[GH-ISSUE #6562] [Bug] Browser source-map collection reports overlapping sections as fully included #3953

New issue

Closed

opened 2026-10-31 00:45:33 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:45:33 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 23, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/6562

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

In a production-boundary reproduction on rea-agents 6.7.0, fetchWebSourceMaps silently omitted an overlapping mapping from an indexed source map and returned both collection and item status included with limitation: null. REA's tracing decoder rejected the exact same map with reason format and message "Embedded source-map mappings overlap the following section boundary." A non-overlapping control was accepted by both paths.

Reproduction

Use this indexed map as a fetched source-map response. Its first section contains generated columns 0 and 2, although the next section starts at generated column 1.

{"version":3,"sections":[{"offset":{"line":0,"column":0},"map":{"version":3,"sources":["a.js"],"sourcesContent":["x();"],"names":[],"mappings":"AAAA,EAAA"}},{"offset":{"line":0,"column":1},"map":{"version":3,"sources":["b.js"],"sourcesContent":["y();"],"names":[],"mappings":"AAAA"}}]}

I parsed an analyzeWebBundleInputSchema request with cdp_endpoint http://127.0.0.1:9222, target_id example, allowed_origins [https://example.test], and fetch_source_maps true, then called fetchWebSourceMaps with scriptKey example and declaredUrl/fetchUrl https://example.test/app.js.map. The injected fetch returned new Response(JSON.stringify(map), {headers: {'content-type': 'application/json'}}); no browser, network server, or full CLI/MCP workflow was used for this probe.
The result had status included, item status included, limitation null, and mapping columns [0, 1]. The declared mapping at column 2 disappeared without an invalid/partial state or overlap diagnostic.
I passed the same JSON to traceSourceMap with URL context https://example.test/app.js.map and position {line: 1, column: 2}; it rejected the overlap. Replacing only the first section's mappings with AAAA produced the non-overlapping control, accepted by both paths.

The public reachable trigger is analyze_web_bundle with fetch_source_maps enabled on a captured script declaring this map on an allowed origin. That complete browser workflow was not run; the caller input was schema-validated and the exercised fetch/decode/projection boundary is production code.

Expected behavior

The browser collection should expose the overlapping section as invalid or explicitly partial with a diagnostic, rather than silently clipping a mapping and reporting fully included evidence. REA already enforces this exact section-boundary invariant in traceSourceMap.

Impact and scope

The affected input is a valid analysis request whose producer-supplied indexed map has overlapping sections. Derived mapping evidence loses a row and conceals the malformed-map signal. The original map artifact remains retained, so this is not deletion of the input artifact. One focused failing fixture and its non-overlapping control were executed; real-site frequency was not measured.

REA version

Observed with npm rea-agents 6.7.0, tag rea-agents-6.7.0 at 27dc42d102. Current main 6bb4f4bf7d retains the same overlap-skipping branch and included/null return; current-main runtime scope is source-derived, not executed.

Runtime and platform

Node.js v26.12.1; Linux x86_64; imported shipped production decoders with an injected standard Response. No system analysis provider was installed or started.

Target and artifact context

Version 3 indexed JavaScript source map with embedded sections; offsets and individual VLQ mappings are well formed, but the first section has a mapping beyond the next section's boundary.

Interface

Other

Earliest failure stage

Artifact or evidence registration

Relevant output or evidence

Expected source: The existing tracing overlap guard rejected this exact fixture during the probe.
Failure source: Browser collection skips the overlapping segment and chooses included/null solely from original-source parse completeness.
Evidence provenance: observed production-boundary output on 6.7.0; static current-main reachability and unchanged relevant branches.
Local verification: reproduced at the fetch/decode/projection boundary; a real browser source-map fetch, full CLI/MCP invocation, and compiled current-main runtime were not run.
The public analyzeBundle path calls fetchWebSourceMaps when fetch_source_maps is true. The release has the same skip and included/null result.

