[GH-ISSUE #6752] [Bug] Markdown formatting fails with a call-stack error for a large retained row page #4112

New issue

Closed

opened 2026-10-31 00:46:54 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:46:54 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 23, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/6752

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

CLI

Observed behavior

A valid retained native-inventory page containing 150,000 rows succeeds as JSON but fails as Markdown with UNKNOWN: Maximum call stack size exceeded. The Markdown result contains no selected observations and exits 1.

This was reproduced through the source CLI's createCli(...).serve(...) and createCliResultOutput boundaries, using synthetic local Evidence and the locked dependencies. The packaged dispatcher was not built or tested.

Reproduction

In the source checkout, create a list_names Evidence record with createEvidence from ./src/domain/evidence.ts. Use the synthetic PE subject /tmp/fixture.exe, SHA-256 "a".repeat(64), and this result:
```
Array.from({ length: 150000 }, (_, i) => ({
  address: `0x${i.toString(16)}`,
  value: `item${i}`,
}))
```

Save /tmp/many-rows-input.json containing:

{
  source: { kind: "inline", evidence: parent },
  view: { kind: "native-inventory", limit: 150000, fields: ["value"] }
}

Invoke the source CLI with these argument vectors, using createCliResultOutput(argv, destination) and createCli(process.env, output).serve(argv, { stdout, exit }), matching the executable's output adapter:
```
inspect-analysis-view /tmp/many-rows-input.json --format json --filter-output normalized_result.rows
inspect-analysis-view /tmp/many-rows-input.json --format md --filter-output normalized_result.rows
```
JSON returns all 150,000 rows with exit 0; Markdown returns the error below with exit 1. One paired reproduction was run.

Expected behavior

Markdown should format the admitted page, or return an actionable typed capacity refusal. A valid page should not fail because its row count exceeds the runtime's function-argument limit.

The native-inventory request schema accepts positive page limits without this ceiling. The CLI output boundary formats the selected observations after analysis succeeds.

Impact and scope

Large valid row pages lose their requested Markdown output. The same fixture succeeded as JSON, which is a demonstrated workaround. The exact failing row threshold and other platforms are untested. No real binary, external provider, or live service was used.

REA version

6.7.0 source, main 2bcd7e6d13f0a8118d6619718254255e84f75d86; locked incur 0.6.1.

Runtime and platform

Node.js v24.22.1; Linux x64. No Hopper or Ghidra involved.

Target and artifact context

Synthetic retained list_names Evidence; 150,000 ordinary address/value rows. The synthetic subject file is never opened.

Interface

CLI

Earliest failure stage

Transport or result projection

Relevant output or evidence

The paired source-CLI probe recorded:

json: exit 0, 11,107,909 output bytes, 150,000 returned rows
md:   exit 1, 188 output bytes

Markdown's complete result was:

| Key     | Value                            |
|---------|----------------------------------|
| code    | UNKNOWN                          |
| message | Maximum call stack size exceeded |

The fixture, probe, and compact result report were retained locally for review. This evidence establishes the source CLI boundary with the pinned runtime, not a packaged executable or a real-provider capture.

Typed outcome or recovery expected

Successful formatting, or a typed resource_constraint naming the formatting limit and suggesting a smaller page or JSON.

Analysis or suspected cause

Source-derived: REA delegates Markdown formatting to its pinned Incur dependency. In the installed ./node_modules/incur/src/Formatter.ts, table() computes each width with Math.max(h.length, ...rows.map(...)). The 150,000-row table therefore becomes a function call with 150,001 arguments. REA's formatter recovery handles Invalid string length, but not this RangeError.

Additional context

This differs from #5525's nested-value stringification: the primary behavior here is complete formatting failure from row count, with Maximum call stack size exceeded.

Triage assessment

Impact level: P2
Assessment status: supported
Impact basis: One admitted 150,000-row page returned no requested observations in Markdown while the identical JSON page succeeded. The failure is bounded to output formatting and does not modify target data.
Workaround status: available
Workaround basis: The paired JSON invocation returned all 150,000 rows successfully on the same runtime and input.

