process/worker: env descriptor validation, worker execArgv policy table with per-worker --expose-gc (+3 tests, worker 74%→76%)

src/js/builtins/ProcessObjectInternals.ts

@@ -548,11 +548,6 @@ export function windowsEnv(
       return delete internalEnv[k];
     },
     defineProperty(_, p, attributes) {
-      // String(symbol) does not throw (it returns the descriptive string), so
-      // reject symbol keys explicitly like the set trap does.
-      if (typeof p === "symbol") {
-        throw new TypeError("Cannot convert a Symbol value to a string");
-      }
       // Same validation as JSEnvironmentVariableMap::defineOwnProperty on
       // POSIX: only plain, fully-permissive data descriptors are accepted.
       if ("get" in attributes || "set" in attributes) {
@@ -572,6 +567,12 @@ export function windowsEnv(
           "'process.env' only accepts a configurable, writable, and enumerable data descriptor",
         );
       }
+      // Node coerces the key only after the descriptor validates; String(symbol)
+      // does not throw (it returns the descriptive string), so reject symbol
+      // keys explicitly like the set trap does.
+      if (typeof p === "symbol") {
+        throw new TypeError("Cannot convert a Symbol value to a string");
+      }
       if (typeof attributes.value === "symbol") {
         throw new TypeError("Cannot convert a Symbol value to a string");
       }
@@ -597,6 +598,9 @@ export function windowsEnv(
       // .slice() because paranoia that there is a way to call this without the engine cloning it for us
       return envMapList.slice();
     },
+    preventExtensions() {
+      return false;
+    },
   });
 }
 

src/jsc/VirtualMachine.rs

@@ -1696,12 +1696,15 @@ pub type RuntimeState = *mut c_void;
 
 /// The subset of a Worker's `execArgv` that bun acts on. Flags whose value must
 /// outlive the parse (--cpu-prof-dir/-name) are absent; nothing needs them yet.
-#[derive(Default, Clone, Copy)]
+#[derive(Default, Clone)]
 pub struct WorkerExecArgv {
     pub allow_addons: Option<bool>,
     pub use_system_ca: Option<bool>,
     pub cpu_prof: bool,
     pub cpu_prof_interval: Option<u32>,
+    pub expose_gc: bool,
+    /// `--require`/`-r`/`--preload`/`--import` specifiers, in order.
+    pub preloads: Vec<Box<[u8]>>,
 }
 
 pub struct RuntimeHooks {
@@ -1825,9 +1828,14 @@ pub struct RuntimeHooks {
         transpiler: *mut Transpiler<'static>,
         graph: &'static dyn bun_resolver::StandaloneModuleGraph,
     ),
-    /// Parse `execArgv` against the `RunCommand` param table (lives in `bun_runtime::cli`, forward-dep).
-    /// Caller writes `allow_addons` back into `transform_options` and applies `cpu_prof` to the worker VM.
-    pub parse_worker_exec_argv: unsafe fn(exec_argv: &[bun_core::WTFStringImpl]) -> WorkerExecArgv,
+    /// Parse a worker's `execArgv` (`bun_runtime::cli::worker_exec_argv`,
+    /// forward-dep); `None` derives an inheriting worker's defaults from the
+    /// process argv. cpu-prof is excluded (the parent VM carries it via
+    /// `parent_cpu_profiler_config`); preloads are excluded too, so an
+    /// inheriting worker does not re-run CLI `-r` (only an explicit execArgv
+    /// does; node re-runs in both — widening is a behavior decision).
+    pub parse_worker_exec_argv:
+        unsafe fn(exec_argv: Option<&[bun_core::WTFStringImpl]>) -> WorkerExecArgv,
     /// `CronJob.clearAllForVM(vm, .teardown)`. `CronJob` lives in
     /// `bun_runtime::api::cron`.
     pub cron_clear_all_teardown: fn(vm: &mut VirtualMachine),

