mini_racer 0.22.0 → 0.22.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7a20d79f246e2bd3f9aa86cdf19c83413d2b782b7738f0bfc13017227e2c20f7
-  data.tar.gz: b1c6d7b75c8bbc7520f0722ed255d042e70e4e606bb627a59926523135640921
+  metadata.gz: 700f0533786f28a992f2b46a0790ed557c36255d8b7357aecfd3fa1bfd4a01a9
+  data.tar.gz: f45170bb718eeff6e2b5d6f83af6039d178f36541983ab20c31e1dbfab83f7cf
 SHA512:
-  metadata.gz: 9c828f6078e1d6f48503bf9870cab6ced783e853decf679c0534735d7c3a9a8d6efb3c06ed7528f88f1ea8f90ddf5e2c8d50c73e89d8e7672d5b03ad7b85e3ef
-  data.tar.gz: 62eb803f2a6aea12b7a80cc6385858631a60dadb61c2eb409e1f5ecf79cfa969f3d9350519377c0a169bf0ffd15987c06635da2d3aaa84f3017183d51b5216bb
+  metadata.gz: ae2e7f4e68826ce1115c933cc17835cc1d32155de483f00a3269b0669fb25198d648aa87fc3ac49b7496c23015b080ea2e9c8e57b061bd4c115716b0180ad6a7
+  data.tar.gz: 4d5a790f98965015cfc97138fe0e8a9e5bbfd11c0f0f67499f8780d0cdee575105f4c7deaf310b6d5937c6fe56f05b9f7548f0d998ea0658c98970fb72b4dc14

data/CHANGELOG

@@ -1,3 +1,20 @@
+- 0.22.2 - 23-10-2026
+  - Fix nested Symbols, functions, and Map keys aborting the process during `eval`/`call` serialization (#447)
+  - Fix attached callback result conversion raising inside the V8 reply path, which could hang the context; conversion errors now propagate normally
+  - Fix callback exceptions whose `to_s` raises or returns a non-string, including reentrant `to_s`, hanging the callback roundtrip
+  - Bound Ruby to JavaScript serialization depth and fix an off-by-one in the JavaScript to Ruby deserializer stack
+  - Fix termination state leaking from error formatting or serialization callbacks into subsequent evaluations
+  - Fix `Snapshot#warmup!` aborting for an empty loaded snapshot (#449)
+  - Fix `Snapshot#warmup!` aborting when warmup creates Intl objects (#450); snapshot creation now uses the same handle scoping as V8's warmup implementation
+  - Reject runtime Intl access in `Snapshot.new` scripts with `MiniRacer::SnapshotError` instead of aborting the process
+  - Validate loaded snapshot versions, headers, section offsets, and checksums, raising `MiniRacer::SnapshotError` for malformed or incompatible blobs instead of terminating the process (#448)
+  - Make `Snapshot#dump` return a copy so mutating it cannot corrupt the stored snapshot
+
+- 0.22.1 - 27-08-2026
+  - Fix building with Clang 22+ and big-endian bigint serialization by making bigint serialization byte-oriented instead of relying on native `uint64_t`/`unsigned long` representations
+  - Fix Ruby integers at or above 512 bits being silently truncated when passed to JavaScript, and large JavaScript bigints producing an invalid internal value when returned to Ruby
+  - Support Ruby and JavaScript bigints up to a 16 MiB magnitude, using allocation-free conversion for common sizes and bounded dynamic storage for larger values
+
 - 0.22.0 - 12-08-2026
   - Add `Context#call_await` and `Context#eval_await`: like `call`/`eval` but block until a returned Promise settles and return the settled value; rejections raise `MiniRacer::RuntimeError`
   - Fix a `call` or `eval` made from a Ruby callback taking the timeout or `stop` meant for the evaluation around it, which then kept running

data/README.md

@@ -60,6 +60,10 @@ puts context.eval("array_and_hash()")
 # => {"a" => 1, "b" => [1, {"a" => 1}]}
 ```
 
+Ruby `Integer` and JavaScript `BigInt` values are converted exactly up to a
+16 MiB magnitude (about 134 million bits). Larger individual values are
+rejected with a serialization error rather than truncated.
+
 ### Return binary data from Ruby to JavaScript
 
 Attached Ruby functions can return binary data as `Uint8Array` using `MiniRacer::Binary`:
@@ -206,6 +210,12 @@ Snapshots can come in handy for example if you want your contexts to be pre-load
 > are fixed once the snapshot has been captured. They are no longer really random
 > nor reflect the current time.
 
+Snapshot scripts passed to `Snapshot.new` that read or write `Intl` are
+rejected with `MiniRacer::SnapshotError`: V8 cannot serialize Intl's foreign
+handles, and allowing them to reach snapshot creation aborts the process.
+`Snapshot#warmup!` may use Intl because its temporary context is discarded
+before the snapshot is created.
+
 Also note that snapshots can be warmed up, using the `warmup!` method, which allows you to call functions which are otherwise lazily compiled to get them to compile right away; any side effect of your warm up code being then dismissed. [More details on warming up here](https://github.com/electron/electron/issues/169#issuecomment-76783481), and a small example:
 
 ```ruby
@@ -238,7 +248,7 @@ context.eval("foo")
 
 Note that snapshots are architecture and V8-version specific. A snapshot created on one platform (e.g., ARM64 macOS) cannot be loaded on a different platform (e.g., x86_64 Linux). Snapshots are best used for same-machine caching or homogeneous deployment environments.
 
