mini_racer 0.22.1 → 0.22.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 522742f60d9062d656ffab6c1eb7ead5ceb0eabb6918b9582e9eec32f1f8a4c8
-  data.tar.gz: 404097b19b0e243bcd995e54f2560dd8fa5097dcc94a9488b435242350bc6719
+  metadata.gz: 700f0533786f28a992f2b46a0790ed557c36255d8b7357aecfd3fa1bfd4a01a9
+  data.tar.gz: f45170bb718eeff6e2b5d6f83af6039d178f36541983ab20c31e1dbfab83f7cf
 SHA512:
-  metadata.gz: 723b3777cf8085b76662a3f4ede9fcdd8d4d8b31c31346ed0a87af1092b6a0323579b4dd6c3ec45a3c06f6cecedda7a30b8e807e69ecceaf5c3bf2ab9ceabc07
-  data.tar.gz: 36e1ce3f381f3d4017c10d811805320af94fd026a81eca8bdc71e6fa0cecd58a23f4668883de3cf8810ce57e41e33e9e4560810d4621b9825104a22dd2076e6b
+  metadata.gz: ae2e7f4e68826ce1115c933cc17835cc1d32155de483f00a3269b0669fb25198d648aa87fc3ac49b7496c23015b080ea2e9c8e57b061bd4c115716b0180ad6a7
+  data.tar.gz: 4d5a790f98965015cfc97138fe0e8a9e5bbfd11c0f0f67499f8780d0cdee575105f4c7deaf310b6d5937c6fe56f05b9f7548f0d998ea0658c98970fb72b4dc14

data/CHANGELOG

@@ -1,3 +1,15 @@
+- 0.22.2 - 23-10-2026
+  - Fix nested Symbols, functions, and Map keys aborting the process during `eval`/`call` serialization (#447)
+  - Fix attached callback result conversion raising inside the V8 reply path, which could hang the context; conversion errors now propagate normally
+  - Fix callback exceptions whose `to_s` raises or returns a non-string, including reentrant `to_s`, hanging the callback roundtrip
+  - Bound Ruby to JavaScript serialization depth and fix an off-by-one in the JavaScript to Ruby deserializer stack
+  - Fix termination state leaking from error formatting or serialization callbacks into subsequent evaluations
+  - Fix `Snapshot#warmup!` aborting for an empty loaded snapshot (#449)
+  - Fix `Snapshot#warmup!` aborting when warmup creates Intl objects (#450); snapshot creation now uses the same handle scoping as V8's warmup implementation
+  - Reject runtime Intl access in `Snapshot.new` scripts with `MiniRacer::SnapshotError` instead of aborting the process
+  - Validate loaded snapshot versions, headers, section offsets, and checksums, raising `MiniRacer::SnapshotError` for malformed or incompatible blobs instead of terminating the process (#448)
+  - Make `Snapshot#dump` return a copy so mutating it cannot corrupt the stored snapshot
+
 - 0.22.1 - 27-08-2026
   - Fix building with Clang 22+ and big-endian bigint serialization by making bigint serialization byte-oriented instead of relying on native `uint64_t`/`unsigned long` representations
   - Fix Ruby integers at or above 512 bits being silently truncated when passed to JavaScript, and large JavaScript bigints producing an invalid internal value when returned to Ruby

data/README.md

@@ -210,6 +210,12 @@ Snapshots can come in handy for example if you want your contexts to be pre-load
 > are fixed once the snapshot has been captured. They are no longer really random
 > nor reflect the current time.
 
+Snapshot scripts passed to `Snapshot.new` that read or write `Intl` are
+rejected with `MiniRacer::SnapshotError`: V8 cannot serialize Intl's foreign
+handles, and allowing them to reach snapshot creation aborts the process.
+`Snapshot#warmup!` may use Intl because its temporary context is discarded
+before the snapshot is created.
+
 Also note that snapshots can be warmed up, using the `warmup!` method, which allows you to call functions which are otherwise lazily compiled to get them to compile right away; any side effect of your warm up code being then dismissed. [More details on warming up here](https://github.com/electron/electron/issues/169#issuecomment-76783481), and a small example:
 
 ```ruby
@@ -242,7 +248,7 @@ context.eval("foo")
 
 Note that snapshots are architecture and V8-version specific. A snapshot created on one platform (e.g., ARM64 macOS) cannot be loaded on a different platform (e.g., x86_64 Linux). Snapshots are best used for same-machine caching or homogeneous deployment environments.
