Allocating TypedArray crashes if MaxStackUsage is configured

[handerss-spotfire]

After upgrading to ClearScript 7.5.1 our test suite has started crashing with the following error (similar error as in #712 (comment)):

Exit code is -2147483645 (#
# Fatal error in , line 0
# Check failed: isolate_->IsOnCentralStack().
#
#
#
#FailureMessage Object: 000000A9947FC0E0)

This happens on every run after a couple of tests have been executed. Each test creates a fresh V8Runtime.

I'll see if I can create a re-producible minimal repro.

[handerss-spotfire]

Only occurs when setting MaxStackUsage. It does not seem to matter which value we set as max however.

[handerss-spotfire]

Minimal repro:

This crashes:

using var runtime = new V8Runtime();
runtime.MaxStackUsage = new UIntPtr(734 * 1024);
using var engine = runtime.CreateScriptEngine();
engine.Execute("new Int8Array(65 * 1024 * 1024);");

Removing the MaxStackUsage avoids the crash:

using var runtime = new V8Runtime();
using var engine = runtime.CreateScriptEngine();
engine.Execute("new Int8Array(65 * 1024 * 1024);");

I thought that typed arrays were allocated on the .NET heap, so in theory the stack size should have no effect here?

[handerss-spotfire]

Investigated a bit with the help of Claude Code and tried to summarize what seems to be the issue below.

The crash is caused by a CHECK(isolate_->IsOnCentralStack()) failure in V8's Heap::CollectGarbage (src/heap/heap.cc).

ClearScript/ClearScriptV8/V8IsolateImpl.cpp

Line 1939 in f43eafc

m_upIsolate->SetStackLimit(reinterpret_cast<uintptr_t>(pStackLimit));

EnterExecutionScope calls v8::Isolate::SetStackLimit to enforce MaxStackUsage, and ExitExecutionScope calls it again with a sentinel value of 8 (defined as s_pMinStackLimit) to effectively remove the limit.

V8 commit c24df23717b ("Respect isolate stack limit in GetCentralStackView") added a set_stack_size(Stack::GetStackStart() - stack_limit) call inside v8::Isolate::SetStackLimit. When ClearScript passes 8 as the limit, this computes stack_size_ = stackTop - 8 ≈ 740 GB, corrupting the isolate's stack_size_ field.

When a subsequent V8 operation triggers GC (e.g., allocating a 65 MB typed array), Heap::CollectGarbage checks IsOnCentralStack(), which computes the central stack lower bound as Stack::GetStackStart() - (stack_size_ + 40KB). With the corrupted ~740 GB stack_size_, this underflows, and the CHECK fails.

A suggested fix can be found here (entirely generated so no copyright): handerss-spotfire@a088e68

[ClearScriptLib]

Thanks for reporting this! We're investigating.