PoC H-2026-2980: contextCreated lambda UAF on reportExecutionContextCreated.
Step 1: enable Runtime agent.
Step 2: persist single global binding "x".
Step 3: delete own globalThis.x; install Object.prototype.x setter that synchronously destroys the InspectedContext via inspector.fireContextDestroyed(); then immediately trigger inspector.fireContextCreated() in the SAME Runtime.evaluate so the lambda at v8-inspector-impl.cc:308-312 runs WHILE the setter is live.
=================================================================
==118642==ERROR: AddressSanitizer: heap-use-after-free on address 0x6f23fe3f5750 at pc 0x5e512e0d8f4c bp 0x6e136a5bdbc0 sp 0x6e136a5bdbb8
READ of size 8 at 0x6f23fe3f5750 thread T7 (Task Runner)
    #0 0x5e512e0d8f4b in std::__Cr::pair<std::__Cr::__hash_iterator<std::__Cr::__hash_node<int, void*>*>, bool> std::__Cr::__hash_table<int, std::__Cr::hash<int>, std::__Cr::equal_to<int>, std::__Cr::allocator<int>>::__emplace_unique<int const&>(int const&)::'lambda'(int const&, int const&)::operator()(int const&, int const&) const third_party/libc++/src/include/__hash_table:531:67
    #1 0x5e5131a8c72c in v8_inspector::InspectedContext::setReported(int, bool) third_party/libc++/src/include/__utility/try_key_extraction.h:44:10
    #2 0x5e5131b2d91f in v8_inspector::V8RuntimeAgentImpl::reportExecutionContextCreated(v8_inspector::InspectedContext*) src/inspector/v8-runtime-agent-impl.cc:1190:12
    #3 0x5e5131adf6c4 in v8_inspector::V8InspectorImpl::forEachSession(int, std::__Cr::function<void (v8_inspector::V8InspectorSessionImpl*)> const&) third_party/libc++/src/include/__functional/function.h:502:12
    #4 0x5e5131ade978 in v8_inspector::V8InspectorImpl::contextCreated(v8_inspector::V8ContextInfo const&) src/inspector/v8-inspector-impl.cc:308:3
    #5 0x5e512e3f5a08 in v8::internal::InspectorIsolateData::FireContextCreated(v8::Local<v8::Context>, int, v8_inspector::StringView) test/inspector/isolate-data.cc:432:15
    #6 0x5e512e0a4cc6 in v8::internal::(anonymous namespace)::InspectorExtension::FireContextCreated(v8::FunctionCallbackInfo<v8::Value> const&) test/inspector/inspector-test.cc:598:11
    #7 0x5e51349ae6d3 in Builtins_CallApiCallbackGeneric crtstuff.c
    #8 0x5e51349ac956 in Builtins_InterpreterEntryTrampoline crtstuff.c
    #9 0x5e51349a96db in Builtins_JSEntryTrampoline crtstuff.c
    #10 0x5e51349a942a in Builtins_JSEntry crtstuff.c
    #11 0x5e512e85cc33 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) src/execution/execution.cc:475:22
    #12 0x5e512e85f708 in v8::internal::Execution::CallScript(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::JSFunction>, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::DirectHandle<v8::internal::Object>) src/execution/execution.cc:575:10
    #13 0x5e512e741442 in v8::internal::DebugEvaluate::Global(v8::internal::Isolate*, v8::internal::Handle<v8::internal::String>, v8::debug::EvaluateGlobalMode, v8::internal::REPLMode) src/debug/debug-evaluate.cc:71:38
    #14 0x5e512e734793 in v8::debug::EvaluateGlobal(v8::Isolate*, v8::Local<v8::String>, v8::debug::EvaluateGlobalMode, bool) src/debug/debug-interface.cc:1295:50
