node:vm: allow a Proxy in the prototype chain of a global object

scripts/build/deps/webkit.ts

@@ -3,7 +3,7 @@
  * for local mode. Override via `--webkit-version=<hash>` to test a branch.
  * From https://github.com/oven-sh/WebKit releases.
  */
-export const WEBKIT_VERSION = "cf1b36ec8703d8e87436094d21d478d358c7d886";
+export const WEBKIT_VERSION = "autobuild-preview-pr-626-f1e23f97";
 
 /**
  * WebKit (JavaScriptCore) — the JS engine.

src/jsc/bindings/BunGlobalScope.cpp

@@ -18,6 +18,11 @@ void GlobalScope::finishCreation(JSC::VM& vm)
     Base::finishCreation(vm);
     ASSERT(inherits(info()));
 
+    // Every Bun global clears IsImmutablePrototypeExoticObject from its structure, so user
+    // code can put a Proxy in its prototype chain (jsdom does, for its window). V8 runs
+    // programs against such a chain, so JSC must not reject it.
+    setAllowsProxyInPrototypeChain(true);
+
     m_encodeIntoObjectStructure.initLater(
         [](const JSC::LazyProperty<JSC::JSGlobalObject, JSC::Structure>::Initializer& init) {
             auto& vm = init.vm;

test/js/node/vm/vm.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from "bun:test";
-import { bunEnv, bunExe, isWindows, normalizeBunSnapshot } from "harness";
+import { bunEnv, bunExe, isWindows, normalizeBunSnapshot, tempDir } from "harness";
 import {
   compileFunction,
   constants,
@@ -1318,6 +1318,63 @@ describe("DONT_CONTEXTIFY", () => {
   });
 });
 
+// https://github.com/oven-sh/bun/issues/42331
+describe("a Proxy in the prototype chain of the context global", () => {
+  // jsdom 28+ puts a Proxy (WindowProperties) in the prototype chain of its
+  // window. V8 runs a program against such a global, so node:vm must too.
+  function installProxy(ctx: object) {
+    const target = { fromProxy: 7 };
+    const g = runInContext("this", ctx);
+    Object.setPrototypeOf(g, Object.create(new Proxy(target, {})));
+    return target;
+  }
+
+  test.each([
+    ["DONT_CONTEXTIFY", () => createContext(constants.DONT_CONTEXTIFY)],
+    ["contextified sandbox", () => createContext({})],
+  ])("%s: programs run and resolve names through the Proxy", (_, makeContext) => {
+    const ctx = makeContext();
+    const target = installProxy(ctx);
+
+    expect(runInContext("1 + 1", ctx)).toBe(2);
+    expect(new Script("2 + 2").runInContext(ctx)).toBe(4);
+    expect(runInContext("fromProxy", ctx)).toBe(7);
+    expect(runInContext("typeof missingName", ctx)).toBe("undefined");
+    expect(runInContext("undeclaredAssign = 9; undeclaredAssign", ctx)).toBe(9);
+    expect(runInContext("fromProxy = 8; fromProxy", ctx)).toBe(8);
+    expect(target.fromProxy).toBe(7);
+  });
+
+  test("contextified sandbox: declarations land on the global, not on the Proxy", () => {
+    const ctx = createContext({});
+    const target = installProxy(ctx);
+
+    expect(runInContext("var declared = 5; function fn() { return 6 } declared + fn()", ctx)).toBe(11);
+    expect(new Script("declared * 2").runInContext(ctx)).toBe(10);
+    expect(target).toEqual({ fromProxy: 7 });
+  });
+
+  test("main realm: runInThisContext and require() run with a Proxy in the chain of globalThis", async () => {
+    using dir = tempDir("vm-proxy-global", { "dep.cjs": "module.exports = 42;" });
+    await using proc = Bun.spawn({
+      cmd: [
+        bunExe(),
+        "-e",
+        `const vm = require("node:vm");
+         Object.setPrototypeOf(globalThis, Object.create(new Proxy({ viaProxy: 3 }, {})));
+         console.log(vm.runInThisContext("1 + 1"), vm.runInThisContext("viaProxy"), require("./dep.cjs"));`,
+      ],
+      env: bunEnv,
+      cwd: String(dir),
+      stderr: "pipe",
+    });
+    const [stdout, stderr, exitCode] = await Promise.all([proc.stdout.text(), proc.stderr.text(), proc.exited]);
+    expect(stderr).toBe("");
+    expect(stdout).toBe("2 3 42\n");
+    expect(exitCode).toBe(0);
+  });
+});
+
 describe("defineProperty errors use vm-realm global", () => {
   test("data descriptor on sandbox-only property", () => {
     const sandbox = {};