cfsolve 0.1.1 → 0.1.2

data/vendor/cfsolve/src/stage2/analysis/analyze.rs

@@ -9,14 +9,15 @@ use serde::Serialize;
 use super::recognize::{ProbeView, Strings};
 use super::{audit, controller, discovery, envelope};
 use crate::candidates;
-use crate::js::JsValue;
+use crate::js::{JsObject, JsValue};
 use crate::listing::Index;
 use crate::script::Source;
 use crate::stage2::payload::{self, Layout};
 use crate::stage2::records::{Envelope, Probe, ProbePlan, WriteOrder};
-use crate::stage2::registry::{AUDIT_PROBE, Operation};
+use crate::stage2::reference::ISOLATION_FAILURE_FIELDS;
+use crate::stage2::registry::{AUDIT_PROBE, Kind, Operation};
 use crate::stage2::trace::Trace;
-use crate::stage2::vocabulary::Vocabulary;
+use crate::stage2::vocabulary::{self, Vocabulary};
 use crate::vm::{Failure, Position};
 
 /// A recovered probe plan with supporting analysis evidence.
@@ -66,8 +67,8 @@ impl Analysis {
             function: (evidence.function.pc, evidence.function.key),
             operation: probe.operation.as_ref(),
             features: &probe.features,
-            expanded_features: &probe.expanded_features,
             writes: &probe.writes,
+            replay_literals: &probe.replay_literals,
             reference: evidence.reference,
         });
         Artifact {
@@ -112,8 +113,8 @@ struct ProbeArtifact<'analysis> {
     function: (u32, u8),
     operation: Option<&'analysis Operation>,
     features: &'analysis [String],
-    expanded_features: &'analysis [String],
     writes: &'analysis WriteOrder,
+    replay_literals: &'analysis JsObject,
     reference: Option<usize>,
 }
 