    #15 0x5e5131b1cc0f in v8_inspector::V8RuntimeAgentImpl::evaluate(v8_inspector::String16 const&, std::__Cr::optional<v8_inspector::String16>, std::__Cr::optional<bool>, std::__Cr::optional<bool>, std::__Cr::optional<int>, std::__Cr::optional<bool>, std::__Cr::optional<bool>, std::__Cr::optional<bool>, std::__Cr::optional<bool>, std::__Cr::optional<bool>, std::__Cr::optional<double>, std::__Cr::optional<bool>, std::__Cr::optional<bool>, std::__Cr::optional<bool>, std::__Cr::optional<v8_inspector::String16>, std::__Cr::unique_ptr<v8_inspector::protocol::Runtime::SerializationOptions, std::__Cr::default_delete<v8_inspector::protocol::Runtime::SerializationOptions>>, std::__Cr::unique_ptr<v8_inspector::protocol::Runtime::Backend::EvaluateCallback, std::__Cr::default_delete<v8_inspector::protocol::Runtime::Backend::EvaluateCallback>>) src/inspector/v8-runtime-agent-impl.cc:425:24
    #16 0x5e5131a56691 in v8_inspector::protocol::Runtime::DomainDispatcherImpl::evaluate(v8_crdtp::Dispatchable const&) gen/src/inspector/protocol/Runtime.cpp:1032:16
    #17 0x5e5131b8090c in v8_crdtp::UberDispatcher::DispatchResult::Run() third_party/libc++/src/include/__functional/function.h:502:12
    #18 0x5e5131af983c in v8_inspector::V8InspectorSessionImpl::dispatchProtocolMessage(v8_inspector::StringView) src/inspector/v8-inspector-session-impl.cc:403:39
    #19 0x5e512e3f7e67 in v8::internal::InspectorIsolateData::SendMessage(int, v8_inspector::StringView const&) test/inspector/isolate-data.cc:234:31
    #20 0x5e512e0a17b9 in v8::internal::SendMessageToBackendTask::Run(v8::internal::InspectorIsolateData*) test/inspector/tasks.h:38:11
    #21 0x5e512e406a73 in v8::internal::TaskRunner::RunMessageLoop(bool) test/inspector/task-runner.cc:80:11
    #22 0x5e512e4066ae in v8::internal::TaskRunner::Run() test/inspector/task-runner.cc:66:3
    #23 0x5e51313d442c in v8::base::ThreadEntry(void*) src/base/platform/platform-posix.cc:1308:11
    #24 0x5e512e056a6a in asan_thread_start(void*) asan_interceptors.cpp

0x6f23fe3f5750 is located 144 bytes inside of 232-byte region [0x6f23fe3f56c0,0x6f23fe3f57a8)
freed by thread T7 (Task Runner) here:
    #0 0x5e512e093e56 in operator delete(void*, unsigned long) (/home/ywatanabee/v8fuzz/v8root/v8/out/fuzzbuild-sandbox-asan/inspector-test+0x23c1e56) (BuildId: e0c223a35147fad9)
    #1 0x5e5131ae01c1 in v8_inspector::V8InspectorImpl::contextCollected(int, int) third_party/libc++/src/include/__memory/shared_count.h:65:7
    #2 0x5e512e3fb899 in v8::internal::InspectorIsolateData::FireContextDestroyed(v8::Local<v8::Context>) test/inspector/isolate-data.cc:438:15
    #3 0x5e51349ae6d3 in Builtins_CallApiCallbackGeneric crtstuff.c
    #4 0x5e51349ac956 in Builtins_InterpreterEntryTrampoline crtstuff.c
    #5 0x5e51349a96db in Builtins_JSEntryTrampoline crtstuff.c
    #6 0x5e51349a942a in Builtins_JSEntry crtstuff.c
    #7 0x5e512e85cc33 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) src/execution/execution.cc:475:22
    #8 0x5e512e85b2ad in v8::internal::Execution::Call(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::DirectHandle<v8::internal::Object>, v8::base::Vector<v8::internal::DirectHandle<v8::internal::Object> const>) src/execution/execution.cc:565:10
    #9 0x5e512f8b5b4e in v8::internal::Object::SetPropertyWithAccessor(v8::internal::LookupIterator*, v8::internal::DirectHandle<v8::internal::Object>, v8::Maybe<v8::internal::ShouldThrow>) src/objects/objects.cc:1740:16
    #10 0x5e512f8bcccc in v8::internal::Object::SetPropertyInternal(v8::internal::LookupIterator*, v8::internal::DirectHandle<v8::internal::Object>, v8::Maybe<v8::internal::ShouldThrow>, v8::internal::StoreOrigin, bool*) src/objects/objects.cc:2473:16
