[scopeinfo] Don't try to reuse the native context's script scope info

verwaest · V8 LUCI CQ · commit 7d4bea55bc93 · 2024-07-17T16:25:08.000Z
Bug: 353561476 Change-Id: I10486d2256b1f455c64f3c96054f01edd7a9df15 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5718230 Auto-Submit: Toon Verwaest <verwaest@chromium.org> Reviewed-by: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/main@{#95091}
diff --git a/src/runtime/runtime-compiler.cc b/src/runtime/runtime-compiler.cc
@@ -655,7 +655,7 @@ static Tagged<Object> CompileGlobalEval(Isolate* isolate,
   static const ParseRestriction restriction = NO_PARSE_RESTRICTION;
   Handle<JSFunction> compiled;
   Handle<Context> context(isolate->context(), isolate);
-  if (v8_flags.reuse_scope_infos) {
+  if (!Is<NativeContext>(*context) && v8_flags.reuse_scope_infos) {
     Tagged<WeakFixedArray> array = Cast<Script>(outer_info->script())->infos();
     Tagged<ScopeInfo> stored_info;
     if (array->get(eval_scope_info_index)
diff --git a/test/mjsunit/regress-353561476.js b/test/mjsunit/regress-353561476.js
@@ -0,0 +1,40 @@
+// Copyright 2024 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --reuse-scope-infos --expose-gc --stress-flush-code
+
+  function executeCode(code) {
+    if (typeof code === 'function') return code();
+  }
+  assertThrows = function assertThrows(code) {
+      executeCode(code);
+  };
+function __getRandomProperty() {
+}
+(function () {
+  __callGC = function () {
+      gc();
+  };
+})();
+  var __v_25 = [];
+function __f_10(__v_29, __v_30) {
+    var __v_31 = Realm.create();
+  try {
+    assertThrows(function () {
+        Realm.eval(__v_31, __v_29[
+        __v_29.length - 1]);
+    }, Realm. __v_30);
+  } catch (e) {}
+    delete __v_25[__getRandomProperty()], __callGC();
+}
+  var __v_28 = [{
+    scripts: ['eval("function NaN() {}");'],
+  }, {
+    scripts: [`
+      `.replace()],
+  }];
+  __v_28.forEach(function (__v_33) {
+      __f_10(__v_33.scripts, __v_33.expectedError);
+      __f_10(__v_33.scripts, __v_33.expectedError);
+  });
