chakra-core / chakra-core/ChakraCore
Handle statements in CatchClause incorrectly when stack overflow
- Dominant language
- JavaScript
- Stars
- 9.3k
- Forks
- 1.2k
- PR merge metrics
- No merged PRs in 30d
Description
The bug can be reproduced in ch version 1.11.15.0.
Executing following code:
```
var i = 0;
function func(obj0) {
{
obj0.c = obj0.a;
}
}
function f() {
try {
f();
} catch (e) {
i++;
func(Array(123456789)); // can not delete
}
}
f();
print(i);
```
When I delete `func(Array(123456789)); `, the output of `i` is 1. So, the statements in catch-clause only execute once.
But when I keep the `func(Array(123456789));`, the output of `i` is more than 1.
Reason of this output:
f() is jitted, when stack is full during recursion, jitted code of f() will bailout. In procedure of bailout, `i++` is executed correctly, but `func(Array(123456789));` will throw an exception because of stack is full again. This exception will be caught by upper jitted f() caller, and will trigger bailout again. Repeat previous process, `i++` is executed and `func(Array(123456789));` will throw an exception again unless there is enough stack space for its execution.
It results to the statements in catch clause execute different times. `i++` is executed several times but `func(Array(123456789)); ` only executed once.
ISec Lab
2019.12.25
Contributor guide
Assessment
This issue has not been assessed yet.