    #11 0x5e512f8af89c in v8::internal::Object::SetProperty(v8::internal::LookupIterator*, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::StoreOrigin, v8::Maybe<v8::internal::ShouldThrow>) src/objects/objects.cc:2567:9
    #12 0x5e512fded76f in v8::internal::Runtime::SetObjectProperty(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::Union<v8::internal::Smi, v8::internal::HeapNumber, v8::internal::BigInt, v8::internal::String, v8::internal::Symbol, v8::internal::Boolean, v8::internal::Null, v8::internal::Undefined, v8::internal::JSReceiver>>, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::MaybeDirectHandle<v8::internal::Union<v8::internal::Smi, v8::internal::HeapNumber, v8::internal::BigInt, v8::internal::String, v8::internal::Symbol, v8::internal::Boolean, v8::internal::Null, v8::internal::Undefined, v8::internal::JSReceiver>>, v8::internal::StoreOrigin, v8::Maybe<v8::internal::ShouldThrow>) src/runtime/runtime-object.cc:389:7
    #13 0x5e512fded8eb in v8::internal::Runtime::SetObjectProperty(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::Union<v8::internal::Smi, v8::internal::HeapNumber, v8::internal::BigInt, v8::internal::String, v8::internal::Symbol, v8::internal::Boolean, v8::internal::Null, v8::internal::Undefined, v8::internal::JSReceiver>>, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::StoreOrigin, v8::Maybe<v8::internal::ShouldThrow>) src/runtime/runtime-object.cc:398:10
    #14 0x5e512e44cd38 in v8::Object::Set(v8::Local<v8::Context>, v8::Local<v8::Value>, v8::Local<v8::Value>) src/api/api.cc:4532:7
    #15 0x5e5131b29d3f in v8_inspector::V8RuntimeAgentImpl::addBinding(v8_inspector::InspectedContext*, v8_inspector::String16 const&) src/inspector/v8-runtime-agent-impl.cc:996:39
    #16 0x5e5131b2b928 in v8_inspector::V8RuntimeAgentImpl::addBindings(v8_inspector::InspectedContext*) src/inspector/v8-runtime-agent-impl.cc:1081:7
    #17 0x5e5131aef897 in void std::__Cr::__function::__policy_func<void (v8_inspector::V8InspectorSessionImpl*)>::__call_func<v8_inspector::V8InspectorImpl::contextCreated(v8_inspector::V8ContextInfo const&)::$_0>(std::__Cr::__function::__policy_storage const*, v8_inspector::V8InspectorSessionImpl*) src/inspector/v8-inspector-impl.cc:310:34
    #18 0x5e5131adf6c4 in v8_inspector::V8InspectorImpl::forEachSession(int, std::__Cr::function<void (v8_inspector::V8InspectorSessionImpl*)> const&) third_party/libc++/src/include/__functional/function.h:502:12
    #19 0x5e5131ade978 in v8_inspector::V8InspectorImpl::contextCreated(v8_inspector::V8ContextInfo const&) src/inspector/v8-inspector-impl.cc:308:3
    #20 0x5e512e3f5a08 in v8::internal::InspectorIsolateData::FireContextCreated(v8::Local<v8::Context>, int, v8_inspector::StringView) test/inspector/isolate-data.cc:432:15
    #21 0x5e512e0a4cc6 in v8::internal::(anonymous namespace)::InspectorExtension::FireContextCreated(v8::FunctionCallbackInfo<v8::Value> const&) test/inspector/inspector-test.cc:598:11
    #22 0x5e51349ae6d3 in Builtins_CallApiCallbackGeneric crtstuff.c
    #23 0x5e51349ac956 in Builtins_InterpreterEntryTrampoline crtstuff.c
    #24 0x5e51349a96db in Builtins_JSEntryTrampoline crtstuff.c
    #25 0x5e51349a942a in Builtins_JSEntry crtstuff.c
    #26 0x5e512e85cc33 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) src/execution/execution.cc:475:22