Originally created by @coygeek on GitHub (Oct 23, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/6752 ## Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ## Area CLI ## Observed behavior A valid retained native-inventory page containing 150,000 rows succeeds as JSON but fails as Markdown with `UNKNOWN: Maximum call stack size exceeded`. The Markdown result contains no selected observations and exits 1. This was reproduced through the source CLI's `createCli(...).serve(...)` and `createCliResultOutput` boundaries, using synthetic local Evidence and the locked dependencies. The packaged dispatcher was not built or tested. ## Reproduction 1. In the source checkout, create a `list_names` Evidence record with `createEvidence` from `./src/domain/evidence.ts`. Use the synthetic PE subject `/tmp/fixture.exe`, SHA-256 `"a".repeat(64)`, and this result: ```js Array.from({ length: 150000 }, (_, i) => ({ address: `0x${i.toString(16)}`, value: `item${i}`, })) ``` 2. Save `/tmp/many-rows-input.json` containing: ```js { source: { kind: "inline", evidence: parent }, view: { kind: "native-inventory", limit: 150000, fields: ["value"] } } ``` 3. Invoke the source CLI with these argument vectors, using `createCliResultOutput(argv, destination)` and `createCli(process.env, output).serve(argv, { stdout, exit })`, matching the executable's output adapter: ```text inspect-analysis-view /tmp/many-rows-input.json --format json --filter-output normalized_result.rows inspect-analysis-view /tmp/many-rows-input.json --format md --filter-output normalized_result.rows ``` 4. JSON returns all 150,000 rows with exit 0; Markdown returns the error below with exit 1. One paired reproduction was run. ## Expected behavior Markdown should format the admitted page, or return an actionable typed capacity refusal. A valid page should not fail because its row count exceeds the runtime's function-argument limit. The [native-inventory request schema](https://github.com/morluto/rea/blob/2bcd7e6d13f0a8118d6619718254255e84f75d86/src/domain/analysisView/nativeInventoryView.ts#L37) accepts positive page limits without this ceiling. The [CLI output boundary](https://github.com/morluto/rea/blob/2bcd7e6d13f0a8118d6619718254255e84f75d86/src/cli/cliResultOutput.ts#L383) formats the selected observations after analysis succeeds. ## Impact and scope Large valid row pages lose their requested Markdown output. The same fixture succeeded as JSON, which is a demonstrated workaround. The exact failing row threshold and other platforms are untested. No real binary, external provider, or live service was used. ## REA version 6.7.0 source, main `2bcd7e6d13f0a8118d6619718254255e84f75d86`; locked `incur` 0.6.1. ## Runtime and platform Node.js v24.22.1; Linux x64. No Hopper or Ghidra involved. ## Target and artifact context Synthetic retained `list_names` Evidence; 150,000 ordinary address/value rows. The synthetic subject file is never opened. ## Interface CLI ## Earliest failure stage Transport or result projection ## Relevant output or evidence The paired source-CLI probe recorded: ```text json: exit 0, 11,107,909 output bytes, 150,000 returned rows md: exit 1, 188 output bytes ``` Markdown's complete result was: ```text | Key | Value | |---------|----------------------------------| | code | UNKNOWN | | message | Maximum call stack size exceeded | ``` The fixture, probe, and compact result report were retained locally for review. This evidence establishes the source CLI boundary with the pinned runtime, not a packaged executable or a real-provider capture. ## Typed outcome or recovery expected Successful formatting, or a typed `resource_constraint` naming the formatting limit and suggesting a smaller page or JSON. ## Analysis or suspected cause Source-derived: REA delegates Markdown formatting to its [pinned Incur dependency](https://github.com/morluto/rea/blob/2bcd7e6d13f0a8118d6619718254255e84f75d86/package.json#L354). In the installed `./node_modules/incur/src/Formatter.ts`, `table()` computes each width with `Math.max(h.length, ...rows.map(...))`. The 150,000-row table therefore becomes a function call with 150,001 arguments. REA's formatter recovery handles `Invalid string length`, but not this RangeError. ## Additional context This differs from #5525's nested-value stringification: the primary behavior here is complete formatting failure from row count, with `Maximum call stack size exceeded`. ## Triage assessment - Impact level: P2 - Assessment status: supported - Impact basis: One admitted 150,000-row page returned no requested observations in Markdown while the identical JSON page succeeded. The failure is bounded to output formatting and does not modify target data. - Workaround status: available - Workaround basis: The paired JSON invocation returned all 150,000 rows successfully on the same runtime and input.

bsakaguchi closed this issue

2026-10-31 00:46:54 +00:00

bsakaguchi referenced this issue

2026-10-31 01:11:34 +00:00

[PR #4112] [MERGED] fix(ghidra): use resolved type addresses for NativeAOT metadata #6062