From 91a30f0b3770265567557eb1ec47ee84b205597d Mon Sep 17 00:00:00 2001
From: Yang Guo <[email protected]>
Date: Fri, 17 Jul 2026 15:27:36 +0000
Subject: [PATCH] [inspector] Fix UAF in ProtocolPromiseHandler on session disconnect

KeepSessionAliveScope was missing in ProtocolPromiseHandler::thenCallback
and catchCallback. If the session is disconnected during JS execution
within these callbacks (e.g. via custom formatters), the session and
associated InjectedScript are destroyed, leading to UAF when the stack
unwinds.

This CL adds KeepSessionAliveScope to both callbacks to keep the session
alive until they finish.

Also adds regression tests based on the PoCs attached to the issue.

TAG=agy
CONV=0d576582-f72b-47f5-a478-6eb9e6ebdbe3

Bug: 520052954
Change-Id: I2e7c65022b2a0d1933d333acabd22b33df13fdf8
Fixed: 520052954
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8117126
Reviewed-by: Simon Zünd <[email protected]>
Commit-Queue: Simon Zünd <[email protected]>
Auto-Submit: Yang Guo <[email protected]>
Cr-Commit-Position: refs/heads/main@{#108738}
---
diff --git a/src/inspector/injected-script.cc b/src/inspector/injected-script.cc
index 0acd4d4..60a2eea 100644
--- a/src/inspector/injected-script.cc
+++ b/src/inspector/injected-script.cc
@@ -244,6 +244,7 @@
     V8InspectorSessionImpl* session =
         m_inspector->sessionById(m_contextGroupId, m_sessionId);
     if (!session) return;
+    V8InspectorSessionImpl::KeepSessionAliveScope keepAlive(*session);
     InjectedScript::ContextScope scope(session, m_executionContextId);
     Response response = scope.initialize();
     if (!response.IsSuccess()) return;
@@ -291,6 +292,7 @@
     V8InspectorSessionImpl* session =
         m_inspector->sessionById(m_contextGroupId, m_sessionId);
     if (!session) return;
+    V8InspectorSessionImpl::KeepSessionAliveScope keepAlive(*session);
     InjectedScript::ContextScope scope(session, m_executionContextId);
     Response response = scope.initialize();
     if (!response.IsSuccess()) return;
diff --git a/test/inspector/inspector.status b/test/inspector/inspector.status
index 411feb8..bff9ad6 100644
--- a/test/inspector/inspector.status
+++ b/test/inspector/inspector.status
@@ -26,6 +26,7 @@
   # Tests that need to run sequentially (e.g. due to memory consumption).
   'runtime/console-messages-limits': [PASS, SLOW, HEAVY],
   'runtime/regression-732717': [PASS, HEAVY],
+  'runtime/regress-520052954': [PASS, ['not asan', SKIP]],
 }],  # ALWAYS
 
 ##############################################################################
diff --git a/test/inspector/runtime/regress-520052954-expected.txt b/test/inspector/runtime/regress-520052954-expected.txt
new file mode 100644
index 0000000..3ecaf44
--- /dev/null
+++ b/test/inspector/runtime/regress-520052954-expected.txt
@@ -0,0 +1,5 @@
+Test session disconnect during exception wrapping.
+victim session id = 1
+[controller] paused -> stock utils.disconnectSession(victim)
+[controller] victim freed; resuming nested loop
+Reached post-wait (unexpected under ASan if bug fires).
diff --git a/test/inspector/runtime/regress-520052954.js b/test/inspector/runtime/regress-520052954.js
new file mode 100644
index 0000000..8fa68066
--- /dev/null
+++ b/test/inspector/runtime/regress-520052954.js
@@ -0,0 +1,66 @@
+// Copyright 2026 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Regression test for b/520052954.
+
+
+InspectorTest.log('Test session disconnect during exception wrapping.');
+
+const contextGroup = new InspectorTest.ContextGroup();
+
+// Victim session.
+const victim = contextGroup.connect();
+const VP = victim.Protocol;
+
+// Controller session.
+const controller = contextGroup.connect();
+const CP = controller.Protocol;
+
+let freed = false;
+
+(async function test() {
+  await VP.Runtime.enable();
+  await VP.Debugger.enable();
+  await VP.Runtime.setCustomObjectFormatterEnabled({enabled: true});
+
+  await CP.Runtime.enable();
+  await CP.Debugger.enable();
+
+  const victimId = victim.id;
+  InspectorTest.log('victim session id = ' + victimId);
+
+  CP.Debugger.onPaused(async () => {
+    if (freed) { await CP.Debugger.resume(); return; }
+    freed = true;
+    InspectorTest.log('[controller] paused -> stock utils.disconnectSession(victim)');
+    // Disconnect victim session.
+    utils.disconnectSession(victimId);
+    InspectorTest.log('[controller] victim freed; resuming nested loop');
+    await CP.Debugger.resume();
+  });
+
+  await VP.Runtime.evaluate({
+    expression: `
+      globalThis.devtoolsFormatters = [{
+        header: function(obj, config) { debugger; return null; },
+        hasBody: function() { return false; },
+      }];
+      setTimeout(function() {
+        // Trigger formatter.
+        throw {tag: 'exc'};
+      }, 0);
+    `,
+  });
+
+  // Drive the scheduled setTimeout to completion from the CONTROLLER. If the UAF
+  // fires under ASan we never get past here.
+  await CP.Runtime.evaluate({
+    expression: 'new Promise(r => setTimeout(r, 0))',
+    awaitPromise: true,
+  });
+
+  InspectorTest.log('Reached post-wait (unexpected under ASan if bug fires).');
+  InspectorTest._sessions.delete(victim);
+  InspectorTest.completeTest();
+})();