-**Security note:** Only load snapshots from trusted sources. V8 snapshots are not designed to be safely loaded from untrusted input—malformed or malicious snapshot data may cause crashes or memory corruption.
+**Security note:** Only load snapshots from trusted sources. V8 snapshots are not designed to be safely loaded from untrusted input—malformed or malicious snapshot data may cause crashes or memory corruption. `Snapshot.load` performs basic version, header, section-offset, and checksum validation, but this is not a sandbox.
 
 ### Garbage collection
 
@@ -518,6 +528,25 @@ gcc >= 12.2 and Xcode >= 13 are, at the time of writing, known to work.
 * Concurrent cause .... JRuby
 * Supports execjs
 
+## Community
+
+Libraries and integrations built with MiniRacer:
+
+- [Humid](https://github.com/thoughtbot/humid) — JavaScript server-side rendering helpers for Rails.
+- [ExecJS](https://github.com/rails/execjs) — A common interface for executing JavaScript from Ruby, with a MiniRacer runtime.
+- [Opal](https://github.com/opal/opal) — A Ruby-to-JavaScript compiler with a MiniRacer CLI runner.
+- [Handlebars::Engine](https://github.com/gi/handlebars-ruby) — A complete Ruby interface to Handlebars.js.
+- [Minibars](https://github.com/combinaut/minibars) — A lightweight Handlebars.rb replacement built on MiniRacer.
+- [Rtlcss](https://github.com/discourse/rtlcss) — Runs rtlcss from Ruby to convert stylesheets between LTR and RTL.
+- [MessageFormat](https://github.com/discourse/messageformat) — Compiles MessageFormat messages from Ruby using `@messageformat/core`.
+- [feelin](https://github.com/ekzo-dev/ruby-feelin) — Evaluates DMN FEEL expressions from Ruby.
+- [parse-css](https://github.com/camertron/parse-css) — Parses CSS, including nested CSS, through the JavaScript parse-css library.
+
+### Notable users
+
+- [Discourse](https://github.com/discourse/discourse) — A large Rails application using MiniRacer for JavaScript compilation, processing, and sandboxed evaluation.
+- [rack-mini-profiler](https://github.com/MiniProfiler/rack-mini-profiler) — Uses MiniRacer in its JavaScript build tooling.
+
 ## Contributing
 
 Bug reports and pull requests are welcome on GitHub at https://github.com/rubyjs/mini_racer. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the [Contributor Covenant](http://contributor-covenant.org) code of conduct.

data/ext/mini_racer_extension/mini_racer_extension.c

@@ -62,6 +62,9 @@ static inline void rb_thread_lock_native_thread(void)
 
 #define countof(x)  (sizeof(x) / sizeof(*(x)))
 #define endof(x)    ((x) + countof(x))
+#define BIGINT_STACK_WORDS 64
+#define BIGINT_MAX_BYTES (16 * 1024 * 1024)
+#define SERIALIZE_MAX_DEPTH 512
 
 // mostly RO: assigned once by platform_set_flag1 while holding |flags_mtx|,
 // from then on read-only and accessible without holding locks
@@ -136,6 +139,7 @@ typedef struct Context
     struct State *pst; // used by v8 thread
     VALUE procs;       // array of js -> ruby callbacks
     VALUE exception;   // pending exception or Qnil
+    int pending_jump_tag; // non-exception jump to replay after the roundtrip
     Buf req, res;      // ruby->v8 request/response, mediated by |mtx| and |cv|
     Buf v8_req;        // stable v8-side copy of a request returned by v8_roundtrip
     int res_ready;     // protected by |mtx|; response may be filled before ready
@@ -287,7 +291,7 @@ static void push(DesCtx *c, VALUE v)
 {
     if (*c->err)
         return;
-    if (c->tos == endof(c->stack)) {
+    if (c->tos == endof(c->stack) - 1) {
         snprintf(c->err, sizeof(c->err), "stack overflow");
         return;
     }
@@ -353,33 +357,32 @@ static void des_date(void *arg, double v)
     put(arg, rb_time_new(sec, usec));
 }
 
-// note: v8 stores bigints in 1's complement, ruby in 2's complement,
-// so we have to take additional steps to ensure correct conversion
+// note: v8 stores bigints as a sign plus little-endian 64-bit magnitude words
 static void des_bigint(void *arg, const void *p, size_t n, int sign)
 {
     VALUE v;
-    size_t i;
     DesCtx *c;
-    unsigned long *a, t, limbs[65]; // +1 to suppress sign extension
+    int flags;
 
     c = arg;
     if (*c->err)
         return;
-    if (n > sizeof(limbs) - sizeof(*limbs)) {
+    if (n % sizeof(uint64_t)) {
+        snprintf(c->err, sizeof(c->err), "bad bigint");
+        return;
+    }
+    if (n > BIGINT_MAX_BYTES) {
         snprintf(c->err, sizeof(c->err), "bigint too big");
         return;
     }
-    a = limbs;
-    t = 0;
-    for (i = 0; i < n; a++, i += sizeof(*a)) {
-        memcpy(a, (char *)p + i, sizeof(*a));
-        t = *a;
-    }
-    if (t >> 63)
-        *a++ = 0; // suppress sign extension
-    v = rb_big_unpack(limbs, a-limbs);
-    if (sign < 0)
-        v = rb_funcall(v, rb_intern("-@"), 0);
+    if (n == 0) {
+        v = INT2FIX(0);
+    } else {
+        flags = INTEGER_PACK_LITTLE_ENDIAN;
+        if (sign < 0)
+            flags |= INTEGER_PACK_NEGATIVE;
+        v = rb_integer_unpack(p, n/sizeof(uint64_t), sizeof(uint64_t), 0, flags);
+    }
     put(c, v);
 }
 