src/jsc/bindings/ErrorCode.ts

@@ -367,6 +367,7 @@ const errors: ErrorCodeMapping = [
   // llhttp reports a missing CRLF after a chunk's data as HPE_STRICT,
   // distinct from a malformed chunk-size line (HPE_INVALID_CHUNK_SIZE).
   ["HPE_STRICT", Error],
+  ["ERR_WORKER_INVALID_EXEC_ARGV", Error],
   ["ERR_NOT_BUILDING_SNAPSHOT", Error],
   ["ERR_CANNOT_WATCH_SIGINT", Error],
   ["ERR_INSPECTOR_NOT_AVAILABLE", Error],

src/jsc/bindings/JSEnvironmentVariableMap.cpp

@@ -127,7 +127,7 @@ bool JSEnvironmentVariableMap::put(JSCell* cell, JSGlobalObject* globalObject, P
 
     auto* uid = propertyName.uid();
     if (uid && uid->isSymbol()) {
-        throwTypeError(globalObject, scope, "Cannot convert a symbol to a string"_s);
+        throwTypeError(globalObject, scope, "Cannot convert a Symbol value to a string"_s);
         return false;
     }
 
@@ -608,6 +608,10 @@ class JSSharedEnvMap final : public JSC::JSNonFinalObject {
     static bool deletePropertyByIndex(JSCell*, JSGlobalObject*, unsigned);
     static void getOwnPropertyNames(JSObject*, JSGlobalObject*, JSC::PropertyNameArrayBuilder&, JSC::DontEnumPropertiesMode);
     static bool defineOwnProperty(JSObject*, JSGlobalObject*, JSC::PropertyName, const JSC::PropertyDescriptor&, bool shouldThrow);
+    static bool preventExtensions(JSC::JSObject*, JSC::JSGlobalObject*)
+    {
+        return false;
+    }
 
 private:
     JSSharedEnvMap(JSC::VM& vm, JSC::Structure* structure)
@@ -728,7 +732,11 @@ bool JSSharedEnvMap::put(JSCell* cell, JSGlobalObject* globalObject, PropertyNam
     auto scope = DECLARE_THROW_SCOPE(vm);
 
     auto* uid = propertyName.uid();
-    if (propertyName.isSymbol() || !uid) {
+    if (propertyName.isSymbol()) {
+        throwTypeError(globalObject, scope, "Cannot convert a Symbol value to a string"_s);
+        return false;
+    }
+    if (!uid) {
         RELEASE_AND_RETURN(scope, Base::put(cell, globalObject, propertyName, value, slot));
     }
 
@@ -807,23 +815,22 @@ bool JSSharedEnvMap::defineOwnProperty(JSObject* object, JSGlobalObject* globalO
         return false;
     }
 
-    if (propertyName.isSymbol() || !uid || !descriptor.isDataDescriptor() || !descriptor.value()) {
-        // getOwnPropertySlot reads the store first; move the entry onto Base so a partial
-        // descriptor keeps enumerability. Node's EnvDefiner also rejects partials (the regular
-        // map does); tightening SHARE_ENV is a separate behavior change with its own tests.
-        if (!propertyName.isSymbol() && uid) {
-            if (auto* store = sharedEnvStoreFor(object)) {
-                String existing = store->get(String(uid));
-                if (!existing.isNull()) {
-                    syncWindowsEnv(store, String(uid), nullptr);
-                    store->remove(String(uid));
-                    object->putDirect(vm, propertyName, jsString(vm, existing), 0);
-                }
-            }
-        }
-        RELEASE_AND_RETURN(scope, Base::defineOwnProperty(object, globalObject, propertyName, descriptor, shouldThrow));
+    if (!descriptor.value()
+        || !descriptor.writablePresent() || !descriptor.writable()
+        || !descriptor.enumerablePresent() || !descriptor.enumerable()
+        || !descriptor.configurablePresent() || !descriptor.configurable()) {
+        throwError(globalObject, scope, ErrorCode::ERR_INVALID_OBJECT_DEFINE_PROPERTY, "'process.env' only accepts a configurable, writable, and enumerable data descriptor"_s);
+        return false;
+    }
+
+    if (propertyName.isSymbol()) {
+        throwTypeError(globalObject, scope, "Cannot convert a Symbol value to a string"_s);
+        return false;
     }
 
