[promise] Avoid stack overflow with context promise hooks in C++

camillobruni · V8 LUCI CQ · commit 81814ed44574 · 2021-08-05T16:08:16.000Z
This was handled in JS but not in C++. Bug: chromium:236703, v8:11025 Change-Id: Ic9adc4ceb4d2af2614427fec459c3e950654572f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3074460 Commit-Queue: Camillo Bruni <cbruni@chromium.org> Reviewed-by: Victor Gomes <victorgomes@chromium.org> Cr-Commit-Position: refs/heads/master@{#76125}
diff --git a/src/objects/contexts.cc b/src/objects/contexts.cc
@@ -525,7 +525,15 @@ void NativeContext::RunPromiseHook(PromiseHookType type,
 
   Handle<Object> receiver = isolate->global_proxy();
 
-  if (Execution::Call(isolate, hook, receiver, argc, argv).is_null()) {
+  StackLimitCheck check(isolate);
+  bool failed = false;
+  if (check.HasOverflowed()) {
+    isolate->StackOverflow();
+    failed = true;
+  } else {
+    failed = Execution::Call(isolate, hook, receiver, argc, argv).is_null();
+  }
+  if (failed) {
     DCHECK(isolate->has_pending_exception());
     Handle<Object> exception(isolate->pending_exception(), isolate);
 
diff --git a/test/mjsunit/promise-hooks.js b/test/mjsunit/promise-hooks.js
@@ -273,3 +273,11 @@ exceptions();
 
   d8.promise.setHooks();
 })();
+
+(function overflow(){
+  d8.promise.setHooks(() => { new Promise(()=>{}) });
+  // Trigger overflow from JS code:
+  Promise.all([Promise.resolve(1)]);
+  %PerformMicrotaskCheckpoint();
+  d8.promise.setHooks();
+});
