chakra-core / chakra-core/ChakraCore

Handle statements in CatchClause incorrectly when stack overflow

Open
#6,366 1 comment 0 reactions 0 assignees View on GitHub
Bug Severity: 2
Dominant language
JavaScript
Stars
9.3k
Forks
1.2k
PR merge metrics
No merged PRs in 30d

Description

The bug can be reproduced in ch version 1.11.15.0.
Executing following code:
```
var i = 0;
function func(obj0) {
{
obj0.c = obj0.a;
}
}

function f() {
try {
f();
} catch (e) {
i++;
func(Array(123456789)); // can not delete
}
}
f();
print(i);
```
When I delete `func(Array(123456789)); `, the output of `i` is 1. So, the statements in catch-clause only execute once.
But when I keep the `func(Array(123456789));`, the output of `i` is more than 1.

Reason of this output:
f() is jitted, when stack is full during recursion, jitted code of f() will bailout. In procedure of bailout, `i++` is executed correctly, but `func(Array(123456789));` will throw an exception because of stack is full again. This exception will be caught by upper jitted f() caller, and will trigger bailout again. Repeat previous process, `i++` is executed and `func(Array(123456789));` will throw an exception again unless there is enough stack space for its execution.
It results to the statements in catch clause execute different times. `i++` is executed several times but `func(Array(123456789)); ` only executed once.

ISec Lab
2019.12.25

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.