@@ -580,15 +583,47 @@ static void add_string(Ser *s, VALUE v)
     return ser_string(s, p, n);
 }
 
-static int serialize1(Ser *s, VALUE refs, VALUE v)
+// Keep small values allocation-free while allowing large values up to a
+// deliberate per-value limit that bounds temporary conversion storage.
+static int serialize_bigint(Ser *s, VALUE v)
+{
+    uint64_t stack_words[BIGINT_STACK_WORDS];
+    uint64_t *words;
+    size_t nwords, nbytes;
+    int packed;
+
+    nwords = rb_absint_numwords(v, 64, NULL);
+    if (nwords == (size_t)-1 || nwords > BIGINT_MAX_BYTES/sizeof(*words))
+        return bail(&s->err, "bigint too big");
+    nbytes = nwords * sizeof(*words);
+    words = stack_words;
+    if (nwords > countof(stack_words)) {
+        words = malloc(nbytes);
+        if (!words)
+            return bail(&s->err, "out of memory");
+    }
+    packed = rb_integer_pack(v, words, nwords, sizeof(*words), 0,
+                             INTEGER_PACK_LITTLE_ENDIAN);
+    if (packed < -1 || packed > 1) {
+        if (words != stack_words)
+            free(words);
+        return bail(&s->err, "bigint too big");
+    }
+    ser_bigint(s, words, nbytes, packed < 0 ? -1 : 1);
+    if (words != stack_words)
+        free(words);
+    return *s->err ? -1 : 0;
+}
+
+static int serialize1(Ser *s, VALUE refs, VALUE v, int depth)
 {
-    unsigned long limbs[64];
     VALUE a, t, id;
     size_t i, n;
-    int sign;
 
     if (*s->err)
         return -1;
+    if (depth > SERIALIZE_MAX_DEPTH)
+        return bail(&s->err, "max depth exceeded");
     switch (TYPE(v)) {
     case T_ARRAY:
         {
@@ -600,7 +635,7 @@ static int serialize1(Ser *s, VALUE refs, VALUE v)
                 rb_hash_aset(refs, obj_id, LONG2FIX(i));
                 ser_array_begin(s, n);
                 for (i = 0; i < n; i++)
-                    if (serialize1(s, refs, rb_ary_entry(v, i)))
+                    if (serialize1(s, refs, rb_ary_entry(v, i), depth + 1))
                         return -1;
                 ser_array_end(s, n);
             } else {
@@ -631,9 +666,9 @@ static int serialize1(Ser *s, VALUE refs, VALUE v)
                 if (i == 2*n) {
                     ser_object_begin(s);
                     for (i = 0; i < 2*n; i += 2) {
-                        if (serialize1(s, refs, rb_ary_entry(a, i+0)))
+                        if (serialize1(s, refs, rb_ary_entry(a, i+0), depth + 1))
                             return -1;
-                        if (serialize1(s, refs, rb_ary_entry(a, i+1)))
+                        if (serialize1(s, refs, rb_ary_entry(a, i+1), depth + 1))
                             return -1;
                     }
                     ser_object_end(s, n);
@@ -670,15 +705,7 @@ static int serialize1(Ser *s, VALUE refs, VALUE v)
         ser_bool(s, 0);
         break;
     case T_BIGNUM:
-        // note: v8 stores bigints in 1's complement, ruby in 2's complement,
-        // so we have to take additional steps to ensure correct conversion
-        memset(limbs, 0, sizeof(limbs));
-        sign = rb_big_sign(v) ? 1 : -1;
-        if (sign < 0)
-            v = rb_big_mul(v, LONG2FIX(-1));
-        rb_big_pack(v, limbs, countof(limbs));
-        ser_bigint(s, limbs, countof(limbs), sign);
-        break;
+        return serialize_bigint(s, v);
     case T_FIXNUM:
         ser_int(s, FIX2LONG(v));
         break;
@@ -725,7 +752,7 @@ static int serialize1(Ser *s, VALUE refs, VALUE v)
 // that will throw off the object reference count
 static int serialize(Ser *s, VALUE v)
 {
-    return serialize1(s, rb_hash_new(), v);
+    return serialize1(s, rb_hash_new(), v, 0);
 }
 
 static struct timespec deadline_ms(int ms)
@@ -958,6 +985,8 @@ static VALUE deserialize1(DesCtx *d, const uint8_t *p, size_t n)
 
     if (des(&err, p, n, d))
         rb_raise(runtime_error, "%s", err);
+    if (*d->err)
+        rb_raise(runtime_error, "%s", d->err);
     if (d->tos != d->stack) // should not happen
         rb_raise(runtime_error, "parse stack not empty");
     return d->tos->a;
@@ -1000,11 +1029,54 @@ static VALUE rendezvous_callback_do(VALUE arg)
     return rb_funcall2(func, rb_intern("call"), RARRAY_LENINT(args), RARRAY_PTR(args));
 }
 
