Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8168373

"Bad local variable type" in ES6 Nashorn when reassigning a `let` within a `try`

    XMLWordPrintable

Details

    • b145
    • generic
    • generic

    Backports

      Description

        FULL PRODUCT VERSION :
        java version "1.8.0_112"
        Java(TM) SE Runtime Environment (build 1.8.0_112-b15)
        Java HotSpot(TM) 64-Bit Server VM (build 25.112-b15, mixed mode)

        ADDITIONAL OS VERSION INFORMATION :
        Linux ______ 4.4.0-21-generic #37-Ubuntu SMP Mon Apr 18 18:33:37 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux

        A DESCRIPTION OF THE PROBLEM :
        Nashorn crashes when running valid ES6 JavaScript code. Beyond that, this is a difficult error to describe with words. For a better understanding of the problem, please see the "Steps to Reproduce" and the "Actual Result" below.

        STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
        I save the following into a file called 'bug.js':

          try { // Must be within a `try`
            let x = 0; // Must use `let` instead of `var`; our variable must be defined before some possible `throw`, and it must be given some initial value
            if (false || false) { throw {}; } // We need `false || false` so this block doesn't get optimized away, since we need some apparent possibility of a `throw`
            x = 0.0; // It seems necessary that the internal type of `x` changes; if `x` is set to `1`, it will be fine, but setting it to a string or double triggers this error
            x; // `x` must be referenced again after being set
          } catch (e) {}

          print("Everything is okay") // Just kidding; it's not, since we don't get here before the JVM explodes

        Then, I run this from my terminal: jjs --language=es6 bug.js

        EXPECTED VERSUS ACTUAL BEHAVIOR :
        EXPECTED -
        That it prints out "Everything is okay"
        ACTUAL -
        It produces an error, whose output is listed in the section below

        ERROR MESSAGES/STACK TRACES THAT OCCUR :
        Exception in thread "main" java.lang.VerifyError: Bad local variable type
        Exception Details:
          Location:
            jdk/nashorn/internal/scripts/Script$bug.:program(Ljdk/nashorn/internal/runtime/ScriptFunction;Ljava/lang/Object;)Ljava/lang/Object; @67: iload
          Reason:
            Type top (current frame, locals[7]) is not assignable to integer
          Current Frame:
            bci: @67
            flags: { }
            locals: { 'jdk/nashorn/internal/runtime/ScriptFunction', 'java/lang/Object', 'jdk/nashorn/internal/runtime/ScriptObject', top, top, 'jdk/nashorn/internal/runtime/Undefined', 'jdk/nashorn/internal/scripts/JO0P0', top, top, 'jdk/nashorn/internal/scripts/JO4' }
            stack: { 'jdk/nashorn/internal/runtime/ECMAException' }
          Bytecode:
            0x0000000: 2ab6 0014 4dbb 0016 5903 b800 1a2c b700
            0x0000010: 1e3a 0619 06b8 0024 4db2 0028 3a05 0357
            0x0000020: 039a 0007 0399 0029 bb00 2a59 04b8 001a
            0x0000030: b700 2d3a 0919 0959 b800 3312 3406 1018
            0x0000040: b800 3a15 0787 3907 b200 283a 05bf 0e5c
            0x0000050: 3907 5cb8 0040 3a05 4a18 075c b800 403a
            0x0000060: 054a 29b8 0040 3a05 a700 393a 06bb 0048
            0x0000070: 5905 b800 1a2c b700 493a 0719 074d 2c19
            0x0000080: 0659 c100 3699 0009 c000 36b4 004c ba00
            0x0000090: 5800 002c b600 5b4d a700 092c b600 5b4d
            0x00000a0: bf2c ba00 6100 00b2 0028 1263 ba00 6700
            0x00000b0: 003a 0519 05b0
          Exception Handler Table:
            bci [30, 104] => handler: 107
            bci [126, 147] => handler: 155
          Stackmap Table:
            full_frame(@40,{Object[#16],Object[#110],Object[#47],Top,Top,Object[#112],Object[#22]},{})
            same_frame(@78)
            full_frame(@107,{Object[#16],Object[#110],Object[#47],Top,Top,Object[#110],Object[#22]},{Object[#70]})
            full_frame(@142,{Object[#16],Object[#110],Object[#72],Top,Top,Object[#110],Object[#70],Object[#72]},{Object[#72],Object[#110]})
            same_locals_1_stack_item_frame(@155,Object[#70])
            full_frame(@161,{Object[#16],Object[#110],Object[#47],Top,Top,Object[#110],Object[#110]},{})

        at java.lang.Class.getDeclaredFields0(Native Method)
        at java.lang.Class.privateGetDeclaredFields(Class.java:2583)
        at java.lang.Class.getDeclaredField(Class.java:2068)
        at jdk.nashorn.internal.runtime.Context$ContextCodeInstaller$1.run(Context.java:209)
        at jdk.nashorn.internal.runtime.Context$ContextCodeInstaller$1.run(Context.java:204)
        at java.security.AccessController.doPrivileged(Native Method)
        at jdk.nashorn.internal.runtime.Context$ContextCodeInstaller.initialize(Context.java:204)
        at jdk.nashorn.internal.codegen.CompilationPhase$InstallPhase.transform(CompilationPhase.java:508)
        at jdk.nashorn.internal.codegen.CompilationPhase.apply(CompilationPhase.java:624)
        at jdk.nashorn.internal.codegen.Compiler.compile(Compiler.java:654)
        at jdk.nashorn.internal.runtime.Context.compile(Context.java:1319)
        at jdk.nashorn.internal.runtime.Context.compileScript(Context.java:1253)
        at jdk.nashorn.internal.runtime.Context.compileScript(Context.java:625)
        at jdk.nashorn.tools.Shell.runScripts(Shell.java:316)
        at jdk.nashorn.tools.Shell.run(Shell.java:171)
        at jdk.nashorn.tools.Shell.main(Shell.java:135)
        at jdk.nashorn.tools.Shell.main(Shell.java:111)

        REPRODUCIBILITY :
        This bug can be reproduced always.

        Attachments

          1. bug.js
            0.7 kB
            Pallavi Sonal

          Issue Links

            Activity

              People

                attila Attila Szegedi
                webbuggrp Webbug Group
                Votes:
                0 Vote for this issue
                Watchers:
                5 Start watching this issue

                Dates

                  Created:
                  Updated:
                  Resolved: