JDK-8066224 : Fuzzing bug: constant folding of ternary operator and IfNode with constant test
  • Type: Sub-task
  • Component: core-libs
  • Sub-Component: jdk.nashorn
  • Affected Version: 8u60
  • Priority: P3
  • Status: Resolved
  • Resolution: Fixed
  • OS: generic
  • CPU: generic
  • Submitted: 2014-12-01
  • Updated: 2015-06-04
  • Resolved: 2014-12-10
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 8 JDK 9
8u40Fixed 9 b43Fixed
Related Reports
Cloners :  
JDK-8066225 - Fuzzing bug: duplicate integer switch cases
Cloners :  
JDK-8066223 - Fuzzing bug: ClassCastException between JO1P0 and WithObject
Description
jjs> try{ (function(){ if(false ? (-1) : '' ) {throw false;} else if (x = this) {var x = x; } })() } catch(e) { e.printStackTrace() }
java.lang.NullPointerException
   at jdk.nashorn.internal.codegen.MethodEmitter.pushType(MethodEmitter.java:258)
   at jdk.nashorn.internal.codegen.MethodEmitter.loadUndefined(MethodEmitter.java:779)
   at jdk.nashorn.internal.codegen.MethodEmitter.emitLocalVariableConversion(MethodEmitter.java:2517)
   at jdk.nashorn.internal.codegen.MethodEmitter.beforeJoinPoint(MethodEmitter.java:2492)
   at jdk.nashorn.internal.codegen.CodeGenerator.leaveBlock(CodeGenerator.java:1126)
   at jdk.nashorn.internal.ir.Block.accept(Block.java:178)
   at jdk.nashorn.internal.ir.LexicalContextNode$Acceptor.accept(LexicalContextNode.java:57)
   at jdk.nashorn.internal.ir.Block.accept(Block.java:425)
   at jdk.nashorn.internal.codegen.CodeGenerator.enterIfNode(CodeGenerator.java:2025)
   at jdk.nashorn.internal.ir.IfNode.accept(IfNode.java:86)
   ...
Comments
This is caused by a bug in constant folding of a ternary operator with a constant test value. The issue is that "false ? a : b" is replaced with "b", but in reality, the leaves of the ternary node is JoinPredecessorExpression(b). We'll be returning an orphaned join predecessor (as we eliminated the ternary, there's no longer a control flow join), and it causes a problem. Unwrapping JoinPredecessorExpression.getExpression() and returning it instead fixes the issue. Additionally, CodeGenerator.enterIfNode doesn't handle as special cases when the test of the if statement is always true or always false. This can lead to further problems as local variable type calculator *does* in fact pay attention to this, so it will not to emit unnecessary join conversions. To put it simply, CodeGenerator and LocalVariableTypeCalculator should treat reachability identically, so since LVTC does isAlwaysTrue/isAlwaysFalse special casing for IfNode, so should CodeGenerator. (Fixing either issue on its own will solve the above NPE, but there's no reason not to fix both).
08-12-2014