+struct callback_serialize_args
+{
+    Ser *ser;
+    VALUE value;
+};
+
+static VALUE callback_serialize(VALUE arg)
+{
+    struct callback_serialize_args *args;
+    args = (void *)arg;
+    return INT2FIX(serialize(args->ser, args->value));
+}
+
+static VALUE callback_exception_to_s(VALUE exception)
+{
+    VALUE message;
+    message = rb_funcall(exception, rb_intern("to_s"), 0);
+    StringValue(message);
+    return message;
+}
+
+static VALUE callback_exception_from_state(int state, int *pending_jump_tag)
+{
+    VALUE exception = rb_errinfo();
+    rb_set_errinfo(Qnil);
+    if (RB_TYPE_P(exception, T_OBJECT) &&
+        rb_obj_is_kind_of(exception, rb_eException)) {
+        return exception;
+    }
+    // Thread#kill and other non-exception jumps leave a sentinel or internal
+    // throw data in errinfo; do not hand that to rb_funcall/rb_exc_raise.
+    // Replay the jump once the V8 roundtrip has fully unwound.
+    if (state && pending_jump_tag && !*pending_jump_tag)
+        *pending_jump_tag = state;
+    return Qnil;
+}
+
+static VALUE callback_internal_error(VALUE message)
+{
+    return rb_exc_new_cstr(internal_error, (const char *)message);
+}
+
 // called with |rr_mtx| and GVL held; |mtx| is unlocked
 // callback data is in |a->res|, serialized result goes in |a->req|
 static void *rendezvous_callback(void *arg)
 {
     struct rendezvous_nogvl *a;
+    struct callback_serialize_args args;
     const char *err;
     Context *c;
     int exc;
@@ -1015,13 +1087,29 @@ static void *rendezvous_callback(void *arg)
     c = a->context;
     r = rb_protect(rendezvous_callback_do, (VALUE)a, &exc);
     if (exc) {
-        c->exception = rb_errinfo();
-        rb_set_errinfo(Qnil);
+        c->exception = callback_exception_from_state(exc, &c->pending_jump_tag);
         goto fail;
     }
     ser_init1(&s, 'c'); // callback reply
-    if (serialize(&s, r)) { // should not happen
-        c->exception = rb_exc_new_cstr(internal_error, s.err);
+    args.ser = &s;
+    args.value = r;
+    r = rb_protect(callback_serialize, (VALUE)&args, &exc);
+    if (exc) {
+        // A Ruby conversion hook, Check_Type(), or stack overflow escaped
+        // serialize().  Keep the V8 thread waiting for a reply and turn it
+        // into a normal callback exception instead.
+        c->exception = callback_exception_from_state(exc, &c->pending_jump_tag);
+        ser_reset(&s);
+        goto fail;
+    }
+    if (NUM2INT(r)) {
+        VALUE exception = rb_protect(callback_internal_error,
+                                     (VALUE)s.err, &exc);
+        if (exc) {
+            c->exception = callback_exception_from_state(exc, &c->pending_jump_tag);
+        } else {
+            c->exception = exception;
+        }
         ser_reset(&s);
         goto fail;
     }
@@ -1031,10 +1119,25 @@ out:
 fail:
     ser_init0(&s);   // ruby exception pending
     w_byte(&s, 'e'); // send ruby error message to v8 thread
-    r = rb_funcall(c->exception, rb_intern("to_s"), 0);
-    err = StringValuePtr(r);
-    if (err)
+    r = Qnil;
+    if (!NIL_P(c->exception)) {
+        VALUE original_exception = c->exception;
+        r = rb_protect(callback_exception_to_s, c->exception, &exc);
+        if (exc) {
+            callback_exception_from_state(exc, &c->pending_jump_tag);
+            r = Qnil;
+        }
+        // to_s can re-enter the context and consume c->exception. Keep the
+        // original callback exception for the eventual Ruby-side re-raise.
+        c->exception = original_exception;
+    }
+    if (NIL_P(r)) {
+        err = "Ruby exception";
+        w(&s, err, strlen(err));
+    } else {
+        err = RSTRING_PTR(r);
         w(&s, err, RSTRING_LEN(r));
+    }
     goto out;
 }
 
@@ -1325,6 +1428,12 @@ static VALUE rendezvous1(Context *c, Buf *req, DesCtx *d)
     int exc;
 
     rendezvous_no_des(c, req, &res); // takes ownership of |req|
+    int jump_tag = c->pending_jump_tag;
+    c->pending_jump_tag = 0;
+    if (jump_tag) {
+        buf_reset(&res);
+        rb_jump_tag(jump_tag);
+    }
     r = c->exception;
     c->exception = Qnil;
     // if js land didn't handle exception from ruby callback, re-raise it now
@@ -2121,15 +2230,22 @@ static VALUE snapshot_dump(VALUE self)
     Snapshot *ss;
 
     TypedData_Get_Struct(self, Snapshot, &snapshot_type, ss);
-    return ss->blob;
+    // Callers may mutate the returned String; never expose the blob that
+    // Context.new/snapshot_warmup later hand to V8.
+    return rb_str_dup(ss->blob);
 }
 
 static VALUE snapshot_load(VALUE klass, VALUE blob)
 {
     Snapshot *ss;
     VALUE self;
+    char err[128];
 
     Check_Type(blob, T_STRING);
+    if (v8_snapshot_validate((const uint8_t *)RSTRING_PTR(blob),
+                             (size_t)RSTRING_LEN(blob), err, sizeof(err))) {
+        rb_raise(snapshot_error, "%s", err);
+    }
     self = snapshot_alloc(klass);
     TypedData_Get_Struct(self, Snapshot, &snapshot_type, ss);
     ss->blob = rb_str_dup(blob);

data/ext/mini_racer_extension/mini_racer_v8.cc

@@ -276,6 +276,8 @@ bool reply(State& st, v8::Local<v8::Value> v)
     Serialized serialized(st, v);
     if (serialized.data)
         v8_reply(st.ruby_context, serialized.data, serialized.size);
+    else
+        try_catch.ReThrow();
     return serialized.data != nullptr; // exception pending if false
 }
 
