process/worker: env descriptor validation, worker execArgv policy table with per-worker --expose-gc (+3 tests, worker 74%→76%)

src/js/builtins/ProcessObjectInternals.ts

@@ -528,13 +528,27 @@ export function windowsEnv(
       return typeof p !== "symbol" ? delete internalEnv[k] : false;
     },
     defineProperty(_, p, attributes) {
+      if (typeof p === "symbol") {
+        // JSProcessEnvMap rejects symbol keys (after descriptor validation),
+        // matching node; no bookkeeping applies.
+        return $Object.$defineProperty(internalEnv, p, attributes);
+      }
       const k = String(p).toUpperCase();
-      $assert(typeof p === "string"); // proxy is only string and symbol. the symbol would have thrown by now
-      if (!(k in internalEnv) && !envMapList.includes(p)) {
+      // Same predicate as the set trap: `k in internalEnv` would be always-true
+      // for the DontEnum TZ/TLS/proxy CustomAccessors and drop them from ownKeys.
+      const isNewKey = !envMapList.includes(p) && !envMapList.some(x => x.toUpperCase() === k);
+      // Define before bookkeeping: JSProcessEnvMap may throw on a partial data
+      // descriptor, and a rejected define must not leave a phantom envMapList key.
+      const r = $Object.$defineProperty(internalEnv, k, attributes);
+      if (isNewKey) {
         envMapList.push(p);
       }
-      editWindowsEnvVar(k, internalEnv[k]);
-      return $Object.$defineProperty(internalEnv, k, attributes);
+      // String-coerce: the data path is coerced natively, but an accessor
+      // descriptor (deliberate divergence) installs a getter whose result
+      // reaches this read raw, and editWindowsEnvVar requires string|null.
+      const v = internalEnv[k];
+      editWindowsEnvVar(k, v == null ? null : String(v));
+      return r;
     },
     getOwnPropertyDescriptor(target, p) {
       if (typeof p === "string") {

src/jsc/VirtualMachine.rs

@@ -1664,12 +1664,15 @@ pub type RuntimeState = *mut c_void;
 
 /// The subset of a Worker's `execArgv` that bun acts on. Flags whose value must
 /// outlive the parse (--cpu-prof-dir/-name) are absent; nothing needs them yet.
-#[derive(Default, Clone, Copy)]
+#[derive(Default, Clone)]
 pub struct WorkerExecArgv {
     pub allow_addons: Option<bool>,
     pub use_system_ca: Option<bool>,
     pub cpu_prof: bool,
     pub cpu_prof_interval: Option<u32>,
+    pub expose_gc: bool,
+    /// `--require`/`-r`/`--preload`/`--import` specifiers, in order.
+    pub preloads: Vec<Box<[u8]>>,
 }
 
 pub struct RuntimeHooks {
@@ -1793,9 +1796,11 @@ pub struct RuntimeHooks {
         transpiler: *mut Transpiler<'static>,
         graph: &'static dyn bun_resolver::StandaloneModuleGraph,
     ),
-    /// Parse `execArgv` against the `RunCommand` param table (lives in `bun_runtime::cli`, forward-dep).
-    /// Caller writes `allow_addons` back into `transform_options` and applies `cpu_prof` to the worker VM.
-    pub parse_worker_exec_argv: unsafe fn(exec_argv: &[bun_core::WTFStringImpl]) -> WorkerExecArgv,
+    /// Parse a worker's `execArgv` (`bun_runtime::cli::worker_exec_argv`,
+    /// forward-dep); `None` derives an inheriting worker's defaults from the
+    /// process argv (preloads/cpu-prof excluded — the parent VM carries both).
+    pub parse_worker_exec_argv:
+        unsafe fn(exec_argv: Option<&[bun_core::WTFStringImpl]>) -> WorkerExecArgv,
     /// `CronJob.clearAllForVM(vm, .teardown)`. `CronJob` lives in
     /// `bun_runtime::api::cron`.
     pub cron_clear_all_teardown: fn(vm: &mut VirtualMachine),

src/jsc/bindings/ErrorCode.ts

@@ -367,6 +367,7 @@ const errors: ErrorCodeMapping = [
   // llhttp reports a missing CRLF after a chunk's data as HPE_STRICT,
   // distinct from a malformed chunk-size line (HPE_INVALID_CHUNK_SIZE).
   ["HPE_STRICT", Error],
+  ["ERR_WORKER_INVALID_EXEC_ARGV", Error],
   ["ERR_CANNOT_WATCH_SIGINT", Error],
   ["ERR_INSPECTOR_NOT_AVAILABLE", Error],
   ["ERR_INVALID_REPL_EVAL_CONFIG", TypeError],

src/jsc/bindings/JSEnvironmentVariableMap.cpp

@@ -21,6 +21,7 @@
 #include "BunProcess.h"
 #include "ScriptExecutionContext.h"
 #include "SharedEnvStore.h"
+#include "ErrorCode.h"
 #include "wtf/NeverDestroyed.h"
 #include "WebCoreJSBuiltins.h"
 
