[GH-ISSUE #3006] [Bug] Browser metadata-budget verifier does not retain scripts across captures #1051

New issue

Closed

opened 2026-10-15 18:30:41 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-15 18:30:41 +00:00

Owner

Originally created by @N0zoM1z0 on GitHub (Oct 13, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/3006

The real-browser metadata-budget fixture can fail its later MCP capture after both CLI checks pass, because its five giant inline scripts do not retain executable references for the four independent captures.

Reproduced on Windows 11 / ordinary medium-integrity caller / Edge 154.0.4258.48 / Node 24.18.0, using pinned main d4f0c5e664e26fe7ed1566dcc4b85ea9b57d52da. The fixture and relevant admission code are unchanged on subsequently inspected main. Original browser arguments, public operation order, observation_ms=0, omission assertions, and production runtime were preserved. No parallel Debugger observer was attached.

The full browser composite finished naturally after 984.18 s and failed at browser-capture-metadata-budget-e2e.mjs:112: CLI inspect (line 90) and CLI bundle (line 99) had already passed. A standalone fresh-browser reproduction retained complete per-phase results locally:

Fixture	CLI inspect	CLI bundle	MCP inspect	MCP bundle
Original boolean assignments	5 giant scripts, 1 retained map, 4 budget omissions	6 parsed scripts; 4 omissions propagated	0 scripts; original assertion fails	Not reached
Global function reference in each giant script	5 giant scripts, 1 retained map, 4 budget omissions	6 parsed scripts; 4 omissions propagated	5 giant scripts, 1 retained map, 4 budget omissions	5 parsed scripts; 4 omissions propagated; passes

The control changes only globalThis[marker] = true to a retained function in the synthetic page. It keeps all five 2 MiB sourceMappingURL annotations, 10 MiB declared metadata, existing metadata admission budget and omission assertions. Both fresh owned browsers closed successfully; enclosing native Jobs ended with activeProcesses=0 and caller token unchanged.

The source-supported explanation is script collection between independent captures: the current fixture leaves only booleans, and each public capture correctly releases its Debugger session. CDP scriptParsed promises replay for known and uncollected scripts. The experiment supports a fixture lifetime defect; it does not directly trace garbage collection and does not establish a provider budget defect.

Fix the fixture producer so all five script identities remain live through its CLI/MCP capture sequence. Preserve production domain/session cleanup, launch authority, admission bounds, full-size annotations and existing public assertions. Inspect other fixtures for the same multi-capture lifetime assumption before adding downstream retries or timing sleeps.

Resource observation, two logical CPUs / BelowNormal / Node heap 768 MiB / outer Job 2 GiB: original failing standalone 51.01 s, peak Job commit 871.2 MiB, sampled family CPU 32.47 s, sampled working set 854.0 MiB; retained-function complete standalone 59.33 s, 1048.4 MiB, 50.50 s, 823.5 MiB. These execute different completed coverage and are not a speed comparison. Sampling every 2 s can miss short children; PowerShell observer is unmeasured. Full map strings and Evidence stay in local files, with only phase/count/timing summaries returned to the analyst.

