2034840 - "InternalError: too much recursion" on deep ternary chains

Status: NEW

(Core :: JavaScript Engine, defect, P3)

Description

[Sky Schubert [:skyschub]]

As part of investigations into the backgrounds of bug 2033215, Microsoft let us know about a difference in browser behavior on deep-nested ternary operator chains. It appears that Firefox throws a

InternalError: too much recursion

at ~5k nested operations, while V8 has no issues with 100k. A very helpful MS engineer (thank you!!) provided a repo with instructions and more details at https://github.com/guru-irl/firefox-ternary-parse-recursion

While no human would ever hand-write code like that, the code in question was created by oxc, which is increasing in popularity, and the problematic code in question was part of a chunk-id-to-filename map function as per the repo, so I can totally imagine other web apps eventually running into the same limit.

We should figure out if we can get closer to V8's behavior here in order to avoid future surprises.

Comment 1

[Tooru Fujisawa (away) [:arai]]

This needs modification in the following parts:

• The recursion between GeneralParser::condExpr and GeneralParser::assignExpr
• The recursion in ParseNodeVisitor, its subclasses, and TernaryNode::visit
• The recursion between BytecodeEmitter::emitConditionalExpression and BytecodeEmitter::emitTree

We could use similar structure as if-else-if.

Comment 2

[Jeff Muizelaar [:jrmuizel]]

Safari throws an exception at a depth of 6325 for me.

Comment 3

[Jeff Muizelaar [:jrmuizel]]

I filed an issue against oxc to avoid introducing these problems: https://github.com/oxc-project/oxc/issues/21901

Comment 4

[Jeff Muizelaar [:jrmuizel]]

and guru-irl had previously put a PR up: https://github.com/oxc-project/oxc/pull/21841