@@ -750,10 +752,35 @@ fail:
     if (!cause && try_catch.HasCaught()) cause = RUNTIME_ERROR;
     if (cause) result = v8::Undefined(st.isolate);
     auto err = to_error(st, &try_catch, cause);
+    // Error formatting can run user JS (for example Error.prepareStackTrace)
+    // which may call Context#stop. Do not let that termination leak into the
+    // reply or the next evaluation.
+    bool terminated_during_error = false;
+    if (st.terminate_requested.load() || st.isolate->IsExecutionTerminating()) {
+        terminated_during_error = true;
+        preserve_termination =
+            suspend_termination(st, nested, cause) || preserve_termination;
+    }
+    if (terminated_during_error) {
+        result = v8::Undefined(st.isolate);
+        std::vector<char> buf;
+        set_error_message(buf, cause,
+                          cause == MEMORY_ERROR ? "out of memory" : "terminated");
+        err = string_from_bytes(st.isolate, buf);
+    }
     if (!reply(st, result, err)) {
         assert(try_catch.HasCaught());
         goto fail; // retry; can be termination exception
     }
+    if (!nested &&
+        (st.terminate_requested.load() || st.isolate->IsExecutionTerminating())) {
+        // A callback invoked by the serializer (for example a getter) can
+        // request termination after the last suspend_termination check. Do not
+        // leak that request into the next outermost evaluation.
+        st.terminate_requested.store(0);
+        st.isolate->CancelTerminateExecution();
+        st.err_reason = NO_ERROR;
+    }
     restore_termination(st, preserve_termination);
 }
 
@@ -818,10 +845,35 @@ fail:
     if (!cause && try_catch.HasCaught()) cause = RUNTIME_ERROR;
     if (cause) result = v8::Undefined(st.isolate);
     auto err = to_error(st, &try_catch, cause);
+    // Error formatting can run user JS (for example Error.prepareStackTrace)
+    // which may call Context#stop. Do not let that termination leak into the
+    // reply or the next evaluation.
+    bool terminated_during_error = false;
+    if (st.terminate_requested.load() || st.isolate->IsExecutionTerminating()) {
+        terminated_during_error = true;
+        preserve_termination =
+            suspend_termination(st, nested, cause) || preserve_termination;
+    }
+    if (terminated_during_error) {
+        result = v8::Undefined(st.isolate);
+        std::vector<char> buf;
+        set_error_message(buf, cause,
+                          cause == MEMORY_ERROR ? "out of memory" : "terminated");
+        err = string_from_bytes(st.isolate, buf);
+    }
     if (!reply(st, result, err)) {
         assert(try_catch.HasCaught());
         goto fail; // retry; can be termination exception
     }
+    if (!nested &&
+        (st.terminate_requested.load() || st.isolate->IsExecutionTerminating())) {
+        // A callback invoked by the serializer (for example a getter) can
+        // request termination after the last suspend_termination check. Do not
+        // leak that request into the next outermost evaluation.
+        st.terminate_requested.store(0);
+        st.isolate->CancelTerminateExecution();
+        st.err_reason = NO_ERROR;
+    }
     restore_termination(st, preserve_termination);
 }
 
