[
https://issues.apache.org/jira/browse/JEXL-405?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17761055#comment-17761055
]
Henri Biestro edited comment on JEXL-405 at 9/1/23 3:16 PM:
------------------------------------------------------------
The fix ensures that the lambda frame is only updated during its
creation/assignment by checking that the caller's scope is indeed the lambda's
scope parent.
Many thanks to VincentB for reporting and analyzing this.
Commit
[53eb3db|https://github.com/apache/commons-jexl/commit/53eb3dbd42d27ba5411197f024ce9ddf2c1bcca]
was (Author: henrib):
The fix ensures that the lambda frame is only updated during its
creation/assignment by checking that the caller's scope is indeed the lambda's
scope parent.
Commit
[53eb3db|https://github.com/apache/commons-jexl/commit/53eb3dbd42d27ba5411197f024ce9ddf2c1bcca]
> Recursive functions corrupt evaluation frame if reassigned
> ----------------------------------------------------------
>
> Key: JEXL-405
> URL: https://issues.apache.org/jira/browse/JEXL-405
> Project: Commons JEXL
> Issue Type: Bug
> Affects Versions: 3.3
> Reporter: Henri Biestro
> Assignee: Henri Biestro
> Priority: Major
> Fix For: 3.3.1
>
>
> This issue stems from the special handling recursive functions. A recursive
> function is detected when a lambda is created and assigned to a variable and
> that variable is captured by the lambda. During the assignment, the lambda
> frame - the captured value for the lambda symbol in that frame - is updated
> with a reference to the lambda itself. This can only occur after the lambda
> is created (obviously).
> The code that handles the special case during assignment does not verify that
> the caller is indeed its creator frame. Thus, if the lambda is assigned to a
> different variable later on in a different scope, that same code will trash
> the frame with a reference to the lambda...
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
