morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #4338] [CLOSED] fix(javascript): verify loader origins, assignment operators, and bootstrap integrity in static analysis #6182

New issue

Closed

opened 2026-10-31 01:12:30 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:12:30 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/4338
Author: @1aifanatic
Created: 10/16/2026
Status: ❌ Closed

Base: main ← Head: fix/4202-native-addon-assignment-operator

📝 Commits (5)

dd08c86 fix(javascript): do not classify compound native-addon assignments as re-exports
37762fd fix(javascript): require proven loader origin for native-addon require bindings
f93dbab fix(javascript): extract native-addon bindings from optional require calls
e5693e2 fix(javascript): resolve computed slot keys in bootstrap module-table writes
a20f4f1 fix(javascript): invalidate bundled default-export getter after loader-alias writes

📊 Changes

7 files changed (+238 additions, -36 deletions)

View changed files

📝 src/domain/javascript/electronBundledRequireIdentity.test.ts (+23 -1)
📝 src/domain/javascript/electronNativeLoaderPaths.test.ts (+85 -0)
📝 src/domain/javascript/electronStaticAnalysis.ts (+3 -1)
📝 src/domain/javascript/electronStaticAnalysisNative.ts (+26 -12)
📝 src/domain/javascript/javascriptBootstrapIntegrity.ts (+77 -11)
📝 src/domain/javascript/javascriptBundledRequireOrigin.ts (+23 -10)
📝 src/domain/javascript/javascriptStaticAnalysis.ts (+1 -1)

📄 Description

Summary

Problem:
1. inspectReExport in src/domain/javascript/electronStaticAnalysisNative.ts treated arithmetic assignments (+=, -=, *=) to exports or module.exports as "re-export" rather than "require" (#4202).
2. nativeRequire in src/domain/javascript/electronStaticAnalysisNative.ts matched any Identifier named "require" or .require method call without verifying that require was an unshadowed loader binding (#3884), and dropped optional require?.(...) calls (#3885).
3. exposedSlotWrite in src/domain/javascript/javascriptBootstrapIntegrity.ts missed computed slot writes (load.m[key] = ...) on module tables, leaving false replaced BrowserWindow evidence (#3883).
4. canonicalWebpackInteropBindings in src/domain/javascript/javascriptBundledRequireOrigin.ts missed loader mutations performed through const aliases of bundled require helpers (#4229).
Outcome:
1. Arithmetic assignments to export targets are classified as "require" rather than direct "re-export".
2. Native-addon require(...) and require?.(...) calls delegate loader provenance and argument normalization to the shared semanticRequireCallAt owner, ignoring local .require methods and shadowed require bindings while retaining optional require?.(...) calls.
3. Computed module-table slot writes resolve constant keys (const key = 0, Number("45840")) and invalidate unproven runtime keys unless they match chunk installation (for (k in chunk) loader.m[k] = chunk[k]).
4. Mutations through loader aliases invalidate affected default-export getter properties.
Approach:
- Check node.operator === "=" in electronStaticAnalysisNative.ts.
- Pass JavaScriptSemanticAnalysisState to inspectElectronNativeNode and delegate call classification (including OptionalCallExpression) to semanticRequireCallAt.
- Resolve constant computed slot keys and guard runtime keys in javascriptBootstrapIntegrity.ts.
- Follow zero-projection binding initializers in mayReferToLoaderBinding in javascriptBundledRequireOrigin.ts.
Scope and authority impact: None; internal static JavaScript and Electron analysis fixes with no new capabilities or schema changes.
Linked issues: Closes #4202, Closes #3884, Closes #3885, Closes #3883, Closes #4229

Validation

Executed:
- npm run test:local -- src/domain/javascript/electronNativeLoaderPaths.test.ts src/domain/javascript/electronWrappedCallPaths.test.ts src/domain/javascript/electronBundledRequireIdentity.test.ts
- npm run check:fast
- npm run format:check
Not run / unavailable:
- Full npm run check:pr gate was not run for this focused domain change.

Performance and Evidence impact

Not performance-sensitive: Reuses existing AST scopes, binding environments, and symbol maps during static analysis; Evidence schemas and token footprint are unchanged.

Author readiness

Leave these unchecked until a human owner has reviewed the diff and validation evidence and is ready to request initial maintainer review.

A human contributor reviewed the final diff and owns this pull request.
Validation entries above report only checks that actually ran, and unavailable coverage is explicit.
Scope, authority, and user-visible changes are accurately described.