 
-**Security note:** Only load snapshots from trusted sources. V8 snapshots are not designed to be safely loaded from untrusted input—malformed or malicious snapshot data may cause crashes or memory corruption.
+**Security note:** Only load snapshots from trusted sources. V8 snapshots are not designed to be safely loaded from untrusted input—malformed or malicious snapshot data may cause crashes or memory corruption. `Snapshot.load` performs basic version, header, section-offset, and checksum validation, but this is not a sandbox.
 
 ### Garbage collection
 

data/ext/mini_racer_extension/mini_racer_extension.c

@@ -64,6 +64,7 @@ static inline void rb_thread_lock_native_thread(void)
 #define endof(x)    ((x) + countof(x))
 #define BIGINT_STACK_WORDS 64
 #define BIGINT_MAX_BYTES (16 * 1024 * 1024)
+#define SERIALIZE_MAX_DEPTH 512
 
 // mostly RO: assigned once by platform_set_flag1 while holding |flags_mtx|,
 // from then on read-only and accessible without holding locks
@@ -138,6 +139,7 @@ typedef struct Context
     struct State *pst; // used by v8 thread
     VALUE procs;       // array of js -> ruby callbacks
     VALUE exception;   // pending exception or Qnil
+    int pending_jump_tag; // non-exception jump to replay after the roundtrip
     Buf req, res;      // ruby->v8 request/response, mediated by |mtx| and |cv|
     Buf v8_req;        // stable v8-side copy of a request returned by v8_roundtrip
     int res_ready;     // protected by |mtx|; response may be filled before ready
@@ -289,7 +291,7 @@ static void push(DesCtx *c, VALUE v)
 {
     if (*c->err)
         return;
-    if (c->tos == endof(c->stack)) {
+    if (c->tos == endof(c->stack) - 1) {
         snprintf(c->err, sizeof(c->err), "stack overflow");
         return;
     }
@@ -613,13 +615,15 @@ static int serialize_bigint(Ser *s, VALUE v)
     return *s->err ? -1 : 0;
 }
 
-static int serialize1(Ser *s, VALUE refs, VALUE v)
+static int serialize1(Ser *s, VALUE refs, VALUE v, int depth)
 {
     VALUE a, t, id;
     size_t i, n;
 
     if (*s->err)
         return -1;
+    if (depth > SERIALIZE_MAX_DEPTH)
+        return bail(&s->err, "max depth exceeded");
     switch (TYPE(v)) {
     case T_ARRAY:
         {
@@ -631,7 +635,7 @@ static int serialize1(Ser *s, VALUE refs, VALUE v)
                 rb_hash_aset(refs, obj_id, LONG2FIX(i));
                 ser_array_begin(s, n);
                 for (i = 0; i < n; i++)
-                    if (serialize1(s, refs, rb_ary_entry(v, i)))
+                    if (serialize1(s, refs, rb_ary_entry(v, i), depth + 1))
                         return -1;
                 ser_array_end(s, n);
             } else {
@@ -662,9 +666,9 @@ static int serialize1(Ser *s, VALUE refs, VALUE v)
                 if (i == 2*n) {
                     ser_object_begin(s);
                     for (i = 0; i < 2*n; i += 2) {
-                        if (serialize1(s, refs, rb_ary_entry(a, i+0)))
+                        if (serialize1(s, refs, rb_ary_entry(a, i+0), depth + 1))
                             return -1;
-                        if (serialize1(s, refs, rb_ary_entry(a, i+1)))
+                        if (serialize1(s, refs, rb_ary_entry(a, i+1), depth + 1))
                             return -1;
                     }
                     ser_object_end(s, n);
@@ -748,7 +752,7 @@ static int serialize1(Ser *s, VALUE refs, VALUE v)
 // that will throw off the object reference count
 static int serialize(Ser *s, VALUE v)
 {
-    return serialize1(s, rb_hash_new(), v);
+    return serialize1(s, rb_hash_new(), v, 0);
 }
 
 static struct timespec deadline_ms(int ms)
@@ -1025,11 +1029,54 @@ static VALUE rendezvous_callback_do(VALUE arg)
     return rb_funcall2(func, rb_intern("call"), RARRAY_LENINT(args), RARRAY_PTR(args));
 }
 
+struct callback_serialize_args
+{
+    Ser *ser;
+    VALUE value;
+};
+
+static VALUE callback_serialize(VALUE arg)
+{
+    struct callback_serialize_args *args;
+    args = (void *)arg;
+    return INT2FIX(serialize(args->ser, args->value));
+}
+
+static VALUE callback_exception_to_s(VALUE exception)
+{
+    VALUE message;
+    message = rb_funcall(exception, rb_intern("to_s"), 0);
+    StringValue(message);
+    return message;
+}
+
+static VALUE callback_exception_from_state(int state, int *pending_jump_tag)
+{
+    VALUE exception = rb_errinfo();
+    rb_set_errinfo(Qnil);
+    if (RB_TYPE_P(exception, T_OBJECT) &&
+        rb_obj_is_kind_of(exception, rb_eException)) {
+        return exception;
+    }
+    // Thread#kill and other non-exception jumps leave a sentinel or internal
+    // throw data in errinfo; do not hand that to rb_funcall/rb_exc_raise.
