193418 - Empty block {} triggers NullPointerException when optimization >= 1

Status: VERIFIED FIXED

(Rhino Graveyard :: Compiler, defect)

Description

[Igor Bukanov]

Empty block {} triggers NullPointerException when optimization >= 1

With optimization level set to 1 or higher empty block { } usage can trigger
NullPointerException in the compiler.

To reproduce, run the following script against Rhino shell with the optimization
level set to 1:

//-------TEST START --------------------------------
var test = false;

function f() {
  while (0) {
    {  }
  }
  test = true;
}

f();

print(test ? "OK" : "FAILED!");
//-------TEST END ----------------------------------


The test should print "OK" but instead the following stack trace appears:


Exception in thread "main" java.lang.NullPointerException
        at org.mozilla.javascript.optimizer.Block.buildBlocks(Block.java:137)
        at
org.mozilla.javascript.optimizer.Optimizer.optimizeFunction(Optimizer.java:71)
        at org.mozilla.javascript.optimizer.Optimizer.optimize(Optimizer.java:149)
        at org.mozilla.javascript.optimizer.Codegen.compile(Codegen.java:95)
        at org.mozilla.javascript.Context.compile(Context.java:2072)
        at org.mozilla.javascript.Context.compile(Context.java:2002)
        at org.mozilla.javascript.Context.compileReader(Context.java:897)
        at org.mozilla.javascript.Context.evaluateReader(Context.java:815)
        at org.mozilla.javascript.tools.shell.Main.evaluateReader(Main.java:363)
        at org.mozilla.javascript.tools.shell.Main.processFileSecure(Main.java:354)
        at org.mozilla.javascript.tools.shell.Main.processFile(Main.java:291)
        at org.mozilla.javascript.tools.shell.Main.processSource(Main.java:283)
        at org.mozilla.javascript.tools.shell.Main.exec(Main.java:103)
        at org.mozilla.javascript.tools.shell.Main.main(Main.java:76)

Comment 1

[Igor Bukanov]

Attachment: Fixing tree iteration problem in Optimizer.buildStatementList

The bug caused by missed check in StmtNodeIterator.nextNode for a possible null
result of findFirstInterestingNode inside the search loop which made search to
stop preliminary with non-empty stack.

The patch fixes this and integrates StmtNodeIterator into
Optimizer.buildStatementList as StmtNodeIterator was used only by
buildStatementList and the new version is simpler.

Comment 2

[Igor Bukanov]

I commited the fix

Comment 3

[Phil Schwartau]

Testcase added to JS testsuite:

      mozilla/js/tests/js1_5/Regress/regress-193418.js

Comment 4

[Phil Schwartau]

Verified FIXED. The above testcase now passes in the Rhino shell.
I tested with optimization levels set to -1, 0, 1, and 9.

Before this patch was committed, the test failed as Igor described
above, whenever the optimization was set to be greater than 0.

Comment 5

[Igor Bukanov]

Targeting as resolved against 1.5R5