[GH-ISSUE #5315] inspect_macho analysis of a 151 MB single-slice binary does not complete #3234

New issue

Open

opened 2026-10-31 00:38:08 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-31 00:38:08 +00:00

Owner

Originally created by @fp2s92d5pd-bit on GitHub (Oct 19, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/5315

What happens

analyzing /Applications/Cognis.app/Contents/MacOS/cognis (a single-slice arm64 Mach-O, 151,383,200 bytes) never returns. Two runs were stopped after 20 minutes each with the client's per-tool budget exhausted; the gate itself answers (initialize returns immediately), so the analysis tool is the part that does not finish.

Repro

Target: /Applications/Cognis.app/Contents/MacOS/cognis — CPU_TYPE_ARM64, one slice, 151 MB.
The analysis sequence: open the binary, then signature/artifact/dylib resolution/Swift types on the same target.
A small binary (/System/Applications/Calculator.app/Contents/MacOS/Calculator, 1.7 MB slice) completes the same sequence normally.

Expected

Either the analysis completes, or it refuses with a bounded diagnostic that says which phase exceeded its limit. A 20-minute silence is indistinguishable from a crash for the caller.

Why it matters

The largest app binaries are exactly the ones an audit needs; today the analysis lane stops at the big ones while the load-command facts (dependencies, rpaths) read in milliseconds from the same file.

Originally created by @fp2s92d5pd-bit on GitHub (Oct 19, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/5315 ## What happens analyzing `/Applications/Cognis.app/Contents/MacOS/cognis` (a single-slice arm64 Mach-O, 151,383,200 bytes) never returns. Two runs were stopped after 20 minutes each with the client's per-tool budget exhausted; the gate itself answers (`initialize` returns immediately), so the analysis tool is the part that does not finish. ## Repro - Target: `/Applications/Cognis.app/Contents/MacOS/cognis` — `CPU_TYPE_ARM64`, one slice, 151 MB. - The analysis sequence: open the binary, then signature/artifact/dylib resolution/Swift types on the same target. - A small binary (`/System/Applications/Calculator.app/Contents/MacOS/Calculator`, 1.7 MB slice) completes the same sequence normally. ## Expected Either the analysis completes, or it refuses with a bounded diagnostic that says which phase exceeded its limit. A 20-minute silence is indistinguishable from a crash for the caller. ## Why it matters The largest app binaries are exactly the ones an audit needs; today the analysis lane stops at the big ones while the load-command facts (dependencies, rpaths) read in milliseconds from the same file.

bsakaguchi commented

2026-10-31 00:38:09 +00:00

Author

Owner

@XinwangTao commented on GitHub (Oct 20, 2026):

Confirmed the same shape of issue from the audit side: 20 minutes of silence with the gate returning immediately means the caller cannot distinguish a hang from a crash, and large single-slice binaries are exactly the targets that matter. +1 on the bounded-diagnostic ask — per-phase timeouts or progress updates (signature / artifact / dylib resolution / Swift types) would at least let a client decide whether to raise the budget or treat the binary as unsupported. A quick check of whether the signature or Swift-type phase scales non-linearly with file size (e.g. quadratic on the section table) would help target the fix.

@XinwangTao commented on GitHub (Oct 20, 2026): Confirmed the same shape of issue from the audit side: 20 minutes of silence with the gate returning immediately means the caller cannot distinguish a hang from a crash, and large single-slice binaries are exactly the targets that matter. +1 on the bounded-diagnostic ask — per-phase timeouts or progress updates (signature / artifact / dylib resolution / Swift types) would at least let a client decide whether to raise the budget or treat the binary as unsupported. A quick check of whether the signature or Swift-type phase scales non-linearly with file size (e.g. quadratic on the section table) would help target the fix.

bsakaguchi referenced this issue

2026-10-31 01:08:24 +00:00

[PR #3234] [CLOSED] fix(cli): name both recorded-core architectures in the path contract #5663

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#3234

No description provided.

Rows
Columns