[debug] fix case of GC-unsafe access in Debug::HandleDebugBreak.

src/debug/debug.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/debug/debug.h"
 
 #include <memory>
 
 #include "src/api.h"
 #include "src/arguments.h"
@@ skipping 2125 matching lines @@
   if (!is_active()) return;
 
   StackLimitCheck check(isolate_);
   if (check.HasOverflowed()) return;
 
   { JavaScriptFrameIterator it(isolate_);
     DCHECK(!it.done());
     Object* fun = it.frame()->function();
     if (fun && fun->IsJSFunction()) {
       HandleScope scope(isolate_);
+      Handle<JSFunction> function(JSFunction::cast(fun), isolate_);
       // Don't stop in builtin and blackboxed functions.
-      Handle<SharedFunctionInfo> shared(JSFunction::cast(fun)->shared(),
-                                        isolate_);
+      Handle<SharedFunctionInfo> shared(function->shared(), isolate_);
       bool ignore_break = ignore_break_mode == kIgnoreIfTopFrameBlackboxed
                               ? IsBlackboxed(shared)
                               : AllFramesOnStackAreBlackboxed();
       if (ignore_break) {
         // Inspector uses pause on next statement for asynchronous breakpoints.
         // When breakpoint is fired we try to break on first not blackboxed
         // statement. To achieve this goal we need to deoptimize current
         // function and don't clear requested DebugBreak even if it's blackboxed
         // to be able to break on not blackboxed function call.
         // TODO(yangguo): introduce break_on_function_entry since current
         // implementation is slow.
         if (isolate_->stack_guard()->CheckDebugBreak()) {
-          Deoptimizer::DeoptimizeFunction(JSFunction::cast(fun));
+          Deoptimizer::DeoptimizeFunction(*function);
         }
         return;
       }
-      JSGlobalObject* global =
-          JSFunction::cast(fun)->context()->global_object();
+      JSGlobalObject* global = function->context()->global_object();
       // Don't stop in debugger functions.
       if (IsDebugGlobal(global)) return;
       // Don't stop if the break location is muted.
       if (IsMutedAtCurrentLocation(it.frame())) return;
     }
   }
 
   isolate_->stack_guard()->ClearDebugBreak();
 
   // Clear stepping to avoid duplicate breaks.
@@ skipping 276 matching lines @@
     isolate_->Throw(*isolate_->factory()->NewEvalError(
         MessageTemplate::kNoSideEffectDebugEvaluate));
   }
   isolate_->set_needs_side_effect_check(old_needs_side_effect_check_);
   isolate_->debug()->UpdateHookOnFunctionCall();
   isolate_->debug()->side_effect_check_failed_ = false;
 }
 
 }  // namespace internal
 }  // namespace v8