morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #7253] [Bug] 6.8.0 regression: the 512-reference alias bound in `canonicalWebpackInteropBindings` drops Electron windows and IPC handlers in a real Webpack app (Bitwarden) #4313

New issue

Open

opened 2026-10-31 00:48:49 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:48:49 +00:00

Owner

Originally created by @Rinkia on GitHub (Oct 26, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/7253

Before submitting

I searched the open and closed issues for a related report (alias-selections, alias selection bound, electron_call_paths_limited, Bitwarden). Related: #2948 and #3883 (Webpack externals and loader writes), #4490 (destructuring, open), #2498 (semantic traversal cost). None covers this bound.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

On Bitwarden desktop 2026.10.0, rea-agents@6.8.0 reports fewer Electron facts for the Webpack main bundle than 6.7.0 did, on identical input and settings:

`analyze-javascript-application app.asar --source-path main.js --source-path preload.js`	6.7.0	6.8.0	`main` `19447516a`
`browser_windows`	1	0	0
`explicit_web_preferences`	7	0	0
`ipc.operations`	145	112	112
`ipc.main_handlers`	50	32	32
literal main channels	33	32 (`ipc.log` lost)	32

All runs used NODE_OPTIONS=--max-old-space-size=5120, so the parent result budget isn't involved. Without it, 6.8.0 also reports "Expanded application relationships for main.js exceed the parent's result budget", which 6.7.0 didn't need.

The lost facts are ordinary Webpack member reads, for example in main.js:

const electron_1 = __webpack_require__(84157);          // line 124396
electron_1.ipcMain.on(ipc_channels_1.AUTOTYPE_MVP_IPC_CHANNELS.TOGGLE, …)   // line 124409, lost
this.win = new electron_1.BrowserWindow({ … })           // line 129766, lost

Of 64 window and handler nodes on 6.7.0, 22 are missing on 6.8.0: 19 main handlers and the window in main.js, and 2 renderer handlers in preload.js. The result says why: semantic_resource_limits: ["alias-selections"], electron_call_paths_limited: true, and the limitation "Alias selection expansion was conservatively bounded (maximum 512 additional selector states); selected paths remain unknown."

The same shape in a small bundle is still resolved on 6.8.0. I checked a minimal Webpack bootstrap whose factory does const electron_1 = __webpack_require__(84157); electron_1.ipcMain.on(…); new electron_1.BrowserWindow(…), and it gives 1 window and 1 handler. So the loss comes from the bound on a large bundle, not the pattern.

Cause (source-derived on 6.8.0 and main 19447516a): canonicalWebpackInteropBindings in src/domain/javascript/javascriptBundledRequireOrigin.ts walks references to decide whether a write may select the Webpack loader. When the walk passes SEMANTIC_ALIAS_SELECTION_LIMIT (512), loaderMayOwnReference returns true, so the loader is treated as possibly overwritten and Electron identity through __webpack_require__ is withheld. Bitwarden's main.js is a 5 MB bootstrap with 1,153 modules, so the walk passes 512 even though the loader is never reassigned. main.js has no assignment to __webpack_require__ itself, only the standard bootstrap property definitions (.c .d .e .f .m .nmd .o .r .s .u .v, one each) and the bootstrap's single module-cache write. The check arrived in 6.8.0, with e9fc8fb30, 5cbcd5855 and 4394e8b59 touching this path.

Raising the bound isn't a workaround. As an experiment I set SEMANTIC_ALIAS_SELECTION_LIMIT to 1,048,576 locally: the worker exhausted a 4,096 MiB heap on main.js, and the result dropped to 0 main handlers.

Reproduction

Bitwarden-2026.10.0-amd64.deb from https://github.com/bitwarden/clients/releases/tag/desktop-v2026.10.0, sha256 fcabfc7da3c327e2625b105e951cee4e60703bb8e256f0aac9cc9bc83ec7063f (matches the GitHub asset digest). opt/Bitwarden/resources/app.asar is 71,317,476 bytes, and its main.js is 5,042,030 bytes.

NODE_OPTIONS=--max-old-space-size=5120 rea analyze-javascript-application …/resources/app.asar \
  --source-path main.js --source-path preload.js --format json

Linux x64 container, Node 24.22.1; 6.7.0 and 6.8.0 from npm, main built from source.

Expected behavior

A bundle as large as Bitwarden's shouldn't lose Electron facts that 6.7.0 found, when nothing writes to the Webpack loader. Possible directions:

Answer "does any write select the loader?" from the set of write sites rather than by walking references from every read. In Bitwarden, the only writes involving the loader are the standard bootstrap property definitions.
Scope the bound per factory instead of per bootstrap.
If a bound remains, report which modules lost Electron identity (a count or locations), so the summary isn't read as 0 windows.

Impact and scope

This affects any large Webpack-bundled Electron main process. Bitwarden is one real case, and its only window plus its webPreferences disappear from the summary. The limitation is disclosed, but the headline numbers changed between 6.7.0 and 6.8.0 without any change in the input. It also prevents verifying #4490's fix (PR #6993) on a real app: that PR passes all six minimal fixtures but can't show the Bitwarden channel while this bound fires.

