vm: lexical declaration no longer throws SyntaxError over a global function declaration in vm context (regression in v26.6.0)

Version

v26.6.0

Platform

Darwin 24.6.0 Darwin Kernel Version 24.6.0: xnu-11417.140.69.705.2~1/RELEASE_ARM64_T6041 arm64 (macOS, Apple Silicon)

Subsystem

No response

What steps will reproduce the bug?

A let declaration that collides with a name introduced by a function declaration in a previous script in the same vm context is no longer rejected with a SyntaxError:

const vm = require('vm');
const context = vm.createContext({});

// A function declaration in global (script) code appends its name to the
// global environment record's [[VarNames]] (CreateGlobalFunctionBinding).
vm.runInContext('function foo() { return 42; }', context);

// Per ECMA-262 GlobalDeclarationInstantiation, HasVarDeclaration('foo') is
// then true, so this lexical declaration must throw.
try {
  vm.runInContext('let foo;', context);
  console.log('NO ERROR (let foo; was accepted)');
} catch (e) {
  console.log('THREW:', e.constructor.name, '-', e.message);
}

// Fallout: the accepted `let` shadows the still-present function.
console.log('typeof foo ->', vm.runInContext('typeof foo', context));
console.log('this.foo() ->', vm.runInContext('this.foo()', context));

How often does it reproduce? Is there a required condition?

100% reproducible.

What is the expected behavior? Why is that the expected behavior?

let foo; should throw a SyntaxError. CreateGlobalFunctionBinding appends the name to the global environment record's [[VarNames]], so on the next script HasVarDeclaration('foo') is true and GlobalDeclarationInstantiation must throw.

v26.5.1 behaves correctly:

THREW: SyntaxError - Identifier 'foo' has already been declared
typeof foo -> function
this.foo() -> 42

What do you see instead?

On v26.6.0 the declaration is silently accepted, and the new lexical binding shadows the function — calling it by name now fails while it is still reachable as a property of the global object:

NO ERROR (let foo; was accepted)
typeof foo -> undefined
this.foo() -> 42

(foo() at that point throws TypeError: foo is not a function.)

Additional information

Bisects to v26.6.0; v26.5.1 and v26.3.0 are fine. Both ship the same V8 (14.6.202.34), so this looks like it comes from #64202 (vm: enable interception on global restricted properties, 7be42b64e1) — the fix for #63715, which landed in v26.6.0. I confirmed #63715's own repro is indeed fixed on v26.6.0, so this appears to be the opposite direction of the same interceptor path.

const and class are affected identically. The reverse order (function foo(){} after let foo;) and all var collisions still behave correctly:

previous script	next script	v26.5.1	v26.6.0
function foo(){}	let foo;	SyntaxError	accepted
function foo(){}	const foo = 1;	SyntaxError	accepted
function foo(){}	class foo {}	SyntaxError	accepted
var foo;	let foo;	SyntaxError	SyntaxError
let foo;	function foo(){}	SyntaxError	SyntaxError

A possibly useful detail for localizing it: the two declaration forms land in different places in a contextified global. After var v; the property exists on the context global as non-configurable and is absent from the sandbox object; after function f(){} the property is on the sandbox object and reads back as configurable: true. Since the restricted-global lookup now consults the interceptor, it sees that configurable sandbox property and reports no collision.

Relatedly, inserting a failed delete this.foo between the two scripts makes v26.6.0 throw again:

vm.runInContext('function foo(){}', context);
vm.runInContext('delete this.foo', context); // returns false
vm.runInContext('let foo;', context);        // SyntaxError again

Found via the test262 language/global-code/script-decl-lex-var.js case, which fails on v26.6.0 and passes on v26.5.1.

vm コンテキストの実装と、報告で言及されている test262 の language/global-code/script-decl-lex-var.js ケースから始めます。提供された再現を v26.6.0 で実行し、v26.5.1 と比較します。グローバル宣言の処理と restricted-global/interceptor の検索を追跡します。function の後に let、const、または class が続く衝突で SyntaxError が発生し、既存の var および逆順のケースが引き続き正しく動作すれば完了です。