[Bug] MSAL JavaScript hits StackOverflow

[ryanmolden]

Library version used

4.61.3

.NET version

net462

Scenario

PublicClient - desktop app

Is this a new or an existing app?

The app is in production, and I have upgraded to a new version of MSAL

Issue description and reproduction steps

This is in perfview.

This (abbreviated, simplified) callstack triggers an SO in the JS interpreter:

<snip>
jscript9!Js::JavascriptError::ThrowStackOverflowError(...)
jscript9!Js::Exception::RaiseIfScriptActive(...)
jscript9!Js::Throw::StackOverflow(...)
jscript9!ThreadContext::ProbeStackNoDispose()
jscript9!ThreadContext::ProbeStack(...)
[[snip literally 6,781 stack frames]]
jscript9!Js::JavascriptFunction::CallFunction<1>(...)
jscript9!Js::JavascriptFunction::CallRootFunctionInternal(...)
jscript9!Js::JavascriptFunction::CallRootFunction(...)
jscript9!ScriptSite::CallRootFunction(...)
jscript9!ScriptSite::Execute(...)
jscript9!ScriptEngineBase::Execute(...)
mshtml!CJScript9Holder::ExecuteCallback(...)
mshtml!CListenerDispatch::InvokeVar(...)
mshtml!CListenerDispatch::Invoke(...)
mshtml!CEventMgr::_InvokeListeners(...)
mshtml!CEventMgr::_InvokeListenersOnWindow(...)
mshtml!CEventMgr::_InvokeListeners(...)
mshtml!CEventMgr::Dispatch(...)
mshtml!CEventMgr::DispatchEvent(...)
mshtml!COmWindowProxy::Fire_onload()
mshtml!CMarkup::OnLoadStatusDone()
mshtml!CMarkup::OnLoadStatus(...)
mshtml!CProgSink::DoUpdate(...)
mshtml!GlobalWndOnMethodCall()
mshtml!GlobalWndProc_SEH(...)
mshtml!GlobalWndProc(...)
user32!UserCallWinProcCheckWow(...)
user32!DispatchMessageWorker(...)
System_Windows_Forms_ni(...)
System_Windows_Forms_ni!System.Windows.Forms.Application.ComponentManager.System.Windows.Forms.UnsafeNativeMethods.IMsoComponentManager.FPushMessageLoop(...)
System_Windows_Forms_ni!System.Windows.Forms.Application.ThreadContext.RunMessageLoopInner(...)
System_Windows_Forms_ni!System.Windows.Forms.Application.ThreadContext.RunMessageLoop(...)
System_Windows_Forms_ni!System.Windows.Forms.Form.ShowDialog(...)
Microsoft_Identity_Client!Microsoft.Identity.Client.Platforms.Features.WinFormsLegacyWebUi.WindowsFormsWebAuthenticationDialog.<>c__DisplayClass5_0.<ShowBrowser>b__0(...)
Microsoft_Identity_Client!Microsoft.Identity.Client.Platforms.Features.WinFormsLegacyWebUi.WindowsFormsWebAuthenticationDialogBase.InvokeHandlingOwnerWindow(...)
Microsoft_Identity_Client!Microsoft.Identity.Client.Platforms.Features.WinFormsLegacyWebUi.WindowsFormsWebAuthenticationDialog.ShowBrowser(...) Microsoft_Identity_Client!Microsoft.Identity.Client.Platforms.Features.WinFormsLegacyWebUi.WindowsFormsWebAuthenticationDialog.OnAuthenticate(...)
Microsoft_Identity_Client!Microsoft.Identity.Client.Platforms.Features.WinFormsLegacyWebUi.WindowsFormsWebAuthenticationDialogBase.AuthenticateAAD(...) Microsoft_Identity_Client!Microsoft.Identity.Client.Platforms.Features.WinFormsLegacyWebUi.InteractiveWebUI.OnAuthenticate(...)
Microsoft_Identity_Client!Microsoft.Identity.Client.Platforms.Features.WinFormsLegacyWebUi.WebUI.Authenticate(...)
<snip>

I work at MSFT (you can contact me internally at rmolden) and have a heap dump of this.

Relevant code snippets

No response

Expected behavior

Not to SO the JS interpreter

Identity provider

Microsoft Entra ID (Work and School accounts and Personal Microsoft accounts)

Regression

No response

Solution and workarounds

No response

[bgavrilMS]

Please use WAM - https://learn.microsoft.com/en-us/entra/msal/dotnet/acquiring-tokens/desktop-mobile/wam