+    // Replay the jump once the V8 roundtrip has fully unwound.
+    if (state && pending_jump_tag && !*pending_jump_tag)
+        *pending_jump_tag = state;
+    return Qnil;
+}
+
+static VALUE callback_internal_error(VALUE message)
+{
+    return rb_exc_new_cstr(internal_error, (const char *)message);
+}
+
 // called with |rr_mtx| and GVL held; |mtx| is unlocked
 // callback data is in |a->res|, serialized result goes in |a->req|
 static void *rendezvous_callback(void *arg)
 {
     struct rendezvous_nogvl *a;
+    struct callback_serialize_args args;
     const char *err;
     Context *c;
     int exc;
@@ -1040,13 +1087,29 @@ static void *rendezvous_callback(void *arg)
     c = a->context;
     r = rb_protect(rendezvous_callback_do, (VALUE)a, &exc);
     if (exc) {
-        c->exception = rb_errinfo();
-        rb_set_errinfo(Qnil);
+        c->exception = callback_exception_from_state(exc, &c->pending_jump_tag);
         goto fail;
     }
     ser_init1(&s, 'c'); // callback reply
-    if (serialize(&s, r)) {
-        c->exception = rb_exc_new_cstr(internal_error, s.err);
+    args.ser = &s;
+    args.value = r;
+    r = rb_protect(callback_serialize, (VALUE)&args, &exc);
+    if (exc) {
+        // A Ruby conversion hook, Check_Type(), or stack overflow escaped
+        // serialize().  Keep the V8 thread waiting for a reply and turn it
+        // into a normal callback exception instead.
+        c->exception = callback_exception_from_state(exc, &c->pending_jump_tag);
+        ser_reset(&s);
+        goto fail;
+    }
+    if (NUM2INT(r)) {
+        VALUE exception = rb_protect(callback_internal_error,
+                                     (VALUE)s.err, &exc);
+        if (exc) {
+            c->exception = callback_exception_from_state(exc, &c->pending_jump_tag);
+        } else {
+            c->exception = exception;
+        }
         ser_reset(&s);
         goto fail;
     }
@@ -1056,10 +1119,25 @@ out:
 fail:
     ser_init0(&s);   // ruby exception pending
     w_byte(&s, 'e'); // send ruby error message to v8 thread
-    r = rb_funcall(c->exception, rb_intern("to_s"), 0);
-    err = StringValuePtr(r);
-    if (err)
+    r = Qnil;
+    if (!NIL_P(c->exception)) {
+        VALUE original_exception = c->exception;
+        r = rb_protect(callback_exception_to_s, c->exception, &exc);
+        if (exc) {
+            callback_exception_from_state(exc, &c->pending_jump_tag);
+            r = Qnil;
+        }
+        // to_s can re-enter the context and consume c->exception. Keep the
+        // original callback exception for the eventual Ruby-side re-raise.
