We probbly should do a stack check before calling PromiseHasUserDefinedRejectHandler. Alternatively, we could implement it in C++. But even then we would still have to guard against it being recursive and possibly causing another stack overflow in C++.

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/5975c47a6a0da2ed1c8b6ea3d1d5867452e0ab29

commit 5975c47a6a0da2ed1c8b6ea3d1d5867452e0ab29
Author: littledan <littledan@chromium.org>
Date: Wed Nov 09 07:52:44 2016

Avoid calling out to JS during stack overflow

If an exception is thrown when there is a Promise being created, the Promise
catch prediction code would call into a part implemented in JavaScript to see if
the Promise has a catch handler. If it is not possible to call back into JS,
e.g., due to a stack overflow, then this would lead to a crash. This patch
"speculates" that, if it's impossible to call back into JavaScript, then the
error is unhandled, avoding the issue. In a future patch, the catch prediction
logic should be entirely written in C++, but this patch adds a minimal fix to
be more friendly to backports.

BUG= chromium:662935 
R=jgruber

Review-Url: https://codereview.chromium.org/2487833002
Cr-Commit-Position: refs/heads/master@{#40851}

[modify] https://crrev.com/5975c47a6a0da2ed1c8b6ea3d1d5867452e0ab29/src/isolate.cc
[add] https://crrev.com/5975c47a6a0da2ed1c8b6ea3d1d5867452e0ab29/test/mjsunit/regress/regress-662935.js

[Automated comment] Request affecting a post-stable build (M54), manual review required.

Your change meets the bar and is auto-approved for M55 (branch: 2883)

The following revision refers to this bug:
  https://chromium.googlesource.com/v8/v8.git/+/f1101290b2830f11a8cf86fb66de234b54bee5d3

commit f1101290b2830f11a8cf86fb66de234b54bee5d3
Author: Dan Ehrenberg <littledan@chromium.org>
Date: Fri Nov 11 00:05:12 2016

Merged: Avoid calling out to JS during stack overflow

Revision: 5975c47a6a0da2ed1c8b6ea3d1d5867452e0ab29

BUG= chromium:662935 
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=adamk@chromium.org

Review URL: https://codereview.chromium.org/2494903002 .

Cr-Commit-Position: refs/branch-heads/5.5@{#36}
Cr-Branched-From: 3cbd5838bd8376103daa45d69dade929ee4e0092-refs/heads/5.5.372@{#1}
Cr-Branched-From: b3c8b0ce2c9af0528837d8309625118d4096553b-refs/heads/master@{#40015}

[modify] https://crrev.com/f1101290b2830f11a8cf86fb66de234b54bee5d3/src/isolate.cc
[add] https://crrev.com/f1101290b2830f11a8cf86fb66de234b54bee5d3/test/mjsunit/regress/regress-662935.js

Could someone review whether this is appropriate to merge into 54?

I recommend to merge this to M54. M54 is definitely affected, and the fix is very safe and simple.

I don't think there will be another M54 push. As this bug is part of the solution for https://bugs.chromium.org/p/chromium/issues/detail?id=662674, we should still merge it though for completeness sake.

Seems like this is not relevant for M54. The JS call in OnException is already handled by the fix for  crbug.com/662674 , and the GetPromiseOnStackOnThrow call in OnThrow does not yet include a JS call.