Boa incorrectly judged stack usage due to ASAN's fake stack.

Thu, 10 Sep 2026 20:14:12 +0900

In the previous article, we fixed the issue where Boa’s parser exhausted a 2 MiB stack. (related article)

We reduced the frame size during recursion and made it return an error for inputs that are too deep. With a normal build, the original Test262 now also passes within the 2 MiB limit.

When we continued diagnosing with AddressSanitizer (ASAN) in that state, it started rejecting even shallow inputs.

parser recursion limit exceeded

The protection we added to prevent stack exhaustion was stopping prematurely, even though the stack hadn’t been fully used. This concerns Issue #640.

Boa's parser exhausted a 2 MiB stack

Thu, 10 Sep 2026 19:58:13 +0900

While running Test262 before importing Boa into Omoikane, we discovered a case where an unoptimized parser aborts due to a stack overflow (issue #633).

The failure occurred in Test262’s regress-672893.js.

It wasn’t a matter of nesting tens of thousands of invalid JavaScript statements. It was valid JavaScript with about fifteen levels of nested function expressions.

If we omit the structural details, the code looks like this:

function f() {
 return function () {
 return function () {
 ...continues in the same pattern up to 15 steps...
 return function (a) {
 var v = a;
 return function () { return v; };
 };
 };
 };
}

f()()() ... ()(42)();

When this code is passed to a Boa built with the dev profile and the thread stack is set to 2 MiB, the parser triggers a stack overflow and exits with status 134.

Parser

Boa incorrectly judged stack usage due to ASAN's fake stack.

Boa's parser exhausted a 2 MiB stack

Boa's parser exhausted a 2 MiB stack