+        c->exception = original_exception;
+    }
+    if (NIL_P(r)) {
+        err = "Ruby exception";
+        w(&s, err, strlen(err));
+    } else {
+        err = RSTRING_PTR(r);
         w(&s, err, RSTRING_LEN(r));
+    }
     goto out;
 }
 
@@ -1350,6 +1428,12 @@ static VALUE rendezvous1(Context *c, Buf *req, DesCtx *d)
     int exc;
 
     rendezvous_no_des(c, req, &res); // takes ownership of |req|
+    int jump_tag = c->pending_jump_tag;
+    c->pending_jump_tag = 0;
+    if (jump_tag) {
+        buf_reset(&res);
+        rb_jump_tag(jump_tag);
+    }
     r = c->exception;
     c->exception = Qnil;
     // if js land didn't handle exception from ruby callback, re-raise it now
@@ -2146,15 +2230,22 @@ static VALUE snapshot_dump(VALUE self)
     Snapshot *ss;
 
     TypedData_Get_Struct(self, Snapshot, &snapshot_type, ss);
-    return ss->blob;
+    // Callers may mutate the returned String; never expose the blob that
+    // Context.new/snapshot_warmup later hand to V8.
+    return rb_str_dup(ss->blob);
 }
 
 static VALUE snapshot_load(VALUE klass, VALUE blob)
 {
     Snapshot *ss;
     VALUE self;
+    char err[128];
 
     Check_Type(blob, T_STRING);
+    if (v8_snapshot_validate((const uint8_t *)RSTRING_PTR(blob),
+                             (size_t)RSTRING_LEN(blob), err, sizeof(err))) {
+        rb_raise(snapshot_error, "%s", err);
+    }
     self = snapshot_alloc(klass);
     TypedData_Get_Struct(self, Snapshot, &snapshot_type, ss);
     ss->blob = rb_str_dup(blob);

data/ext/mini_racer_extension/mini_racer_v8.cc

@@ -276,6 +276,8 @@ bool reply(State& st, v8::Local<v8::Value> v)
     Serialized serialized(st, v);
     if (serialized.data)
         v8_reply(st.ruby_context, serialized.data, serialized.size);
+    else
+        try_catch.ReThrow();
     return serialized.data != nullptr; // exception pending if false
 }
 
@@ -750,10 +752,35 @@ fail:
     if (!cause && try_catch.HasCaught()) cause = RUNTIME_ERROR;
     if (cause) result = v8::Undefined(st.isolate);
     auto err = to_error(st, &try_catch, cause);
+    // Error formatting can run user JS (for example Error.prepareStackTrace)
+    // which may call Context#stop. Do not let that termination leak into the
+    // reply or the next evaluation.
+    bool terminated_during_error = false;
+    if (st.terminate_requested.load() || st.isolate->IsExecutionTerminating()) {
+        terminated_during_error = true;
+        preserve_termination =
+            suspend_termination(st, nested, cause) || preserve_termination;
+    }
+    if (terminated_during_error) {
+        result = v8::Undefined(st.isolate);
+        std::vector<char> buf;
+        set_error_message(buf, cause,
+                          cause == MEMORY_ERROR ? "out of memory" : "terminated");
+        err = string_from_bytes(st.isolate, buf);
+    }
     if (!reply(st, result, err)) {
         assert(try_catch.HasCaught());
         goto fail; // retry; can be termination exception
     }
+    if (!nested &&
+        (st.terminate_requested.load() || st.isolate->IsExecutionTerminating())) {
+        // A callback invoked by the serializer (for example a getter) can
+        // request termination after the last suspend_termination check. Do not
+        // leak that request into the next outermost evaluation.
+        st.terminate_requested.store(0);
+        st.isolate->CancelTerminateExecution();
+        st.err_reason = NO_ERROR;
+    }
     restore_termination(st, preserve_termination);
 }
 
@@ -818,10 +845,35 @@ fail:
     if (!cause && try_catch.HasCaught()) cause = RUNTIME_ERROR;
     if (cause) result = v8::Undefined(st.isolate);
     auto err = to_error(st, &try_catch, cause);
+    // Error formatting can run user JS (for example Error.prepareStackTrace)
+    // which may call Context#stop. Do not let that termination leak into the
+    // reply or the next evaluation.
+    bool terminated_during_error = false;
+    if (st.terminate_requested.load() || st.isolate->IsExecutionTerminating()) {
+        terminated_during_error = true;
+        preserve_termination =
+            suspend_termination(st, nested, cause) || preserve_termination;
+    }
+    if (terminated_during_error) {
+        result = v8::Undefined(st.isolate);
+        std::vector<char> buf;
+        set_error_message(buf, cause,
+                          cause == MEMORY_ERROR ? "out of memory" : "terminated");
+        err = string_from_bytes(st.isolate, buf);
+    }
     if (!reply(st, result, err)) {
         assert(try_catch.HasCaught());
         goto fail; // retry; can be termination exception
     }
+    if (!nested &&
+        (st.terminate_requested.load() || st.isolate->IsExecutionTerminating())) {
+        // A callback invoked by the serializer (for example a getter) can
+        // request termination after the last suspend_termination check. Do not
+        // leak that request into the next outermost evaluation.
