From 9634c1ea1c47db5494f5486b6bfa25c11cf441bc Mon Sep 17 00:00:00 2001
From: Dominik Inführ <dinfuehr@chromium.org>
Date: Mon, 08 Jun 2026 15:38:33 +0200
Subject: [PATCH] [objects] Fix DCHECK when reading out-of-object double @@toStringTag

During heap snapshotting, allocation is disallowed. When V8 attempts
to read a custom @@toStringTag property to get the constructor name,
it must not allocate.

However, LookupIterator::FetchValue could still trigger an allocation
for doubles in out-of-object properties. This CL fixes this by
returning undefined in that case as well.

TAG=agy
CONV=811d12eb-568f-4c95-813c-bf202ead40c9

Bug: 520656237
Change-Id: I6a67ac9e656aebdc6d5a8c01acb6e5eb2ce54a19
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7908689
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#107912}
---

diff --git a/src/objects/lookup.cc b/src/objects/lookup.cc
index f50bc81..16a809d 100644
--- a/src/objects/lookup.cc
+++ b/src/objects/lookup.cc
@@ -1020,8 +1020,7 @@
     DirectHandle<JSObject> holder = GetHolder<JSObject>();
     FieldIndex field_index =
         FieldIndex::ForDetails(holder->map(), property_details_);
-    if (allow_allocation == AllowAllocation::kNo && field_index.is_inobject() &&
-        field_index.is_double()) {
+    if (allow_allocation == AllowAllocation::kNo && field_index.is_double()) {
       return isolate_->factory()->undefined_value();
     }
     return JSObject::FastPropertyAt(
diff --git a/test/mjsunit/regress/regress-double-toStringTag.js b/test/mjsunit/regress/regress-double-toStringTag.js
new file mode 100644
index 0000000..0e770ca
--- /dev/null
+++ b/test/mjsunit/regress/regress-double-toStringTag.js
@@ -0,0 +1,19 @@
+// Copyright 2026 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function make() {
+  var v = { maxByteLength: 1073741824 };
+  Object.defineProperty(v, "p1", { value: 0 });
+  Object.defineProperty(v, "p2", { value: 0 });
+  Object.defineProperty(v, Symbol.toStringTag, { value: 1073741824 });
+  return v;
+}
+
+// Keep it alive in a variable so it is visited during the snapshot.
+const keep = make();
+
+// Trigger heap snapshot
+%TakeHeapSnapshot("/dev/null");

diff --git a/test/mjsunit/regress/regress-double-toStringTag.js b/test/mjsunit/regress/regress-double-toStringTag.js
new file mode 100644
index 0000000..0e770ca
--- /dev/null
+++ b/test/mjsunit/regress/regress-double-toStringTag.js
@@ -0,0 +1,19 @@
+// Copyright 2026 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function make() {
+  var v = { maxByteLength: 1073741824 };
+  Object.defineProperty(v, "p1", { value: 0 });
+  Object.defineProperty(v, "p2", { value: 0 });
+  Object.defineProperty(v, Symbol.toStringTag, { value: 1073741824 });
+  return v;
+}
+
+// Keep it alive in a variable so it is visited during the snapshot.
+const keep = make();
+
+// Trigger heap snapshot
+%TakeHeapSnapshot("/dev/null");