Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 752ab9007271ac2a897a91b2ffb65d1e5f709c9c
https://github.com/WebKit/WebKit/commit/752ab9007271ac2a897a91b2ffb65d1e5f709c9c
Author: Sosuke Suzuki <[email protected]>
Date: 2026-08-25 (Tue, 25 Aug 2026)
Changed paths:
A JSTests/stress/destructuring-pattern-deep-recursion.js
M Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp
Log Message:
-----------
[JSC] Deeply nested destructuring pattern crashes bytecode generation
https://bugs.webkit.org/show_bug.cgi?id=322333
Reviewed by Yusuke Suzuki.
The parser guards its own recursion and accepts destructuring patterns
nested ~20k levels deep, but ArrayPatternNode::bindValue recurses into
nested patterns with no stack check. Each level costs about 1KB of
native stack for the iterator temporaries and try/finally machinery, so
a pattern several thousand levels deep overflows the stack before the
parser's limit is reached:
let [[[ /* 12000 levels */ z ]]] = []; // SIGSEGV
ObjectPatternNode::bindValue has the same unbounded recursion.
Add the isSafeToRecurse() check that emitNode() already performs to the
top of both bindValue implementations. On failure, bytecode generation
reports ParserError::OutOfMemory and the caller sees a catchable
RangeError, matching other engines.
Test: JSTests/stress/destructuring-pattern-deep-recursion.js
* JSTests/stress/destructuring-pattern-deep-recursion.js: Added.
(shouldThrowRangeError):
* Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp:
(JSC::ArrayPatternNode::bindValue const):
(JSC::ObjectPatternNode::bindValue const):
Canonical link: https://commits.webkit.org/319778@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
