8026112: Function("with(x ? 1e81 : (x2.constructor = 0.1)){}") throws AssertionError: double is not compatible with object

Wed, 09 Oct 2013 10:47:47 +0200

author
sundar
date
Wed, 09 Oct 2013 10:47:47 +0200
changeset 602
8d29733ad609
parent 596
346ba5b8a488
child 603
1e03d7caa68b

8026112: Function("with(x ? 1e81 : (x2.constructor = 0.1)){}") throws AssertionError: double is not compatible with object
Reviewed-by: lagergren, hannesw

src/jdk/nashorn/internal/codegen/CodeGenerator.java file | annotate | diff | comparison | revisions
test/script/basic/JDK-8026112.js file | annotate | diff | comparison | revisions
     1.1 --- a/src/jdk/nashorn/internal/codegen/CodeGenerator.java	Tue Oct 08 16:46:03 2013 +0200
     1.2 +++ b/src/jdk/nashorn/internal/codegen/CodeGenerator.java	Wed Oct 09 10:47:47 2013 +0200
     1.3 @@ -2893,7 +2893,7 @@
     1.4          final Label  falseLabel = new Label("ternary_false");
     1.5          final Label  exitLabel  = new Label("ternary_exit");
     1.6  
     1.7 -        Type widest = Type.widest(trueExpr.getType(), falseExpr.getType());
     1.8 +        Type widest = Type.widest(ternaryNode.getType(), Type.widest(trueExpr.getType(), falseExpr.getType()));
     1.9          if (trueExpr.getType().isArray() || falseExpr.getType().isArray()) { //loadArray creates a Java array type on the stack, calls global allocate, which creates a native array type
    1.10              widest = Type.OBJECT;
    1.11          }
    1.12 @@ -2904,7 +2904,7 @@
    1.13          // we still keep the conversion here as the AccessSpecializer can have separated the types, e.g. var y = x ? x=55 : 17
    1.14          // will left as (Object)x=55 : (Object)17 by Lower. Then the first term can be {I}x=55 of type int, which breaks the
    1.15          // symmetry for the temporary slot for this TernaryNode. This is evidence that we assign types and explicit conversions
    1.16 -        // to early, or Apply the AccessSpecializer too late. We are mostly probably looking for a separate type pass to
    1.17 +        // too early, or Apply the AccessSpecializer too late. We are mostly probably looking for a separate type pass to
    1.18          // do this property. Then we never need any conversions in CodeGenerator
    1.19          method.ifeq(falseLabel);
    1.20          load(trueExpr);
     2.1 --- /dev/null	Thu Jan 01 00:00:00 1970 +0000
     2.2 +++ b/test/script/basic/JDK-8026112.js	Wed Oct 09 10:47:47 2013 +0200
     2.3 @@ -0,0 +1,31 @@
     2.4 +/*
     2.5 + * Copyright (c) 2010, 2013, Oracle and/or its affiliates. All rights reserved.
     2.6 + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
     2.7 + * 
     2.8 + * This code is free software; you can redistribute it and/or modify it
     2.9 + * under the terms of the GNU General Public License version 2 only, as
    2.10 + * published by the Free Software Foundation.
    2.11 + * 
    2.12 + * This code is distributed in the hope that it will be useful, but WITHOUT
    2.13 + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    2.14 + * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
    2.15 + * version 2 for more details (a copy is included in the LICENSE file that
    2.16 + * accompanied this code).
    2.17 + * 
    2.18 + * You should have received a copy of the GNU General Public License version
    2.19 + * 2 along with this work; if not, write to the Free Software Foundation,
    2.20 + * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
    2.21 + * 
    2.22 + * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
    2.23 + * or visit www.oracle.com if you need additional information or have any
    2.24 + * questions.
    2.25 + */
    2.26 +
    2.27 +/**
    2.28 + * JDK-8026112: Function("with(x ? 1e81 : (x2.constructor = 0.1)){}") throws AssertionError: double is not compatible with object
    2.29 + *
    2.30 + * @test
    2.31 + * @run
    2.32 + */
    2.33 +
    2.34 +Function("with(x ? 1e81 : (x2.constructor = 0.1)){}")

mercurial