Originally created by @N0zoM1z0 on GitHub (Oct 13, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/3006 The real-browser metadata-budget fixture can fail its later MCP capture after both CLI checks pass, because its five giant inline scripts do not retain executable references for the four independent captures. Reproduced on Windows 11 / ordinary medium-integrity caller / Edge 154.0.4258.48 / Node 24.18.0, using pinned main `d4f0c5e664e26fe7ed1566dcc4b85ea9b57d52da`. The fixture and relevant admission code are unchanged on subsequently inspected main. Original browser arguments, public operation order, observation_ms=0, omission assertions, and production runtime were preserved. No parallel Debugger observer was attached. The full browser composite finished naturally after 984.18 s and failed at `browser-capture-metadata-budget-e2e.mjs:112`: CLI inspect (line 90) and CLI bundle (line 99) had already passed. A standalone fresh-browser reproduction retained complete per-phase results locally: | Fixture | CLI inspect | CLI bundle | MCP inspect | MCP bundle | | --- | --- | --- | --- | --- | | Original boolean assignments | 5 giant scripts, 1 retained map, 4 budget omissions | 6 parsed scripts; 4 omissions propagated | 0 scripts; original assertion fails | Not reached | | Global function reference in each giant script | 5 giant scripts, 1 retained map, 4 budget omissions | 6 parsed scripts; 4 omissions propagated | 5 giant scripts, 1 retained map, 4 budget omissions | 5 parsed scripts; 4 omissions propagated; passes | The control changes only `globalThis[marker] = true` to a retained function in the synthetic page. It keeps all five 2 MiB sourceMappingURL annotations, 10 MiB declared metadata, existing metadata admission budget and omission assertions. Both fresh owned browsers closed successfully; enclosing native Jobs ended with activeProcesses=0 and caller token unchanged. The source-supported explanation is script collection between independent captures: the current fixture leaves only booleans, and each public capture correctly releases its Debugger session. [CDP scriptParsed](https://raw.githubusercontent.com/ChromeDevTools/devtools-protocol/master/json/js_protocol.json) promises replay for known and uncollected scripts. The experiment supports a fixture lifetime defect; it does not directly trace garbage collection and does not establish a provider budget defect. Fix the fixture producer so all five script identities remain live through its CLI/MCP capture sequence. Preserve production domain/session cleanup, launch authority, admission bounds, full-size annotations and existing public assertions. Inspect other fixtures for the same multi-capture lifetime assumption before adding downstream retries or timing sleeps. Resource observation, two logical CPUs / BelowNormal / Node heap 768 MiB / outer Job 2 GiB: original failing standalone 51.01 s, peak Job commit 871.2 MiB, sampled family CPU 32.47 s, sampled working set 854.0 MiB; retained-function complete standalone 59.33 s, 1048.4 MiB, 50.50 s, 823.5 MiB. These execute different completed coverage and are not a speed comparison. Sampling every 2 s can miss short children; PowerShell observer is unmeasured. Full map strings and Evidence stay in local files, with only phase/count/timing summaries returned to the analyst.

bsakaguchi

2026-10-15 18:30:41 +00:00

closed this issue
added the
area: runtime

bug
labels

bsakaguchi commented

2026-10-15 18:30:42 +00:00

Author

Owner

@morluto commented on GitHub (Oct 14, 2026):

Verified the reported defect is addressed on main by faf209e50d.

Root cause and resolution: Real Chrome released debugger sessions between independent captures and V8 collected scripts because fixture held only booleans; the fixture now retains a distinct function per script through CLI and MCP captures.

Validation: scripts/lib/browser-capture-metadata-budget-e2e.mjs — verifyBrowserCaptureMetadataBudget: CLI inspect/bundle and MCP inspect/bundle assertions retain 5 large scripts, at least one but fewer than five maps, exact omission count, truncated source_maps, and partial bundle unknowns.

Evidence: Current-head CI job browser / real-browser: npm run verify:browser succeeded and runs this real Chrome workflow.

Verification scope: Validates the verifier fixture/admission report; it does not establish production capture behavior beyond those four routes.

Current main CI has separate failures under repair; this closure does not claim the complete main workflow is green.

@morluto commented on GitHub (Oct 14, 2026): Verified the reported defect is addressed on main by faf209e50d9faab03a185c1f044de3582552d11e. Root cause and resolution: Real Chrome released debugger sessions between independent captures and V8 collected scripts because fixture held only booleans; the fixture now retains a distinct function per script through CLI and MCP captures. Validation: `scripts/lib/browser-capture-metadata-budget-e2e.mjs` — verifyBrowserCaptureMetadataBudget: CLI inspect/bundle and MCP inspect/bundle assertions retain 5 large scripts, at least one but fewer than five maps, exact omission count, truncated source_maps, and partial bundle unknowns. Evidence: Current-head CI job `browser / real-browser`: `npm run verify:browser` succeeded and runs this real Chrome workflow. Verification scope: Validates the verifier fixture/admission report; it does not establish production capture behavior beyond those four routes. Current main CI has separate failures under repair; this closure does not claim the complete main workflow is green.

bsakaguchi referenced this issue

2026-10-16 21:02:34 +00:00

[GH-ISSUE #2383] [Tracker] Audit analysis and debugging coverage for the TIOBE top 100 languages (October 2026) #794

bsakaguchi referenced this issue

2026-10-17 21:08:10 +00:00

[PR #1051] [MERGED] feat(evm): inspect offline bytecode interfaces through EVMole #2608

bsakaguchi referenced this issue

2026-10-31 00:36:56 +00:00

[GH-ISSUE #5088] [Bug] inspect_evm_interface loses detail field guidance and advertised default #3126