When a function .prototype is accessed for the first time during
side-effect-free evaluation (Runtime.evaluate), GetFunctionPrototype
lazily allocates the .prototype object (JSObject) and its initial Map.
Previously, GetFunctionPrototype disabled temporary object tracking
(DisableTemporaryObjectTracking) around this allocation so that
mutations to the prototype of a permanent function would not be
misidentified as temporary. However, when tracking was disabled,
AllocationEvent simply returned without taking any action. If the newly
allocated prototype object or its Map reused memory addresses belonging
to dead temporary objects, those stale memory ranges remained in
TemporaryObjectsTracker::regions_. Consequently, HasObject incorrectly
identified the permanent function prototype as a temporary object,
allowing its prototype to be polluted during debug evaluation without
triggering a side-effect check error.
To fix this simply and robustly:
1. When TemporaryObjectsTracker::AllocationEvent is invoked while
tracking is disabled (disabled == true), it explicitly calls
RemoveFromRegions(addr, addr + size). This clears out any stale
overlapping memory ranges from dead temporary objects while
ensuring the new allocation is not added to regions_.
2. JSFunction::GetFunctionPrototype conditionally enters
DisableTemporaryObjectTracking when the parent JSFunction (function)
is not a temporary object (!isolate->debug()->IsTemporaryObject(function)).
TAG=agy
CONV=b7469c8c-dfea-4bf5-ae4e-e442ac035cad
Bug: 532099983
Change-Id: I9586b1db45a768dc1f3f7cde10c4a7f72fe1b661
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8064726
Commit-Queue: Yang Guo <yangguo@chromium.org>
Auto-Submit: Yang Guo <yangguo@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#108584}
Yang Guo
0fa2b00928