@@ -936,6 +988,138 @@ fail:
     reply_retry(st, result);
 }
 
+static uint32_t read_le32(const uint8_t *p)
+{
+    return static_cast<uint32_t>(p[0])
+         | static_cast<uint32_t>(p[1]) << 8
+         | static_cast<uint32_t>(p[2]) << 16
+         | static_cast<uint32_t>(p[3]) << 24;
+}
+
+static bool snapshot_checksum_matches(const uint8_t *data, size_t n)
+{
+    if (n < 13)
+        return false;
+    uint32_t expected = read_le32(data + 8);
+
+    // V8 uses zlib's adler32 when built with V8_USE_ZLIB, otherwise a
+    // Fletcher-32 variant. Accept either so this check remains portable
+    // across libv8-node builds. This is a corruption check, not a sandbox:
+    // snapshots are still trusted-input-only.
+    uint32_t s1 = 0, s2 = 0;
+    for (size_t i = 12; i < n; i++) {
+        s1 = (s1 + data[i]) % 65521;
+        s2 = (s2 + s1) % 65521;
+    }
+    if ((s2 << 16 | s1) == expected)
+        return true;
+
+    s1 = s2 = 0;
+    for (size_t i = 12; i < n; i++) {
+        s1 = (s1 + data[i]) % 65535;
+        s2 = (s2 + s1) % 65535;
+    }
+    return (s2 << 16 | s1) == expected;
+}
+
+// The header/section offsets below mirror V8 13.6's SnapshotImpl. Keep them
+// in sync with libv8-node; the fallback is intentionally limited to preventing
+// V8's fatal deserializer checks, not to sandboxing untrusted snapshots.
+extern "C" int v8_snapshot_validate(const uint8_t *data, size_t n,
+                                     char *err, size_t errlen)
+{
+#define SNAPSHOT_INVALID(msg)                                           \
+    do {                                                                \
+        if (err && errlen)                                              \
+            snprintf(err, errlen, "%s", msg);                           \
+        return -1;                                                      \
+    } while (0)
+
+    if (n == 0)
+        return 0; // Snapshot.load("") means "use V8's built-in snapshot".
+    if (n > static_cast<size_t>(std::numeric_limits<int>::max()))
+        SNAPSHOT_INVALID("snapshot is too large");
+    if (n < 88)
+        SNAPSHOT_INVALID("snapshot is too short");
+
+    v8::StartupData blob{reinterpret_cast<const char*>(data),
+                         static_cast<int>(n)};
+    if (!blob.IsValid())
+        SNAPSHOT_INVALID("snapshot version mismatch");
+
+    uint32_t num_contexts = read_le32(data);
+    uint32_t rehashability = read_le32(data + 4);
+    if (rehashability > 1)
+        SNAPSHOT_INVALID("snapshot header is invalid");
+    if (num_contexts == 0)
+        SNAPSHOT_INVALID("snapshot has no contexts");
+    if (num_contexts > (n - 88) / 4)
+        SNAPSHOT_INVALID("snapshot context table is invalid");
+
+    const size_t pointer_size = sizeof(void*);
+    size_t header_size = 88 + static_cast<size_t>(num_contexts) * 4;
+    size_t startup_offset =
+        (header_size + pointer_size - 1) & ~(pointer_size - 1);
+    if (startup_offset > n)
+        SNAPSHOT_INVALID("snapshot context table is invalid");
+
+    uint32_t read_only_offset = read_le32(data + 80);
+    uint32_t shared_heap_offset = read_le32(data + 84);
+    if (read_only_offset <= startup_offset || read_only_offset > n)
+        SNAPSHOT_INVALID("snapshot read-only section is invalid");
+    if (shared_heap_offset <= read_only_offset || shared_heap_offset > n)
+        SNAPSHOT_INVALID("snapshot shared-heap section is invalid");
+
+    size_t previous_offset = shared_heap_offset;
+    for (uint32_t i = 0; i < num_contexts; i++) {
+        uint32_t offset = read_le32(data + 88 + static_cast<size_t>(i) * 4);
+        if (offset <= previous_offset || offset >= n)
+            SNAPSHOT_INVALID("snapshot context section is invalid");
+        previous_offset = offset;
+    }
+
+    if (!snapshot_checksum_matches(data, n))
+        SNAPSHOT_INVALID("snapshot checksum mismatch");
+
+    return 0;
+#undef SNAPSHOT_INVALID
+}
+
+// Keep all guard state in a JavaScript closure. The setup script returns a
+// query function to C++; do not install a native callback or External global,
+// because a retained property descriptor would otherwise make CreateBlob fail
+// with "Unknown external reference".
+static const char snapshot_intl_setup_source[] = R"js(
+;(function() {
+    const original = globalThis.Intl
+    let used = false
+    const getter = function() {
+        used = true
+        return original
+    }
+    const setter = function(value) {
+        used = true
+    }
+    if (!original) {
+        const query = function() { return used }
+        query.getter = getter
+        return query
+    }
+    Object.defineProperty(globalThis, "Intl", {
+        configurable: true,
+        enumerable: false,
+        get: getter,
+        set: setter
+    })
+    const query = function() { return used }
+    query.getter = getter
+    return query
+})()
+)js";
+
+static const char snapshot_intl_error[] =
+    "Intl is not supported in Snapshot.new scripts";
+
 int snapshot(bool is_warmup, bool verbose_exceptions,
              const v8::String::Utf8Value& code,
              v8::StartupData blob, v8::StartupData *result,
@@ -943,40 +1127,107 @@ int snapshot(bool is_warmup, bool verbose_exceptions,
 {
     // SnapshotCreator takes ownership of isolate
     v8::Isolate *isolate = v8::Isolate::Allocate();
-    v8::StartupData *existing_blob = is_warmup ? &blob : nullptr;
+    // An empty loaded snapshot means "start from V8's built-in snapshot", just
+    // like Context.new. Passing a non-null StartupData with raw_size == 0 to
+    // SnapshotCreator trips CHECK(!artifacts) during warmup.
+    v8::StartupData *existing_blob =
+        (is_warmup && blob.data && blob.raw_size > 0) ? &blob : nullptr;
     v8::SnapshotCreator snapshot_creator(isolate, nullptr, existing_blob);
     v8::Isolate::Scope isolate_scope(isolate);
-    v8::HandleScope handle_scope(isolate);
     v8::TryCatch try_catch(isolate);
     try_catch.SetVerbose(verbose_exceptions);
-    auto filename = is_warmup
-        ? v8::String::NewFromUtf8Literal(isolate, "<warmup>")
-        : v8::String::NewFromUtf8Literal(isolate, "<snapshot>");
     auto mode = is_warmup
         ? v8::SnapshotCreator::FunctionCodeHandling::kKeep
         : v8::SnapshotCreator::FunctionCodeHandling::kClear;
     int cause = INTERNAL_ERROR;
     {
+        // Keep script-created values out of the scope that is alive when
+        // CreateBlob() runs. V8's own warmup implementation uses separate
+        // scopes; sharing one scope leaves Intl foreign handles visible to the
+        // snapshot handle checker and aborts with
+        // CheckGlobalAndEternalHandles failed.
+        v8::HandleScope handle_scope(isolate);
+        auto filename = is_warmup
+            ? v8::String::NewFromUtf8Literal(isolate, "<warmup>")
+            : v8::String::NewFromUtf8Literal(isolate, "<snapshot>");
         auto context = v8::Context::New(isolate);
         v8::Context::Scope context_scope(context);
+        auto intl_key = v8::String::NewFromUtf8Literal(isolate, "Intl");
+        v8::Local<v8::Value> intl_original;
+        v8::Local<v8::Function> intl_state_fn;
+        v8::Local<v8::Function> intl_guard_getter;
+        bool intl_guarded = false;
+        if (!context->Global()->Get(context, intl_key).ToLocal(&intl_original)) {
+            set_error_message(*errbuf, INTERNAL_ERROR,
