Stack overflow in ParseNode::Grfnop()

[fumfel]

Git Head: d1524eb

To reproduce: ch so.js

Crashing payload:

let limit = (1 << 16) - 4;
function test0() {
    return arguments[limit - 1];
}
while (true) {
    try {
        const txt = `test/(${Array(limit).fill(0).map((_, i) => i).join(",")})`;
        var val1 = eval(txt);
        console.log(`arguments[${limit - 1}] == ${val1}`);
        break;
    } catch (e) {
        console.log(e)
        console.log(`${limit} is too many arguments`);
        limit--;
    }
}
console.log(`Arguments limit: ${limit}`);

Extract from Valgrind log (full log available here: https://gist.github.com/fumfel/3c246644270ce2d6f486283a6b570347):

==21642== Stack overflow in thread #1: can't grow stack to 0x1ffe801000
==21642== Stack overflow in thread #1: can't grow stack to 0x1ffe801000
==21642== Can't extend stack to 0x1ffe801068 during signal delivery for thread 1:
==21642==   no stack segment
==21642== 
==21642== Process terminating with default action of signal 11 (SIGSEGV)
==21642==  Access not within mapped region at address 0x1FFE801068
==21642== Stack overflow in thread #1: can't grow stack to 0x1ffe801000
==21642==    at 0x2106D9F: ParseNode::Grfnop() (ptree.h:176)
==21642==  If you believe this happened as a result of a stack
==21642==  overflow in your program's main thread (unlikely but
==21642==  possible), you can try to increase the size of the
==21642==  main thread stack using the --main-stacksize= flag.
==21642==  The main thread stack size used in this run was 8388608.
==21642== Stack overflow in thread #1: can't grow stack to 0x1ffe801000
==21642== 
==21642== Process terminating with default action of signal 11 (SIGSEGV)
==21642==  Access not within mapped region at address 0x1FFE801F28
==21642== Stack overflow in thread #1: can't grow stack to 0x1ffe801000
==21642==    at 0x8296650: _vgnU_freeres (in /usr/lib/valgrind/vgpreload_core-amd64-linux.so)
==21642==  If you believe this happened as a result of a stack
==21642==  overflow in your program's main thread (unlikely but
==21642==  possible), you can try to increase the size of the
==21642==  main thread stack using the --main-stacksize= flag.
==21642==  The main thread stack size used in this run was 8388608.

[wyrichte]

A shorter repro:
eval("a/("+Array(2**16).fill(0).join(",")+")");

[ryanelfmank2]

I am able to reproduce this still with NuGet package 1.11.17 using the code above

eval("a/("+Array(2**16).fill(0).join(",")+")");