[api] Add safe API to inspect monkey-patched functions [v8/v8 : main]

0 views
Skip to first unread message

Yao Xiao (Gerrit)

unread,
Jun 9, 2026, 1:05:08 PM (2 days ago) Jun 9
to Josh Karlin, v8-s...@luci-project-accounts.iam.gserviceaccount.com, cbruni...@chromium.org, v8-m...@googlegroups.com, v8-re...@googlegroups.com
Attention needed from Josh Karlin

Yao Xiao added 3 comments

File include/v8-object.h
Line 795, Patchset 12: GetAssessedFunctionForPathNoJavascriptExecution(
Josh Karlin . resolved

V8 reviewers will know better but I'd suggest removing the "NoJavascriptExecution" suffix and just mark that as a note in the comment about the behavior.

Yao Xiao

Done

Line 765, Patchset 12: */
V8_WARN_UNUSED_RESULT MaybeLocal<Value> GetPropertyNoJavascriptExecution(
Local<Context> context, Local<Name> key);
Josh Karlin . resolved

Why define this here? Can't it just be a helper function in unnamed namespace in cc?

Yao Xiao

Done. (Originally, I thought it would be beneficial to expose it as a separate API because it abstracts a potentially reusable part. But given that there is currently no embedder using it, I agree it's better to remove it.)

File src/api/api.cc
Line 5413, Patchset 12: bool is_user_defined =
Josh Karlin . resolved

Looks like we can improve upon our existing heuristic here.

The current heuristic will miss monkey-patches that use `.bind()`, such as `window.history.pushState = adWrapper.bind(window.history);`. In V8, the result of `.bind()` is a `JSBoundFunction`, which does not have a script ID, causing `is_user_defined` to be `false`.

Since native platform APIs are never exposed as `JSBoundFunction` objects by default, I think we can safely assume that if the resolved function is a bound function, it is user-defined/monkey-patched.

I think you can udpate to this:
```cpp
i::Tagged<i::Object> internal_func = *Utils::OpenDirectHandle(*api_function);
bool is_user_defined = i::IsJSBoundFunction(internal_func) ||
api_function->ScriptId() != v8::Message::kNoScriptIdInfo;
```

Please then also add a test.

Yao Xiao

Done

Open in Gerrit

Related details

Attention is currently required from:
  • Josh Karlin
Submit Requirements:
  • requirement is not satisfiedCode-Owners
  • requirement is not satisfiedCode-Review
  • requirement is not satisfiedReview-Enforcement
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: v8/v8
Gerrit-Branch: main
Gerrit-Change-Id: I79a258f7ac02f9ef4f74f765d5932719961ee007
Gerrit-Change-Number: 7903561
Gerrit-PatchSet: 15
Gerrit-Owner: Yao Xiao <yao...@chromium.org>
Gerrit-Reviewer: Josh Karlin <jka...@chromium.org>
Gerrit-Reviewer: Yao Xiao <yao...@chromium.org>
Gerrit-Attention: Josh Karlin <jka...@chromium.org>
Gerrit-Comment-Date: Tue, 09 Jun 2026 17:04:58 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: No
Comment-In-Reply-To: Josh Karlin <jka...@chromium.org>
unsatisfied_requirement
open
diffy

Josh Karlin (Gerrit)

unread,
Jun 9, 2026, 1:42:10 PM (2 days ago) Jun 9
to Yao Xiao, Josh Karlin, v8-s...@luci-project-accounts.iam.gserviceaccount.com, cbruni...@chromium.org, v8-m...@googlegroups.com, v8-re...@googlegroups.com
Attention needed from Yao Xiao

Josh Karlin added 3 comments

File include/v8-object.h
Line 778, Patchset 15 (Latest): * function bails out and returns an empty function. It allows native C++
Josh Karlin . unresolved

suggest saying "returns a default constructed AssessedFunction" or stating that is_user_defined is false in such cases.

Line 778, Patchset 15 (Latest): * function bails out and returns an empty function. It allows native C++
Josh Karlin . unresolved

nit: remove unnecessary words

File src/api/api.cc
Line 5320, Patchset 15 (Latest): Local<Context> context, MemorySpan<const char* const> property_path) {
Josh Karlin . unresolved

Suggest taking a span of v8::Name so that v8 doesn't have to assume that the incoming string is UTF8 and create a new string each call. This way the embedder can create the string once and hold onto it for better performance if it wants.

