Wed, 03 Jun 2015 18:08:57 +0200
8066237: Fuzzing bug: Parser error on optimistic recompilation
Reviewed-by: lagergren, attila
1.1 --- a/src/jdk/nashorn/internal/runtime/RecompilableScriptFunctionData.java Wed Jun 03 16:44:24 2015 +0200 1.2 +++ b/src/jdk/nashorn/internal/runtime/RecompilableScriptFunctionData.java Wed Jun 03 18:08:57 2015 +0200 1.3 @@ -342,6 +342,9 @@ 1.4 if (functionNode.isVarArg()) { 1.5 flags |= IS_VARIABLE_ARITY; 1.6 } 1.7 + if (functionNode.getKind() == FunctionNode.Kind.GETTER || functionNode.getKind() == FunctionNode.Kind.SETTER) { 1.8 + flags |= IS_PROPERTY_ACCESSOR; 1.9 + } 1.10 return flags; 1.11 } 1.12 1.13 @@ -382,7 +385,7 @@ 1.14 parser.setReparsedFunction(this); 1.15 1.16 final FunctionNode program = parser.parse(CompilerConstants.PROGRAM.symbolName(), descPosition, 1.17 - Token.descLength(token), true); 1.18 + Token.descLength(token), isPropertyAccessor()); 1.19 // Parser generates a program AST even if we're recompiling a single function, so when we are only 1.20 // recompiling a single function, extract it from the program. 1.21 return (isProgram() ? program : extractFunctionFromScript(program)).setName(null, functionName);
2.1 --- a/src/jdk/nashorn/internal/runtime/ScriptFunctionData.java Wed Jun 03 16:44:24 2015 +0200 2.2 +++ b/src/jdk/nashorn/internal/runtime/ScriptFunctionData.java Wed Jun 03 18:08:57 2015 +0200 2.3 @@ -80,24 +80,24 @@ 2.4 private static final MethodHandle BIND_VAR_ARGS = findOwnMH("bindVarArgs", Object[].class, Object[].class, Object[].class); 2.5 2.6 /** Is this a strict mode function? */ 2.7 - public static final int IS_STRICT = 1 << 0; 2.8 + public static final int IS_STRICT = 1 << 0; 2.9 /** Is this a built-in function? */ 2.10 - public static final int IS_BUILTIN = 1 << 1; 2.11 + public static final int IS_BUILTIN = 1 << 1; 2.12 /** Is this a constructor function? */ 2.13 - public static final int IS_CONSTRUCTOR = 1 << 2; 2.14 + public static final int IS_CONSTRUCTOR = 1 << 2; 2.15 /** Does this function expect a callee argument? */ 2.16 - public static final int NEEDS_CALLEE = 1 << 3; 2.17 + public static final int NEEDS_CALLEE = 1 << 3; 2.18 /** Does this function make use of the this-object argument? */ 2.19 - public static final int USES_THIS = 1 << 4; 2.20 + public static final int USES_THIS = 1 << 4; 2.21 /** Is this a variable arity function? */ 2.22 - public static final int IS_VARIABLE_ARITY = 1 << 5; 2.23 + public static final int IS_VARIABLE_ARITY = 1 << 5; 2.24 + /** Is this a object literal property getter or setter? */ 2.25 + public static final int IS_PROPERTY_ACCESSOR = 1 << 6; 2.26 2.27 /** Flag for strict or built-in functions */ 2.28 public static final int IS_STRICT_OR_BUILTIN = IS_STRICT | IS_BUILTIN; 2.29 /** Flag for built-in constructors */ 2.30 public static final int IS_BUILTIN_CONSTRUCTOR = IS_BUILTIN | IS_CONSTRUCTOR; 2.31 - /** Flag for strict constructors */ 2.32 - public static final int IS_STRICT_CONSTRUCTOR = IS_STRICT | IS_CONSTRUCTOR; 2.33 2.34 private static final long serialVersionUID = 4252901245508769114L; 2.35 2.36 @@ -122,6 +122,10 @@ 2.37 return (flags & IS_VARIABLE_ARITY) != 0; 2.38 } 2.39 2.40 + final boolean isPropertyAccessor() { 2.41 + return (flags & IS_PROPERTY_ACCESSOR) != 0; 2.42 + } 2.43 + 2.44 /** 2.45 * Used from e.g. Native*$Constructors as an explicit call. TODO - make arity immutable and final 2.46 * @param arity new arity
3.1 --- /dev/null Thu Jan 01 00:00:00 1970 +0000 3.2 +++ b/test/script/basic/JDK-8066237.js Wed Jun 03 18:08:57 2015 +0200 3.3 @@ -0,0 +1,38 @@ 3.4 +/* 3.5 + * Copyright (c) 2015, Oracle and/or its affiliates. All rights reserved. 3.6 + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. 3.7 + * 3.8 + * This code is free software; you can redistribute it and/or modify it 3.9 + * under the terms of the GNU General Public License version 2 only, as 3.10 + * published by the Free Software Foundation. 3.11 + * 3.12 + * This code is distributed in the hope that it will be useful, but WITHOUT 3.13 + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 3.14 + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License 3.15 + * version 2 for more details (a copy is included in the LICENSE file that 3.16 + * accompanied this code). 3.17 + * 3.18 + * You should have received a copy of the GNU General Public License version 3.19 + * 2 along with this work; if not, write to the Free Software Foundation, 3.20 + * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. 3.21 + * 3.22 + * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA 3.23 + * or visit www.oracle.com if you need additional information or have any 3.24 + * questions. 3.25 + */ 3.26 + 3.27 +/** 3.28 + * JDK-8066237: Fuzzing bug: Parser error on optimistic recompilation 3.29 + * 3.30 + * @test 3.31 + * @run 3.32 + */ 3.33 + 3.34 +try { 3.35 + (function() { 3.36 + eval("get, a") 3.37 + })(); 3.38 + fail("should have thrown"); 3.39 +} catch (e) { 3.40 + Assert.assertTrue(e.name === "ReferenceError"); 3.41 +}