Don't compile functions in a context the caller doesn't have access to

src/d8.cc

Index: src/d8.cc
diff --git a/src/d8.cc b/src/d8.cc
index 7c955dacb929e682c21797f06c45cabc78e9bc96..0af0476aa62b5a2a362760a95c70faf302b336bf 100644
--- a/src/d8.cc
+++ b/src/d8.cc
@@ -202,6 +202,10 @@ Worker* GetWorkerFromInternalField(Isolate* isolate, Local<Object> object) {
 }
 #endif  // !V8_SHARED
 
+bool AccessCheck(v8::Local<v8::Context> accessing_context,
+                 v8::Local<v8::Object> accessed_object, v8::Local<Value> data) {
+  return !Shell::options.restricted_realms;
+}
 
 }  // namespace
 
@@ -1225,6 +1229,8 @@ Local<ObjectTemplate> Shell::CreateGlobalTemplate(Isolate* isolate) {
           .ToLocalChecked(),
       os_templ);
 
+  global_template->SetAccessCheckCallback(AccessCheck);
+
   return global_template;
 }
 
@@ -1990,6 +1996,9 @@ bool Shell::SetOptions(int argc, char* argv[]) {
         return false;
       }
       argv[i] = NULL;
+    } else if (strcmp(argv[i], "--restricted-realms") == 0) {
+      options.restricted_realms = true;
+      argv[i] = nullptr;
     }
   }