    #27 0x5e512e85f708 in v8::internal::Execution::CallScript(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::JSFunction>, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::DirectHandle<v8::internal::Object>) src/execution/execution.cc:575:10
    #28 0x5e512e741442 in v8::internal::DebugEvaluate::Global(v8::internal::Isolate*, v8::internal::Handle<v8::internal::String>, v8::debug::EvaluateGlobalMode, v8::internal::REPLMode) src/debug/debug-evaluate.cc:71:38
    #29 0x5e512e734793 in v8::debug::EvaluateGlobal(v8::Isolate*, v8::Local<v8::String>, v8::debug::EvaluateGlobalMode, bool) src/debug/debug-interface.cc:1295:50

previously allocated by thread T7 (Task Runner) here:
    #0 0x5e512e093251 in operator new(unsigned long) (/home/ywatanabee/v8fuzz/v8root/v8/out/fuzzbuild-sandbox-asan/inspector-test+0x23c1251) (BuildId: e0c223a35147fad9)
    #1 0x5e5131ade1fd in v8_inspector::V8InspectorImpl::contextCreated(v8_inspector::V8ContextInfo const&) src/inspector/v8-inspector-impl.cc:288:19
    #2 0x5e512e3f5a08 in v8::internal::InspectorIsolateData::FireContextCreated(v8::Local<v8::Context>, int, v8_inspector::StringView) test/inspector/isolate-data.cc:432:15
    #3 0x5e512e0a4cc6 in v8::internal::(anonymous namespace)::InspectorExtension::FireContextCreated(v8::FunctionCallbackInfo<v8::Value> const&) test/inspector/inspector-test.cc:598:11
    #4 0x5e51349ae6d3 in Builtins_CallApiCallbackGeneric crtstuff.c
    #5 0x5e51349ac956 in Builtins_InterpreterEntryTrampoline crtstuff.c
    #6 0x5e51349a96db in Builtins_JSEntryTrampoline crtstuff.c
    #7 0x5e51349a942a in Builtins_JSEntry crtstuff.c
    #8 0x5e512e85cc33 in v8::internal::(anonymous namespace)::Invoke(v8::internal::Isolate*, v8::internal::(anonymous namespace)::InvokeParams const&) src/execution/execution.cc:475:22
    #9 0x5e512e85f708 in v8::internal::Execution::CallScript(v8::internal::Isolate*, v8::internal::DirectHandle<v8::internal::JSFunction>, v8::internal::DirectHandle<v8::internal::Object>, v8::internal::DirectHandle<v8::internal::Object>) src/execution/execution.cc:575:10
    #10 0x5e512e741442 in v8::internal::DebugEvaluate::Global(v8::internal::Isolate*, v8::internal::Handle<v8::internal::String>, v8::debug::EvaluateGlobalMode, v8::internal::REPLMode) src/debug/debug-evaluate.cc:71:38
    #11 0x5e512e734793 in v8::debug::EvaluateGlobal(v8::Isolate*, v8::Local<v8::String>, v8::debug::EvaluateGlobalMode, bool) src/debug/debug-interface.cc:1295:50
    #12 0x5e5131b1cc0f in v8_inspector::V8RuntimeAgentImpl::evaluate(v8_inspector::String16 const&, std::__Cr::optional<v8_inspector::String16>, std::__Cr::optional<bool>, std::__Cr::optional<bool>, std::__Cr::optional<int>, std::__Cr::optional<bool>, std::__Cr::optional<bool>, std::__Cr::optional<bool>, std::__Cr::optional<bool>, std::__Cr::optional<bool>, std::__Cr::optional<double>, std::__Cr::optional<bool>, std::__Cr::optional<bool>, std::__Cr::optional<bool>, std::__Cr::optional<v8_inspector::String16>, std::__Cr::unique_ptr<v8_inspector::protocol::Runtime::SerializationOptions, std::__Cr::default_delete<v8_inspector::protocol::Runtime::SerializationOptions>>, std::__Cr::unique_ptr<v8_inspector::protocol::Runtime::Backend::EvaluateCallback, std::__Cr::default_delete<v8_inspector::protocol::Runtime::Backend::EvaluateCallback>>) src/inspector/v8-runtime-agent-impl.cc:425:24
    #13 0x5e5131a56691 in v8_inspector::protocol::Runtime::DomainDispatcherImpl::evaluate(v8_crdtp::Dispatchable const&) gen/src/inspector/protocol/Runtime.cpp:1032:16