@@ -122,23 +123,10 @@ pub fn analyze(source: &Source, program: &[u8]) -> Result<Analysis> {
     // Include `cf-chl-peek` when resolving hashed comparisons. The worker-fetch probe reads
     // this header but does not store its name as a program string.
     let machine = source.machine()?;
-    let mut listing = machine.disassemble_from(program, &[machine.entry()], &["cf-chl-peek"])?;
-    crate::listing::normalize::constants(&mut listing);
+    let listing = machine.disassemble_from(program, &[machine.entry()], &["cf-chl-peek"])?;
     let index = Index::new(&listing);
     let (pool_pc, pool) = index.pool()?;
     let discovery = discovery::discover(&index, pool)?;
-    let session_features: Vec<&[String]> = discovery
-        .probes
-        .iter()
-        .map(|probe| probe.features.as_slice())
-        .collect();
-    let mut vocabulary = Vocabulary::infer(&session_features);
-    let expanded_features: Vec<&[String]> = discovery
-        .probes
-        .iter()
-        .map(|probe| probe.expanded_features.as_slice())
-        .collect();
-    vocabulary.extend_expanded(&expanded_features);
     let mut wrapper: BTreeSet<String> = discovery
         .probes
         .first()
@@ -147,27 +135,29 @@ pub fn analyze(source: &Source, program: &[u8]) -> Result<Analysis> {
     for probe in &discovery.probes {
         wrapper.retain(|text| probe.features.contains(text));
     }
+    // Builds with hex names decode program-wide names, such as the record envelope's, in every
+    // probe instead of loading them once in the header. Recognizers treat them as header names.
+    let hex_names = wrapper.iter().filter(|text| vocabulary::is_hex_name(text));
+    let header: BTreeSet<String> = index.header().values().chain(hex_names).cloned().collect();
+    let session_features: Vec<&[String]> = discovery
+        .probes
+        .iter()
+        .map(|probe| probe.features.as_slice())
+        .collect();
+    let mut vocabulary = Vocabulary::infer(&session_features);
     for (position, raw) in discovery.probes.iter().enumerate() {
-        if let Some(reference) = vocabulary.partner(position) {
-            vocabulary.pin(
-                position,
-                super::outputs::names(&index, raw.function.pc, reference, &wrapper),
-            );
-        }
         if vocabulary.partner(position) == Some(AUDIT_PROBE)
             && let Some(names) = audit::names(&index, &raw.writes.fields)
         {
             vocabulary.pin(position, names);
         }
     }
-    let mut header: BTreeSet<String> = index.header().values().cloned().collect();
-    header.extend(envelope::counter(&index, &discovery.creation));
     let mut probes = Vec::new();
     let mut evidence = Vec::new();
     for (position, raw) in discovery.probes.into_iter().enumerate() {
         let to_reference = |text: &String| vocabulary.to_reference(position, text).to_owned();
         let features: Vec<String> = raw.features.iter().map(to_reference).collect();
-        let outputs: BTreeSet<String> = raw.writes.fields.iter().map(to_reference).collect();
+        let outputs: BTreeSet<String> = raw.outputs.iter().map(to_reference).collect();
         let reference = vocabulary.partner(position);
         // Treat an unrecognized computed probe as a device fact and replay its paired reference
         // answer.
@@ -184,14 +174,38 @@ pub fn analyze(source: &Source, program: &[u8]) -> Result<Analysis> {
             strings: Strings::new(&features, &outputs),
         })
         .or(reference.map(|reference| Operation::Replay { reference }));
+        let mut replay_literals = JsObject::new();
+        // The last history result write is its exception branch. The eval callback reports the
+        // same failure marker. Both are program literals.
+        if reference.and_then(Kind::from_reference) == Some(Kind::Isolation)
+            && let Some(marker) = index
+                .stores()
+                .iter()
+                .rev()
+                .filter(|store| {
+                    vocabulary.to_reference(position, &store.key) == ISOLATION_FAILURE_FIELDS[1]
+                })
+                .find_map(|store| {
+                    index
+                        .text(store.pc, &store.value)
+                        .filter(|text| vocabulary::is_hex_name(text))
+                })
+        {
+            for name in ISOLATION_FAILURE_FIELDS {
+                replay_literals.insert(
+                    vocabulary.to_session(position, name).to_owned(),
+                    JsValue::String(marker.clone()),
+                );
+            }
+        }
         probes.push(Probe {
             index: raw.index,
             token: raw.token,
             input: raw.input,
             operation,
             features: raw.features,
-            expanded_features: raw.expanded_features,
             writes: raw.writes,
+            replay_literals,
         });
         evidence.push(ProbeEvidence {
             states: raw.states,
@@ -228,12 +242,15 @@ pub fn analyze(source: &Source, program: &[u8]) -> Result<Analysis> {
     })
 }
 
-/// Finds the frame left by the probe immediately before the uniquely paired environment audit.
-/// If the audit runs first, retains the iframe's root frames.
+/// The early audit runs in the worker-navigator continuation if that probe has finished.
+/// Synchronous probes between the worker and the audit do not replace that continuation.
+/// Without a preceding worker, the iframe callback remains the controller frame.
 fn controller_frame(index: &Index<'_>, evidence: &[ProbeEvidence], push: &str) -> Option<String> {
     let audits =
         (0..evidence.len()).filter(|&position| evidence[position].reference == Some(AUDIT_PROBE));
     let position = candidates::exactly_one(audits, "environment audit").ok()?;
-    let preceding = evidence.get(position.checked_sub(1)?)?;
-    controller::controller_trace(index, push, preceding.function.pc)
+    let worker = evidence[..position].iter().rev().find(|probe| {
+        probe.reference.and_then(Kind::from_reference) == Some(Kind::WorkerNavigator)
+    })?;
+    controller::controller_trace(index, push, worker.function.pc)
 }

data/vendor/cfsolve/src/stage2/analysis/discovery.rs

@@ -40,7 +40,8 @@ pub(super) struct RawProbe {
     pub function: Position,
     /// Collection-function strings in order, including duplicates.
     pub features: Vec<String>,
-    pub expanded_features: Vec<String>,
+    /// The names it stores into registers or properties.
+    pub outputs: BTreeSet<String>,
     pub writes: WriteOrder,
 }
 