diff --git a/test/inspector/runtime/regress-520052954-expected.txt b/test/inspector/runtime/regress-520052954-expected.txt
new file mode 100644
index 0000000..3ecaf44
--- /dev/null
+++ b/test/inspector/runtime/regress-520052954-expected.txt
@@ -0,0 +1,5 @@
+Test session disconnect during exception wrapping.
+victim session id = 1
+[controller] paused -> stock utils.disconnectSession(victim)
+[controller] victim freed; resuming nested loop
+Reached post-wait (unexpected under ASan if bug fires).
diff --git a/test/inspector/runtime/regress-520052954.js b/test/inspector/runtime/regress-520052954.js
new file mode 100644
index 0000000..8fa68066
--- /dev/null
+++ b/test/inspector/runtime/regress-520052954.js
@@ -0,0 +1,66 @@
+// Copyright 2026 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Regression test for b/520052954.
+
+
+InspectorTest.log('Test session disconnect during exception wrapping.');
+
+const contextGroup = new InspectorTest.ContextGroup();
+
+// Victim session.
+const victim = contextGroup.connect();
+const VP = victim.Protocol;
+
+// Controller session.
+const controller = contextGroup.connect();
+const CP = controller.Protocol;
+
+let freed = false;
+
+(async function test() {
+  await VP.Runtime.enable();
+  await VP.Debugger.enable();
+  await VP.Runtime.setCustomObjectFormatterEnabled({enabled: true});
+
+  await CP.Runtime.enable();
+  await CP.Debugger.enable();
+
+  const victimId = victim.id;
+  InspectorTest.log('victim session id = ' + victimId);
+
+  CP.Debugger.onPaused(async () => {
+    if (freed) { await CP.Debugger.resume(); return; }
+    freed = true;
+    InspectorTest.log('[controller] paused -> stock utils.disconnectSession(victim)');
+    // Disconnect victim session.
+    utils.disconnectSession(victimId);
+    InspectorTest.log('[controller] victim freed; resuming nested loop');
+    await CP.Debugger.resume();
+  });
+
+  await VP.Runtime.evaluate({
+    expression: `
+      globalThis.devtoolsFormatters = [{
+        header: function(obj, config) { debugger; return null; },
+        hasBody: function() { return false; },
+      }];
+      setTimeout(function() {
+        // Trigger formatter.
+        throw {tag: 'exc'};
+      }, 0);
+    `,
+  });
+
+  // Drive the scheduled setTimeout to completion from the CONTROLLER. If the UAF
+  // fires under ASan we never get past here.
+  await CP.Runtime.evaluate({
+    expression: 'new Promise(r => setTimeout(r, 0))',
+    awaitPromise: true,
+  });
+
+  InspectorTest.log('Reached post-wait (unexpected under ASan if bug fires).');
+  InspectorTest._sessions.delete(victim);
+  InspectorTest.completeTest();
+})();