@@ -371,6 +372,27 @@ static SharedEnvStore* sharedEnvStoreFor(JSC::JSObject* object)
     return globalObject ? sharedEnvStoreFor(globalObject) : nullptr;
 }
 
+// Node rejects all but a full writable+enumerable+configurable data descriptor
+// (https://github.com/nodejs/node/blob/main/src/node_env_var.cc EnvDefiner).
+// Bun diverges: accessors are still accepted. Returns false with a pending exception on reject.
+static bool validateEnvPropertyDescriptor(JSC::JSGlobalObject* globalObject, const JSC::PropertyDescriptor& descriptor, JSC::ThrowScope& scope)
+{
+    static constexpr auto dataDescriptorMessage = "'process.env' only accepts a configurable, writable, and enumerable data descriptor"_s;
+
+    // Accessors pass (Bun divergence); everything else — including attribute-only
+    // and empty descriptors — must be a full permissive data descriptor per node.
+    if (descriptor.isAccessorDescriptor())
+        return true;
+    if (!descriptor.value()
+        || !descriptor.writablePresent() || !descriptor.enumerablePresent() || !descriptor.configurablePresent()
+        || !descriptor.writable() || !descriptor.enumerable() || !descriptor.configurable()) {
+        scope.throwException(globalObject, createError(globalObject, Bun::ErrorCode::ERR_INVALID_OBJECT_DEFINE_PROPERTY, dataDescriptorMessage));
+        return false;
+    }
+
+    return true;
+}
+
 // process.env variant whose reads/writes/deletes/enumeration go through the
 // tree's SharedEnvStore; no instance state, so no custom subspace.
 class JSSharedEnvMap final : public JSC::JSNonFinalObject {
@@ -416,6 +438,11 @@ class JSSharedEnvMap final : public JSC::JSNonFinalObject {
     static bool deletePropertyByIndex(JSCell*, JSGlobalObject*, unsigned);
     static void getOwnPropertyNames(JSObject*, JSGlobalObject*, JSC::PropertyNameArrayBuilder&, JSC::DontEnumPropertiesMode);
     static bool defineOwnProperty(JSObject*, JSGlobalObject*, JSC::PropertyName, const JSC::PropertyDescriptor&, bool shouldThrow);
+    // See JSProcessEnvMap::preventExtensions — node parity for freeze/seal.
+    static bool preventExtensions(JSC::JSObject*, JSC::JSGlobalObject*)
+    {
+        return false;
+    }
 
 private:
     JSSharedEnvMap(JSC::VM& vm, JSC::Structure* structure)
@@ -583,13 +610,21 @@ bool JSSharedEnvMap::defineOwnProperty(JSObject* object, JSGlobalObject* globalO
     VM& vm = JSC::getVM(globalObject);
     auto scope = DECLARE_THROW_SCOPE(vm);
 
+    if (!validateEnvPropertyDescriptor(globalObject, descriptor, scope))
+        return false;
+
+    // node coerces the key to a string after validating the descriptor, so a
+    // symbol key throws the plain conversion TypeError (no code).
+    // Symbol-keyed accessors flow through with the accessor divergence.
+    if (propertyName.isSymbol() && !descriptor.isAccessorDescriptor()) {
+        JSC::throwTypeError(globalObject, scope, "Cannot convert a Symbol value to a string"_s);
+        return false;
+    }
+
     auto* uid = propertyName.uid();
-    if (propertyName.isSymbol() || !uid || !descriptor.isDataDescriptor() || !descriptor.value()) {
-        // The descriptor lands on the Base object, but getOwnPropertySlot reads the
-        // store first, so a store entry would shadow it. Move the entry onto Base as
-        // an enumerable data property first: a partial descriptor then keeps that
-        // enumerability, exactly as it does on the regular process.env. (Node rejects
-        // accessors on process.env outright — on both maps — so match bun's own map.)
+    if (propertyName.isSymbol() || !uid || descriptor.isAccessorDescriptor()) {
+        // getOwnPropertySlot reads the store first, so a store entry would shadow the
+        // Base-landed accessor; hoist it to Base as an enumerable data property first.
         if (!propertyName.isSymbol() && uid) {
             if (auto* store = sharedEnvStoreFor(object)) {
                 String existing = store->get(String(uid));
@@ -723,19 +758,100 @@ RefPtr<SharedEnvStore> ensureSharedEnvStoreForWorker(Zig::GlobalObject* globalOb
     return store;
 }
 
