morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #1912] [MERGED] fix(javascript): follow actual receivers in nested intrinsic calls #4901

New issue

Closed

opened 2026-10-31 00:56:36 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:56:36 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1912
Author: @N0zoM1z0
Created: 10/11/2026
Status: ✅ Merged
Merged: 10/11/2026
Merged by: @morluto

Base: main ← Head: fix/javascript-call-receivers

📝 Commits (1)

f80e2b7 fix(javascript): follow actual receivers in nested intrinsic calls

📊 Changes

4 files changed (+99 additions, -45 deletions)

View changed files

📝 docs/javascript-artifact-reconstruction.md (+7 -5)
📝 src/domain/javascript/electronModuleInterop.test.ts (+49 -5)
📝 src/domain/javascript/javascriptIntrinsicInvocation.ts (+16 -24)
📝 tests/acceptance/applications/electronModuleInteropCli.test.ts (+27 -11)

📄 Description

Summary

Nested Function.prototype.call.call.call(...) consumes an extra argument layer and misses a visible Object.create overwrite. REA then attributes the helper-derived constructor to Electron. Follow the actual callable receiver at each generic invocation, preserving bound arguments and the original bound receiver. Fixes #1909; follow-up to #1857.

Problem and expected behavior

A property's depth does not define how many calls occurred. Retain the actual function receiver and consume arguments once per invocation, so visible intrinsic replacement makes helper-derived identity unresolved while fresh local targets preserve legitimate findings.

Change and scope

Replace path-segment stripping with receiver propagation. Reuse the existing binding-factory and intrinsic-read checks. Correct detached call/apply alias fixtures to supply an actual receiver; creating an alias does not preserve JavaScript's implicit this. Keep the fixture setup outside the CLI/MCP test body.

Contract and boundary impact

Semantic owner and earliest changed stage: static JavaScript intrinsic invocation normalization.
CLI/MCP/tool catalog: unchanged schemas; incorrect inferred window attribution is removed.
Provider/bridge/platform compatibility: none; shared static workflow.
Evidence/provenance: preserve original anchors, preload expressions and unresolved identity.
Execution/authorization/cleanup: none; target source remains inert.
Generated metadata/package/install impact: none; generated outputs remain ignored.

Evidence and regression coverage

Pinned main e4ac7bbfc: triple-call and bound nested-call source cases fail. Both actual CLI/stdio MCP regressions report eight windows instead of seven. An apply/apply control already passes on main.
After the fix: the public fixture parses 12 files, retains all seven legitimate source anchors and preload uncertainty, and excludes ten intrinsic-poisoned modules plus the fake helper.
Source controls retain generic binding, capture timing, opaque arguments and fresh targets. Exact duplicate controls are omitted.
Remaining proof gap: arbitrary cross-call side effects are not evaluated.
Observed, derived and inferred claims remain distinguishable.
Artifact identity, source provenance and failed attempts remain preserved.
Uncertain outcomes remain visible.

Validation performed

npm run test:focused -- … — 488 tests across 11 files pass: 189 interop, 295 adjacent source/RPC and four production CLI/stdio MCP cases.
npm run docs:check — six tasks pass.
Normal pre-commit formatting/lint and pre-push check:fast typecheck/lint — pass.
Independent final-diff review and automated review on f80e2b7 — no remaining blocker. The PR was merged while CI was running. Its eventual sole test failure was the static Wasm/Harmony wording audit; #1917 fixes that audit omission. The focused receiver regressions passed.
Public T3 nightly boot/main source subset (main SHA-256 e566055ab42d104b413575920bb62ea7f43677e014ad840fd7319d69fc83cf1f) — four windows, zero parse failures, both dynamic preload expressions preserved. This is a source subset, not full ASAR/runtime verification.
Bounded Flameox producer profile — 2,997 samples, 555 rows examined; invocation normalization accounts for nine self samples. CPU and RSS receipts retained locally; no speedup claim.

Compatibility, safety, and release

Breaking changes/migration: none; correct static attribution with existing interfaces.
Real coverage: Linux x64 CLI/production stdio MCP; no target runtime or deep provider involved.
Package/release metadata: none.
Security/privacy/process: no target execution or expanded authority; fixture inputs throw if executed.

