[api] Support Detached global in GetAlignedPointerFromEmbedderDataInCreationContextImpl

verwaest · V8 LUCI CQ · commit e48ce362eb67 · 2025-07-07T05:34:53.000-07:00
Otherwise we get nullptr ScriptState which isn't supported. We might want to look into a better solution long-term though Bug: 428451956 Change-Id: I5127d5f63078ec9afb41bd316850f43cec2c436d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6708443 Commit-Queue: Toon Verwaest <verwaest@chromium.org> Commit-Queue: Michael Lippautz <mlippautz@chromium.org> Auto-Submit: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Michael Lippautz <mlippautz@chromium.org> Cr-Commit-Position: refs/heads/main@{#101290}
diff --git a/src/api/api.cc b/src/api/api.cc
@@ -5202,12 +5202,25 @@ V8_INLINE void* GetAlignedPointerFromEmbedderDataInCreationContextImpl(
   const char* location =
       "v8::Object::GetAlignedPointerFromEmbedderDataInCreationContext()";
   auto maybe_context = object->GetCreationContext();
-  if (!maybe_context.has_value()) return nullptr;
+  i::Tagged<i::NativeContext> native_context;
+  if (maybe_context.has_value()) {
+    native_context = maybe_context.value();
+  } else {
+    // This happens when we're accessing a global property but passed its (now
+    // detached) global proxy as holder. If the global proxy is detached because
+    // of navigation, it won't have a context-specific metamap anymore (it gets
+    // cleared on Detach to avoid leaks). Since we're doing a global proxy
+    // access though, the Isolate's current native context must be the native
+    // context we care about.
+    i::Isolate* isolate = i::Isolate::Current();
+    i::Tagged<i::Context> context = isolate->context();
+    CHECK_EQ(context->global_proxy(), *object);
+    native_context = context->native_context();
+  }
 
   // The code below mostly mimics Context::GetAlignedPointerFromEmbedderData()
   // but it doesn't try to expand the EmbedderDataArray instance.
   i::DisallowGarbageCollection no_gc;
-  i::Tagged<i::NativeContext> native_context = maybe_context.value();
 
   // This macro requires a real Isolate while |i_isolate_for_sandbox| might be
   // nullptr if the V8 sandbox is not enabled.
