Do an access check before compiling code via eval()

src/builtins/builtins-global.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/builtins/builtins.h"
 #include "src/builtins/builtins-utils.h"
 
 #include "src/compiler.h"
 #include "src/uri.h"
 
@@ skipping 67 matching lines @@
   RETURN_RESULT_OR_FAILURE(isolate, Uri::Unescape(isolate, string));
 }
 
 // ES6 section 18.2.1 eval (x)
 BUILTIN(GlobalEval) {
   HandleScope scope(isolate);
   Handle<Object> x = args.atOrUndefined(isolate, 1);
   Handle<JSFunction> target = args.target<JSFunction>();
   Handle<JSObject> target_global_proxy(target->global_proxy(), isolate);
   if (!x->IsString()) return *x;
+  if (!Builtins::AllowDynamicFunction(isolate, target, target_global_proxy)) {
+    isolate->CountUsage(v8::Isolate::kFunctionConstructorReturnedUndefined);
+    return isolate->heap()->undefined_value();
+  }
   Handle<JSFunction> function;
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
       isolate, function, Compiler::GetFunctionFromString(
                              handle(target->native_context(), isolate),
                              Handle<String>::cast(x), NO_PARSE_RESTRICTION));
   RETURN_RESULT_OR_FAILURE(
       isolate,
       Execution::Call(isolate, function, target_global_proxy, 0, nullptr));
 }
 
 }  // namespace internal
 }  // namespace v8