Review checklist

Concrete problem, focused outcome and conventional title.
Related issue linked.
Observable regressions and uncertainty/fresh-target controls covered.
Owning documentation updated.
Representative CLI/MCP output verified.
Final diff checked for secrets, unrelated changes and unsupported claims.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1912 **Author:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Created:** 10/11/2026 **Status:** ✅ Merged **Merged:** 10/11/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `fix/javascript-call-receivers` --- ### 📝 Commits (1) - [`f80e2b7`](https://github.com/morluto/rea/commit/f80e2b72b7fdb02d707dd643fb7341c482d9491f) fix(javascript): follow actual receivers in nested intrinsic calls ### 📊 Changes **4 files changed** (+99 additions, -45 deletions) <details> <summary>View changed files</summary> 📝 `docs/javascript-artifact-reconstruction.md` (+7 -5) 📝 `src/domain/javascript/electronModuleInterop.test.ts` (+49 -5) 📝 `src/domain/javascript/javascriptIntrinsicInvocation.ts` (+16 -24) 📝 `tests/acceptance/applications/electronModuleInteropCli.test.ts` (+27 -11) </details> ### 📄 Description ## Summary Nested `Function.prototype.call.call.call(...)` consumes an extra argument layer and misses a visible `Object.create` overwrite. REA then attributes the helper-derived constructor to Electron. Follow the actual callable receiver at each generic invocation, preserving bound arguments and the original bound receiver. Fixes #1909; follow-up to #1857. ## Problem and expected behavior A property's depth does not define how many calls occurred. Retain the actual function receiver and consume arguments once per invocation, so visible intrinsic replacement makes helper-derived identity unresolved while fresh local targets preserve legitimate findings. ## Change and scope Replace path-segment stripping with receiver propagation. Reuse the existing binding-factory and intrinsic-read checks. Correct detached call/apply alias fixtures to supply an actual receiver; creating an alias does not preserve JavaScript's implicit `this`. Keep the fixture setup outside the CLI/MCP test body. ## Contract and boundary impact - Semantic owner and earliest changed stage: static JavaScript intrinsic invocation normalization. - CLI/MCP/tool catalog: unchanged schemas; incorrect inferred window attribution is removed. - Provider/bridge/platform compatibility: none; shared static workflow. - Evidence/provenance: preserve original anchors, preload expressions and unresolved identity. - Execution/authorization/cleanup: none; target source remains inert. - Generated metadata/package/install impact: none; generated outputs remain ignored. ## Evidence and regression coverage - Pinned main `e4ac7bbfc`: triple-call and bound nested-call source cases fail. Both actual CLI/stdio MCP regressions report eight windows instead of seven. An apply/apply control already passes on main. - After the fix: the public fixture parses 12 files, retains all seven legitimate source anchors and preload uncertainty, and excludes ten intrinsic-poisoned modules plus the fake helper. - Source controls retain generic binding, capture timing, opaque arguments and fresh targets. Exact duplicate controls are omitted. - Remaining proof gap: arbitrary cross-call side effects are not evaluated. - [x] Observed, derived and inferred claims remain distinguishable. - [x] Artifact identity, source provenance and failed attempts remain preserved. - [x] Uncertain outcomes remain visible. ## Validation performed - `npm run test:focused -- …` — 488 tests across 11 files pass: 189 interop, 295 adjacent source/RPC and four production CLI/stdio MCP cases. - `npm run docs:check` — six tasks pass. - Normal pre-commit formatting/lint and pre-push `check:fast` typecheck/lint — pass. - Independent final-diff review and automated review on `f80e2b7` — no remaining blocker. The PR was merged while CI was running. Its eventual sole test failure was the static Wasm/Harmony wording audit; [#1917](https://github.com/morluto/rea/pull/1917) fixes that audit omission. The focused receiver regressions passed. - Public T3 nightly boot/main source subset (main SHA-256 `e566055ab42d104b413575920bb62ea7f43677e014ad840fd7319d69fc83cf1f`) — four windows, zero parse failures, both dynamic preload expressions preserved. This is a source subset, not full ASAR/runtime verification. - Bounded Flameox producer profile — 2,997 samples, 555 rows examined; invocation normalization accounts for nine self samples. CPU and RSS receipts retained locally; no speedup claim. ## Compatibility, safety, and release - Breaking changes/migration: none; correct static attribution with existing interfaces. - Real coverage: Linux x64 CLI/production stdio MCP; no target runtime or deep provider involved. - Package/release metadata: none. - Security/privacy/process: no target execution or expanded authority; fixture inputs throw if executed. ## Review checklist - [x] Concrete problem, focused outcome and conventional title. - [x] Related issue linked. - [x] Observable regressions and uncertainty/fresh-target controls covered. - [x] Owning documentation updated. - [x] Representative CLI/MCP output verified. - [x] Final diff checked for secrets, unrelated changes and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 00:56:36 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-11-01 21:42:10 +00:00

[PR #4901] [CLOSED] fix(process): retain kernel limit descriptor cleanup capability #6667

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#4901

No description provided.

Rows
Columns