+// Ordinary (non-SHARE_ENV) process.env: a plain object plus a defineOwnProperty
+// hook for node's descriptor validation (https://github.com/nodejs/node/blob/main/src/node_env_var.cc).
+class JSProcessEnvMap final : public JSC::JSNonFinalObject {
+public:
+    using Base = JSC::JSNonFinalObject;
+
+    static constexpr unsigned StructureFlags = Base::StructureFlags;
+
+    template<typename CellType, JSC::SubspaceAccess>
+    static JSC::GCClient::IsoSubspace* subspaceFor(JSC::VM& vm)
+    {
+        STATIC_ASSERT_ISO_SUBSPACE_SHARABLE(JSProcessEnvMap, Base);
+        return &vm.plainObjectSpace();
+    }
+
+    DECLARE_INFO;
+
+    static JSC::Structure* createStructure(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(vm, globalObject, prototype, JSC::TypeInfo(JSC::ObjectType, StructureFlags), info());
+    }
+
+    static JSProcessEnvMap* create(JSC::VM& vm, JSC::Structure* structure)
+    {
+        JSProcessEnvMap* ptr = new (NotNull, JSC::allocateCell<JSProcessEnvMap>(vm)) JSProcessEnvMap(vm, structure);
+        ptr->finishCreation(vm);
+        return ptr;
+    }
+
+    static bool defineOwnProperty(JSObject* object, JSGlobalObject* globalObject, JSC::PropertyName propertyName, const JSC::PropertyDescriptor& descriptor, bool shouldThrow)
+    {
+        VM& vm = JSC::getVM(globalObject);
+        auto scope = DECLARE_THROW_SCOPE(vm);
+
+        if (!validateEnvPropertyDescriptor(globalObject, descriptor, scope))
+            return false;
+
+        if (descriptor.isAccessorDescriptor())
+            RELEASE_AND_RETURN(scope, Base::defineOwnProperty(object, globalObject, propertyName, descriptor, shouldThrow));
+
+        // node coerces the key to a string after validating the descriptor,
+        // so a symbol key throws the plain conversion TypeError (no code).
+        // Symbol-keyed accessors flow through with the accessor divergence.
+        if (propertyName.isSymbol()) {
+            JSC::throwTypeError(globalObject, scope, "Cannot convert a Symbol value to a string"_s);
+            return false;
+        }
+
+        // node's EnvDefiner stringifies the value, matching the assignment
+        // trap; storing the raw value would break the string-only contract
+        // the Windows env sync (editWindowsEnvVar) relies on.
+        String stringValue = descriptor.value().toWTFString(globalObject);
+        RETURN_IF_EXCEPTION(scope, false);
+        JSC::PropertyDescriptor coerced(jsString(vm, stringValue), 0);
+        RELEASE_AND_RETURN(scope, Base::defineOwnProperty(object, globalObject, propertyName, coerced, shouldThrow));
+    }
+
+    // Node's process.env fails [[PreventExtensions]] so freeze/seal throw and the
+    // map stays extensible (https://github.com/nodejs/node/blob/main/src/node_env_var.cc).
+    static bool preventExtensions(JSC::JSObject*, JSC::JSGlobalObject*)
+    {
+        return false;
+    }
+
+private:
+    JSProcessEnvMap(JSC::VM& vm, JSC::Structure* structure)
+        : Base(vm, structure)
+    {
+    }
+
+    void finishCreation(JSC::VM& vm)
+    {
+        Base::finishCreation(vm);
+    }
+};
+
+const JSC::ClassInfo JSProcessEnvMap::s_info = { "ProcessEnv"_s, &Base::s_info, nullptr, nullptr, CREATE_METHOD_TABLE(JSProcessEnvMap) };
+
+JSObject* createEmptyProcessEnvMap(Zig::GlobalObject* globalObject)
+{
+    VM& vm = globalObject->vm();
+    return JSProcessEnvMap::create(vm, JSProcessEnvMap::createStructure(vm, globalObject, globalObject->objectPrototype()));
+}
+
 JSValue createEnvironmentVariablesMap(Zig::GlobalObject* globalObject)
 {
     VM& vm = globalObject->vm();
     auto scope = DECLARE_THROW_SCOPE(vm);
 