+    if (!uid) [[unlikely]]
+        RELEASE_AND_RETURN(scope, Base::defineOwnProperty(object, globalObject, propertyName, descriptor, shouldThrow));
+
     maybeEmitEnvNonstringDeprecation(globalObject, scope, descriptor.value());
     RETURN_IF_EXCEPTION(scope, false);
     String stringValue = descriptor.value().toWTFString(globalObject);
@@ -1104,7 +1111,23 @@ JSValue createEnvironmentVariablesMap(Zig::GlobalObject* globalObject)
     }
 
 #if OS(WINDOWS)
-    auto editWindowsEnvVar = JSC::JSFunction::create(vm, globalObject, 0, String("editWindowsEnvVar"_s), jsEditWindowsEnvVar, ImplementationVisibility::Public);
+    RELEASE_AND_RETURN(scope, wrapInWindowsEnvProxy(globalObject, object, keyArray, /* syncOSEnv */ true));
+#else
+    return object;
+#endif
+}
+
+#if OS(WINDOWS)
+JSC_DEFINE_HOST_FUNCTION(jsNoopEditWindowsEnvVar, (JSGlobalObject*, JSC::CallFrame*))
+{
+    return JSValue::encode(jsUndefined());
+}
+
+JSValue wrapInWindowsEnvProxy(Zig::GlobalObject* globalObject, JSC::JSObject* object, JSC::JSArray* keyArray, bool syncOSEnv)
+{
+    VM& vm = globalObject->vm();
+    auto scope = DECLARE_THROW_SCOPE(vm);
+    auto editWindowsEnvVar = JSC::JSFunction::create(vm, globalObject, 0, String("editWindowsEnvVar"_s), syncOSEnv ? jsEditWindowsEnvVar : jsNoopEditWindowsEnvVar, ImplementationVisibility::Public);
 
     JSC::JSFunction* getSourceEvent = JSC::JSFunction::create(vm, globalObject, processObjectInternalsWindowsEnvCodeGenerator(vm), globalObject);
     RETURN_IF_EXCEPTION(scope, {});
@@ -1126,8 +1149,6 @@ JSValue createEnvironmentVariablesMap(Zig::GlobalObject* globalObject)
     }
 
     RELEASE_AND_RETURN(scope, result);
-#else
-    return object;
-#endif
 }
+#endif
 }

src/jsc/bindings/JSEnvironmentVariableMap.h

@@ -45,6 +45,10 @@ class JSEnvironmentVariableMap final : public JSC::JSNonFinalObject {
     static bool putByIndex(JSC::JSCell*, JSC::JSGlobalObject*, unsigned, JSC::JSValue, bool shouldThrow);
     static bool defineOwnProperty(JSC::JSObject*, JSC::JSGlobalObject*, JSC::PropertyName, const JSC::PropertyDescriptor&, bool shouldThrow);
     static bool deleteProperty(JSC::JSCell*, JSC::JSGlobalObject*, JSC::PropertyName, JSC::DeletePropertySlot&);
+    static bool preventExtensions(JSC::JSObject*, JSC::JSGlobalObject*)
+    {
+        return false;
+    }
 
 private:
     JSEnvironmentVariableMap(JSC::VM& vm, JSC::Structure* structure)
@@ -55,6 +59,10 @@ class JSEnvironmentVariableMap final : public JSC::JSNonFinalObject {
 
 JSC::JSValue createEnvironmentVariablesMap(Zig::GlobalObject* globalObject);
 
+#if OS(WINDOWS)
+JSC::JSValue wrapInWindowsEnvProxy(Zig::GlobalObject* globalObject, JSC::JSObject* object, JSC::JSArray* keyArray, bool syncOSEnv);
+#endif
+
 // Setting TZ must make *existing* Date instances recompute local time. JSC's DateCache
 // reset only clears shared slots; live DateInstances keep a Ref to DateInstanceData
 // whose gregorian cache still matches, so walk the heap and invalidate those.

