Skip to content

fix(engine): bound JSON.stringify and to_json nesting by the recursion limit - #5638

Open
asdv23 wants to merge 1 commit into
boa-dev:mainfrom
asdv23:fix/json-stringify-native-stack-overflow
Open

asdv23 wants to merge 1 commit into
boa-dev:mainfrom
asdv23:fix/json-stringify-native-stack-overflow

Conversation

@asdv23

@asdv23 asdv23 commented Nov 5, 2026

Copy link
Copy Markdown

Fixes #5637.

It changes the following:

  • Adds Context::check_native_recursion(extra_depth), which applies the existing recursion limit (frames + host calls + extra native depth).
  • JSON.stringify (object and array serialization) and JsValue::to_json call it per nesting level, using the length of their existing cycle-detection set as the depth. Past the limit they return the uncatchable RuntimeLimitError::Recursion, like the other native recursion cases, instead of overflowing the native stack.
  • Tests: a 100000-level object for JSON.stringify and to_json (these abort the test process without the check), and a 100-level array that still serializes under a limit of 128.

Note for review: with the default recursion limit (512), JSON.stringify of values nested deeper than about 512 levels now errors. Embedders can raise the limit; a separate JSON-specific limit is an alternative if preferred. cargo test -p boa_engine --lib passes (1142 tests); I did not run test262.

…n limit

Both recurse natively over the object graph without going through check_runtime_limits, so a deeply nested value overflows the native stack and aborts the process (about 2.7k levels on a 2 MiB thread). Check the recursion limit per nesting level and throw the uncatchable RuntimeLimit error instead, like the other native recursion cases.
@asdv23
asdv23 requested a review from a team as a code owner November 5, 2026 09:45
@github-actions github-actions Bot added C-Tests Issues and PRs related to the tests. C-Builtins PRs and Issues related to builtins/intrinsics C-VM Issues and PRs related to the Boa Virtual Machine. Waiting On Review Waiting on reviews from the maintainers labels Nov 5, 2026
@github-actions github-actions Bot added this to the v0.23 milestone Nov 5, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

C-Builtins PRs and Issues related to builtins/intrinsics C-Tests Issues and PRs related to the tests. C-VM Issues and PRs related to the Boa Virtual Machine. Waiting On Review Waiting on reviews from the maintainers

Projects

None yet

Development

Successfully merging this pull request may close these issues.

JSON.stringify of a deeply nested object overflows the native stack and aborts the process

1 participant