

###### JerryScript revision
2faafa4

###### Build platform
Ubuntu 18.04.5 LTS(Linux 4.15.0-119-generic x86_64)
###### Build steps
```
./tools/build.py --clean --debug --compile-flag=-fsanitize=address \
--compile-flag=-m32 --compile-flag=-fno-omit-frame-pointer \
--compile-flag=-fno-common --compile-flag=-g --strip=off \
--system-allocator=on --logging=on --linker-flag=-fuse-ld=gold \
--error-messages=on --profile=es2015-subset  --builddir=$PWD/build
```
###### Test case
```
assert((function ()
        {
            Object.defineProperty(Object.prototype, 'b', {
                get: function() { b.data(c,this.widgetName,this);this.element=b(c);this.options=b.extend(true,{},this.options,
this._getCreateOptions(),a);var d=this;this.element.bind("remove."+this.widgetName,function(){d.destroy()});this._create();this._trigger("create");this._init() }
              });
            let orig = {};
            orig.a = 1;
            
            let newObj = Object.assign({}, orig);
            assert.areEqual(newObj.b, "asdf");
            assert.areEqual(newObj.a, orig.a);
        })());
```

###### Output
```
ASAN:DEADLYSIGNAL
=================================================================
==11898==ERROR: AddressSanitizer: stack-overflow on address 0xff76bfec (pc 0x5671ff85 bp 0xff76c008 sp 0xff76bff0 T0)
    #0 0x5671ff84 in jmem_compress_pointer /root/jerryscript/jerry-core/jmem/jmem-allocator.c:180
    #1 0x567a20e9 in ecma_lcache_lookup /root/jerryscript/jerry-core/ecma/base/ecma-lcache.c:149
    #2 0x5679da6b in ecma_find_named_property /root/jerryscript/jerry-core/ecma/base/ecma-helpers.c:591
    #3 0x5679d456 in ecma_create_named_data_property /root/jerryscript/jerry-core/ecma/base/ecma-helpers.c:525
    #4 0x56707e79 in vm_loop /root/jerryscript/jerry-core/vm/vm.c:1380
    #5 0x5671e48a in vm_execute /root/jerryscript/jerry-core/vm/vm.c:4953
    #6 0x5671ead3 in vm_run /root/jerryscript/jerry-core/vm/vm.c:5060
    #7 0x5678e18e in ecma_op_function_call_simple /root/jerryscript/jerry-core/ecma/operations/ecma-function-object.c:1160
    #8 0x5678edd6 in ecma_op_function_call /root/jerryscript/jerry-core/ecma/operations/ecma-function-object.c:1390
    #9 0x56755d3c in ecma_op_object_find_own /root/jerryscript/jerry-core/ecma/operations/ecma-objects.c:675
    #10 0x56755ea8 in ecma_op_object_find /root/jerryscript/jerry-core/ecma/operations/ecma-objects.c:727
    #11 0x56765ece in ecma_op_object_bound_environment_resolve_reference_value /root/jerryscript/jerry-core/ecma/operations/ecma-reference.c:245
    #12 0x567665c9 in ecma_op_resolve_reference_value /root/jerryscript/jerry-core/ecma/operations/ecma-reference.c:361
    #13 0x56705d0d in vm_loop /root/jerryscript/jerry-core/vm/vm.c:1115
    #14 0x5671e48a in vm_execute /root/jerryscript/jerry-core/vm/vm.c:4953
    #15 0x5671ead3 in vm_run /root/jerryscript/jerry-core/vm/vm.c:5060
    #16 0x5678e18e in ecma_op_function_call_simple /root/jerryscript/jerry-core/ecma/operations/ecma-function-object.c:1160
    #17 0x5678edd6 in ecma_op_function_call /root/jerryscript/jerry-core/ecma/operations/ecma-function-object.c:1390
    #18 0x56755d3c in ecma_op_object_find_own /root/jerryscript/jerry-core/ecma/operations/ecma-objects.c:675
    #19 0x56755ea8 in ecma_op_object_find /root/jerryscript/jerry-core/ecma/operations/ecma-objects.c:727
    #20 0x56765ece in ecma_op_object_bound_environment_resolve_reference_value /root/jerryscript/jerry-core/ecma/operations/ecma-reference.c:245
......
    #247 0x56705d0d in vm_loop /root/jerryscript/jerry-core/vm/vm.c:1115
    #248 0x5671e48a in vm_execute /root/jerryscript/jerry-core/vm/vm.c:4953
    #249 0x5671ead3 in vm_run /root/jerryscript/jerry-core/vm/vm.c:5060

SUMMARY: AddressSanitizer: stack-overflow /root/jerryscript/jerry-core/jmem/jmem-allocator.c:180 in jmem_compress_pointer
==11898==ABORTING
```
Credits: Found by chong from OWL337.
 stack-overflow in jmem_compress_pointer
This is a GitHub Issue
repo:jerryscript
owner:jerryscript-project
Title :  stack-overflow in jmem_compress_pointer
Issue date:

