Electron Releases

Description of Change

A number of places unwrap a v8::MaybeLocal with ToLocalChecked() (or a v8::Maybe with Check() / ToChecked()) on a value that JavaScript controls. If the read runs a user accessor or Proxy trap that throws, the MaybeLocal is empty and the process aborts instead of raising a catchable error. One commit per site:

• contextBridge array copy: a renderer crash reachable from sandboxed web content by passing an array with a throwing index getter (or any nested such array) to an exposed function, or returning one from it. Spec added for both directions.
• contextBridge DeepFreeze: throwing accessors on page-controlled objects reached by the freeze walk.
• contextBridge internalContextBridge.override* helpers: failed conversions were ToLocalChecked()'d.
• HttpResponseHeaders converter (webRequest.onHeadersReceived result): throwing header getters / ownKeys traps.
• std::set / std::map converters (webRequest filters, session.downloadURL headers, utilityProcess.fork env): throwing index accessors / ownKeys traps.
• header-pair converter (net.request / WebSocket headers): throwing ownKeys trap.
• gin_helper::Dictionary::IsEmptyObject (webContents.print options): throwing ownKeys trap.
• webFrame.setSpellCheckProvider: throwing has trap.
• sharedTexture nativePixmap.planes: throwing index accessor, plus a missing object check.
• pooled worker contexts (nodeIntegrationInWorker): CHECK on reading a redefined process / require global.
• utility-process LanguageModel bridge: malformed stream chunks / throwing getters now report an error instead of CHECKing.
• Set().Check() on freshly created arrays and error objects → CreateDataProperty, so a throwing setter installed on Array.prototype / Error.prototype cannot abort.

Verified locally: each case crashes the pre-fix build with Fatal error in V8: v8::ToLocalChecked Empty MaybeLocal and surfaces as a normal JS error on the fixed build.

Checklist

• PR description included and stakeholders cc'd
• npm test passes
• tests are changed or added
• PR title follows semantic commit guidelines

Release Notes

Notes: Fixed a renderer crash when an array with a throwing property getter is passed across contextBridge, and several main/utility-process crashes when option objects passed to Electron APIs contain throwing accessors or Proxy traps.