+        st.terminate_requested.store(0);
+        st.isolate->CancelTerminateExecution();
+        st.err_reason = NO_ERROR;
+    }
     restore_termination(st, preserve_termination);
 }
 
@@ -936,6 +988,138 @@ fail:
     reply_retry(st, result);
 }
 
+static uint32_t read_le32(const uint8_t *p)
+{
+    return static_cast<uint32_t>(p[0])
+         | static_cast<uint32_t>(p[1]) << 8
+         | static_cast<uint32_t>(p[2]) << 16
+         | static_cast<uint32_t>(p[3]) << 24;
+}
+
+static bool snapshot_checksum_matches(const uint8_t *data, size_t n)
+{
+    if (n < 13)
+        return false;
+    uint32_t expected = read_le32(data + 8);
+
+    // V8 uses zlib's adler32 when built with V8_USE_ZLIB, otherwise a
+    // Fletcher-32 variant. Accept either so this check remains portable
+    // across libv8-node builds. This is a corruption check, not a sandbox:
+    // snapshots are still trusted-input-only.
+    uint32_t s1 = 0, s2 = 0;
+    for (size_t i = 12; i < n; i++) {
+        s1 = (s1 + data[i]) % 65521;
+        s2 = (s2 + s1) % 65521;
+    }
+    if ((s2 << 16 | s1) == expected)
+        return true;
+
+    s1 = s2 = 0;
+    for (size_t i = 12; i < n; i++) {
+        s1 = (s1 + data[i]) % 65535;
+        s2 = (s2 + s1) % 65535;
+    }
+    return (s2 << 16 | s1) == expected;
+}
+
+// The header/section offsets below mirror V8 13.6's SnapshotImpl. Keep them
+// in sync with libv8-node; the fallback is intentionally limited to preventing
+// V8's fatal deserializer checks, not to sandboxing untrusted snapshots.
+extern "C" int v8_snapshot_validate(const uint8_t *data, size_t n,
+                                     char *err, size_t errlen)
+{
+#define SNAPSHOT_INVALID(msg)                                           \
+    do {                                                                \
+        if (err && errlen)                                              \
+            snprintf(err, errlen, "%s", msg);                           \
+        return -1;                                                      \
+    } while (0)
+
+    if (n == 0)
+        return 0; // Snapshot.load("") means "use V8's built-in snapshot".
+    if (n > static_cast<size_t>(std::numeric_limits<int>::max()))
+        SNAPSHOT_INVALID("snapshot is too large");
+    if (n < 88)
+        SNAPSHOT_INVALID("snapshot is too short");
+
+    v8::StartupData blob{reinterpret_cast<const char*>(data),
+                         static_cast<int>(n)};
+    if (!blob.IsValid())
+        SNAPSHOT_INVALID("snapshot version mismatch");
+
+    uint32_t num_contexts = read_le32(data);
+    uint32_t rehashability = read_le32(data + 4);
+    if (rehashability > 1)
+        SNAPSHOT_INVALID("snapshot header is invalid");
+    if (num_contexts == 0)
+        SNAPSHOT_INVALID("snapshot has no contexts");
+    if (num_contexts > (n - 88) / 4)
+        SNAPSHOT_INVALID("snapshot context table is invalid");
+
+    const size_t pointer_size = sizeof(void*);
+    size_t header_size = 88 + static_cast<size_t>(num_contexts) * 4;
+    size_t startup_offset =
+        (header_size + pointer_size - 1) & ~(pointer_size - 1);
+    if (startup_offset > n)
+        SNAPSHOT_INVALID("snapshot context table is invalid");
+
+    uint32_t read_only_offset = read_le32(data + 80);
+    uint32_t shared_heap_offset = read_le32(data + 84);
+    if (read_only_offset <= startup_offset || read_only_offset > n)
+        SNAPSHOT_INVALID("snapshot read-only section is invalid");
+    if (shared_heap_offset <= read_only_offset || shared_heap_offset > n)
+        SNAPSHOT_INVALID("snapshot shared-heap section is invalid");
+
+    size_t previous_offset = shared_heap_offset;
+    for (uint32_t i = 0; i < num_contexts; i++) {
+        uint32_t offset = read_le32(data + 88 + static_cast<size_t>(i) * 4);
+        if (offset <= previous_offset || offset >= n)
+            SNAPSHOT_INVALID("snapshot context section is invalid");
+        previous_offset = offset;
+    }
+
+    if (!snapshot_checksum_matches(data, n))
+        SNAPSHOT_INVALID("snapshot checksum mismatch");
+
+    return 0;
+#undef SNAPSHOT_INVALID
+}
+
+// Keep all guard state in a JavaScript closure. The setup script returns a
+// query function to C++; do not install a native callback or External global,
+// because a retained property descriptor would otherwise make CreateBlob fail
+// with "Unknown external reference".