+                              "failed to inspect snapshot Intl");
+            return INTERNAL_ERROR;
+        }
+        if (!is_warmup && intl_original->IsObject()) {
+            auto intl_setup_source = v8::String::NewFromUtf8Literal(
+                isolate, snapshot_intl_setup_source);
+            v8::Local<v8::Script> intl_setup_script;
+            v8::Local<v8::Value> intl_state;
+            if (!v8::Script::Compile(context, intl_setup_source)
+                     .ToLocal(&intl_setup_script) ||
+                !intl_setup_script->Run(context).ToLocal(&intl_state) ||
+                !intl_state->IsFunction()) {
+                set_error_message(*errbuf, INTERNAL_ERROR,
+                                  "failed to initialize snapshot Intl guard");
+                return INTERNAL_ERROR;
+            }
+            intl_state_fn = intl_state.As<v8::Function>();
+            v8::Local<v8::Value> getter;
+            auto getter_key =
+                v8::String::NewFromUtf8Literal(isolate, "getter");
+            if (!intl_state_fn->Get(context, getter_key).ToLocal(&getter) ||
+                !getter->IsFunction()) {
+                set_error_message(*errbuf, INTERNAL_ERROR,
+                                  "failed to initialize snapshot Intl guard");
+                return INTERNAL_ERROR;
+            }
+            intl_guard_getter = getter.As<v8::Function>();
+            intl_guarded = true;
+        }
         v8::Local<v8::String> source;
         auto type = v8::NewStringType::kNormal;
         if (!v8::String::NewFromUtf8(isolate, *code, type, code.length()).ToLocal(&source)) {
             v8::String::Utf8Value s(isolate, try_catch.Exception());
             if (!set_error_message(*errbuf, cause, s))
                 set_error_message(*errbuf, cause, "unexpected failure");
-            goto fail;
+            return cause;
         }
         v8::ScriptOrigin origin(filename);
         v8::Local<v8::Script> script;
         cause = PARSE_ERROR;
         if (!v8::Script::Compile(context, source, &origin).ToLocal(&script)) {
-            goto err;
+            auto m = try_catch.Message();
+            if (m.IsEmpty()) {
+                set_error_message(*errbuf, cause, "unexpected failure");
+                return cause;
+            }
+            v8::String::Utf8Value s(isolate, m->Get());
+            v8::String::Utf8Value name(isolate, m->GetScriptResourceName());
+            auto line = m->GetLineNumber(context).FromMaybe(0);
+            auto column = m->GetStartColumn(context).FromMaybe(0);
+            if (*s && *name) {
+                errbuf->clear();
+                errbuf->push_back(static_cast<char>(cause));
+                append_utf8(*errbuf, s);
+                append_literal(*errbuf, "\n");
+                append_utf8(*errbuf, name);
+                append_format(*errbuf, ":%d:%d", line, column);
+            } else {
+                set_error_message(*errbuf, cause, "unexpected failure");
+            }
+            return cause;
         }
         cause = RUNTIME_ERROR;
         if (script->Run(context).IsEmpty()) {
-        err:
             auto m = try_catch.Message();
+            if (m.IsEmpty()) {
+                set_error_message(*errbuf, cause, "unexpected failure");
+                return cause;
+            }
             v8::String::Utf8Value s(isolate, m->Get());
             v8::String::Utf8Value name(isolate, m->GetScriptResourceName());
             auto line = m->GetLineNumber(context).FromMaybe(0);
@@ -991,20 +1242,82 @@ int snapshot(bool is_warmup, bool verbose_exceptions,
             } else {
                 set_error_message(*errbuf, cause, "unexpected failure");
             }
-            goto fail;
+            return cause;
+        }
+        if (intl_guarded) {
+            v8::Local<v8::Value> used;
+            auto recv = v8::Undefined(isolate);
+            if (!intl_state_fn->Call(context, recv, 0, nullptr)
+                     .ToLocal(&used)) {
+                set_error_message(*errbuf, INTERNAL_ERROR,
+                                  "failed to inspect snapshot Intl guard");
+                return INTERNAL_ERROR;
+            }
+            if (used->IsTrue()) {
+                set_error_message(*errbuf, RUNTIME_ERROR, snapshot_intl_error);
+                return RUNTIME_ERROR;
+            }
+        }
+        if (intl_guarded) {
+            // Only replace our accessor. If the script deliberately replaced
+            // or deleted Intl, leave that change in the snapshot.
+            v8::Local<v8::Value> descriptor;
+            if (!context->Global()
+                     ->GetOwnPropertyDescriptor(context, intl_key)
+                     .ToLocal(&descriptor)) {
+                set_error_message(*errbuf, INTERNAL_ERROR,
+                                  "failed to inspect Intl after snapshot script");
+                return INTERNAL_ERROR;
+            }
+            bool restore_intl = false;
+            if (descriptor->IsObject()) {
+                auto get_key =
+                    v8::String::NewFromUtf8Literal(isolate, "get");
+                v8::Local<v8::Value> getter_descriptor;
+                if (!descriptor.As<v8::Object>()
+                         ->GetOwnPropertyDescriptor(context, get_key)
+                         .ToLocal(&getter_descriptor)) {
+                    set_error_message(*errbuf, INTERNAL_ERROR,
+                                      "failed to inspect Intl after snapshot script");
+                    return INTERNAL_ERROR;
+                }
+                if (getter_descriptor->IsObject()) {
+                    v8::Local<v8::Value> getter;
+                    auto value_key =
+                        v8::String::NewFromUtf8Literal(isolate, "value");
+                    if (!getter_descriptor.As<v8::Object>()
+                             ->Get(context, value_key)
+                             .ToLocal(&getter)) {
+                        set_error_message(*errbuf, INTERNAL_ERROR,
+                                          "failed to inspect Intl after snapshot script");
+                        return INTERNAL_ERROR;
+                    }
+                    restore_intl =
+                        getter->IsFunction() &&
+                        getter->SameValue(intl_guard_getter);
+                }
+            }
+            if (restore_intl &&
+                !context->Global()
+                     ->DefineOwnProperty(
+                         context, intl_key, intl_original,
+                         v8::PropertyAttribute::DontEnum)
+                     .FromMaybe(false)) {
+                set_error_message(*errbuf, INTERNAL_ERROR,
+                                  "failed to restore Intl after snapshot script");
+                return INTERNAL_ERROR;
+            }
         }
-        cause = INTERNAL_ERROR;
         if (!is_warmup) snapshot_creator.SetDefaultContext(context);
     }
     if (is_warmup) {
+        v8::HandleScope handle_scope(isolate);
         isolate->ContextDisposedNotification(false);
         auto context = v8::Context::New(isolate);
         snapshot_creator.SetDefaultContext(context);
     }
     *result = snapshot_creator.CreateBlob(mode);
-    cause = NO_ERROR;
-fail:
-    return cause;
+    return NO_ERROR;
 }
 