--- start body ---


###### JerryScript revision
2faafa4

###### Build platform
Ubuntu 18.04.5 LTS(Linux 4.15.0-119-generic x86_64)
###### Build steps
```
./tools/build.py --clean --debug --compile-flag=-fsanitize=address \
--compile-flag=-m32 --compile-flag=-fno-omit-frame-pointer \
--compile-flag=-fno-common --compile-flag=-g --strip=off \
--system-allocator=on --logging=on --linker-flag=-fuse-ld=gold \
--error-messages=on --profile=es2015-subset  --builddir=$PWD/build
```
###### Test case
```
assert((function ()
        {
            Object.defineProperty(Object.prototype, 'b', {
                get: function() { b.data(c,this.widgetName,this);this.element=b(c);this.options=b.extend(true,{},this.options,
this._getCreateOptions(),a);var d=this;this.element.bind("remove."+this.widgetName,function(){d.destroy()});this._create();this._trigger("create");this._init() }
              });
            let orig = {};
            orig.a = 1;
            
            let newObj = Object.assign({}, orig);
            assert.areEqual(newObj.b, "asdf");
            assert.areEqual(newObj.a, orig.a);
        })());
```

###### Output
```
ASAN:DEADLYSIGNAL
=================================================================
==11898==ERROR: AddressSanitizer: stack-overflow on address 0xff76bfec (pc 0x5671ff85 bp 0xff76c008 sp 0xff76bff0 T0)
    #0 0x5671ff84 in jmem_compress_pointer /root/jerryscript/jerry-core/jmem/jmem-allocator.c:180
    #1 0x567a20e9 in ecma_lcache_lookup /root/jerryscript/jerry-core/ecma/base/ecma-lcache.c:149
    #2 0x5679da6b in ecma_find_named_property /root/jerryscript/jerry-core/ecma/base/ecma-helpers.c:591
    #3 0x5679d456 in ecma_create_named_data_property /root/jerryscript/jerry-core/ecma/base/ecma-helpers.c:525
    #4 0x56707e79 in vm_loop /root/jerryscript/jerry-core/vm/vm.c:1380
    #5 0x5671e48a in vm_execute /root/jerryscript/jerry-core/vm/vm.c:4953
    #6 0x5671ead3 in vm_run /root/jerryscript/jerry-core/vm/vm.c:5060
    #7 0x5678e18e in ecma_op_function_call_simple /root/jerryscript/jerry-core/ecma/operations/ecma-function-object.c:1160
    #8 0x5678edd6 in ecma_op_function_call /root/jerryscript/jerry-core/ecma/operations/ecma-function-object.c:1390
    #9 0x56755d3c in ecma_op_object_find_own /root/jerryscript/jerry-core/ecma/operations/ecma-objects.c:675
    #10 0x56755ea8 in ecma_op_object_find /root/jerryscript/jerry-core/ecma/operations/ecma-objects.c:727
    #11 0x56765ece in ecma_op_object_bound_environment_resolve_reference_value /root/jerryscript/jerry-core/ecma/operations/ecma-reference.c:245
    #12 0x567665c9 in ecma_op_resolve_reference_value /root/jerryscript/jerry-core/ecma/operations/ecma-reference.c:361
    #13 0x56705d0d in vm_loop /root/jerryscript/jerry-core/vm/vm.c:1115
    #14 0x5671e48a in vm_execute /root/jerryscript/jerry-core/vm/vm.c:4953
    #15 0x5671ead3 in vm_run /root/jerryscript/jerry-core/vm/vm.c:5060
    #16 0x5678e18e in ecma_op_function_call_simple /root/jerryscript/jerry-core/ecma/operations/ecma-function-object.c:1160
    #17 0x5678edd6 in ecma_op_function_call /root/jerryscript/jerry-core/ecma/operations/ecma-function-object.c:1390
    #18 0x56755d3c in ecma_op_object_find_own /root/jerryscript/jerry-core/ecma/operations/ecma-objects.c:675
    #19 0x56755ea8 in ecma_op_object_find /root/jerryscript/jerry-core/ecma/operations/ecma-objects.c:727
    #20 0x56765ece in ecma_op_object_bound_environment_resolve_reference_value /root/jerryscript/jerry-core/ecma/operations/ecma-reference.c:245
......
    #247 0x56705d0d in vm_loop /root/jerryscript/jerry-core/vm/vm.c:1115
    #248 0x5671e48a in vm_execute /root/jerryscript/jerry-core/vm/vm.c:4953
    #249 0x5671ead3 in vm_run /root/jerryscript/jerry-core/vm/vm.c:5060

SUMMARY: AddressSanitizer: stack-overflow /root/jerryscript/jerry-core/jmem/jmem-allocator.c:180 in jmem_compress_pointer
==11898==ABORTING
```
Credits: Found by chong from OWL337.
--- end body ---

A stack overflow vulnerability in the jmem_compress_pointer function of JerryScript allows attackers to cause a Denial of Service (DoS) by executing a crafted JavaScript function that leads to infinite recursion. This can be exploited by providing a specific object definition that triggers the recursive calls, ultimately exhausting the stack space.