     void* list;
     size_t count = Bun__getEnvCount(globalObject, &list);
-    JSC::JSObject* object = nullptr;
-    if (count < 63) {
-        object = constructEmptyObject(globalObject, globalObject->objectPrototype(), count);
-    } else {
-        object = constructEmptyObject(globalObject, globalObject->objectPrototype());
-    }
+    // Not pre-sized: JSNonFinalObject has no inline storage (only JSFinalObject
+    // does, and it is `final`), so a defineOwnProperty hook precludes inline slots.
+    JSC::JSObject* object = JSProcessEnvMap::create(vm, JSProcessEnvMap::createStructure(vm, globalObject, globalObject->objectPrototype()));
 
 #if OS(WINDOWS)
     JSArray* keyArray = constructEmptyArray(globalObject, nullptr, count);

src/jsc/bindings/JSEnvironmentVariableMap.h

@@ -17,6 +17,11 @@ JSC::JSValue createEnvironmentVariablesMap(Zig::GlobalObject* globalObject);
 // through the SharedEnvStore of the tree its global belongs to.
 JSC::JSValue createSharedEnvironmentVariablesMap(Zig::GlobalObject* globalObject);
 
+// Empty process.env for a worker that was handed a snapshot of the spawning
+// thread's env: same class as the ordinary map so defineProperty validation
+// applies on worker threads too. Caller populates it.
+JSC::JSObject* createEmptyProcessEnvMap(Zig::GlobalObject* globalObject);
+
 // Resolve the SHARE_ENV store for a worker spawned from `globalObject`: the
 // spawning thread's existing store if it has one, otherwise a fresh store seeded
 // from its `process.env` (which is then swapped to a write-through view).

src/jsc/bindings/ZigGlobalObject.cpp

@@ -577,6 +577,9 @@ extern "C" JSC::JSGlobalObject* Zig__GlobalObject__create(void* console_client,
     if (executionContextId > -1) {
         const auto initializeWorker = [&](WebCore::Worker& worker) -> void {
             auto& options = worker.options();
+            // Outermost scope (called from Rust with none on the stack). putDirect*
+            // bypasses the defineOwnProperty hook; only allocation can throw here.
+            auto catchScope = DECLARE_TOP_EXCEPTION_SCOPE(vm);
 
             if (options.env.has_value()) {
                 HashMap<String, String> map = *std::exchange(options.env, std::nullopt);
@@ -590,12 +593,16 @@ extern "C" JSC::JSGlobalObject* Zig__GlobalObject__create(void* console_client,
                     strings.append(jsString(vm, value));
                 }
 
-                auto env = JSC::constructEmptyObject(globalObject, globalObject->objectPrototype(), size >= JSFinalObject::maxInlineCapacity ? JSFinalObject::maxInlineCapacity : size);
+                auto env = Bun::createEmptyProcessEnvMap(globalObject);
                 size_t i = 0;
                 for (auto k : map) {
                     // They can have environment variables with numbers as keys.
                     // So we must use putDirectMayBeIndex to handle that.
                     env->putDirectMayBeIndex(globalObject, JSC::Identifier::fromString(vm, WTF::move(k.key)), strings.at(i++));
+                    // Index-storage allocation can throw (OOM); stop populating
+                    // rather than keep calling into JSC with a pending exception.
+                    if (catchScope.exception()) [[unlikely]]
+                        break;
                 }
                 globalObject->m_processEnvObject.set(vm, globalObject, env);
             } else if (options.sharedEnvStore) {
@@ -606,6 +613,10 @@ extern "C" JSC::JSGlobalObject* Zig__GlobalObject__create(void* console_client,
                 globalObject->scriptExecutionContext()->setSharedEnvStore(*store);
                 globalObject->m_processEnvObject.set(vm, globalObject, Bun::createSharedEnvironmentVariablesMap(globalObject).getObject());
             }
+            // The only possible exception above is allocation failure while
+            // populating env, and there is no JS frame to deliver it to during
+            // global creation — drop it at this top scope (termination stays).
+            catchScope.clearExceptionExceptTermination();
 