Typed outcome or recovery expected

An invalid item, or a partial item explicitly explaining overlap, should replace the unconditional included claim. A proposed restoration check should require an overlap signal for this fixture while preserving successful inclusion of the non-overlapping control.

Analysis or suspected cause

Source-derived: isBeforeSourceMapLeafStop is treated as a filter in browser collection, while tracing treats the same false result as a format violation. The original-source parser can succeed on x(); and y();, leaving no other condition that changes the browser item's status.

Additional context

All-state targeted searches for source-map/overlap, source maps/overlapping, and indexed source-map found no matching defect report. Related search hits were trackers #4027 and #4330; their relevant source-map entries cover other cases. No separate reverification or independent semantic-review pass was performed after drafting.

Triage assessment

Impact level: P2
Assessment status: supported
Impact basis: Browser analysis silently drops a producer mapping and represents the resulting indexed-map evidence as fully included for a bounded malformed-map input, despite an existing decoder detecting the same violation.
Workaround status: unverified
Workaround basis: The tracing decoder detects this fixture's overlap and the original artifact is retained, but an end-to-end public recovery workflow was not run and no browser-collection option was verified to expose the omitted mapping or diagnostic.

Originally created by @coygeek on GitHub (Oct 23, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/6562 ## Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ## Area Evidence, artifacts, or reconstruction ## Observed behavior In a production-boundary reproduction on rea-agents 6.7.0, fetchWebSourceMaps silently omitted an overlapping mapping from an indexed source map and returned both collection and item status included with limitation: null. REA's tracing decoder rejected the exact same map with reason format and message "Embedded source-map mappings overlap the following section boundary." A non-overlapping control was accepted by both paths. ## Reproduction 1. Use this indexed map as a fetched source-map response. Its first section contains generated columns 0 and 2, although the next section starts at generated column 1. ```json {"version":3,"sections":[{"offset":{"line":0,"column":0},"map":{"version":3,"sources":["a.js"],"sourcesContent":["x();"],"names":[],"mappings":"AAAA,EAAA"}},{"offset":{"line":0,"column":1},"map":{"version":3,"sources":["b.js"],"sourcesContent":["y();"],"names":[],"mappings":"AAAA"}}]} ``` 2. I parsed an analyzeWebBundleInputSchema request with cdp_endpoint http://127.0.0.1:9222, target_id example, allowed_origins [https://example.test], and fetch_source_maps true, then called fetchWebSourceMaps with scriptKey example and declaredUrl/fetchUrl https://example.test/app.js.map. The injected fetch returned new Response(JSON.stringify(map), {headers: {'content-type': 'application/json'}}); no browser, network server, or full CLI/MCP workflow was used for this probe. 3. The result had status included, item status included, limitation null, and mapping columns [0, 1]. The declared mapping at column 2 disappeared without an invalid/partial state or overlap diagnostic. 4. I passed the same JSON to traceSourceMap with URL context https://example.test/app.js.map and position {line: 1, column: 2}; it rejected the overlap. Replacing only the first section's mappings with AAAA produced the non-overlapping control, accepted by both paths. The public reachable trigger is analyze_web_bundle with fetch_source_maps enabled on a captured script declaring this map on an allowed origin. That complete browser workflow was not run; the caller input was schema-validated and the exercised fetch/decode/projection boundary is production code. ## Expected behavior The browser collection should expose the overlapping section as invalid or explicitly partial with a diagnostic, rather than silently clipping a mapping and reporting fully included evidence. REA already enforces this exact section-boundary invariant in [traceSourceMap](https://github.com/morluto/rea/blob/6bb4f4bf7d64e5d2f47479d46225a5383b57cdad/src/javascript/sourceMaps/TraceSourceMap.ts#L36-L45). ## Impact and scope The affected input is a valid analysis request whose producer-supplied