Reported on nashorn-dev: http://mail.openjdk.java.net/pipermail/nashorn-dev/2019-August/007499.html

We have encountered a bug in Nashorn with JDK8 u221. It can be reproduced by evaluation of this script with "jjs --language=es6":

{{{{{{{{{{{{{{{ let x; }}}}}}}}}}}}}}}

It results in "java.lang.ArrayIndexOutOfBoundsException: 16" output. It need exactly 15 curly braces to cause this bug.

And here is the patch to fix it:

diff -r 06eed83ab4cd src/jdk.scripting.nashorn/share/classes/jdk/nashorn/internal/ir/LexicalContext.java
--- a/src/jdk.scripting.nashorn/share/classes/jdk/nashorn/internal/ir/LexicalContext.java Tue Aug 06 12:14:41 20>
+++ b/src/jdk.scripting.nashorn/share/classes/jdk/nashorn/internal/ir/LexicalContext.java Fri Aug 09 11:37:23 20>
@@ -697,7 +697,7 @@
     * @return {@code true} if in unprotected switch statement.
     */
    public boolean inUnprotectedSwitchContext() {
- for (int i = sp; i > 0; i--) {
+ for (int i = sp - 1; i > 0; i--) {
            final LexicalContextNode next = stack[i];
            if (next instanceof Block) {
                return stack[i - 1] instanceof SwitchNode;