JDK-8131039 : after adding a function property to Object.prototype, JSON.parse with reviver function goes into infinite loop
  • Type: Bug
  • Component: core-libs
  • Sub-Component: jdk.nashorn
  • Affected Version: 8-pool,9
  • Priority: P3
  • Status: Resolved
  • Resolution: Fixed
  • OS: windows_7
  • CPU: x86_64
  • Submitted: 2015-07-11
  • Updated: 2016-01-14
  • Resolved: 2015-07-16
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 8 JDK 9
8u72Fixed 9 b74Fixed
Description
FULL PRODUCT VERSION :
java version "1.8.0_45"
Java(TM) SE Runtime Environment (build 1.8.0_45-b15)
Java HotSpot(TM) 64-Bit Server VM (build 25.45-b02, mixed mode)

ADDITIONAL OS VERSION INFORMATION :
Windows -7

A DESCRIPTION OF THE PROBLEM :
	public static void main(String[] args) throws ScriptException {
		ScriptEngine engine = new ScriptEngineManager().getEngineByName("js");
		engine.eval("Object.prototype.merge = function(obj2){ return this; }");
		engine.eval("function nothingTodo(k, v) {return v}");
		engine.eval("JSON.parse('{\"name\" : \"jack\"}')");
                // ^^^^^^^^^^^^ THAT IS OK
		engine.eval("JSON.parse('{\"name\" : \"jack\"}', nothingTodo)");
                // ^^^^^^^^^^^^ DEAD LOOP
	}


Exception in thread "main" java.lang.StackOverflowError
	at jdk.nashorn.internal.runtime.PropertyHashMap.find(PropertyHashMap.java:275)
	at jdk.nashorn.internal.runtime.PropertyMap.findProperty(PropertyMap.java:552)
	at jdk.nashorn.internal.runtime.ScriptObject.findProperty(ScriptObject.java:814)
	at jdk.nashorn.internal.runtime.ScriptObject.findProperty(ScriptObject.java:823)
	at jdk.nashorn.internal.runtime.ScriptObject.findProperty(ScriptObject.java:790)
	at jdk.nashorn.internal.runtime.ScriptObject.get(ScriptObject.java:3000)
	at jdk.nashorn.internal.runtime.ScriptObject.get(ScriptObject.java:3020)
	at jdk.nashorn.internal.runtime.JSONFunctions.walk(JSONFunctions.java:113)
	at jdk.nashorn.internal.runtime.JSONFunctions.walk(JSONFunctions.java:120)
	at jdk.nashorn.internal.runtime.JSONFunctions.walk(JSONFunctions.java:120)
	at jdk.nashorn.internal.runtime.JSONFunctions.walk(JSONFunctions.java:120)
	at jdk.nashorn.internal.runtime.JSONFunctions.walk(JSONFunctions.java:120)
	at jdk.nashorn.internal.runtime.JSONFunctions.walk(JSONFunctions.java:120)
	at jdk.nashorn.internal.runtime.JSONFunctions.walk(JSONFunctions.java:120)
	at jdk.nashorn.internal.runtime.JSONFunctions.walk(JSONFunctions.java:120)
	at jdk.nashorn.internal.runtime.JSONFunctions.walk(JSONFunctions.java:120)
	at jdk.nashorn.internal.runtime.JSONFunctions.walk(JSONFunctions.java:120)
	at jdk.nashorn.internal.runtime.JSONFunctions.walk(JSONFunctions.java:120)
	at jdk.nashorn.internal.runtime.JSONFunctions.walk(JSONFunctions.java:120)


