fix(javascript): read utilityProcess.fork options from the argv slot (#6280)

Electron's utilityProcess.fork(modulePath[, args][, options]) treats a
non-array object in the second argument as the options and ignores the
third. The static extractor only read the third argument, so
`fork("./worker.js", { serviceName })` lost the declared name while
reporting exact, complete coverage, and an object in the second slot let
an ignored third argument supply the name.

Move the optional-argv options selection that child_process already used
into the shared expression-shape owner and reuse it for utility
processes. Unproven argv shapes, spreads and identifier options remain
unknown with partial coverage; nullish options or a nullish serviceName
declare no name, matching Electron's runtime checks.

Fixes #6208

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Kaoru0822
2026-10-22 01:17:40 -07:00
committed by GitHub
parent 2452efa921
commit 73b756430f
7 changed files with 126 additions and 36 deletions
@@ -7,7 +7,11 @@ import type {
JavaScriptSemanticChildProcessSpawn,
} from "./javascriptSemanticIr.js";
import { createSemanticCallableIdStack } from "./javascriptSemanticCallableStack.js";
import { createSemanticExpressionShapeResolver } from "./javascriptSemanticExpressionShapes.js";
import {
createSemanticExpressionShapeResolver,
optionsAfterOptionalArgv,
type JavaScriptExpressionShapeResolver,
} from "./javascriptSemanticExpressionShapes.js";
import {
semanticStaticPropertyName,
staticObjectProperty,
@@ -41,9 +45,7 @@ interface ChildProcessAnalysis {
readonly childProcessInteractions: readonly JavaScriptSemanticChildProcessInteraction[];
}
type ChildSpawnContext = ReturnType<
typeof createSemanticExpressionShapeResolver
>;
type ChildSpawnContext = JavaScriptExpressionShapeResolver;
interface SpawnCandidate {
readonly node: t.CallExpression | t.OptionalCallExpression;
@@ -381,22 +383,15 @@ const spawnArguments = (
const args = candidate.node.arguments;
if (t.isSpreadElement(args[0])) return { options: args[0], argvCount: null };
const second = args[1] && unwrapJavaScriptExpression(args[1]).node;
const third = args[2] && unwrapJavaScriptExpression(args[2]).node;
const expressionShape = context;
const argv =
candidate.method !== "exec" && t.isArrayExpression(second)
? second
: undefined;
// Only a proven argv array or nullish placeholder admits third-slot options.
// Otherwise the second argument may itself be options, ignoring the third.
// exec(command[, options][, callback]) has no argv slot.
const options =
candidate.method === "exec" || second === undefined
candidate.method === "exec"
? second
: argv !== undefined ||
expressionShape.isArray(second) ||
expressionShape.isNullish(second)
? third
: second;
: optionsAfterOptionalArgv(args, context);
return {
options,
argvCount: