When the debugger pauses, it can execute arbitrary JS (e.g. via
evaluation or inspector listeners). This JS can modify heap state,
such as detaching ArrayBuffers.
If the execution stack contains optimized frames, they might be using
load-eliminated values (like backing store pointers or array lengths)
that are now invalidated by the heap modifications.
To prevent use-after-free or out-of-bounds accesses when resuming,
deoptimize the topmost optimized JS frame when handling a debug break.
We only need to deoptimize the topmost frame because any caller frames
are at a call site, which acts as a memory serialization barrier,
forcing them to reload all heap state upon return anyway.
TAG=agy
CONV=be1ec857-0c4b-479c-ba1b-e84d8741da83
Bug: 531297707
Change-Id: I5e46963660eaa228a68422490e7495ec6f0d9f8a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8131283
Auto-Submit: Darius Mercadier <dmercadier@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#108890}
Darius Mercadier
73b4712d0f