             // Ensure that the TerminationException singleton is constructed. Workers need this so
             // that we can request their termination from another thread. For the main thread, we
@@ -3239,6 +3250,10 @@ JSC_DEFINE_HOST_FUNCTION(functionJsGc,
 extern "C" [[ZIG_EXPORT(nothrow)]] void JSC__JSGlobalObject__addGc(JSC::JSGlobalObject* globalObject)
 {
     auto& vm = JSC::getVM(globalObject);
+    // Also reached from web_worker.rs start_vm before the worker thread takes
+    // the API lock; putDirectNativeFunction allocates and asserts the lock.
+    // JSLock is recursive, so this is a no-op on the main path.
+    JSC::JSLockHolder locker(vm);
     globalObject->putDirectNativeFunction(vm, globalObject, JSC::Identifier::fromString(vm, "gc"_s), 0, functionJsGc, ImplementationVisibility::Public, JSC::NoIntrinsic, PropertyAttribute::DontEnum | 0);
 }
 

src/jsc/bindings/webcore/JSWorker.cpp

@@ -73,6 +73,12 @@
 #include "JSEnvironmentVariableMap.h"
 #include <JavaScriptCore/JSMap.h>
 
+// Worker execArgv / NODE_OPTIONS policy (src/runtime/cli/worker_exec_argv.rs).
+// Both return true when valid; otherwise write the ERR_WORKER_INVALID_EXEC_ARGV
+// message tail into outMessage.
+extern "C" bool Bun__Worker__validateExecArgv(WTF::StringImpl* const* argv, size_t len, BunString* outMessage);
+extern "C" bool Bun__Worker__validateWorkerNodeOptions(WTF::StringImpl* nodeOptions, BunString* outMessage);
+
 namespace WebCore {
 using namespace JSC;
 
@@ -294,6 +300,20 @@ template<> JSC::EncodedJSValue JSC_HOST_CALL_ATTRIBUTES JSWorkerDOMConstructor::
                     env.add(key.impl()->isolatedCopy(), str);
                 }
 
+                // Only an explicit env's NODE_OPTIONS is validated (Rust skips when
+                // byte-identical to the parent's): https://github.com/nodejs/node/blob/main/src/node_worker.cc
+                if (envValue && envValue.isCell()) {
+                    auto nodeOptions = env.find("NODE_OPTIONS"_s);
+                    if (nodeOptions != env.end()) {
+                        BunString invalidNodeOptions = BunStringEmpty;
+                        if (!Bun__Worker__validateWorkerNodeOptions(nodeOptions->value.impl(), &invalidNodeOptions)) {
+                            auto message = makeString("Initiated Worker with invalid NODE_OPTIONS env variable: "_s, invalidNodeOptions.transferToWTFString());
+                            throwScope.throwException(lexicalGlobalObject, Bun::createError(globalObject, Bun::ErrorCode::ERR_WORKER_INVALID_EXEC_ARGV, message));
+                            return {};
+                        }
+                    }
+                }
+
                 options.env.emplace(WTF::move(env));
             }
         }
@@ -333,6 +353,16 @@ template<> JSC::EncodedJSValue JSC_HOST_CALL_ATTRIBUTES JSWorkerDOMConstructor::
                 execArgv.append(str);
             });
             RETURN_IF_EXCEPTION(throwScope, {});
+            // node_worker.cc: an explicit execArgv is validated synchronously
+            // against the worker flag policy table (unknown flags, flags Bun or
+            // node cannot honour in a worker, and missing required values).
+            BunString invalidExecArgv = BunStringEmpty;
+            static_assert(sizeof(WTF::String) == sizeof(WTF::StringImpl*));
+            if (!Bun__Worker__validateExecArgv(reinterpret_cast<WTF::StringImpl* const*>(execArgv.begin()), execArgv.size(), &invalidExecArgv)) {
+                auto message = makeString("Initiated Worker with invalid execArgv flags: "_s, invalidExecArgv.transferToWTFString());
+                throwScope.throwException(lexicalGlobalObject, Bun::createError(globalObject, Bun::ErrorCode::ERR_WORKER_INVALID_EXEC_ARGV, message));
+                return {};
+            }
             options.execArgv.emplace(WTF::move(execArgv));
         }
     }