jerryscript-project / jerryscript

Ultra-lightweight JavaScript engine for the Internet of Things.
https://jerryscript.net
Apache License 2.0
6.87k stars 666 forks source link

Fix rare crash caused by get method of proxy object #5129

Closed matetokodi closed 3 months ago

matetokodi commented 4 months ago

This fixes #5101 In rare cases the proxy object could get used after being incorrectly removed by the gc

Add stack checks to the start of all function calls

A Regression test is not included because I was unable to reproduce the crash with code that would be readable / easy to understand, only with a marginally simplified version of the example code given in the original issue, and @zherczeg advised against including it:

async function f0() {
    function f6() {
        return f0;
    }
    var proxy_handler = {
        "get": f0,
    };

    f0.__proto__ = new Proxy(f6, proxy_handler);
    var v12 = f0();
    return f0;
}
f0();

However I can include it anyways if requested.

matetokodi commented 3 months ago

The code changes look good to me, but I do think that the issue-reproducing test case should be included in the commit / test suite.

Alright, I have included the regression test.