8066237: Fuzzing bug: Parser error on optimistic recompilation
Reviewed-by: lagergren, attila
--- a/nashorn/src/jdk.scripting.nashorn/share/classes/jdk/nashorn/internal/runtime/RecompilableScriptFunctionData.java Wed May 06 15:46:54 2015 +0200
+++ b/nashorn/src/jdk.scripting.nashorn/share/classes/jdk/nashorn/internal/runtime/RecompilableScriptFunctionData.java Wed May 06 16:22:22 2015 +0200
@@ -342,6 +342,9 @@
if (functionNode.isVarArg()) {
flags |= IS_VARIABLE_ARITY;
}
+ if (functionNode.getKind() == FunctionNode.Kind.GETTER || functionNode.getKind() == FunctionNode.Kind.SETTER) {
+ flags |= IS_PROPERTY_ACCESSOR;
+ }
return flags;
}
@@ -382,7 +385,7 @@
parser.setReparsedFunction(this);
final FunctionNode program = parser.parse(CompilerConstants.PROGRAM.symbolName(), descPosition,
- Token.descLength(token), true);
+ Token.descLength(token), isPropertyAccessor());
// Parser generates a program AST even if we're recompiling a single function, so when we are only
// recompiling a single function, extract it from the program.
return (isProgram() ? program : extractFunctionFromScript(program)).setName(null, functionName);
--- a/nashorn/src/jdk.scripting.nashorn/share/classes/jdk/nashorn/internal/runtime/ScriptFunctionData.java Wed May 06 15:46:54 2015 +0200
+++ b/nashorn/src/jdk.scripting.nashorn/share/classes/jdk/nashorn/internal/runtime/ScriptFunctionData.java Wed May 06 16:22:22 2015 +0200
@@ -80,24 +80,24 @@
private static final MethodHandle BIND_VAR_ARGS = findOwnMH("bindVarArgs", Object[].class, Object[].class, Object[].class);
/** Is this a strict mode function? */
- public static final int IS_STRICT = 1 << 0;
+ public static final int IS_STRICT = 1 << 0;
/** Is this a built-in function? */
- public static final int IS_BUILTIN = 1 << 1;
+ public static final int IS_BUILTIN = 1 << 1;
/** Is this a constructor function? */
- public static final int IS_CONSTRUCTOR = 1 << 2;
+ public static final int IS_CONSTRUCTOR = 1 << 2;
/** Does this function expect a callee argument? */
- public static final int NEEDS_CALLEE = 1 << 3;
+ public static final int NEEDS_CALLEE = 1 << 3;
/** Does this function make use of the this-object argument? */
- public static final int USES_THIS = 1 << 4;
+ public static final int USES_THIS = 1 << 4;
/** Is this a variable arity function? */
- public static final int IS_VARIABLE_ARITY = 1 << 5;
+ public static final int IS_VARIABLE_ARITY = 1 << 5;
+ /** Is this a object literal property getter or setter? */
+ public static final int IS_PROPERTY_ACCESSOR = 1 << 6;
/** Flag for strict or built-in functions */
public static final int IS_STRICT_OR_BUILTIN = IS_STRICT | IS_BUILTIN;
/** Flag for built-in constructors */
public static final int IS_BUILTIN_CONSTRUCTOR = IS_BUILTIN | IS_CONSTRUCTOR;
- /** Flag for strict constructors */
- public static final int IS_STRICT_CONSTRUCTOR = IS_STRICT | IS_CONSTRUCTOR;
private static final long serialVersionUID = 4252901245508769114L;
@@ -122,6 +122,10 @@
return (flags & IS_VARIABLE_ARITY) != 0;
}
+ final boolean isPropertyAccessor() {
+ return (flags & IS_PROPERTY_ACCESSOR) != 0;
+ }
+
/**
* Used from e.g. Native*$Constructors as an explicit call. TODO - make arity immutable and final
* @param arity new arity
--- /dev/null Thu Jan 01 00:00:00 1970 +0000
+++ b/nashorn/test/script/basic/JDK-8066237.js Wed May 06 16:22:22 2015 +0200
@@ -0,0 +1,38 @@
+/*
+ * Copyright (c) 2015, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/**
+ * JDK-8066237: Fuzzing bug: Parser error on optimistic recompilation
+ *
+ * @test
+ * @run
+ */
+
+try {
+ (function() {
+ eval("get, a")
+ })();
+ fail("should have thrown");
+} catch (e) {
+ Assert.assertTrue(e.name === "ReferenceError");
+}