From 239fdbbca67bf897e946e30179113f8b81698fe0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Hannes=20Walln=C3=B6fer?= <hannesw@openjdk.org>
Date: Tue, 14 Nov 2017 10:04:45 +0100
Subject: [PATCH] 8185119: Uninitialized const when using multiple threads

Reviewed-by: jlaskey, sundar
---
 .../internal/runtime/ScriptObject.java        |  4 +-
 .../linker/NashornCallSiteDescriptor.java     |  9 +++
 .../script/nosecurity/es6/JDK-8185119.js      | 58 +++++++++++++++++++
 3 files changed, 69 insertions(+), 2 deletions(-)
 create mode 100644 test/nashorn/script/nosecurity/es6/JDK-8185119.js

diff --git a/src/jdk.scripting.nashorn/share/classes/jdk/nashorn/internal/runtime/ScriptObject.java b/src/jdk.scripting.nashorn/share/classes/jdk/nashorn/internal/runtime/ScriptObject.java
index 19f1a2214e3..2b0ac1b7f55 100644
--- a/src/jdk.scripting.nashorn/share/classes/jdk/nashorn/internal/runtime/ScriptObject.java
+++ b/src/jdk.scripting.nashorn/share/classes/jdk/nashorn/internal/runtime/ScriptObject.java
@@ -2050,7 +2050,7 @@ public abstract class ScriptObject implements PropertyAccess, Cloneable {
 
         final PropertyMap newMap = oldMap.replaceProperty(property, property.removeFlags(Property.NEEDS_DECLARATION));
         setMap(newMap);
-        set(key, value, 0);
+        set(key, value, NashornCallSiteDescriptor.CALLSITE_DECLARE);
     }
 
     /**
@@ -3071,7 +3071,7 @@ public abstract class ScriptObject implements PropertyAccess, Cloneable {
         }
 
         if (f != null) {
-            if (!f.getProperty().isWritable() || !f.getProperty().hasNativeSetter()) {
+            if ((!f.getProperty().isWritable() && !NashornCallSiteDescriptor.isDeclaration(callSiteFlags)) || !f.getProperty().hasNativeSetter()) {
                 if (isScopeFlag(callSiteFlags) && f.getProperty().isLexicalBinding()) {
                     throw typeError("assign.constant", key.toString()); // Overwriting ES6 const should throw also in non-strict mode.
                 }
diff --git a/src/jdk.scripting.nashorn/share/classes/jdk/nashorn/internal/runtime/linker/NashornCallSiteDescriptor.java b/src/jdk.scripting.nashorn/share/classes/jdk/nashorn/internal/runtime/linker/NashornCallSiteDescriptor.java
index 71f9f47b2f6..f01faa921a8 100644
--- a/src/jdk.scripting.nashorn/share/classes/jdk/nashorn/internal/runtime/linker/NashornCallSiteDescriptor.java
+++ b/src/jdk.scripting.nashorn/share/classes/jdk/nashorn/internal/runtime/linker/NashornCallSiteDescriptor.java
@@ -504,6 +504,15 @@ public final class NashornCallSiteDescriptor extends CallSiteDescriptor {
         return (flags & CALLSITE_SCOPE) != 0;
     }
 
+    /**
+     * Returns true if {@code flags} has the {@link  #CALLSITE_DECLARE} bit set.
+     * @param flags the flags
+     * @return true if the flag is set, false otherwise.
+     */
+    public static boolean isDeclaration(final int flags) {
+        return (flags & CALLSITE_DECLARE) != 0;
+    }
+
     /**
      * Get a program point from a descriptor (must be optimistic)
      * @param desc descriptor
diff --git a/test/nashorn/script/nosecurity/es6/JDK-8185119.js b/test/nashorn/script/nosecurity/es6/JDK-8185119.js
new file mode 100644
index 00000000000..42e332a1597
--- /dev/null
+++ b/test/nashorn/script/nosecurity/es6/JDK-8185119.js
@@ -0,0 +1,58 @@
+/*
+ * Copyright (c) 2017, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ * 
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ * 
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ * 
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ * 
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/**
+ * JDK-8185119: Uninitialized const when using multiple threads
+ *
+ * @test
+ * @option --language=es6
+ * @run
+ */
+
+function f() {
+    let a;
+    const b = {};
+    b.crash; // b is sometimes undefined
+
+    function c() {
+        a; b;
+    }
+}
+
+let count = new java.util.concurrent.atomic.AtomicInteger();
+
+let T = Java.extend(Java.type('java.lang.Thread'), {
+    run: function() {
+        for (let j = 0; j < 100; j++) {
+            f();
+        }
+        count.getAndIncrement();
+    }
+});
+
+const threads = [new T(), new T(), new T(), new T()];
+threads.forEach(t => t.start());
+threads.forEach(t => t.join());
+
+Assert.assertEquals(count.intValue(), 4);
+