Skip to content

Fix ShadowRealm.prototype.evaluate rejecting super and new.target in nested code#2573

Merged
lahma merged 1 commit into
sebastienros:mainfrom
lahma:fix-shadowrealm-super-validation
Jul 4, 2026
Merged

Fix ShadowRealm.prototype.evaluate rejecting super and new.target in nested code#2573
lahma merged 1 commit into
sebastienros:mainfrom
lahma:fix-shadowrealm-super-validation

Conversation

@lahma

@lahma lahma commented Jul 4, 2026

Copy link
Copy Markdown
Collaborator

Problem

ShadowRealm.prototype.evaluate (and the .NET ShadowRealm.Evaluate overloads) rejected any script containing super, no matter where it appeared. ShadowScriptValidator walked the whole AST with an unrestricted visitor, so perfectly legal code was refused:

new ShadowRealm().evaluate(`
  class Base { greet() { return 'base'; } }
  class Derived extends Base { greet() { return 'derived:' + super.greet(); } }
  new Derived().greet();
`);
// before: TypeError: Shadow realm code cannot contain super
// after:  'derived:base'

This made ShadowRealm unusable for any real-world bundle that defines classes (surfaced in the #2569 discussion, where evaluating a page bundle "would stop on evaluate as the code contains super").

Spec

PerformShadowRealmEval steps:

If body Contains NewTarget is true, throw a SyntaxError exception.
If body Contains SuperProperty is true, throw a SyntaxError exception.
If body Contains SuperCall is true, throw a SyntaxError exception.

where Contains does not descend into nested function bodies or class element values (those have their own home object, making super legal there). It only descends into arrow functions (transparent for super/new.target), class heritage expressions and computed property names. The exception type is SyntaxError, not the TypeError previously thrown.

Fix

ShadowScriptValidator now mirrors the Contains semantics:

  • skips FunctionDeclaration/FunctionExpression subtrees (this also covers object-literal and class method/getter/setter bodies, whose values are function expressions)
  • skips class field/accessor values and static blocks, while still visiting decorators and computed property names
  • still descends into arrow functions, so top-level super/new.target smuggled through an arrow is caught
  • throws SyntaxError (caller realm) instead of TypeError
  • adds the previously missing NewTarget check

Tests

  • New Jint.Tests.PublicInterface/ShadowRealmTests cases: super in derived-class methods/constructors/getters, static methods, field initializers, static blocks and object-literal methods (string and Prepared<Script> paths), plus negative top-level super/super()/new.target cases asserting SyntaxError
  • Test262 --filter ShadowRealm: 124/124 passing
  • Full Jint.Tests and Jint.Tests.PublicInterface suites green (one pre-existing, unrelated wall-clock flake in TimeSystemTests.CanUseTimeProvider on net472 that also fails on unmodified main)

🤖 Generated with Claude Code

…nested code

ShadowScriptValidator visited the entire AST and threw for any `super`
node, so evaluate() rejected legal scripts such as classes whose methods
use super. Per PerformShadowRealmEval, the Contains static semantics
must not descend into nested function bodies or class element values -
only top-level SuperProperty/SuperCall/NewTarget are forbidden, and the
required exception type is SyntaxError, not TypeError.

The validator now mirrors Contains: it skips function declarations and
expressions (covering object and class method bodies), class field and
accessor values and static blocks, while still descending into arrow
functions (transparent for super/new.target), class heritage expressions,
decorators and computed property names. It also implements the previously
missing NewTarget check.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@lahma
lahma merged commit 9d01bb8 into sebastienros:main Jul 4, 2026
4 checks passed
@lahma
lahma deleted the fix-shadowrealm-super-validation branch July 4, 2026 17:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant