JDK-8031106 : Nashorn: IndexOutOfBoundsException in NashornCallSiteDescriptor.getNameToken()
  • Type: Bug
  • Component: core-libs
  • Sub-Component: jdk.nashorn
  • Affected Version: 8u20
  • Priority: P4
  • Status: Resolved
  • Resolution: Fixed
  • OS: linux_ubuntu
  • Submitted: 2013-12-13
  • Updated: 2014-07-29
  • Resolved: 2014-01-14
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 8 JDK 9
8u20Fixed 9 b02Fixed
Description
FULL PRODUCT VERSION :


A DESCRIPTION OF THE PROBLEM :
IndexOutOfBoundsException in NashornCallSiteDescriptor.getNameToken() when accessing a property of java.lang.Class instance. Only applies to jjssecure.

Nashorn version: hg tip 18edd7a1b166

ADDITIONAL REGRESSION INFORMATION:
Java(TM) SE Runtime Environment (build 1.8.0-ea-b119)
Java HotSpot(TM) 64-Bit Server VM (build 25.0-b61, mixed mode)

STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
jjs> try{ for(;;)void Array.apply(null,Array(0xffff)).map(function(){return 0}).sort(function(){return Math.random()>.5 ? 1 : -1}) }catch(e){cl = e.getClass()}
class java.lang.IllegalArgumentException
jjs> try { cl["forName"] } catch(e) { e.printStackTrace() }
java.lang.IndexOutOfBoundsException: 2
at jdk.nashorn.internal.runtime.linker.NashornCallSiteDescriptor.getNameToken(NashornCallSiteDescriptor.java:145)
at jdk.nashorn.internal.runtime.linker.ReflectionCheckLinker.checkLinkRequest(ReflectionCheckLinker.java:78)
at jdk.nashorn.internal.runtime.linker.ReflectionCheckLinker.getGuardedInvocation(ReflectionCheckLinker.java:57)
at jdk.internal.dynalink.support.CompositeTypeBasedGuardingDynamicLinker.getGuardedInvocation(CompositeTypeBasedGuardingDynamicLinker.java:176)
at jdk.internal.dynalink.support.CompositeGuardingDynamicLinker.getGuardedInvocation(CompositeGuardingDynamicLinker.java:124)
at jdk.internal.dynalink.support.LinkerServicesImpl.getGuardedInvocation(LinkerServicesImpl.java:138)
at jdk.internal.dynalink.DynamicLinker.relink(DynamicLinker.java:232)
at jdk.nashorn.internal.scripts.Script$\^shell\_.runScript(<shell>:1)
at jdk.nashorn.internal.runtime.ScriptFunctionData.invoke(ScriptFunctionData.java:498)
at jdk.nashorn.internal.runtime.ScriptFunction.invoke(ScriptFunction.java:207)
at jdk.nashorn.internal.runtime.ScriptRuntime.apply(ScriptRuntime.java:378)
at jdk.nashorn.internal.runtime.Context.eval(Context.java:475)
at jdk.nashorn.tools.Shell.readEvalPrint(Shell.java:439)
at jdk.nashorn.tools.Shell.run(Shell.java:155)
at jdk.nashorn.tools.Shell.main(Shell.java:130)
at jdk.nashorn.tools.Shell.main(Shell.java:109)


REPRODUCIBILITY :
This bug can be reproduced always.
Comments
changeset: 686:78cdf566535d tag: tip user: sundar date: Fri Jan 03 10:09:48 2014 +0530 summary: 8031106: Nashorn: IndexOutOfBoundsException in NashornCallSiteDescriptor.getNameToken()
03-01-2014
Reduced priority as this is not a security issue - rather an issue of throwing wrong exception (ArrayIndexOutOfBounds thrown instead of right exception).
02-01-2014
Simpler test to reproduce the issue: jjs -J-Djava.irs=../dist/ -J-Djava.security.manager -doe jjs> var x = new java.lang.Object() jjs> var cl = x.getClass() jjs> cl class java.lang.Object jjs> cl["forName"] java.lang.IndexOutOfBoundsException: 2 [....]
02-01-2014
I reproduced the bug as described. As noted, this is applicable only when "jjs" is run under security manager. Still it does not appear to be a security issue. A correctness issue when security manager is enabled. Also, "forName" is not a valid property on Class objects - since forName is a static method, it can be called only on StaticClass representing java.lang.Class (and not on specific Class instance). Nevertheless appropriate error has to be thrown rather than ArrayIndexOutOfBoundsException inside reflection check linker.
02-01-2014