8066237: Fuzzing bug: Parser error on optimistic recompilation

Reviewed-by: lagergren, attila

nashorn/src/jdk.scripting.nashorn/share/classes/jdk/nashorn/internal/runtime/RecompilableScriptFunctionData.java

@@ -342,6 +342,9 @@ public final class RecompilableScriptFunctionData extends ScriptFunctionData imp
         if (functionNode.isVarArg()) {
             flags |= IS_VARIABLE_ARITY;
         }
+        if (functionNode.getKind() == FunctionNode.Kind.GETTER || functionNode.getKind() == FunctionNode.Kind.SETTER) {
+            flags |= IS_PROPERTY_ACCESSOR;
+        }
         return flags;
     }
 
@@ -382,7 +385,7 @@ public final class RecompilableScriptFunctionData extends ScriptFunctionData imp
         parser.setReparsedFunction(this);
 
         final FunctionNode program = parser.parse(CompilerConstants.PROGRAM.symbolName(), descPosition,
-                Token.descLength(token), true);
+                Token.descLength(token), isPropertyAccessor());
         // Parser generates a program AST even if we're recompiling a single function, so when we are only
         // recompiling a single function, extract it from the program.
         return (isProgram() ? program : extractFunctionFromScript(program)).setName(null, functionName);

nashorn/src/jdk.scripting.nashorn/share/classes/jdk/nashorn/internal/runtime/ScriptFunctionData.java

@@ -80,24 +80,24 @@ public abstract class ScriptFunctionData implements Serializable {
     private static final MethodHandle BIND_VAR_ARGS = findOwnMH("bindVarArgs", Object[].class, Object[].class, Object[].class);
 
     /** Is this a strict mode function? */
-    public static final int IS_STRICT      = 1 << 0;
+    public static final int IS_STRICT            = 1 << 0;
     /** Is this a built-in function? */
-    public static final int IS_BUILTIN     = 1 << 1;
+    public static final int IS_BUILTIN           = 1 << 1;
     /** Is this a constructor function? */
-    public static final int IS_CONSTRUCTOR = 1 << 2;
+    public static final int IS_CONSTRUCTOR       = 1 << 2;
     /** Does this function expect a callee argument? */
-    public static final int NEEDS_CALLEE   = 1 << 3;
+    public static final int NEEDS_CALLEE         = 1 << 3;
     /** Does this function make use of the this-object argument? */
-    public static final int USES_THIS      = 1 << 4;
+    public static final int USES_THIS            = 1 << 4;
     /** Is this a variable arity function? */
-    public static final int IS_VARIABLE_ARITY = 1 << 5;
+    public static final int IS_VARIABLE_ARITY    = 1 << 5;
+    /** Is this a object literal property getter or setter? */
+    public static final int IS_PROPERTY_ACCESSOR = 1 << 6;
 
     /** Flag for strict or built-in functions */
     public static final int IS_STRICT_OR_BUILTIN = IS_STRICT | IS_BUILTIN;
     /** Flag for built-in constructors */
     public static final int IS_BUILTIN_CONSTRUCTOR = IS_BUILTIN | IS_CONSTRUCTOR;
-    /** Flag for strict constructors */
-    public static final int IS_STRICT_CONSTRUCTOR = IS_STRICT | IS_CONSTRUCTOR;
 
     private static final long serialVersionUID = 4252901245508769114L;
 
@@ -122,6 +122,10 @@ public abstract class ScriptFunctionData implements Serializable {
         return (flags & IS_VARIABLE_ARITY) != 0;
     }
 
+    final boolean isPropertyAccessor() {
+        return (flags & IS_PROPERTY_ACCESSOR) != 0;
+    }
+
     /**
      * Used from e.g. Native*$Constructors as an explicit call. TODO - make arity immutable and final
      * @param arity new arity

nashorn/test/script/basic/JDK-8066237.js

@@ -0,0 +1,38 @@
+/*
+ * Copyright (c) 2015, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ * 
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ * 
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ * 
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ * 
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/**
+ * JDK-8066237: Fuzzing bug: Parser error on optimistic recompilation
+ *
+ * @test
+ * @run
+ */
+
+try {
+    (function() {
+        eval("get, a")
+    })();
+    fail("should have thrown");
+} catch (e) {
+    Assert.assertTrue(e.name === "ReferenceError");
+}