Critical bug in Nashorn with 8u40

[Tal Liron]

Though the Three Crickets stack works with Nashorn, in investigating a bug I have uncovered a devastating bug in Nashorn, which apparently existing for a very long time and remained undetected. It affects all public releases of Nashorn until now, including the latest 8u40.

The issue is that if you use the break/continue keywords as well as a try/catch/finally within the same function, you may get unexpected behavior. Specifically, the "finally" block may be run more than once and at the wrong time -- when the break/continue is reached.

This is, of course, awful, and can lead to some very insidious bugs, such as the one that I investigated that led me to this discovery.

I'm happy to say that the Nashorn team has acknowledged the severity of the issue and there is a fix in the pipeline, though it's unclear when exactly it will be made public. You can read the complete discussion here (I am linking to the latest response from the Nashorn team):

https://www.mail-archive.com/nasho...@openjdk.java.net/msg03419.html

Note the workaround suggested by Szegedi is good. It is syntactically awkward, and of course introduces a minor performance hit, but it will maintain the try/catch/finally semantics and will continue working in the future when the bug is fixed.

I have made a release of Sincerity (1.0-beta11) to fix this issue in my code (specifically it was in the Service Plugin), but of course you need to be aware of it in your own JavaScript code. So, please audit carefully. I suggest searching your codebase for any break/continue keyword, and apply Szegedi's workaround where appropriate.