From 01b5e5a2cda3d4d89434aa614753798b17bad438 Mon Sep 17 00:00:00 2001
From: Clemens Backes <clemensb@chromium.org>
Date: Wed, 08 Jul 2026 10:21:45 +0200
Subject: [PATCH] [wasm][debug] Fix trap frame confusion in Wasm debugger

When a trap occurs immediately after a breakpoint, the debugger might
attempt to inspect values from an unrelated C++ stack frame if it
misidentifies the callee frame layout.

This CL adds a verification step to ensure the callee frame is a valid
WASM_DEBUG_BREAK frame before using its frame pointer for register
retrieval.

TAG=agy
R=szuend@chromium.org

Bug: 531245718
Change-Id: I2654d29e10d32b09891db443e016f1d606b8b572
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/8053369
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/main@{#108515}
---

diff --git a/src/debug/debug-wasm-objects.cc b/src/debug/debug-wasm-objects.cc
index 9ed9085..bbf988d 100644
--- a/src/debug/debug-wasm-objects.cc
+++ b/src/debug/debug-wasm-objects.cc
@@ -35,6 +35,17 @@
       base::VectorOf(sb.start(), sb.length()));
 }
 
+Address GetDebugBreakFp(WasmFrame* frame) {
+  Address callee_fp = frame->callee_fp();
+  if (callee_fp == kNullAddress) return kNullAddress;
+  intptr_t marker =
+      base::Memory<intptr_t>(callee_fp + TypedFrameConstants::kFrameTypeOffset);
+  if (marker != StackFrame::TypeToMarker(StackFrame::WASM_DEBUG_BREAK)) {
+    return kNullAddress;
+  }
+  return callee_fp;
+}
+
 enum DebugProxyId {
   kFunctionsProxy,
   kGlobalsProxy,
@@ -431,7 +442,7 @@
     for (int i = 0; i < count; ++i) {
       auto value = WasmValueObject::New(
           isolate, debug_info->GetLocalValue(i, frame->pc(), frame->fp(),
-                                             frame->callee_fp(), isolate));
+                                             GetDebugBreakFp(frame), isolate));
       values->set(i, *value);
     }
     values->set(count + 0, frame->wasm_instance()->module_object());
@@ -478,7 +489,7 @@
     for (int i = 0; i < count; ++i) {
       auto value = WasmValueObject::New(
           isolate, debug_info->GetStackValue(i, frame->pc(), frame->fp(),
-                                             frame->callee_fp(), isolate));
+                                             GetDebugBreakFp(frame), isolate));
       values->set(i, *value);
     }
     return IndexedDebugProxy::Create(isolate, values);
diff --git a/src/wasm/wasm-debug.cc b/src/wasm/wasm-debug.cc
index 0a1a6b8..4b2bd13 100644
--- a/src/wasm/wasm-debug.cc
+++ b/src/wasm/wasm-debug.cc
@@ -640,6 +640,7 @@
     }
 
     if (value->is_register()) {
+      if (debug_break_fp == kNullAddress) return {};
       auto reg = LiftoffRegister::from_liftoff_code(value->reg_code);
       auto gp_addr = [debug_break_fp](Register reg) {
         return debug_break_fp +