Summary

path.evaluate() crashes with RangeError: Maximum call stack size exceeded on input like:

String({ toString: "".toUpperCase })

The CallExpression branch of the evaluator invokes the real native function (here, String(obj)) via func.apply(context, args). If the evaluator has previously produced an object whose own coercion methods recurse infinitely (the ObjectExpression branch allows function-valued properties, so obj.toString === String.prototype.toUpperCase is reachable), that native call blows the stack instead of being caught.

This wraps the native call in try/catch and deopts on any thrown error, which matches how path.evaluate() already gives up in other uncertain cases (e.g., inherited methods — see existing should not evaluate inherited methods test).

Change

try {
  return func.apply(context, args);
} catch {
  deopt(path, state);
  return;
}

After the fix, path.evaluate() on the issue's input returns { confident: false, value: undefined, deopt: <path> } — no crash.

Tests

Added a regression test in packages/babel-traverse/test/evaluation.js using the issue's exact input. Full yarn jest packages/babel-traverse suite is green (652 passed, 1 skipped), make lint clean.

Note for reviewers - related, out-of-scope crash

If a caller stores the result of path.evaluate().value for an ObjectExpression like { toString: "".toUpperCase } and later coerces that returned object to a string in their own code, it will still crash with the same RangeError — because the returned value is a real JS object with a malicious toString. This PR intentionally does not address that path, because:

• The issue as filed only asks about the crash inside path.evaluate() itself, which is now fixed.
• Avoiding it would require either (a) refusing to build objects whose values are function references, or (b) returning a wrapped/safe value - both of which are larger design decisions than the reported bug calls for.

Happy to follow up in a separate PR / issue if maintainers want broader hardening of the ObjectExpression branch.