From 81058289115d7a2e90735e61782814e67afa56e4 Mon Sep 17 00:00:00 2001 From: Mohamed Sayed Date: Tue, 2 Jun 2026 22:28:57 +0300 Subject: [PATCH 1/2] deps: V8: respect interceptors in lexical restricted-global check Signed-off-by: Mohamed Sayed --- deps/v8/include/v8-version.h | 2 +- deps/v8/src/execution/execution.cc | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/deps/v8/include/v8-version.h b/deps/v8/include/v8-version.h index 326e55cb91358f..e4d9c9c128f8a3 100644 --- a/deps/v8/include/v8-version.h +++ b/deps/v8/include/v8-version.h @@ -11,7 +11,7 @@ #define V8_MAJOR_VERSION 14 #define V8_MINOR_VERSION 6 #define V8_BUILD_NUMBER 202 -#define V8_PATCH_LEVEL 34 +#define V8_PATCH_LEVEL 35 // Use 1 for candidates and 0 otherwise. // (Boolean macro values are not supported by all preprocessors.) diff --git a/deps/v8/src/execution/execution.cc b/deps/v8/src/execution/execution.cc index 37c313309e1e24..aff63635e489e5 100644 --- a/deps/v8/src/execution/execution.cc +++ b/deps/v8/src/execution/execution.cc @@ -231,12 +231,12 @@ MaybeDirectHandle NewScriptContext( if (IsLexicalVariableMode(mode)) { LookupIterator lookup_it(isolate, global_object, name, global_object, - LookupIterator::OWN_SKIP_INTERCEPTOR); + LookupIterator::OWN); Maybe maybe = JSReceiver::GetPropertyAttributes(&lookup_it); - // Can't fail since the we looking up own properties on the global object - // skipping interceptors. - CHECK(!maybe.IsNothing()); + // The interceptor query callback may throw, in which case propagate the + // pending exception instead of continuing. + if (maybe.IsNothing()) return MaybeDirectHandle(); if ((maybe.FromJust() & DONT_DELETE) != 0) { // ES#sec-globaldeclarationinstantiation 5.a: // If envRec.HasVarDeclaration(name) is true, throw a SyntaxError From 933440eb6f68f1272d63665b7aecdc354a86e526 Mon Sep 17 00:00:00 2001 From: Mohamed Sayed Date: Tue, 2 Jun 2026 22:29:16 +0300 Subject: [PATCH 2/2] test: add regression test for vm lexical restricted global Assert that a top-level `let`/`const` declaration colliding with a non-configurable property on a vm context's global object throws a SyntaxError, and that a configurable property does not block the declaration. Refs: test262 language/global-code/script-decl-lex-restricted-global.js Signed-off-by: Mohamed Sayed --- .../test-vm-global-property-interceptors.js | 23 +++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/test/parallel/test-vm-global-property-interceptors.js b/test/parallel/test-vm-global-property-interceptors.js index 01ae72446047f9..0c2dcddae68ce4 100644 --- a/test/parallel/test-vm-global-property-interceptors.js +++ b/test/parallel/test-vm-global-property-interceptors.js @@ -127,3 +127,26 @@ assert.throws(() => vm.runInContext(` 'use strict'; Object.defineProperty(this, 'f', { value: 'newF' }); `, ctx), /TypeError: Cannot redefine property: f/); + +{ + const restrictedCtx = vm.createContext({}); + vm.runInContext( + "Object.defineProperty(this, 'foo', { value: 1, configurable: false });", + restrictedCtx); + assert.throws(() => vm.runInContext('let foo;', restrictedCtx), { + name: 'SyntaxError', + message: /Identifier 'foo' has already been declared/, + }); + assert.throws(() => vm.runInContext('const foo = 2;', restrictedCtx), { + name: 'SyntaxError', + message: /Identifier 'foo' has already been declared/, + }); + + // A configurable global property does not restrict a lexical declaration. + const configurableCtx = vm.createContext({}); + vm.runInContext( + "Object.defineProperty(this, 'bar', { value: 1, configurable: true });", + configurableCtx); + assert.doesNotThrow(() => vm.runInContext('let bar = 9; bar;', + configurableCtx)); +}