+static const char snapshot_intl_setup_source[] = R"js(
+;(function() {
+    const original = globalThis.Intl
+    let used = false
+    const getter = function() {
+        used = true
+        return original
+    }
+    const setter = function(value) {
+        used = true
+    }
+    if (!original) {
+        const query = function() { return used }
+        query.getter = getter
+        return query
+    }
+    Object.defineProperty(globalThis, "Intl", {
+        configurable: true,
+        enumerable: false,
+        get: getter,
+        set: setter
+    })
+    const query = function() { return used }
+    query.getter = getter
+    return query
+})()
+)js";
+
+static const char snapshot_intl_error[] =
+    "Intl is not supported in Snapshot.new scripts";
+
 int snapshot(bool is_warmup, bool verbose_exceptions,
              const v8::String::Utf8Value& code,
              v8::StartupData blob, v8::StartupData *result,
@@ -943,40 +1127,107 @@ int snapshot(bool is_warmup, bool verbose_exceptions,
 {
     // SnapshotCreator takes ownership of isolate
     v8::Isolate *isolate = v8::Isolate::Allocate();
-    v8::StartupData *existing_blob = is_warmup ? &blob : nullptr;
+    // An empty loaded snapshot means "start from V8's built-in snapshot", just
+    // like Context.new. Passing a non-null StartupData with raw_size == 0 to
+    // SnapshotCreator trips CHECK(!artifacts) during warmup.
+    v8::StartupData *existing_blob =
+        (is_warmup && blob.data && blob.raw_size > 0) ? &blob : nullptr;
     v8::SnapshotCreator snapshot_creator(isolate, nullptr, existing_blob);
     v8::Isolate::Scope isolate_scope(isolate);
-    v8::HandleScope handle_scope(isolate);
     v8::TryCatch try_catch(isolate);
     try_catch.SetVerbose(verbose_exceptions);
-    auto filename = is_warmup
-        ? v8::String::NewFromUtf8Literal(isolate, "<warmup>")
-        : v8::String::NewFromUtf8Literal(isolate, "<snapshot>");
     auto mode = is_warmup
         ? v8::SnapshotCreator::FunctionCodeHandling::kKeep
         : v8::SnapshotCreator::FunctionCodeHandling::kClear;
     int cause = INTERNAL_ERROR;
     {
+        // Keep script-created values out of the scope that is alive when
+        // CreateBlob() runs. V8's own warmup implementation uses separate
+        // scopes; sharing one scope leaves Intl foreign handles visible to the
+        // snapshot handle checker and aborts with
+        // CheckGlobalAndEternalHandles failed.
