vm: lexical declaration no longer throws SyntaxError over a global function declaration in vm context (regression in v26.6.0)

Version

v26.6.0

Platform

Darwin 24.6.0 Darwin Kernel Version 24.6.0: xnu-11417.140.69.705.2~1/RELEASE_ARM64_T6041 arm64 (macOS, Apple Silicon)

Subsystem

No response

What steps will reproduce the bug?

A let declaration that collides with a name introduced by a function declaration in a previous script in the same vm context is no longer rejected with a SyntaxError:

const vm = require('vm');
const context = vm.createContext({});

// A function declaration in global (script) code appends its name to the
// global environment record's [[VarNames]] (CreateGlobalFunctionBinding).
vm.runInContext('function foo() { return 42; }', context);

// Per ECMA-262 GlobalDeclarationInstantiation, HasVarDeclaration('foo') is
// then true, so this lexical declaration must throw.
try {
  vm.runInContext('let foo;', context);
  console.log('NO ERROR (let foo; was accepted)');
} catch (e) {
  console.log('THREW:', e.constructor.name, '-', e.message);
}

// Fallout: the accepted `let` shadows the still-present function.
console.log('typeof foo ->', vm.runInContext('typeof foo', context));
console.log('this.foo() ->', vm.runInContext('this.foo()', context));

How often does it reproduce? Is there a required condition?

100% reproducible.

What is the expected behavior? Why is that the expected behavior?

let foo; should throw a SyntaxError. CreateGlobalFunctionBinding appends the name to the global environment record's [[VarNames]], so on the next script HasVarDeclaration('foo') is true and GlobalDeclarationInstantiation must throw.

v26.5.1 behaves correctly:

THREW: SyntaxError - Identifier 'foo' has already been declared
typeof foo -> function
this.foo() -> 42

What do you see instead?

On v26.6.0 the declaration is silently accepted, and the new lexical binding shadows the function — calling it by name now fails while it is still reachable as a property of the global object:

NO ERROR (let foo; was accepted)
typeof foo -> undefined
this.foo() -> 42

(foo() at that point throws TypeError: foo is not a function.)

Additional information

Bisects to v26.6.0; v26.5.1 and v26.3.0 are fine. Both ship the same V8 (14.6.202.34), so this looks like it comes from #64202 (vm: enable interception on global restricted properties, 7be42b64e1) — the fix for #63715, which landed in v26.6.0. I confirmed #63715's own repro is indeed fixed on v26.6.0, so this appears to be the opposite direction of the same interceptor path.

const and class are affected identically. The reverse order (function foo(){} after let foo;) and all var collisions still behave correctly:

previous script	next script	v26.5.1	v26.6.0
function foo(){}	let foo;	SyntaxError	accepted
function foo(){}	const foo = 1;	SyntaxError	accepted
function foo(){}	class foo {}	SyntaxError	accepted
var foo;	let foo;	SyntaxError	SyntaxError
let foo;	function foo(){}	SyntaxError	SyntaxError

A possibly useful detail for localizing it: the two declaration forms land in different places in a contextified global. After var v; the property exists on the context global as non-configurable and is absent from the sandbox object; after function f(){} the property is on the sandbox object and reads back as configurable: true. Since the restricted-global lookup now consults the interceptor, it sees that configurable sandbox property and reports no collision.

Relatedly, inserting a failed delete this.foo between the two scripts makes v26.6.0 throw again:

vm.runInContext('function foo(){}', context);
vm.runInContext('delete this.foo', context); // returns false
vm.runInContext('let foo;', context);        // SyntaxError again

Found via the test262 language/global-code/script-decl-lex-var.js case, which fails on v26.6.0 and passes on v26.5.1.

从 vm 上下文实现以及报告中提到的 test262 language/global-code/script-decl-lex-var.js 用例开始；在 v26.6.0 上运行提供的复现，并与 v26.5.1 进行比较。跟踪全局声明处理以及 restricted-global/interceptor 查找。完成标准是：function 后跟 let、const 或 class 的冲突会引发 SyntaxError，同时现有的 var 和逆序用例仍然正确。