    #14 0x5e5131b8090c in v8_crdtp::UberDispatcher::DispatchResult::Run() third_party/libc++/src/include/__functional/function.h:502:12
    #15 0x5e5131af983c in v8_inspector::V8InspectorSessionImpl::dispatchProtocolMessage(v8_inspector::StringView) src/inspector/v8-inspector-session-impl.cc:403:39
    #16 0x5e512e3f7e67 in v8::internal::InspectorIsolateData::SendMessage(int, v8_inspector::StringView const&) test/inspector/isolate-data.cc:234:31
    #17 0x5e512e0a17b9 in v8::internal::SendMessageToBackendTask::Run(v8::internal::InspectorIsolateData*) test/inspector/tasks.h:38:11
    #18 0x5e512e406a73 in v8::internal::TaskRunner::RunMessageLoop(bool) test/inspector/task-runner.cc:80:11
    #19 0x5e512e4066ae in v8::internal::TaskRunner::Run() test/inspector/task-runner.cc:66:3
    #20 0x5e51313d442c in v8::base::ThreadEntry(void*) src/base/platform/platform-posix.cc:1308:11
    #21 0x5e512e056a6a in asan_thread_start(void*) asan_interceptors.cpp

Thread T7 (Task Runner) created by T0 here:
    #0 0x5e512e03c795 in pthread_create (/home/ywatanabee/v8fuzz/v8root/v8/out/fuzzbuild-sandbox-asan/inspector-test+0x236a795) (BuildId: e0c223a35147fad9)
    #1 0x5e51313d420f in v8::base::Thread::Start() src/base/platform/platform-posix.cc:1340:14
    #2 0x5e512e405dda in v8::internal::TaskRunner::TaskRunner(std::__Cr::vector<std::__Cr::unique_ptr<v8::internal::InspectorIsolateData::SetupGlobalTask, std::__Cr::default_delete<v8::internal::InspectorIsolateData::SetupGlobalTask>>, std::__Cr::allocator<std::__Cr::unique_ptr<v8::internal::InspectorIsolateData::SetupGlobalTask, std::__Cr::default_delete<v8::internal::InspectorIsolateData::SetupGlobalTask>>>>, v8::internal::CatchExceptions, v8::base::Semaphore*, v8::StartupData*, v8::internal::WithInspector) test/inspector/task-runner.cc:57:9
    #3 0x5e512e0954b7 in main test/inspector/inspector-test.cc:942:16
    #4 0x7213ff02a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #5 0x7213ff02a28a in __libc_start_main csu/../csu/libc-start.c:360:3
    #6 0x5e512dfb7029 in _start (/home/ywatanabee/v8fuzz/v8root/v8/out/fuzzbuild-sandbox-asan/inspector-test+0x22e5029) (BuildId: e0c223a35147fad9)

SUMMARY: AddressSanitizer: heap-use-after-free third_party/libc++/src/include/__hash_table:531:67 in std::__Cr::pair<std::__Cr::__hash_iterator<std::__Cr::__hash_node<int, void*>*>, bool> std::__Cr::__hash_table<int, std::__Cr::hash<int>, std::__Cr::equal_to<int>, std::__Cr::allocator<int>>::__emplace_unique<int const&>(int const&)::'lambda'(int const&, int const&)::operator()(int const&, int const&) const
Shadow bytes around the buggy address:
  0x6f23fe3f5480: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x6f23fe3f5500: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
  0x6f23fe3f5580: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x6f23fe3f5600: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x6f23fe3f5680: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
=>0x6f23fe3f5700: fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd
  0x6f23fe3f5780: fd fd fd fd fd fa fa fa fa fa fa fa fa fa fa fa
  0x6f23fe3f5800: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x6f23fe3f5880: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x6f23fe3f5900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x6f23fe3f5980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==118642==ABORTING