+        v8::HandleScope handle_scope(isolate);
+        auto filename = is_warmup
+            ? v8::String::NewFromUtf8Literal(isolate, "<warmup>")
+            : v8::String::NewFromUtf8Literal(isolate, "<snapshot>");
         auto context = v8::Context::New(isolate);
         v8::Context::Scope context_scope(context);
+        auto intl_key = v8::String::NewFromUtf8Literal(isolate, "Intl");
+        v8::Local<v8::Value> intl_original;
+        v8::Local<v8::Function> intl_state_fn;
+        v8::Local<v8::Function> intl_guard_getter;
+        bool intl_guarded = false;
+        if (!context->Global()->Get(context, intl_key).ToLocal(&intl_original)) {
+            set_error_message(*errbuf, INTERNAL_ERROR,
+                              "failed to inspect snapshot Intl");
+            return INTERNAL_ERROR;
+        }
+        if (!is_warmup && intl_original->IsObject()) {
+            auto intl_setup_source = v8::String::NewFromUtf8Literal(
+                isolate, snapshot_intl_setup_source);
+            v8::Local<v8::Script> intl_setup_script;
+            v8::Local<v8::Value> intl_state;
+            if (!v8::Script::Compile(context, intl_setup_source)
+                     .ToLocal(&intl_setup_script) ||
+                !intl_setup_script->Run(context).ToLocal(&intl_state) ||
+                !intl_state->IsFunction()) {
+                set_error_message(*errbuf, INTERNAL_ERROR,
+                                  "failed to initialize snapshot Intl guard");
+                return INTERNAL_ERROR;
+            }
+            intl_state_fn = intl_state.As<v8::Function>();
+            v8::Local<v8::Value> getter;
+            auto getter_key =
+                v8::String::NewFromUtf8Literal(isolate, "getter");
+            if (!intl_state_fn->Get(context, getter_key).ToLocal(&getter) ||
+                !getter->IsFunction()) {
+                set_error_message(*errbuf, INTERNAL_ERROR,
+                                  "failed to initialize snapshot Intl guard");
+                return INTERNAL_ERROR;
+            }
+            intl_guard_getter = getter.As<v8::Function>();
+            intl_guarded = true;
+        }
         v8::Local<v8::String> source;
         auto type = v8::NewStringType::kNormal;
         if (!v8::String::NewFromUtf8(isolate, *code, type, code.length()).ToLocal(&source)) {
             v8::String::Utf8Value s(isolate, try_catch.Exception());
             if (!set_error_message(*errbuf, cause, s))
                 set_error_message(*errbuf, cause, "unexpected failure");
-            goto fail;
+            return cause;
         }
         v8::ScriptOrigin origin(filename);
         v8::Local<v8::Script> script;
         cause = PARSE_ERROR;
         if (!v8::Script::Compile(context, source, &origin).ToLocal(&script)) {
-            goto err;
+            auto m = try_catch.Message();
+            if (m.IsEmpty()) {
+                set_error_message(*errbuf, cause, "unexpected failure");
+                return cause;
+            }
+            v8::String::Utf8Value s(isolate, m->Get());
+            v8::String::Utf8Value name(isolate, m->GetScriptResourceName());
+            auto line = m->GetLineNumber(context).FromMaybe(0);
+            auto column = m->GetStartColumn(context).FromMaybe(0);
+            if (*s && *name) {
+                errbuf->clear();
+                errbuf->push_back(static_cast<char>(cause));
+                append_utf8(*errbuf, s);
+                append_literal(*errbuf, "\n");
+                append_utf8(*errbuf, name);
+                append_format(*errbuf, ":%d:%d", line, column);
+            } else {
+                set_error_message(*errbuf, cause, "unexpected failure");
+            }
+            return cause;
         }
         cause = RUNTIME_ERROR;
         if (script->Run(context).IsEmpty()) {
-        err:
             auto m = try_catch.Message();
+            if (m.IsEmpty()) {
+                set_error_message(*errbuf, cause, "unexpected failure");
+                return cause;
+            }
             v8::String::Utf8Value s(isolate, m->Get());
             v8::String::Utf8Value name(isolate, m->GetScriptResourceName());
             auto line = m->GetLineNumber(context).FromMaybe(0);
@@ -991,20 +1242,82 @@ int snapshot(bool is_warmup, bool verbose_exceptions,
             } else {
                 set_error_message(*errbuf, cause, "unexpected failure");
             }
-            goto fail;
+            return cause;
+        }
+        if (intl_guarded) {
+            v8::Local<v8::Value> used;
+            auto recv = v8::Undefined(isolate);
+            if (!intl_state_fn->Call(context, recv, 0, nullptr)
+                     .ToLocal(&used)) {
+                set_error_message(*errbuf, INTERNAL_ERROR,
+                                  "failed to inspect snapshot Intl guard");
+                return INTERNAL_ERROR;
+            }
+            if (used->IsTrue()) {
+                set_error_message(*errbuf, RUNTIME_ERROR, snapshot_intl_error);
+                return RUNTIME_ERROR;
+            }
+        }
+        if (intl_guarded) {
+            // Only replace our accessor. If the script deliberately replaced
+            // or deleted Intl, leave that change in the snapshot.
