java:393)
at jdk.nashorn.api.scripting.NashornScriptEngine.evalImpl(NashornScriptEngine.java:449)
at jdk.nashorn.api.scripting.NashornScriptEngine.evalImpl(NashornScriptEngine.java:406)
at jdk.nashorn.api.scripting.NashornScriptEngine.evalImpl(NashornScriptEngine.java:402)
at jdk.nashorn.api.scripting.NashornScriptEngine.eval(NashornScriptEngine.java:155)
at javax.script.AbstractScriptEngine.eval(AbstractScriptEngine.java:264)
at A.main(A.java:30)
REPRODUCIBILITY :
This bug can be reproduced always.
---------- BEGIN SOURCE ----------
import jdk.nashorn.api.scripting.AbstractJSObject;
import jdk.nashorn.api.scripting.NashornScriptEngine;
public class A {
public static void main(String[] args) throws Throwable {
NashornScriptEngine engine = (NashornScriptEngine) new jdk.nashorn.api.scripting.NashornScriptEngineFactory().getScriptEngine();
AbstractJSObject obj = new AbstractJSObject() {
@Override
public Object getMember(String name) {
return new AbstractJSObject() {
@Override
public Object call(Object thiz, Object... args) {
return Undefined.getUndefined();
}
};
}
@Override
public Object call(Object thiz, Object... args) {
return Undefined.getUndefined();
}
};
engine.put("a", obj);
engine.eval("function b(){a.apply(null, arguments);};b();");
}
}
---------- END SOURCE ----------
CUSTOMER SUBMITTED WORKAROUND :
Possible workarounds:
- Disable -ea argument for the jvm
- Put "arguments" in a variable before passing it as an argument to the "apply" call
SUPPORT :
YES
java version "1.8.0_131"
Java(TM) SE Runtime Environment (build 1.8.0_131-b11)
Java HotSpot(TM) 64-Bit Server VM (build 25.131-b11, mixed mode)
ADDITIONAL OS VERSION INFORMATION :
Microsoft Windows [Version 6.3.9600] (windows 8 64 bit)
A DESCRIPTION OF THE PROBLEM :
Under certain conditions (described below) jdk.nashorn.internal.runtime.linker.JSObjectLinker.callToApply is called with the 4th argument being an Object array of length=1, which causes an AssertionError when the jvm argument "-ea" is present.
This is an erroneous assertion as it is not illegal to pass such an argument value.
This is reproducible when "apply(anyArg, arguments);" is called in the nashorn engine from inside a function body, when called on a custom implementation of JSObject.
Example:
engine.put("a", cusomJSObject);
engine.eval("function b(){a.apply(null, arguments);};b();");
Conditions:
- The jvm argument "-ea" is present
- Calling getMember("apply") on the custom JSObject implementation has to also return a custom JSObject implementation (can be the same, could even be the same instance, it doesn't matter)
STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
Run the provided source code (required JVM argument "-ea)
EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
No output.
ACTUAL -
Thrown AssertionError
ERROR MESSAGES/STACK TRACES THAT OCCUR :
Exception in thread "main" java.lang.AssertionError
at jdk.nashorn.internal.runtime.linker.JSObjectLinker.callToApply(JSObjectLinker.java:204)
at jdk.nashorn.internal.scripts.Script$Recompilation$1$12$\^eval\_.b(<eval>:1)
at jdk.nashorn.internal.scripts.Script$\^eval\_.:program(<eval>:1)
at jdk.nashorn.internal.runtime.ScriptFunctionData.invoke(ScriptFunctionData.java:637)
at jdk.nashorn.internal.runtime.ScriptFunction.invoke(ScriptFunction.java:494)
at jdk.nashorn.internal.runtime.ScriptRuntime.apply(ScriptRuntime.java:393)
at jdk.nashorn.api.scripting.NashornScriptEngine.evalImpl(NashornScriptEngine.java:449)
at jdk.nashorn.api.scripting.NashornScriptEngine.evalImpl(NashornScriptEngine.java:406)
at jdk.nashorn.api.scripting.NashornScriptEngine.evalImpl(NashornScriptEngine.java:402)
at jdk.nashorn.api.scripting.NashornScriptEngine.eval(NashornScriptEngine.java:155)
at javax.script.AbstractScriptEngine.eval(AbstractScriptEngine.java:264)
at A.main(A.java:30)
REPRODUCIBILITY :
This bug can be reproduced always.
---------- BEGIN SOURCE ----------
import jdk.nashorn.api.scripting.AbstractJSObject;
import jdk.nashorn.api.scripting.NashornScriptEngine;
public class A {
public static void main(String[] args) throws Throwable {
NashornScriptEngine engine = (NashornScriptEngine) new jdk.nashorn.api.scripting.NashornScriptEngineFactory().getScriptEngine();
AbstractJSObject obj = new AbstractJSObject() {
@Override
public Object getMember(String name) {
return new AbstractJSObject() {
@Override
public Object call(Object thiz, Object... args) {
return Undefined.getUndefined();
}
};
}
@Override
public Object call(Object thiz, Object... args) {
return Undefined.getUndefined();
}
};
engine.put("a", obj);
engine.eval("function b(){a.apply(null, arguments);};b();");
}
}
---------- END SOURCE ----------
CUSTOMER SUBMITTED WORKAROUND :
Possible workarounds:
- Disable -ea argument for the jvm
- Put "arguments" in a variable before passing it as an argument to the "apply" call
SUPPORT :
YES