Summary

Fixes a denial-of-service vulnerability where a dynamic import rejecting with an Error whose name property is a non-string type (Number, Object, Symbol) would panic and terminate the Deno process.

The Problem

In catch_dynamic_import_promise_error, the code deserializes the error:

let e: crate::error::NativeJsError = serde_v8::from_v8(scope, arg).unwrap();

When name is not a string, serde_v8::from_v8 returns an error and .unwrap() panics. This bypasses all JavaScript-level error handling.

The Fix

Replace .unwrap() with .unwrap_or_default():

let e: crate::error::NativeJsError =
    serde_v8::from_v8(scope, arg).unwrap_or_default();

NativeJsError already derives Default, so this gracefully handles malformed errors with name: None, message: None.

PoC (before fix)

try {
  await import(\`data:application/javascript,
    const e = new Error("x");
    Object.defineProperty(e, "name", { value: 42 });
    throw e;
  \`);
} catch (e) {
  console.log("never reached");
}

Result: panicked at libs/core/runtime/bindings.rs:961:72