Open in Gerrit

Related details

Attention is currently required from:
  • Yao Xiao
Submit Requirements:
    • requirement is not satisfiedCode-Owners
    • requirement is not satisfiedCode-Review
    • requirement is not satisfiedNo-Unresolved-Comments
    • requirement is not satisfiedReview-Enforcement
    Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
    Gerrit-MessageType: comment
    Gerrit-Project: v8/v8
    Gerrit-Branch: main
    Gerrit-Change-Id: I79a258f7ac02f9ef4f74f765d5932719961ee007
    Gerrit-Change-Number: 7903561
    Gerrit-PatchSet: 15
    Gerrit-Owner: Yao Xiao <yao...@chromium.org>
    Gerrit-Reviewer: Josh Karlin <jka...@chromium.org>
    Gerrit-Reviewer: Yao Xiao <yao...@chromium.org>
    Gerrit-Attention: Yao Xiao <yao...@chromium.org>
    Gerrit-Comment-Date: Tue, 09 Jun 2026 17:41:57 +0000
    Gerrit-HasComments: Yes
    Gerrit-Has-Labels: No
    unsatisfied_requirement
    open
    diffy

    Yao Xiao (Gerrit)

    unread,
    Jun 9, 2026, 2:41:12 PM (2 days ago) Jun 9
    to Josh Karlin, v8-s...@luci-project-accounts.iam.gserviceaccount.com, cbruni...@chromium.org, v8-m...@googlegroups.com, v8-re...@googlegroups.com
    Attention needed from Josh Karlin

    Yao Xiao added 3 comments

    File include/v8-object.h
    Line 778, Patchset 15: * function bails out and returns an empty function. It allows native C++
    Josh Karlin . resolved

    suggest saying "returns a default constructed AssessedFunction" or stating that is_user_defined is false in such cases.

    Yao Xiao

    Done

    Line 778, Patchset 15: * function bails out and returns an empty function. It allows native C++
    Josh Karlin . resolved

    nit: remove unnecessary words

    Yao Xiao

    Done

    File src/api/api.cc
    Line 5320, Patchset 15: Local<Context> context, MemorySpan<const char* const> property_path) {
    Josh Karlin . resolved

    Suggest taking a span of v8::Name so that v8 doesn't have to assume that the incoming string is UTF8 and create a new string each call. This way the embedder can create the string once and hold onto it for better performance if it wants.

    Yao Xiao

    Done

    Open in Gerrit

    Related details

    Attention is currently required from:
    • Josh Karlin
    Submit Requirements:
      • requirement is not satisfiedCode-Owners
      • requirement is not satisfiedCode-Review
      • requirement is not satisfiedReview-Enforcement
      Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
      Gerrit-MessageType: comment
      Gerrit-Project: v8/v8
      Gerrit-Branch: main
      Gerrit-Change-Id: I79a258f7ac02f9ef4f74f765d5932719961ee007
      Gerrit-Change-Number: 7903561
      Gerrit-PatchSet: 16
      Gerrit-Attention: Josh Karlin <jka...@chromium.org>
      Gerrit-Comment-Date: Tue, 09 Jun 2026 18:41:08 +0000
      Gerrit-HasComments: Yes
      Gerrit-Has-Labels: No
      Comment-In-Reply-To: Josh Karlin <jka...@chromium.org>
      unsatisfied_requirement
      open
      diffy

      Josh Karlin (Gerrit)

      unread,
      Jun 10, 2026, 8:18:30 AM (20 hours ago) Jun 10
      to Yao Xiao, Josh Karlin, v8-s...@luci-project-accounts.iam.gserviceaccount.com, cbruni...@chromium.org, v8-m...@googlegroups.com, v8-re...@googlegroups.com
      Attention needed from Yao Xiao

      Josh Karlin added 1 comment

      File include/v8-object.h
      Line 786, Patchset 16 (Latest): V8_WARN_UNUSED_RESULT AssessedFunction GetAssessedFunctionForPath(
      Josh Karlin . unresolved

      So the caller doesn't really need both values returned. Basically, what Chrome wants is a "GetUserDefinedFunctionIfExists" which returns an MaybeLocal function, right?

      Open in Gerrit

      Related details

      Attention is currently required from:
      • Yao Xiao
      Submit Requirements:
        • requirement is not satisfiedCode-Owners
        • requirement is not satisfiedCode-Review
        • requirement is not satisfiedNo-Unresolved-Comments
        • requirement is not satisfiedReview-Enforcement
        Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
        Gerrit-MessageType: comment
        Gerrit-Project: v8/v8
        Gerrit-Branch: main
        Gerrit-Change-Id: I79a258f7ac02f9ef4f74f765d5932719961ee007
        Gerrit-Change-Number: 7903561
        Gerrit-PatchSet: 16
        Gerrit-Owner: Yao Xiao <yao...@chromium.org>
        Gerrit-Reviewer: Josh Karlin <jka...@chromium.org>
        Gerrit-Reviewer: Yao Xiao <yao...@chromium.org>
        Gerrit-Attention: Yao Xiao <yao...@chromium.org>
        Gerrit-Comment-Date: Wed, 10 Jun 2026 12:18:25 +0000
        Gerrit-HasComments: Yes
        Gerrit-Has-Labels: No
        unsatisfied_requirement
        open
        diffy
        Reply all
        Reply to author
        Forward
        0 new messages