indexed map has overlapping sections. Derived mapping evidence loses a row and conceals the malformed-map signal. The original map artifact remains retained, so this is not deletion of the input artifact. One focused failing fixture and its non-overlapping control were executed; real-site frequency was not measured. ## REA version Observed with npm rea-agents 6.7.0, tag rea-agents-6.7.0 at 27dc42d10249f0410904a75c0997842eb03b931c. Current main 6bb4f4bf7d64e5d2f47479d46225a5383b57cdad retains the same overlap-skipping branch and included/null return; current-main runtime scope is source-derived, not executed. ## Runtime and platform Node.js v26.12.1; Linux x86_64; imported shipped production decoders with an injected standard Response. No system analysis provider was installed or started. ## Target and artifact context Version 3 indexed JavaScript source map with embedded sections; offsets and individual VLQ mappings are well formed, but the first section has a mapping beyond the next section's boundary. ## Interface Other ## Earliest failure stage Artifact or evidence registration ## Relevant output or evidence - Expected source: [The existing tracing overlap guard](https://github.com/morluto/rea/blob/6bb4f4bf7d64e5d2f47479d46225a5383b57cdad/src/javascript/sourceMaps/TraceSourceMap.ts#L36-L45) rejected this exact fixture during the probe. - Failure source: [Browser collection skips the overlapping segment](https://github.com/morluto/rea/blob/6bb4f4bf7d64e5d2f47479d46225a5383b57cdad/src/browser/WebSourceMapFetcher.ts#L650-L658) and [chooses included/null solely from original-source parse completeness](https://github.com/morluto/rea/blob/6bb4f4bf7d64e5d2f47479d46225a5383b57cdad/src/browser/WebSourceMapFetcher.ts#L696-L724). - Evidence provenance: observed production-boundary output on 6.7.0; static current-main reachability and unchanged relevant branches. - Local verification: reproduced at the fetch/decode/projection boundary; a real browser source-map fetch, full CLI/MCP invocation, and compiled current-main runtime were not run. - The public [analyzeBundle path calls fetchWebSourceMaps when fetch_source_maps is true](https://github.com/morluto/rea/blob/6bb4f4bf7d64e5d2f47479d46225a5383b57cdad/src/browser/CdpBrowserProvider.ts#L187-L208). The release has the same [skip](https://github.com/morluto/rea/blob/27dc42d10249f0410904a75c0997842eb03b931c/src/browser/WebSourceMapFetcher.ts#L625-L630) and [included/null result](https://github.com/morluto/rea/blob/27dc42d10249f0410904a75c0997842eb03b931c/src/browser/WebSourceMapFetcher.ts#L684-L696). ## Typed outcome or recovery expected An invalid item, or a partial item explicitly explaining overlap, should replace the unconditional included claim. A proposed restoration check should require an overlap signal for this fixture while preserving successful inclusion of the non-overlapping control. ## Analysis or suspected cause Source-derived: isBeforeSourceMapLeafStop is treated as a filter in browser collection, while tracing treats the same false result as a format violation. The original-source parser can succeed on x(); and y();, leaving no other condition that changes the browser item's status. ## Additional context All-state targeted searches for source-map/overlap, source maps/overlapping, and indexed source-map found no matching defect report. Related search hits were trackers [#4027](https://github.com/morluto/rea/issues/4027) and [#4330](https://github.com/morluto/rea/issues/4330); their relevant source-map entries cover other cases. No separate reverification or independent semantic-review pass was performed after drafting. ## Triage assessment - Impact level: P2 - Assessment status: supported - Impact basis: Browser analysis silently drops a producer mapping and represents the resulting indexed-map evidence as fully included for a bounded malformed-map input, despite an existing decoder detecting the same violation. - Workaround status: unverified - Workaround basis: The tracing decoder detects this fixture's overlap and the original artifact is retained, but an end-to-end public recovery workflow was not run and no browser-collection option was verified to expose the omitted mapping or diagnostic.

bsakaguchi closed this issue

2026-10-31 00:45:33 +00:00

bsakaguchi referenced this issue

2026-10-31 01:10:59 +00:00

[PR #4006] [CLOSED] fix(artifacts): report ZIP reads beyond the archive as malformed #5986