src/jsc/bindings/ZigGlobalObject.cpp

@@ -593,13 +593,27 @@ extern "C" JSC::JSGlobalObject* Zig__GlobalObject__create(void* console_client,
 
 #if OS(WINDOWS)
                 JSC::JSObject* env = JSC::constructEmptyObject(globalObject, globalObject->objectPrototype(), size >= JSFinalObject::maxInlineCapacity ? JSFinalObject::maxInlineCapacity : size);
+                JSC::JSArray* keyArray = JSC::constructEmptyArray(globalObject, nullptr, size);
+                scope.assertNoException();
+                unsigned keyIndex = 0;
+                size_t i = 0;
+                for (auto k : map) {
+                    keyArray->putByIndexInline(globalObject, keyIndex++, jsString(vm, k.key), false);
+                    scope.assertNoException();
+                    // Numeric env keys hit putDirectIndex → defineOwnProperty (declares a
+                    // ThrowScope). Seeded values are JSStrings so only OOM can throw.
+                    env->putDirectMayBeIndex(globalObject, JSC::Identifier::fromString(vm, k.key.convertToASCIIUppercase()), strings.at(i++));
+                    scope.assertNoException();
+                }
+                JSValue wrapped = Bun::wrapInWindowsEnvProxy(globalObject, env, keyArray, /* syncOSEnv */ false);
+                scope.assertNoException();
+                globalObject->m_processEnvObject.set(vm, globalObject, wrapped.getObject());
 #else
                 // Same exotic object as the main thread so writes inside the
                 // worker coerce to string, reject symbol keys, and validate
                 // defineProperty like Node's EnvSetter/EnvDefiner.
                 auto* envStructure = Bun::JSEnvironmentVariableMap::createStructure(vm, globalObject, globalObject->objectPrototype());
                 JSC::JSObject* env = Bun::JSEnvironmentVariableMap::create(vm, envStructure);
-#endif
                 size_t i = 0;
                 for (auto k : map) {
                     // Numeric env keys hit putDirectIndex → defineOwnProperty (declares a
@@ -608,6 +622,7 @@ extern "C" JSC::JSGlobalObject* Zig__GlobalObject__create(void* console_client,
                     scope.assertNoException();
                 }
                 globalObject->m_processEnvObject.set(vm, globalObject, env);
+#endif
             } else if (options.sharedEnvStore) {
                 // worker_threads SHARE_ENV: join the env tree the spawning thread
                 // resolved. Consumed like options.env, and published on the context
@@ -3267,6 +3282,10 @@ JSC_DEFINE_HOST_FUNCTION(functionJsGc,
 extern "C" [[ZIG_EXPORT(nothrow)]] void JSC__JSGlobalObject__addGc(JSC::JSGlobalObject* globalObject)
 {
     auto& vm = JSC::getVM(globalObject);
+    // Also reached from web_worker.rs start_vm before the worker thread takes
+    // the API lock; putDirectNativeFunction allocates and asserts the lock.
+    // JSLock is recursive, so this is a no-op on the main path.
+    JSC::JSLockHolder locker(vm);
     globalObject->putDirectNativeFunction(vm, globalObject, JSC::Identifier::fromString(vm, "gc"_s), 0, functionJsGc, ImplementationVisibility::Public, JSC::NoIntrinsic, PropertyAttribute::DontEnum | 0);
 }
 

src/jsc/bindings/webcore/JSWorker.cpp

@@ -73,6 +73,9 @@
 #include "JSEnvironmentVariableMap.h"
 #include <JavaScriptCore/JSMap.h>
 
+extern "C" bool Bun__Worker__validateExecArgv(WTF::StringImpl* const* argv, size_t len, BunString* outMessage);
+extern "C" bool Bun__Worker__validateWorkerNodeOptions(WTF::StringImpl* nodeOptions, BunString* outMessage);
+
 namespace WebCore {
 using namespace JSC;
 