@@ -128,8 +129,7 @@ pub(super) fn discover(index: &Index<'_>, pool: &str) -> Result<ProbeDiscovery>
                 _ => None,
             })
             .context("probe has no collection function")?;
-        let (features, expanded_features) =
-            collection_strings(index, function.pc, &dispatcher, pool);
+        let (features, outputs) = collection_strings(index, function.pc, &dispatcher);
         traced.push(trace_writes(index, function.pc, &dispatcher));
         probes.push(RawProbe {
             index: index_one,
@@ -138,7 +138,7 @@ pub(super) fn discover(index: &Index<'_>, pool: &str) -> Result<ProbeDiscovery>
             input,
             function,
             features,
-            expanded_features,
+            outputs,
             writes: WriteOrder::default(),
         });
     }
@@ -244,23 +244,10 @@ fn collection_strings(
     index: &Index<'_>,
     entry: u32,
     dispatcher: &RangeInclusive<u32>,
-    pool: &str,
-) -> (Vec<String>, Vec<String>) {
+) -> (Vec<String>, BTreeSet<String>) {
     let mut strings: BTreeMap<u32, Vec<String>> = BTreeMap::new();
-    let mut expanded: BTreeMap<u32, Vec<String>> = BTreeMap::new();
+    let mut outputs = BTreeSet::new();
     let outside = |pc: u32| !dispatcher.contains(&pc);
-    // Keep the original feature sequence stable as newly recovered exception paths add
-    // evidence. The expanded sequence includes those paths for cross-build name recovery.
-    let ordinary = query::walk(
-        index.listing(),
-        entry,
-        outside,
-        |pc, instruction, pending| {
-            pending.extend(instruction.exits());
-            pending.extend(index.closures_in(pc..=pc));
-            pending.extend(index.hidden_at(pc).iter().map(|hidden| hidden.target.pc));
-        },
-    );
     query::walk(
         index.listing(),
         entry,
@@ -269,62 +256,64 @@ fn collection_strings(
             pending.extend(instruction.exits());
             for path in &instruction.paths {
                 let mut at_pc = Vec::new();
-                let mut expanded_at_pc = Vec::new();
                 for effect in &path.effects {
-                    effect.visit_terms(&mut |term| {
-                        if let Some(text) = index
-                            .text(pc, term)
-                            .filter(|text| text.len() <= FEATURE_LENGTH)
-                        {
-                            let decoded = (text.starts_with('\0') || text.starts_with("ÿÿ"))
-                                .then(|| listing::decode_string(&text, pool).ok())
-                                .flatten()
-                                .filter(|decoded| crate::stage2::vocabulary::is_name(decoded));
-                            let text = decoded.unwrap_or(text);
-                            if !expanded_at_pc.contains(&text) {
-                                expanded_at_pc.push(text);
-                            }
-                        }
-                    });
+                    let output = match effect {
+                        Effect::Set(_, term) => Some(term),
+                        Effect::SetProperty { key, .. } => Some(&**key),
+                        _ => None,
+                    };
+                    if let Some(Term::Const(Constant::String(name))) = output {
+                        outputs.insert(name.clone());
+                    }
                     effect.visit_terms(&mut |term| match term {
                         Term::Const(Constant::String(text)) if text.len() <= FEATURE_LENGTH => {
-                            let decoded = (text.starts_with('\0') || text.starts_with("ÿÿ"))
-                                .then(|| listing::decode_string(text, pool).ok())
-                                .flatten()
-                                .filter(|decoded| crate::stage2::vocabulary::is_name(decoded));
-                            let text = decoded.as_ref().unwrap_or(text);
                             if !at_pc.contains(text) {
                                 at_pc.push(text.clone());
                             }
                         }
                         Term::Closure { pc, .. } => pending.push(*pc),
-                        // A frame pushed for a catch handler: [pc, key, ...].
-                        Term::Array(frame) => {
-                            pending.extend(vm::catch_frame(frame).map(|handler| handler.pc));
-                        }
+                        // Exception results are recovered separately from collection paths.
                         _ => {}
                     });
                 }
-                if ordinary.contains(&pc) {
-                    strings.entry(pc).or_default().extend(at_pc);
-                }
-                expanded.entry(pc).or_default().extend(expanded_at_pc);
+                strings.entry(pc).or_default().extend(at_pc);
             }
             for hidden in index.hidden_at(pc) {
-                if ordinary.contains(&pc) {
-                    strings.entry(pc).or_default().push(hidden.string.clone());
-                }
-                expanded.entry(pc).or_default().push(hidden.string.clone());
+                strings.entry(pc).or_default().push(hidden.string.clone());
                 pending.push(hidden.target.pc);
             }
         },
     );
     (
-        strings.into_values().flatten().collect(),
-        expanded.into_values().flatten().collect(),
+        without_inline_descriptors(strings.into_values().flatten()),
+        outputs,
     )
 }
 
