From a7a2c827801a1cf64a66395c987577e77383849c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Hannes=20Walln=C3=B6fer?= <hannesw@openjdk.org>
Date: Thu, 11 Dec 2014 19:15:47 +0100
Subject: [PATCH] 8067219: NPE in ScriptObject.clone() when running with object
 fields

Reviewed-by: attila, lagergren
---
 .../internal/codegen/CodeGenerator.java       |  2 +-
 .../internal/runtime/ScriptObject.java        |  4 +-
 .../script/basic/es6/for-let-object-fields.js | 81 +++++++++++++++++++
 .../es6/for-let-object-fields.js.EXPECTED     | 33 ++++++++
 nashorn/test/script/basic/es6/for-let.js      |  3 +-
 5 files changed, 120 insertions(+), 3 deletions(-)
 create mode 100644 nashorn/test/script/basic/es6/for-let-object-fields.js
 create mode 100644 nashorn/test/script/basic/es6/for-let-object-fields.js.EXPECTED

diff --git a/nashorn/src/jdk.scripting.nashorn/share/classes/jdk/nashorn/internal/codegen/CodeGenerator.java b/nashorn/src/jdk.scripting.nashorn/share/classes/jdk/nashorn/internal/codegen/CodeGenerator.java
index 4a583f7842e..32173a6c543 100644
--- a/nashorn/src/jdk.scripting.nashorn/share/classes/jdk/nashorn/internal/codegen/CodeGenerator.java
+++ b/nashorn/src/jdk.scripting.nashorn/share/classes/jdk/nashorn/internal/codegen/CodeGenerator.java
@@ -3283,7 +3283,7 @@ final class CodeGenerator extends NodeOperatorVisitor<CodeGeneratorLexicalContex
             emitContinueLabel(continueLabel, liveLocalsOnContinue);
         }
 
-        if (loopNode.hasPerIterationScope() && lc.getParentBlock().needsScope()) {
+        if (loopNode.hasPerIterationScope() && lc.getCurrentBlock().needsScope()) {
             // ES6 for loops with LET init need a new scope for each iteration. We just create a shallow copy here.
             method.loadCompilerConstant(SCOPE);
             method.invoke(virtualCallNoLookup(ScriptObject.class, "copy", ScriptObject.class));
diff --git a/nashorn/src/jdk.scripting.nashorn/share/classes/jdk/nashorn/internal/runtime/ScriptObject.java b/nashorn/src/jdk.scripting.nashorn/share/classes/jdk/nashorn/internal/runtime/ScriptObject.java
index 90244bc06d7..c3eca18fee1 100644
--- a/nashorn/src/jdk.scripting.nashorn/share/classes/jdk/nashorn/internal/runtime/ScriptObject.java
+++ b/nashorn/src/jdk.scripting.nashorn/share/classes/jdk/nashorn/internal/runtime/ScriptObject.java
@@ -3710,7 +3710,9 @@ public abstract class ScriptObject implements PropertyAccess, Cloneable {
         final ScriptObject clone = (ScriptObject) super.clone();
         if (objectSpill != null) {
             clone.objectSpill = objectSpill.clone();
-            clone.primitiveSpill = primitiveSpill.clone();
+            if (primitiveSpill != null) {
+                clone.primitiveSpill = primitiveSpill.clone();
+            }
         }
         clone.arrayData = arrayData.copy();
         return clone;
diff --git a/nashorn/test/script/basic/es6/for-let-object-fields.js b/nashorn/test/script/basic/es6/for-let-object-fields.js
new file mode 100644
index 00000000000..fe44eda551b
--- /dev/null
+++ b/nashorn/test/script/basic/es6/for-let-object-fields.js
@@ -0,0 +1,81 @@
+/*
+ * Copyright (c) 2010, 2014, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ * 
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ * 
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ * 
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ * 
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/**
+ * JDK-8067219: NPE in ScriptObject.clone() when running with object fields
+ *
+ * @test
+ * @run
+ * @fork
+ * @option -Dnashorn.fields.objects=true
+ * @option --language=es6
+ */
+
+"use strict";
+
+for (let i = 0; i < 10; i++) {
+    print(i);
+}
+
+try {
+    print(i);
+} catch (e) {
+    print(e);
+}
+
+let a = [];
+
+for (let i = 0; i < 10; i++) {
+    a.push(function() { print(i); });
+}
+
+a.forEach(function(f) { f(); });
+
+a = [];
+
+for (let i = 0; i < 10; i++) {
+    if (i == 5) {
+        i = "foo";
+    }
+    a.push(function() { print(i); });
+}
+
+a.forEach(function(f) { f(); });
+
+try {
+    print(i);
+} catch (e) {
+    print(e);
+}
+
+a = [];
+
+for (let i = 0; i < 20; i++) {
+    if (i % 2 == 1) {
+        i += 2;
+        continue;
+    }
+    a.push(function() { print(i); });
+}
+
+a.forEach(function(f) { f(); });
diff --git a/nashorn/test/script/basic/es6/for-let-object-fields.js.EXPECTED b/nashorn/test/script/basic/es6/for-let-object-fields.js.EXPECTED
new file mode 100644
index 00000000000..21787adb64b
--- /dev/null
+++ b/nashorn/test/script/basic/es6/for-let-object-fields.js.EXPECTED
@@ -0,0 +1,33 @@
+0
+1
+2
+3
+4
+5
+6
+7
+8
+9
+ReferenceError: "i" is not defined
+0
+1
+2
+3
+4
+5
+6
+7
+8
+9
+0
+1
+2
+3
+4
+foo
+ReferenceError: "i" is not defined
+0
+4
+8
+12
+16
diff --git a/nashorn/test/script/basic/es6/for-let.js b/nashorn/test/script/basic/es6/for-let.js
index 848dc3ce061..2ad38e57ff8 100644
--- a/nashorn/test/script/basic/es6/for-let.js
+++ b/nashorn/test/script/basic/es6/for-let.js
@@ -26,7 +26,8 @@
  *
  * @test
  * @run
- * @option --language=es6 */
+ * @option --language=es6
+ */
 
 "use strict";