stan/jdk-24
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

8026112: Function("with(x ? 1e81 : (x2.constructor = 0.1)){}") throws AssertionError: double is not compatible with object

Browse Source 
Reviewed-by: lagergren, hannesw
This commit is contained in:
Athijegannathan Sundararajan 2013-10-09 10:47:47 +02:00
parent c257318ccc
commit 1ed2372816
2 changed files with 33 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
nashorn/src/jdk/nashorn/internal/codegen/CodeGenerator.java
View File

@ -2893,7 +2893,7 @@ final class CodeGenerator extends NodeOperatorVisitor<CodeGeneratorLexicalContex
final Label falseLabel = new Label("ternary_false"); final Label falseLabel = new Label("ternary_false");
final Label exitLabel = new Label("ternary_exit"); final Label exitLabel = new Label("ternary_exit");
Type widest = Type.widest(trueExpr.getType(), falseExpr.getType()); Type widest = Type.widest(ternaryNode.getType(), Type.widest(trueExpr.getType(), falseExpr.getType()));
if (trueExpr.getType().isArray() || falseExpr.getType().isArray()) { //loadArray creates a Java array type on the stack, calls global allocate, which creates a native array type if (trueExpr.getType().isArray() || falseExpr.getType().isArray()) { //loadArray creates a Java array type on the stack, calls global allocate, which creates a native array type
widest = Type.OBJECT; widest = Type.OBJECT;
} }
@ -2904,7 +2904,7 @@ final class CodeGenerator extends NodeOperatorVisitor<CodeGeneratorLexicalContex
// we still keep the conversion here as the AccessSpecializer can have separated the types, e.g. var y = x ? x=55 : 17 // we still keep the conversion here as the AccessSpecializer can have separated the types, e.g. var y = x ? x=55 : 17
// will left as (Object)x=55 : (Object)17 by Lower. Then the first term can be {I}x=55 of type int, which breaks the // will left as (Object)x=55 : (Object)17 by Lower. Then the first term can be {I}x=55 of type int, which breaks the
// symmetry for the temporary slot for this TernaryNode. This is evidence that we assign types and explicit conversions // symmetry for the temporary slot for this TernaryNode. This is evidence that we assign types and explicit conversions
// to early, or Apply the AccessSpecializer too late. We are mostly probably looking for a separate type pass to // too early, or Apply the AccessSpecializer too late. We are mostly probably looking for a separate type pass to
// do this property. Then we never need any conversions in CodeGenerator // do this property. Then we never need any conversions in CodeGenerator
method.ifeq(falseLabel); method.ifeq(falseLabel);
load(trueExpr); load(trueExpr);

31
nashorn/test/script/basic/JDK-8026112.js Normal file
View File

@ -0,0 +1,31 @@
/*
* Copyright (c) 2010, 2013, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/**
* JDK-8026112: Function("with(x ? 1e81 : (x2.constructor = 0.1)){}") throws AssertionError: double is not compatible with object
*
* @test
* @run
*/
Function("with(x ? 1e81 : (x2.constructor = 0.1)){}")