Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8136544

Call site switching to megamorphic causes incorrect property read

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Resolved
    • Priority: P3
    • Resolution: Fixed
    • Affects Version/s: 8u51, 9
    • Fix Version/s: 9
    • Component/s: core-libs
    • Subcomponent:
    • Resolved In Build:
      b83
    • CPU:
      generic
    • OS:
      generic

      Backports

        Description

        From http://stackoverflow.com/questions/32585425/java-nashorn-inconsistent-binding-behavior-is-this-a-bug:

        -------------------------------
        import javax.script.Bindings;
        import javax.script.ScriptContext;
        import javax.script.ScriptEngine;
        import jdk.nashorn.api.scripting.NashornScriptEngineFactory;

        public class JsBugTest {

            public static Object resolve(final ScriptEngine engine, final String script) {
              Object r = null;
              try {
                r = engine.eval(script);
              } catch (final Exception ex) {
                System.out.println("exception: " + ex.getMessage());
                r = null;
              }
              return r;
            }

            public static void runTest()
            {
               final ScriptEngine jsEngine = new NashornScriptEngineFactory().getScriptEngine("--log=fields", "-ot=false");
               final String script = "DataA + 'foo';";
               final Bindings binds = jsEngine.getBindings(ScriptContext.ENGINE_SCOPE);
               Object ret;

               for (int i = 0; i < 12; i++) {
                 binds.remove("DataA");
                 ret = resolve(jsEngine, script);
                 if (ret != null) {
                   System.out.println("Iteration " + i + ": Returned value should be null but is: \"" + ret + "\"");
                 }

                 binds.put("DataA", "foo");
                 ret = resolve(jsEngine, script);
                 if (ret == null) {
                   System.out.println("Iteration " + i + " failed");
                 }
               }
            }

            public static void main(final String[] args) {
              JsBugTest.runTest();
            }
        }
        -------------------------------

        The program prints:

        exception: ReferenceError: "DataA" is not defined in <eval> at line number 1

        but then on iteration 8 starts printing:

        Iteration 8: Returned value should be null but is: "undefinedfoo"

        Running with "--log=fields" we see:

        exception: ReferenceError: "DataA" is not defined in <eval> at line number 1
        [fields] Megamorphic getter: dyn:getProp|getElem|getMethod:DataA(Object)Object@jdk.nashorn.internal.scripts.Script$\^eval\_ DataA false
        Iteration 8: Returned value should be null but is: "undefinedfoo"

        That is, we switch the call site to a megamorphic getter right before the incorrect behaviour starts happening.

          Attachments

            Issue Links

              Activity

                People

                Assignee:
                sundar Sundararajan Athijegannathan
                Reporter:
                attila Attila Szegedi
                Votes:
                0 Vote for this issue
                Watchers:
                2 Start watching this issue

                  Dates

                  Created:
                  Updated:
                  Resolved: