chakra-core / chakra-core/ChakraCore
[Bug]: Crash when nesting encodeURI with large .repeat() chains
Open
Bug
By Design
- Dominant language
- JavaScript
- Stars
- 9.3k
- Forks
- 1.2k
- PR merge metrics
- No merged PRs in 30d
Description
### ChakraCore Version
ch version 1.13.0.0-beta
### Steps to reproduce
./build.sh -j --static --sanitize=address,undefined,signed-integer-overflow
### Proof of concept
```js
encodeURI(
encodeURI(
encodeURI({}).repeat(322)
).repeat(322)
).repeat(322);
```
### Exception or Error
```text
Aborted (core dumped)
```
### Additional Context
ChakraCore crashes with a core dump when executing deeply nested encodeURI(...).repeat(...) calls on stringified objects, likely due to memory exhaustion.
Contributor guide
Assessment
This issue has not been assessed yet.