From 13845ff52f646bd449d2da84557167ab3995d57e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?M=C3=A1t=C3=A9=20Tokodi?= <mate.tokodi@szteszoftver.hu>
Date: Wed, 13 Mar 2024 11:29:29 +0100
Subject: [PATCH] Fix rare crash caused by get method of proxy object
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This fixes #5101
In rare cases the proxy object could get used after
being incorrectly removed by the gc

Add stack checks to the start of all function calls

JerryScript-DCO-1.0-Signed-off-by: Máté Tokodi mate.tokodi@szteszoftver.hu
---
 .../ecma/operations/ecma-function-object.c    |  8 +++++
 .../ecma/operations/ecma-proxy-object.c       |  2 ++
 tests/jerry/regression-test-issue-5101.js     | 32 +++++++++++++++++++
 3 files changed, 42 insertions(+)
 create mode 100644 tests/jerry/regression-test-issue-5101.js

diff --git a/jerry-core/ecma/operations/ecma-function-object.c b/jerry-core/ecma/operations/ecma-function-object.c
index 1e24384c90..2905d4abe1 100644
--- a/jerry-core/ecma/operations/ecma-function-object.c
+++ b/jerry-core/ecma/operations/ecma-function-object.c
@@ -1010,6 +1010,8 @@ ecma_op_function_call_constructor (vm_frame_ctx_shared_args_t *shared_args_p, /*
                                    ecma_object_t *scope_p, /**< lexical environment to use */
                                    ecma_value_t this_binding) /**< value of 'ThisBinding' */
 {
+  ECMA_CHECK_STACK_USAGE ();
+
   shared_args_p->header.status_flags |= VM_FRAME_CTX_SHARED_NON_ARROW_FUNC;
 
   ecma_value_t ret_value;
@@ -1080,6 +1082,8 @@ ecma_op_function_call_simple (ecma_object_t *func_obj_p, /**< Function object */
 {
   JERRY_ASSERT (ecma_get_object_type (func_obj_p) == ECMA_OBJECT_TYPE_FUNCTION);
 
+  ECMA_CHECK_STACK_USAGE ();
+
   vm_frame_ctx_shared_args_t shared_args;
   shared_args.header.status_flags = VM_FRAME_CTX_SHARED_HAS_ARG_LIST;
   shared_args.header.function_object_p = func_obj_p;
@@ -1205,6 +1209,8 @@ ecma_op_function_call_native_built_in (ecma_object_t *func_obj_p, /**< Function
 {
   JERRY_ASSERT (ecma_get_object_type (func_obj_p) == ECMA_OBJECT_TYPE_BUILT_IN_FUNCTION);
 
+  ECMA_CHECK_STACK_USAGE ();
+
 #if JERRY_BUILTIN_REALMS
   ecma_global_object_t *saved_global_object_p = JERRY_CONTEXT (global_object_p);
 
@@ -1235,6 +1241,8 @@ ecma_op_function_call_native (ecma_object_t *func_obj_p, /**< Function object */
 {
   JERRY_ASSERT (ecma_get_object_type (func_obj_p) == ECMA_OBJECT_TYPE_NATIVE_FUNCTION);
 
+  ECMA_CHECK_STACK_USAGE ();
+
   ecma_native_function_t *native_function_p = (ecma_native_function_t *) func_obj_p;
 
 #if JERRY_BUILTIN_REALMS
diff --git a/jerry-core/ecma/operations/ecma-proxy-object.c b/jerry-core/ecma/operations/ecma-proxy-object.c
index 35ff2bf00e..df864651d9 100644
--- a/jerry-core/ecma/operations/ecma-proxy-object.c
+++ b/jerry-core/ecma/operations/ecma-proxy-object.c
@@ -1170,7 +1170,9 @@ ecma_proxy_object_get (ecma_object_t *obj_p, /**< proxy object */
   ecma_value_t args[] = { proxy_obj_p->target, prop_value, receiver };
 
   /* 9. */
+  ecma_ref_object (obj_p);
   ecma_value_t trap_result = ecma_op_function_call (func_obj_p, handler, args, 3);
+  ecma_deref_object (obj_p);
 
   ecma_deref_object (func_obj_p);
 
diff --git a/tests/jerry/regression-test-issue-5101.js b/tests/jerry/regression-test-issue-5101.js
new file mode 100644
index 0000000000..6ee4f30af4
--- /dev/null
+++ b/tests/jerry/regression-test-issue-5101.js
@@ -0,0 +1,32 @@
+// Copyright JS Foundation and other contributors, http://js.foundation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+var iter = 100;
+async function f0() {
+    iter--;
+    function f6() {
+        return f0;
+    }
+    var proxy_handler = {
+        "get": f0,
+    };
+
+    f0.__proto__ = new Proxy(f6, proxy_handler);
+
+    if ((iter >= 0)) {
+        var v12 = f0();
+    }
+    return f0;
+}
+f0();