Skip to content

Fix: unbounded native recursion in Array.prototype.flat() - #5660

Open
woterr wants to merge 1 commit into
boa-dev:mainfrom
woterr:fix-5655-flat-native-recursion
Open

woterr wants to merge 1 commit into
boa-dev:mainfrom
woterr:fix-5655-flat-native-recursion

Conversation

@woterr

@woterr woterr commented Nov 11, 2026

Copy link
Copy Markdown

This Pull Request fixes/closes #5655

It changes the following:

  • Accounts for each level of the FlattenIntoArray native self-recursion via context.vm.host_call_depth and enforces the configured recursion_limit through context.check_runtime_limits() at the recursive call site — the same mechanism the VM already uses for nested host calls and deep JS recursion. Hitting the limit raises the existing RuntimeLimitError::Recursion instead of aborting the process.
  • Adds a regression test covering a self-referential array with flat(Infinity), finite-depth nesting beyond the recursion limit, and flat(0) on a self-referential array (still flattens one level, no over-blocking).

Map each level of the FlattenIntoArray native self-recursion onto the
engine's existing host-call accounting and enforce the configured
recursion limit at the recursive call site, so self-referential or
deeply nested arrays raise RuntimeLimitError::Recursion instead of
exhausting the OS stack.

Fixes: boa-dev#5655
@woterr
woterr requested a review from a team as a code owner November 11, 2026 12:20
@github-actions github-actions Bot added the Waiting On Review Waiting on reviews from the maintainers label Nov 11, 2026
@github-actions github-actions Bot added this to the v0.23 milestone Nov 11, 2026
@github-actions github-actions Bot added C-Tests Issues and PRs related to the tests. C-Builtins PRs and Issues related to builtins/intrinsics labels Nov 11, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

C-Builtins PRs and Issues related to builtins/intrinsics C-Tests Issues and PRs related to the tests. Waiting On Review Waiting on reviews from the maintainers

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Unbounded native recursion in Array.prototype.flat(): FlattenIntoArray() maps flat(Infinity) to u64::MAX, exhausting the native stack

1 participant