src, child_process: fix fatal error on Array prototype pollution

src/process_wrap.cc

@@ -149,6 +149,10 @@ class ProcessWrap : public HandleWrap {
       if (!stdios->Get(context, i).ToLocal(&val)) {
         return Nothing<void>();
       }
+      if (!val->IsObject()) {
+        THROW_ERR_INVALID_ARG_TYPE(env, "options.stdio elements must be objects");
+        return Nothing<void>();
+      }
       Local<Object> stdio = val.As<Object>();
       Local<Value> type;
       if (!stdio->Get(context, env->type_string()).ToLocal(&type)) {

test/parallel/test-child-process-array-prototype-pollution.js

@@ -0,0 +1,19 @@
+'use strict';
+require('../common');
+const assert = require('assert');
+const { exec } = require('child_process');
+
+Object.defineProperty(Array.prototype, '2', { set: function () {} });
+
+// child_process.exec() used to crash due to missing Array properties from prototype pollution.
+// It should now throw a TypeError from C++ ProcessWrap::ParseStdioOptions instead of a fatal error.
+assert.throws(
+  () => {
+    exec('echo 1');
+  },
+  {
+    code: 'ERR_INVALID_ARG_TYPE',
+    name: 'TypeError',
+    message: /options\.stdio elements must be objects/
+  }
+);