commit 77cbe27689d3c8823ea492cbc33f7718a4b5e417
author littledan <littledan@chromium.org> Mon Jul 11 19:28:56 2016
committer Commit bot <commit-bot@chromium.org> Mon Jul 11 19:33:43 2016
tree e918c68818f58d37b7f5a1fe19d521b3f743f6b6
parent 56d013d48166e4df94c7a17d4bee5d87d15be3fa

Narrowly address async function stack overflow parsing case

This patch just checks for a stack overflow and returns failure
from the cases which Clusterfuzz found. However, there may be
more locations in the parser which need similar treatment.

R=caitpotter88@gmail.com,neis
BUG=v8:4483,chromium:624300

Review-Url: https://codereview.chromium.org/2135503002
Cr-Commit-Position: refs/heads/master@{#37655}

src/parsing/parser.cc

diff --git a/src/parsing/parser.cc b/src/parsing/parser.cc
index 8669b03..4308b33 100644
--- a/src/parsing/parser.cc
+++ b/src/parsing/parser.cc
@@ -1098,8 +1098,14 @@
       bool is_async = allow_harmony_async_await() && shared_info->is_async();
       if (is_async) {
         DCHECK(!scanner()->HasAnyLineTerminatorAfterNext());
-        Consume(Token::ASYNC);
-        DCHECK(peek_any_identifier() || peek() == Token::LPAREN);
+        if (!Check(Token::ASYNC)) {
+          CHECK(stack_overflow());
+          return nullptr;
+        }
+        if (!(peek_any_identifier() || peek() == Token::LPAREN)) {
+          CHECK(stack_overflow());
+          return nullptr;
+        }
       }
 
       // TODO(adamk): We should construct this scope from the ScopeInfo.

test/mjsunit/harmony/regress/regress-624300.js

diff --git a/test/mjsunit/harmony/regress/regress-624300.js b/test/mjsunit/harmony/regress/regress-624300.js
new file mode 100644
index 0000000..f96fbbb
--- /dev/null
+++ b/test/mjsunit/harmony/regress/regress-624300.js
@@ -0,0 +1,13 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-async-await
+
+(function f() {
+  try {
+    f();
+  } catch (e) {
+    (async() => await 1).length;
+  }
+})();