Originally created by @Rinkia on GitHub (Oct 26, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/7253 ### Before submitting - [x] I searched the open and closed issues for a related report (alias-selections, alias selection bound, electron_call_paths_limited, Bitwarden). Related: #2948 and #3883 (Webpack externals and loader writes), #4490 (destructuring, open), #2498 (semantic traversal cost). None covers this bound. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Evidence, artifacts, or reconstruction ### Observed behavior On Bitwarden desktop 2026.10.0, `rea-agents@6.8.0` reports fewer Electron facts for the Webpack main bundle than 6.7.0 did, on identical input and settings: | `analyze-javascript-application app.asar --source-path main.js --source-path preload.js` | 6.7.0 | 6.8.0 | `main` `19447516a` | |---|---|---|---| | `browser_windows` | 1 | **0** | 0 | | `explicit_web_preferences` | 7 | **0** | 0 | | `ipc.operations` | 145 | **112** | 112 | | `ipc.main_handlers` | 50 | **32** | 32 | | literal main channels | 33 | 32 (`ipc.log` lost) | 32 | All runs used `NODE_OPTIONS=--max-old-space-size=5120`, so the parent result budget isn't involved. Without it, 6.8.0 also reports "Expanded application relationships for main.js exceed the parent's result budget", which 6.7.0 didn't need. The lost facts are ordinary Webpack member reads, for example in `main.js`: ```js const electron_1 = __webpack_require__(84157); // line 124396 electron_1.ipcMain.on(ipc_channels_1.AUTOTYPE_MVP_IPC_CHANNELS.TOGGLE, …) // line 124409, lost this.win = new electron_1.BrowserWindow({ … }) // line 129766, lost ``` Of 64 window and handler nodes on 6.7.0, 22 are missing on 6.8.0: 19 main handlers and the window in `main.js`, and 2 renderer handlers in `preload.js`. The result says why: `semantic_resource_limits: ["alias-selections"]`, `electron_call_paths_limited: true`, and the limitation "Alias selection expansion was conservatively bounded (maximum 512 additional selector states); selected paths remain unknown." The same shape in a small bundle is still resolved on 6.8.0. I checked a minimal Webpack bootstrap whose factory does `const electron_1 = __webpack_require__(84157); electron_1.ipcMain.on(…); new electron_1.BrowserWindow(…)`, and it gives 1 window and 1 handler. So the loss comes from the bound on a large bundle, not the pattern. **Cause (source-derived on 6.8.0 and `main` `19447516a`):** `canonicalWebpackInteropBindings` in `src/domain/javascript/javascriptBundledRequireOrigin.ts` walks references to decide whether a write may select the Webpack loader. When the walk passes `SEMANTIC_ALIAS_SELECTION_LIMIT` (512), `loaderMayOwnReference` returns `true`, so the loader is treated as possibly overwritten and Electron identity through `__webpack_require__` is withheld. Bitwarden's `main.js` is a 5 MB bootstrap with 1,153 modules, so the walk passes 512 even though the loader is never reassigned. `main.js` has no assignment to `__webpack_require__` itself, only the standard bootstrap property definitions (`.c .d .e .f .m .nmd .o .r .s .u .v`, one each) and the bootstrap's single module-cache write. The check arrived in 6.8.0, with e9fc8fb30, 5cbcd5855 and 4394e8b59 touching this path. Raising the bound isn't a workaround. As an experiment I set `SEMANTIC_ALIAS_SELECTION_LIMIT` to 1,048,576 locally: the worker exhausted a 4,096 MiB heap on `main.js`, and the result dropped to 0 main handlers. ### Reproduction - `Bitwarden-2026.10.0-amd64.deb` from https://github.com/bitwarden/clients/releases/tag/desktop-v2026.10.0, sha256 `fcabfc7da3c327e2625b105e951cee4e60703bb8e256f0aac9cc9bc83ec7063f` (matches the GitHub asset digest). `opt/Bitwarden/resources/app.asar` is 71,317,476 bytes, and its `main.js` is 5,042,030 bytes. ```sh NODE_OPTIONS=--max-old-space-size=5120 rea analyze-javascript-application …/resources/app.asar \ --source-path main.js --source-path preload.js --format json ``` Linux x64 container, Node 24.22.1; 6.7.0 and 6.8.0 from npm, `main` built from source. ### Expected behavior A bundle as large as Bitwarden's shouldn't lose Electron facts that 6.7.0 found, when nothing writes to the Webpack loader. Possible directions: - Answer "does any write select the loader?" from the set of write sites rather than by walking references from every read. In Bitwarden, the only writes involving the loader are the standard bootstrap property definitions. - Scope the bound per factory instead of per bootstrap. - If a bound remains, report which modules lost Electron identity (a count or locations), so the summary isn't read as 0 windows. ### Impact and scope This affects any large Webpack-bundled Electron main process. Bitwarden is one real case, and its only window plus its `webPreferences` disappear from the summary. The limitation is disclosed, but the headline numbers changed between 6.7.0 and 6.8.0 without any change in the input. It also prevents verifying #4490's fix (PR #6993) on a real app: that PR passes all six minimal fixtures but can't show the Bitwarden channel while this bound fires.

bsakaguchi referenced this issue

2026-11-01 21:10:57 +00:00

[GH-ISSUE #3796] [Tracker] Open feature requests by area (October 2026) #1471

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#4313

No description provided.

Rows
Columns

[GH-ISSUE #7253] [Bug] 6.8.0 regression: the 512-reference alias bound in canonicalWebpackInteropBindings drops Electron windows and IPC handlers in a real Webpack app (Bitwarden) #4313