8066237: Fuzzing bug: Parser error on optimistic recompilation

Wed, 03 Jun 2015 18:08:57 +0200

author
hannesw
date
Wed, 03 Jun 2015 18:08:57 +0200
changeset 1396
d5a9705a27b1
parent 1395
fb99aafd5c0d
child 1397
19263eb2ff0c

8066237: Fuzzing bug: Parser error on optimistic recompilation
Reviewed-by: lagergren, attila

src/jdk/nashorn/internal/runtime/RecompilableScriptFunctionData.java file | annotate | diff | comparison | revisions
src/jdk/nashorn/internal/runtime/ScriptFunctionData.java file | annotate | diff | comparison | revisions
test/script/basic/JDK-8066237.js file | annotate | diff | comparison | revisions
     1.1 --- a/src/jdk/nashorn/internal/runtime/RecompilableScriptFunctionData.java	Wed Jun 03 16:44:24 2015 +0200
     1.2 +++ b/src/jdk/nashorn/internal/runtime/RecompilableScriptFunctionData.java	Wed Jun 03 18:08:57 2015 +0200
     1.3 @@ -342,6 +342,9 @@
     1.4          if (functionNode.isVarArg()) {
     1.5              flags |= IS_VARIABLE_ARITY;
     1.6          }
     1.7 +        if (functionNode.getKind() == FunctionNode.Kind.GETTER || functionNode.getKind() == FunctionNode.Kind.SETTER) {
     1.8 +            flags |= IS_PROPERTY_ACCESSOR;
     1.9 +        }
    1.10          return flags;
    1.11      }
    1.12  
    1.13 @@ -382,7 +385,7 @@
    1.14          parser.setReparsedFunction(this);
    1.15  
    1.16          final FunctionNode program = parser.parse(CompilerConstants.PROGRAM.symbolName(), descPosition,
    1.17 -                Token.descLength(token), true);
    1.18 +                Token.descLength(token), isPropertyAccessor());
    1.19          // Parser generates a program AST even if we're recompiling a single function, so when we are only
    1.20          // recompiling a single function, extract it from the program.
    1.21          return (isProgram() ? program : extractFunctionFromScript(program)).setName(null, functionName);
     2.1 --- a/src/jdk/nashorn/internal/runtime/ScriptFunctionData.java	Wed Jun 03 16:44:24 2015 +0200
     2.2 +++ b/src/jdk/nashorn/internal/runtime/ScriptFunctionData.java	Wed Jun 03 18:08:57 2015 +0200
     2.3 @@ -80,24 +80,24 @@
     2.4      private static final MethodHandle BIND_VAR_ARGS = findOwnMH("bindVarArgs", Object[].class, Object[].class, Object[].class);
     2.5  
     2.6      /** Is this a strict mode function? */
     2.7 -    public static final int IS_STRICT      = 1 << 0;
     2.8 +    public static final int IS_STRICT            = 1 << 0;
     2.9      /** Is this a built-in function? */
    2.10 -    public static final int IS_BUILTIN     = 1 << 1;
    2.11 +    public static final int IS_BUILTIN           = 1 << 1;
    2.12      /** Is this a constructor function? */
    2.13 -    public static final int IS_CONSTRUCTOR = 1 << 2;
    2.14 +    public static final int IS_CONSTRUCTOR       = 1 << 2;
    2.15      /** Does this function expect a callee argument? */
    2.16 -    public static final int NEEDS_CALLEE   = 1 << 3;
    2.17 +    public static final int NEEDS_CALLEE         = 1 << 3;
    2.18      /** Does this function make use of the this-object argument? */
    2.19 -    public static final int USES_THIS      = 1 << 4;
    2.20 +    public static final int USES_THIS            = 1 << 4;
    2.21      /** Is this a variable arity function? */
    2.22 -    public static final int IS_VARIABLE_ARITY = 1 << 5;
    2.23 +    public static final int IS_VARIABLE_ARITY    = 1 << 5;
    2.24 +    /** Is this a object literal property getter or setter? */
    2.25 +    public static final int IS_PROPERTY_ACCESSOR = 1 << 6;
    2.26  
    2.27      /** Flag for strict or built-in functions */
    2.28      public static final int IS_STRICT_OR_BUILTIN = IS_STRICT | IS_BUILTIN;
    2.29      /** Flag for built-in constructors */
    2.30      public static final int IS_BUILTIN_CONSTRUCTOR = IS_BUILTIN | IS_CONSTRUCTOR;
    2.31 -    /** Flag for strict constructors */
    2.32 -    public static final int IS_STRICT_CONSTRUCTOR = IS_STRICT | IS_CONSTRUCTOR;
    2.33  
    2.34      private static final long serialVersionUID = 4252901245508769114L;
    2.35  
    2.36 @@ -122,6 +122,10 @@
    2.37          return (flags & IS_VARIABLE_ARITY) != 0;
    2.38      }
    2.39  
    2.40 +    final boolean isPropertyAccessor() {
    2.41 +        return (flags & IS_PROPERTY_ACCESSOR) != 0;
    2.42 +    }
    2.43 +
    2.44      /**
    2.45       * Used from e.g. Native*$Constructors as an explicit call. TODO - make arity immutable and final
    2.46       * @param arity new arity
     3.1 --- /dev/null	Thu Jan 01 00:00:00 1970 +0000
     3.2 +++ b/test/script/basic/JDK-8066237.js	Wed Jun 03 18:08:57 2015 +0200
     3.3 @@ -0,0 +1,38 @@
     3.4 +/*
     3.5 + * Copyright (c) 2015, Oracle and/or its affiliates. All rights reserved.
     3.6 + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
     3.7 + * 
     3.8 + * This code is free software; you can redistribute it and/or modify it
     3.9 + * under the terms of the GNU General Public License version 2 only, as
    3.10 + * published by the Free Software Foundation.
    3.11 + * 
    3.12 + * This code is distributed in the hope that it will be useful, but WITHOUT
    3.13 + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    3.14 + * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
    3.15 + * version 2 for more details (a copy is included in the LICENSE file that
    3.16 + * accompanied this code).
    3.17 + * 
    3.18 + * You should have received a copy of the GNU General Public License version
    3.19 + * 2 along with this work; if not, write to the Free Software Foundation,
    3.20 + * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
    3.21 + * 
    3.22 + * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
    3.23 + * or visit www.oracle.com if you need additional information or have any
    3.24 + * questions.
    3.25 + */
    3.26 +
    3.27 +/**
    3.28 + * JDK-8066237: Fuzzing bug: Parser error on optimistic recompilation
    3.29 + *
    3.30 + * @test
    3.31 + * @run
    3.32 + */
    3.33 +
    3.34 +try {
    3.35 +    (function() {
    3.36 +        eval("get, a")
    3.37 +    })();
    3.38 +    fail("should have thrown");
    3.39 +} catch (e) {
    3.40 +    Assert.assertTrue(e.name === "ReferenceError");
    3.41 +}

mercurial