Human owner:

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/4338 **Author:** [@1aifanatic](https://github.com/1aifanatic) **Created:** 10/16/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/4202-native-addon-assignment-operator` --- ### 📝 Commits (5) - [`dd08c86`](https://github.com/morluto/rea/commit/dd08c86d04999837edc91f939908fe5878e20159) fix(javascript): do not classify compound native-addon assignments as re-exports - [`37762fd`](https://github.com/morluto/rea/commit/37762fdd86f53a40fecd029925c7156c5a8773e7) fix(javascript): require proven loader origin for native-addon require bindings - [`f93dbab`](https://github.com/morluto/rea/commit/f93dbab55b75f552e21d6d5078abd8161f84bed0) fix(javascript): extract native-addon bindings from optional require calls - [`e5693e2`](https://github.com/morluto/rea/commit/e5693e258c789caef3ec2b92edc7fb65b8c1ba6c) fix(javascript): resolve computed slot keys in bootstrap module-table writes - [`a20f4f1`](https://github.com/morluto/rea/commit/a20f4f195821c8ab3d4b3588c635499e08268c1e) fix(javascript): invalidate bundled default-export getter after loader-alias writes ### 📊 Changes **7 files changed** (+238 additions, -36 deletions) <details> <summary>View changed files</summary> 📝 `src/domain/javascript/electronBundledRequireIdentity.test.ts` (+23 -1) 📝 `src/domain/javascript/electronNativeLoaderPaths.test.ts` (+85 -0) 📝 `src/domain/javascript/electronStaticAnalysis.ts` (+3 -1) 📝 `src/domain/javascript/electronStaticAnalysisNative.ts` (+26 -12) 📝 `src/domain/javascript/javascriptBootstrapIntegrity.ts` (+77 -11) 📝 `src/domain/javascript/javascriptBundledRequireOrigin.ts` (+23 -10) 📝 `src/domain/javascript/javascriptStaticAnalysis.ts` (+1 -1) </details> ### 📄 Description ## Summary - Problem: 1. `inspectReExport` in `src/domain/javascript/electronStaticAnalysisNative.ts` treated arithmetic assignments (`+=`, `-=`, `*=`) to `exports` or `module.exports` as `"re-export"` rather than `"require"` (#4202). 2. `nativeRequire` in `src/domain/javascript/electronStaticAnalysisNative.ts` matched any `Identifier` named `"require"` or `.require` method call without verifying that `require` was an unshadowed loader binding (#3884), and dropped optional `require?.(...)` calls (#3885). 3. `exposedSlotWrite` in `src/domain/javascript/javascriptBootstrapIntegrity.ts` missed computed slot writes (`load.m[key] = ...`) on module tables, leaving false replaced `BrowserWindow` evidence (#3883). 4. `canonicalWebpackInteropBindings` in `src/domain/javascript/javascriptBundledRequireOrigin.ts` missed loader mutations performed through `const` aliases of bundled require helpers (#4229). - Outcome: 1. Arithmetic assignments to export targets are classified as `"require"` rather than direct `"re-export"`. 2. Native-addon `require(...)` and `require?.(...)` calls delegate loader provenance and argument normalization to the shared `semanticRequireCallAt` owner, ignoring local `.require` methods and shadowed `require` bindings while retaining optional `require?.(...)` calls. 3. Computed module-table slot writes resolve constant keys (`const key = 0`, `Number("45840")`) and invalidate unproven runtime keys unless they match chunk installation (`for (k in chunk) loader.m[k] = chunk[k]`). 4. Mutations through loader aliases invalidate affected default-export getter properties. - Approach: - Check `node.operator === "="` in `electronStaticAnalysisNative.ts`. - Pass `JavaScriptSemanticAnalysisState` to `inspectElectronNativeNode` and delegate call classification (including `OptionalCallExpression`) to `semanticRequireCallAt`. - Resolve constant computed slot keys and guard runtime keys in `javascriptBootstrapIntegrity.ts`. - Follow zero-projection binding initializers in `mayReferToLoaderBinding` in `javascriptBundledRequireOrigin.ts`. - Scope and authority impact: None; internal static JavaScript and Electron analysis fixes with no new capabilities or schema changes. - Linked issues: Closes #4202, Closes #3884, Closes #3885, Closes #3883, Closes #4229 ## Validation - Executed: - `npm run test:local -- src/domain/javascript/electronNativeLoaderPaths.test.ts src/domain/javascript/electronWrappedCallPaths.test.ts src/domain/javascript/electronBundledRequireIdentity.test.ts` - `npm run check:fast` - `npm run format:check` - Not run / unavailable: - Full `npm run check:pr` gate was not run for this focused domain change. ## Performance and Evidence impact - Not performance-sensitive: Reuses existing AST scopes, binding environments, and symbol maps during static analysis; Evidence schemas and token footprint are unchanged. ## Author readiness Leave these unchecked until a human owner has reviewed the diff and validation evidence and is ready to request initial maintainer review. - [ ] A human contributor reviewed the final diff and owns this pull request. - [ ] Validation entries above report only checks that actually ran, and unavailable coverage is explicit. - [ ] Scope, authority, and user-visible changes are accurately described. Human owner:  --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:12:30 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-11-01 21:46:02 +00:00

[PR #6182] [MERGED] refactor: consolidate remaining legacy contract ownership #7190

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#6182

No description provided.

Rows
Columns