REGRESSION.  Last worked in version 8u45


ERROR MESSAGES/STACK TRACES THAT OCCUR :
Exception in thread "main" java.lang.StackOverflowError
	at jdk.nashorn.internal.runtime.PropertyHashMap.find(PropertyHashMap.java:275)
	at jdk.nashorn.internal.runtime.PropertyMap.findProperty(PropertyMap.java:552)
	at jdk.nashorn.internal.runtime.ScriptObject.findProperty(ScriptObject.java:814)
	at jdk.nashorn.internal.runtime.ScriptObject.findProperty(ScriptObject.java:823)
	at jdk.nashorn.internal.runtime.ScriptObject.findProperty(ScriptObject.java:790)
	at jdk.nashorn.internal.runtime.ScriptObject.get(ScriptObject.java:3000)
	at jdk.nashorn.internal.runtime.ScriptObject.get(ScriptObject.java:3020)
	at jdk.nashorn.internal.runtime.JSONFunctions.walk(JSONFunctions.java:113)
	at jdk.nashorn.internal.runtime.JSONFunctions.walk(JSONFunctions.java:120)
	at jdk.nashorn.internal.runtime.JSONFunctions.walk(JSONFunctions.java:120)
	at jdk.nashorn.internal.runtime.JSONFunctions.walk(JSONFunctions.java:120)
	at jdk.nashorn.internal.runtime.JSONFunctions.walk(JSONFunctions.java:120)
	at jdk.nashorn.internal.runtime.JSONFunctions.walk(JSONFunctions.java:120)
	at jdk.nashorn.internal.runtime.JSONFunctions.walk(JSONFunctions.java:120)
	at jdk.nashorn.internal.runtime.JSONFunctions.walk(JSONFunctions.java:120)
	at jdk.nashorn.internal.runtime.JSONFunctions.walk(JSONFunctions.java:120)
	at jdk.nashorn.internal.runtime.JSONFunctions.walk(JSONFunctions.java:120)
	at jdk.nashorn.internal.runtime.JSONFunctions.walk(JSONFunctions.java:120)
	at jdk.nashorn.internal.runtime.JSONFunctions.walk(JSONFunctions.java:120)

REPRODUCIBILITY :
This bug can be reproduced always.

---------- BEGIN SOURCE ----------
import javax.script.ScriptEngine;
import javax.script.ScriptEngineManager;
import javax.script.ScriptException;

public class Look {
	public static void main(String[] args) throws ScriptException {
		ScriptEngine engine = new ScriptEngineManager().getEngineByName("js");
		engine.eval("Object.prototype.merge = function(obj2){ return this; }");
		engine.eval("function nothingTodo(k, v) {return v}");
		engine.eval("JSON.parse('{\"name\" : \"jack\"}')");
		engine.eval("JSON.parse('{\"name\" : \"jack\"}', nothingTodo)");
	}
}

---------- END SOURCE ----------


Comments
Relevant spec. section link: https://es5.github.io/#Walk
15-07-2015

1. Run the attached test case (Look.java). 2. Checked this for JDK 7u80, 8, 8u45, 8u60 ea b21, and 9 ea b71. 7u80: OK 8: FAIL 8u45: FAIL 8u60 ea b23: FAIL 9 ea b72: FAIL 3. Output with JDK 8u45: Exception in thread "main" java.lang.StackOverflowError at jdk.nashorn.internal.runtime.PropertyHashMap.find(PropertyHashMap.java:275) at jdk.nashorn.internal.runtime.PropertyMap.findProperty(PropertyMap.java:552) at jdk.nashorn.internal.runtime.ScriptObject.findProperty(ScriptObject.java:814) at jdk.nashorn.internal.runtime.ScriptObject.findProperty(ScriptObject.java:823) at jdk.nashorn.internal.runtime.ScriptObject.findProperty(ScriptObject.java:790) at jdk.nashorn.internal.runtime.ScriptObject.get(ScriptObject.java:3000) at jdk.nashorn.internal.runtime.ScriptObject.get(ScriptObject.java:3020) at jdk.nashorn.internal.runtime.JSONFunctions.walk(JSONFunctions.java:113) at jdk.nashorn.internal.runtime.JSONFunctions.walk(JSONFunctions.java:120) ................................................................. ................................................................. 4. Able to reproduce this issue with JDK 8-all and 9 ea b72. However, the code run fine with JDK 7u80.
13-07-2015