fix(javascript): preserve builtin identity and share alias traversal

Track module writes and escapes at their owner, preserve capture and reassignment ordering, and share CommonJS/default namespace identity without erasing parent-slot changes. Carry write sites into ambient alias resolution and use parsed write targets across consumers. Deduplicate returned-reference work with cycle context; retain unchanged temporal selection identity so provenance memoization stays effective.

Reviewed fixes include #2041, #2465, #2830, #2881, and #2948. Remove superseded mutation representations and the ineffective per-markValue dedup layer.

Validation: 380 focused JavaScript tests passed under a 384 MiB heap cap, including the previously aborting 30-level/128-call alias regression. Six public CLI/MCP builtin tests passed. Exact pdf.js completed-workflow performance remains unmeasured.
This commit is contained in:
morluto
2026-10-14 08:44:52 +08:00
parent 0f4c484be5
commit 04672f2b91
34 changed files with 3778 additions and 321 deletions
@@ -1,7 +1,9 @@
import * as t from "@babel/types";
import { semanticBuiltinNamespacePath } from "./javascriptSemanticProvenance.js";
import {
BUILTIN_RESOURCE_SPECIFIERS,
BUILTIN_RESOURCE_METHODS,
} from "./javascriptBuiltinResourceMethods.js";
import type {
JavaScriptSemanticCallable,
JavaScriptSemanticResourceOperation,
@@ -13,6 +15,7 @@ import {
type JavaScriptSemanticBindingState,
} from "./javascriptSemanticState.js";
import {
builtinDataEffectMethod,
dataEffectMemberCallee,
outerDataEffectBinding,
traverseDataEffects,
@@ -20,14 +23,6 @@ import {
} from "./javascriptSemanticDataEffectHelpers.js";
import { range } from "./javascriptStaticAnalysisHelpers.js";
const ACQUIRE_METHODS = [
"open",
"openSync",
"createReadStream",
"createWriteStream",
"connect",
"createConnection",
] as const;
const RELEASE_METHODS = ["close", "destroy", "end"] as const;
interface ResourceCandidate {
@@ -137,58 +132,19 @@ const acquisitionMethod = (
callee: t.Node,
state: JavaScriptSemanticAnalysisState,
): JavaScriptSemanticResourceOperation["method"] | null => {
if (t.isIdentifier(callee)) {
const binding = resolveSemanticBindingState(state, callee, callee.name);
return methodFromBinding(binding);
}
if (!t.isMemberExpression(callee) && !t.isOptionalMemberExpression(callee))
return null;
const method = ACQUIRE_METHODS.find(
(candidate) =>
candidate ===
semanticStaticPropertyName(callee.property, callee.computed),
);
if (method === undefined || !t.isIdentifier(callee.object)) return null;
const binding = resolveSemanticBindingState(
state,
callee.object,
callee.object.name,
);
return resourceNamespace(binding) ? method : null;
};
const methodFromBinding = (
binding: JavaScriptSemanticBindingState | undefined,
): JavaScriptSemanticResourceOperation["method"] | null => {
for (const { specifier, importedPath } of binding?.directOrigins ?? []) {
if (!resourceModule(specifier)) continue;
const method = ACQUIRE_METHODS.find(
(candidate) => candidate === importedPath.at(-1),
);
if (method !== undefined) return method;
for (const specifier of BUILTIN_RESOURCE_SPECIFIERS) {
const method = builtinDataEffectMethod(callee, state, [specifier]);
if (
method !== null &&
(
BUILTIN_RESOURCE_METHODS[
specifier as keyof typeof BUILTIN_RESOURCE_METHODS
] as readonly string[]
).includes(method)
)
return method as JavaScriptSemanticResourceOperation["method"];
}
return null;
};
const resourceNamespace = (
binding: JavaScriptSemanticBindingState | undefined,
): boolean =>
binding?.directOrigins.some(
({ specifier, importedPath }) =>
resourceModule(specifier) && semanticBuiltinNamespacePath(importedPath),
) ?? false;
const resourceModule = (specifier: string): boolean =>
[
"fs",
"fs/promises",
"net",
"node:fs",
"node:fs/promises",
"node:net",
"node:tls",
"tls",
].includes(specifier);
const resourceCandidateId = (candidate: ResourceCandidate): string =>
`resource:acquire:${String(candidate.node.start ?? -1)}:${String(candidate.node.end ?? -1)}`;