@@ -294,6 +297,20 @@ template<> JSC::EncodedJSValue JSC_HOST_CALL_ATTRIBUTES JSWorkerDOMConstructor::
                     env.add(key.impl()->isolatedCopy(), str);
                 }
 
+                // Only an explicit env's NODE_OPTIONS is validated (Rust skips when
+                // byte-identical to the parent's): https://github.com/nodejs/node/blob/main/src/node_worker.cc
+                if (envValue && envValue.isCell()) {
+                    auto nodeOptions = env.find("NODE_OPTIONS"_s);
+                    if (nodeOptions != env.end()) {
+                        BunString invalidNodeOptions = BunStringEmpty;
+                        if (!Bun__Worker__validateWorkerNodeOptions(nodeOptions->value.impl(), &invalidNodeOptions)) {
+                            auto message = makeString("Initiated Worker with invalid NODE_OPTIONS env variable: "_s, invalidNodeOptions.transferToWTFString());
+                            throwScope.throwException(lexicalGlobalObject, Bun::createError(globalObject, Bun::ErrorCode::ERR_WORKER_INVALID_EXEC_ARGV, message));
+                            return {};
+                        }
+                    }
+                }
+
                 options.env.emplace(WTF::move(env));
             }
         }
@@ -333,6 +350,13 @@ template<> JSC::EncodedJSValue JSC_HOST_CALL_ATTRIBUTES JSWorkerDOMConstructor::
                 execArgv.append(str);
             });
             RETURN_IF_EXCEPTION(throwScope, {});
+            BunString invalidExecArgv = BunStringEmpty;
+            static_assert(sizeof(WTF::String) == sizeof(WTF::StringImpl*));
+            if (!Bun__Worker__validateExecArgv(reinterpret_cast<WTF::StringImpl* const*>(execArgv.begin()), execArgv.size(), &invalidExecArgv)) {
+                auto message = makeString("Initiated Worker with invalid execArgv flags: "_s, invalidExecArgv.transferToWTFString());
+                throwScope.throwException(lexicalGlobalObject, Bun::createError(globalObject, Bun::ErrorCode::ERR_WORKER_INVALID_EXEC_ARGV, message));
+                return {};
+            }
             options.execArgv.emplace(WTF::move(execArgv));
         }
     }

src/jsc/bindings/webcore/Worker.cpp

@@ -569,7 +569,9 @@ bool Worker::dispatchErrorWithValue(Zig::GlobalObject* workerGlobalObject, JSVal
     // property read must not propagate exceptions out of this function.
     auto& vm = JSC::getVM(workerGlobalObject);
     auto scope = DECLARE_TOP_EXCEPTION_SCOPE(vm);
-    // A TerminationException survives CLEAR_IF_EXCEPTION; do not enter JS with one pending.
+    // A TerminationException can be pending here (CLEAR_IF_EXCEPTION at the
+    // call site cannot clear it); SerializedScriptValue::create enters JS and
+    // asserts on entry with one on the VM.
     if (scope.exception())
         return false;
 
@@ -776,12 +778,12 @@ extern "C" void WebWorker__dispatchError(Zig::GlobalObject* globalObject, Worker
     JSValue error = JSC::JSValue::decode(errorValue);
     WTF::String messageStr = message->transferToWTFString();
     auto& vm = JSC::getVM(globalObject);
-    // terminate() mid-entry-evaluation routes the rejected entry promise here;
-    // do not run JS (dispatchEvent, structured clone) with it still pending.
-    if (vm.hasPendingTerminationException()) {
-        worker->dispatchErrorWithMessage(WTF::move(messageStr), {});
-        return;
-    }
+    // terminate() may land mid-entry now that 'online' fires first; the pending
+    // TerminationException is non-clearable and the dispatch/serialize below enter
+    // JS (executeCallImpl asserts !exception()), so post parent-side only.
+    if (vm.hasPendingTerminationException()) [[unlikely]]
+        return worker->dispatchErrorWithMessage(WTF::move(messageStr), {});
+
     ErrorEvent::Init init;
     init.message = messageStr.isolatedCopy();
     init.error = error;