mirror of
https://github.com/morluto/rea.git
synced 2026-11-09 16:26:36 +00:00
2c27c2a43b
* feat(electron): report V8 cachedData execution boundaries
analyze-javascript-application treated new vm.Script(source, {cachedData}) and vm.compileFunction(..., {cachedData}) as ordinary source. V8 deserializes previously compiled bytecode for those calls, so an Electron preload wrapper that delegates its whole contextBridge and IPC surface to a .cache/.jsc snapshot appeared to have been fully analyzed with zero exposed APIs.
Record each vm compilation with its inert cache path when the cachedData value traces to a readFileSync/readFile of path syntax, and project a cached-data execution unknown plus a loads edge from the owning source. Compilations without a cache stay recorded as no-cached-data so absence remains distinguishable from an unparsed snapshot. Count cachedData executions in the Electron summary and state the coverage limit in the graph limitations.
* style(cli): wrap the native data type path description
The `inspect-native-data-type` argument description line is 82 columns, over the repository's 80-column `.oxfmtrc.json` limit, so `npm run format:check` fails on main and on every branch merged from it. It came in with #9465 and the following commits to this file did not touch it. Reformat the one call the formatter objects to; no behaviour change.
* style(domain): reformat the pending dynamic-code accumulator field
`npm run format:check` fails on this branch, which is what `Static checks` reports: oxfmt wants the `pendingDynamicCode` union on one line. Applying it is the whole change; no behaviour is touched.
* fix(electron): preserve VM callable and cache source uncertainty
* docs(javascript): specify cached-data compilation boundaries
* fix(electron): exclude disabled caches from recovered boundaries
---------
Co-authored-by: 2SinceJuly <202121119+2SinceJuly@users.noreply.github.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
44 lines
2.3 KiB
Markdown
44 lines
2.3 KiB
Markdown
# V8 cached-data compilation boundaries
|
|
|
|
## Analyst question
|
|
|
|
Which source-visible Node VM compilation sites declare or may receive cached
|
|
bytes, and which admitted artifact can be associated with those bytes?
|
|
|
|
## Scope and authority
|
|
|
|
Static application analysis recognizes member calls to `vm.Script` and
|
|
`vm.compileFunction` when the shared built-in callable owner establishes their
|
|
identity. Analysis reads admitted source and inventory only. It does not invoke
|
|
the target, validate V8 cache bytes, establish cache acceptance, or execute code.
|
|
Node separates compilation, cache rejection and subsequent execution; see the
|
|
[Node VM contract](https://nodejs.org/docs/latest-v24.x/api/vm.html).
|
|
|
|
## Owning facts
|
|
|
|
- Resolve complete callable identity after shared mutation facts settle. ESM
|
|
default/namespace imports and proven CommonJS bindings use the same owner.
|
|
Replaced methods do not establish VM authority.
|
|
- `cached_data_status` is `declared` for an explicit cachedData property,
|
|
`absent` for proven omission or a proven undefined cache value, and `unknown` for unresolved options or argument
|
|
spreads that can supply or shift the options position. Declaration does not
|
|
prove a valid runtime value or successful cache use.
|
|
- A proven `fs.readFileSync` or awaited `fs/promises.readFile` can identify a
|
|
cache path. Unawaited promises and unproven readers retain bounded source
|
|
expressions. A supplied string alone is not proof that a file was read.
|
|
- Preserve the parsed path base through the worker boundary. Only a proven
|
|
source-directory base permits an application inventory lookup. Relative
|
|
literal paths depend on the unknown target working directory; source paths
|
|
and unresolved expressions stay separate from resolved artifact identity.
|
|
- Graph cache boundaries remain explicit unknowns with source provenance.
|
|
Absent sites do not add cache-boundary uncertainty. Summary counts describe
|
|
declared compilations, never observed executions.
|
|
|
|
## Compatibility and verification
|
|
|
|
Existing source declarations and inventory remain available. Optional path-base
|
|
facts may be absent in historical analyses; omission does not prove a base.
|
|
Public application workflows verify worker serialization, summary and graph
|
|
projection with local files. No test that merely supplies cache-shaped bytes
|
|
establishes real V8 acceptance or target execution.
|