 // response is errback [result, err] array

data/ext/mini_racer_extension/mini_racer_v8.h

@@ -48,6 +48,10 @@ void v8_perform_microtask_checkpoint(struct State *pst);
 void v8_pump_message_loop(struct State *pst);
 void v8_snapshot(struct State *pst, const uint8_t *p, size_t n);
 void v8_warmup(struct State *pst, const uint8_t *p, size_t n);
+// Returns 0 for a valid blob (including an empty blob), otherwise nonzero and
+// writes a short reason to |err|. This performs header/section/checksum checks
+// before V8's fatal snapshot deserializer sees the blob.
+int v8_snapshot_validate(const uint8_t *data, size_t n, char *err, size_t errlen);
 void v8_low_memory_notification(struct State *pst);
 void v8_terminate_execution(struct State *pst); // called from ruby thread
 void v8_terminate_watchdog(struct State *pst); // called from watchdog thread

data/ext/mini_racer_extension/serde.c

@@ -243,33 +243,38 @@ static void ser_num(Ser *s, double v)
     }
 }
 
-// ser_bigint: |n| is in bytes, not quadwords
-static void ser_bigint(Ser *s, const uint64_t *p, size_t n, int sign)
+// ser_bigint: |p| points to |n| bytes, interpreted as little-endian
+// 64-bit words. Keep the interface byte-oriented so callers don't need to
+// expose a concrete word type.
+static void ser_bigint(Ser *s, const void *p, size_t n, int sign)
 {
+    const uint8_t *bytes;
+
     if (*s->err)
         return;
     if (n % 8) {
         snprintf(s->err, sizeof(s->err), "bad bigint");
         return;
     }
+    bytes = p;
     w_byte(s, 'Z');
     // chop off high all-zero words
-    n /= 8;
-    while (n--)
-        if (p[n])
-            break;
-    if (n == (size_t)-1) {
+    while (n > 0 && bytes[n-1] == 0)
+        n--;
+    if (n == 0) {
         w_byte(s, 0); // normalized zero
     } else {
-        n = 8*n + 8;
+        n = (n + 7) & ~(size_t)7;
         w_varint(s, 2*n + (sign < 0));
-        w(s, p, n);
+        w(s, bytes, n);
     }
 }
 
 static void ser_int(Ser *s, int64_t v)
 {
+    uint8_t bytes[8];
     uint64_t t;
+    size_t i;
     int sign;
 
     if (*s->err)
@@ -279,8 +284,10 @@ static void ser_int(Ser *s, int64_t v)
             if (v <= INT64_MAX/1024)
                 return ser_num(s, v);
         t = v < 0 ? (uint64_t)(-(v + 1)) + 1 : (uint64_t)v;
+        for (i = 0; i < sizeof(bytes); i++)
+            bytes[i] = t >> (8*i);
         sign = v < 0 ? -1 : 1;
-        ser_bigint(s, &t, sizeof(t), sign);
+        ser_bigint(s, bytes, sizeof(bytes), sign);
     } else {
         w_byte(s, 'I');
         w_zigzag(s, v);

data/lib/mini_racer/version.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
 module MiniRacer
-  VERSION = "0.22.0"
+  VERSION = "0.22.2"
   LIBV8_NODE_VERSION = "~> 24.12.0.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: mini_racer
 version: !ruby/object:Gem::Version
-  version: 0.22.0
+  version: 0.22.2
 platform: ruby
 authors:
 - Sam Saffron
@@ -164,9 +164,9 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/discourse/mini_racer/issues
-  changelog_uri: https://github.com/discourse/mini_racer/blob/v0.22.0/CHANGELOG
-  documentation_uri: https://www.rubydoc.info/gems/mini_racer/0.22.0
-  source_code_uri: https://github.com/discourse/mini_racer/tree/v0.22.0
+  changelog_uri: https://github.com/discourse/mini_racer/blob/v0.22.2/CHANGELOG
+  documentation_uri: https://www.rubydoc.info/gems/mini_racer/0.22.2
+  source_code_uri: https://github.com/discourse/mini_racer/tree/v0.22.2
 rdoc_options: []
 require_paths:
 - lib