+            v8::Local<v8::Value> descriptor;
+            if (!context->Global()
+                     ->GetOwnPropertyDescriptor(context, intl_key)
+                     .ToLocal(&descriptor)) {
+                set_error_message(*errbuf, INTERNAL_ERROR,
+                                  "failed to inspect Intl after snapshot script");
+                return INTERNAL_ERROR;
+            }
+            bool restore_intl = false;
+            if (descriptor->IsObject()) {
+                auto get_key =
+                    v8::String::NewFromUtf8Literal(isolate, "get");
+                v8::Local<v8::Value> getter_descriptor;
+                if (!descriptor.As<v8::Object>()
+                         ->GetOwnPropertyDescriptor(context, get_key)
+                         .ToLocal(&getter_descriptor)) {
+                    set_error_message(*errbuf, INTERNAL_ERROR,
+                                      "failed to inspect Intl after snapshot script");
+                    return INTERNAL_ERROR;
+                }
+                if (getter_descriptor->IsObject()) {
+                    v8::Local<v8::Value> getter;
+                    auto value_key =
+                        v8::String::NewFromUtf8Literal(isolate, "value");
+                    if (!getter_descriptor.As<v8::Object>()
+                             ->Get(context, value_key)
+                             .ToLocal(&getter)) {
+                        set_error_message(*errbuf, INTERNAL_ERROR,
+                                          "failed to inspect Intl after snapshot script");
+                        return INTERNAL_ERROR;
+                    }
+                    restore_intl =
+                        getter->IsFunction() &&
+                        getter->SameValue(intl_guard_getter);
+                }
+            }
+            if (restore_intl &&
+                !context->Global()
+                     ->DefineOwnProperty(
+                         context, intl_key, intl_original,
+                         v8::PropertyAttribute::DontEnum)
+                     .FromMaybe(false)) {
+                set_error_message(*errbuf, INTERNAL_ERROR,
+                                  "failed to restore Intl after snapshot script");
+                return INTERNAL_ERROR;
+            }
         }
-        cause = INTERNAL_ERROR;
         if (!is_warmup) snapshot_creator.SetDefaultContext(context);
     }
     if (is_warmup) {
+        v8::HandleScope handle_scope(isolate);
         isolate->ContextDisposedNotification(false);
         auto context = v8::Context::New(isolate);
         snapshot_creator.SetDefaultContext(context);
     }
     *result = snapshot_creator.CreateBlob(mode);
-    cause = NO_ERROR;
-fail:
-    return cause;
+    return NO_ERROR;
 }
 
 // response is errback [result, err] array

data/ext/mini_racer_extension/mini_racer_v8.h

@@ -48,6 +48,10 @@ void v8_perform_microtask_checkpoint(struct State *pst);
 void v8_pump_message_loop(struct State *pst);
 void v8_snapshot(struct State *pst, const uint8_t *p, size_t n);
 void v8_warmup(struct State *pst, const uint8_t *p, size_t n);
+// Returns 0 for a valid blob (including an empty blob), otherwise nonzero and
+// writes a short reason to |err|. This performs header/section/checksum checks
+// before V8's fatal snapshot deserializer sees the blob.
+int v8_snapshot_validate(const uint8_t *data, size_t n, char *err, size_t errlen);
 void v8_low_memory_notification(struct State *pst);
 void v8_terminate_execution(struct State *pst); // called from ruby thread
 void v8_terminate_watchdog(struct State *pst); // called from watchdog thread

data/lib/mini_racer/version.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
 module MiniRacer
-  VERSION = "0.22.1"
+  VERSION = "0.22.2"
   LIBV8_NODE_VERSION = "~> 24.12.0.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: mini_racer
 version: !ruby/object:Gem::Version
-  version: 0.22.1
+  version: 0.22.2
 platform: ruby
 authors:
 - Sam Saffron
@@ -164,9 +164,9 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/discourse/mini_racer/issues
-  changelog_uri: https://github.com/discourse/mini_racer/blob/v0.22.1/CHANGELOG
-  documentation_uri: https://www.rubydoc.info/gems/mini_racer/0.22.1
-  source_code_uri: https://github.com/discourse/mini_racer/tree/v0.22.1
+  changelog_uri: https://github.com/discourse/mini_racer/blob/v0.22.2/CHANGELOG
+  documentation_uri: https://www.rubydoc.info/gems/mini_racer/0.22.2
+  source_code_uri: https://github.com/discourse/mini_racer/tree/v0.22.2
 rdoc_options: []
 require_paths:
 - lib