From ede68f0c6b6400c94e84f98d38e77a5226fcd181 Mon Sep 17 00:00:00 2001
From: Yang Guo <[email protected]>
Date: Thu, 09 Jul 2026 17:03:40 +0000
Subject: [PATCH] [inspector] Prevent synchronous JS execution during Map/Set entry preview

During V8 Inspector preview generation (buildObjectPreviewInternal),
when generating nested previews for Map/Set entry keys and values
(forEntry = true), getPropertiesForPreview previously called
ValueMirror::getProperties with ownProperties = false.

Furthermore, when DebugPropertyIterator advanced along the prototype
chain of an object during inspection or when initializing on an object
with zero own properties (DebugPropertyIterator::Create), it would land
on any JSProxy present in the prototype chain via
PrototypeIterator::AdvanceIgnoringProxies(). Once on the proxy,
KeyAccumulator::GetKeys() and property descriptor lookups would
invoke page-controlled JS traps (ownKeys and getOwnPropertyDescriptor)
synchronously inside preview generation.

This change fixes the issue by:
1. Updating DebugPropertyIterator::AdvanceToPrototype() to loop over and
skip any JSProxy objects encountered when traversing prototype chains,
ensuring proxy traps are never invoked during debug property iteration.
2. Updating getPropertiesForPreview(..., bool forEntry, ...) and
passing forEntry as ownProperties to ValueMirror::getProperties().
When generating previews for Map/Set entries (forEntry = true),
property retrieval is restricted to own properties only (ownProperties = true),
avoiding redundant prototype traversals.

TAG=agy
CONV=eb961c5d-e12d-4826-ab96-b720eec9a825

Fixed: 532914769
Change-Id: I5be13911a5a0aec8d158cc709ddcd3e639fc72b0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8067733
Reviewed-by: Simon Zünd <[email protected]>
Auto-Submit: Yang Guo <[email protected]>
Commit-Queue: Simon Zünd <[email protected]>
Cr-Commit-Position: refs/heads/main@{#108569}
---

diff --git a/src/debug/debug-property-iterator.cc b/src/debug/debug-property-iterator.cc
index 00dd8d3..9d49620 100644
--- a/src/debug/debug-property-iterator.cc
+++ b/src/debug/debug-property-iterator.cc
@@ -50,6 +50,11 @@
   is_own_ = false;
   if (!prototype_iterator_.HasAccess()) is_done_ = true;
   prototype_iterator_.AdvanceIgnoringProxies();
+  while (!prototype_iterator_.IsAtEnd() &&
+         IsJSProxy(
+             *PrototypeIterator::GetCurrent<JSReceiver>(prototype_iterator_))) {
+    prototype_iterator_.AdvanceIgnoringProxies();
+  }
   if (prototype_iterator_.IsAtEnd()) is_done_ = true;
 }
 
diff --git a/test/inspector/runtime/map-set-entry-preview-sideeffects-expected.txt b/test/inspector/runtime/map-set-entry-preview-sideeffects-expected.txt
new file mode 100644
index 0000000..b26aa73
--- /dev/null
+++ b/test/inspector/runtime/map-set-entry-preview-sideeffects-expected.txt
@@ -0,0 +1,7 @@
+Checks that Map/Set entry preview does not trigger Proxy traps on prototype chain.
+
+Running test: testMapSetEntryPreviewSideEffects
+{
+    gOPDCalled : 0
+    ownKeysCalled : 0
+}
diff --git a/test/inspector/runtime/map-set-entry-preview-sideeffects.js b/test/inspector/runtime/map-set-entry-preview-sideeffects.js
new file mode 100644
index 0000000..c6bdccb
--- /dev/null
+++ b/test/inspector/runtime/map-set-entry-preview-sideeffects.js
@@ -0,0 +1,49 @@
+// Copyright 2026 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let {session, contextGroup, Protocol} = InspectorTest.start(
+    'Checks that Map/Set entry preview does not trigger Proxy traps on prototype chain.');
+
+contextGroup.addScript(`
+function testMapSetEntryPreview() {
+  let ownKeysCalled = 0;
+  let gOPDCalled = 0;
+  const target = { foo: 1 };
+  const evilProto = new Proxy(target, {
+    ownKeys(t) {
+      ownKeysCalled++;
+      return Reflect.ownKeys(t);
+    },
+    getOwnPropertyDescriptor(t, prop) {
+      gOPDCalled++;
+      return Reflect.getOwnPropertyDescriptor(t, prop);
+    }
+  });
+  const entryVal = {};
+  Object.setPrototypeOf(entryVal, evilProto);
+  const map = new Map([['key', entryVal]]);
+  const set = new Set([entryVal]);
+  return { map, set, getTrapsCalled: () => ({ ownKeysCalled, gOPDCalled }) };
+}
+`);
+
+InspectorTest.runAsyncTestSuite([
+  async function testMapSetEntryPreviewSideEffects() {
+    await Protocol.Runtime.enable();
+    await Protocol.Runtime.evaluate({
+      expression: 'var { map, set, getTrapsCalled } = testMapSetEntryPreview(); map',
+      generatePreview: true
+    });
+    await Protocol.Runtime.evaluate({
+      expression: 'set',
+      generatePreview: true
+    });
+    const result = await Protocol.Runtime.evaluate({
+      expression: 'getTrapsCalled()',
+      returnByValue: true
+    });
+    InspectorTest.logObject(result.result.result.value);
+    await Protocol.Runtime.disable();
+  }
+]);