+/// Drops string descriptors the program decodes in place, keeping the decoded text that follows
+/// each one (see `vm::packed_names`). Other builds decode descriptors where the listing cannot
+/// follow, so recognizers read those descriptors themselves.
+fn without_inline_descriptors(strings: impl Iterator<Item = String>) -> Vec<String> {
+    // An inline descriptor: a two-unit big-endian length, then at least that much text.
+    let describes = |descriptor: &str, text: &str| {
+        let units: Vec<u16> = descriptor.encode_utf16().collect();
+        let [high @ 0..=255, low @ 0..=255, rest @ ..] = units.as_slice() else {
+            return false;
+        };
+        let length = usize::from(*high) * 256 + usize::from(*low);
+        rest.get(..length)
+            .is_some_and(|described| described.iter().copied().eq(text.encode_utf16()))
+    };
+    let mut kept: Vec<String> = Vec::new();
+    for text in strings {
+        if kept.last().is_some_and(|last| describes(last, &text)) {
+            kept.pop();
+        }
+        kept.push(text);
+    }
+    kept
+}
+
 /// Writes made by a collection function, in execution order.
 #[derive(Default)]
 struct Writes {
@@ -369,22 +358,11 @@ impl Writes {
             .min()
         else {
             return WriteOrder {
-                internal: Vec::new(),
                 fields: self.fields,
                 late: Vec::new(),
             };
         };
         let descriptors: HashSet<u32> = descriptor_pushes.iter().map(|push| push.object).collect();
-        let internal: Vec<String> = self
-            .body_stores
-            .iter()
-            .filter(|store| {
-                store
-                    .object
-                    .is_some_and(|object| descriptors.contains(&object))
-            })
-            .map(|store| store.key.clone())
-            .collect();
         // Objects stored into a descriptor hold its defaults.
         let defaults: HashSet<u32> = self
             .body_stores
@@ -409,7 +387,6 @@ impl Writes {
             .cloned()
             .collect();
         WriteOrder {
-            internal,
             fields: self.fields,
             late,
         }
@@ -540,3 +517,21 @@ fn pushed_object(
         stores_before,
     })
 }
+
+#[cfg(test)]
+mod tests {
+    use super::without_inline_descriptors;
+
+    #[test]
+    fn drops_only_descriptors_followed_by_their_text() {
+        let strings = [
+            "\0\u{3}abc\0\0", // decoded in place
+            "abc",
+            "\0\u{3}xyz\0", // decoded elsewhere
+            "toString",     // reads as an oversized length
+            "String",
+        ];
+        let kept = without_inline_descriptors(strings.into_iter().map(String::from));
+        assert_eq!(kept, ["abc", "\0\u{3}xyz\0", "toString", "String"]);
+    }
+}

data/vendor/cfsolve/src/stage2/analysis/envelope.rs

@@ -3,7 +3,6 @@
 use std::collections::BTreeSet;
 
 use anyhow::{Context, Result};
-use swc_core::ecma::ast::BinaryOp;
 
 use crate::js::JsValue;
 use crate::listing::fold::{Frame, Known};
@@ -13,22 +12,6 @@ use crate::stage2::payload::RecordLiteral;
 use crate::stage2::records::{Completion, Envelope, INITIAL_STATUS, Probe};
 use crate::vm::{Effect, Term};
 
-pub(super) fn counter(index: &Index<'_>, creation: &BTreeSet<u32>) -> Option<String> {
-    let fields: BTreeSet<String> = index
-        .stores()
-        .iter()
-        .filter(|store| creation.contains(&store.pc))
-        .filter(|store| {
-            matches!(
-                index.dereference(store.pc, &store.value),
-                Some((_, Term::Binary(BinaryOp::Add, _, _)))
-            )
-        })
-        .map(|store| store.key.clone())
-        .collect();
-    crate::candidates::exactly_one(fields, "record counter").ok()
-}
-
 /// Recovers record-envelope fields: creation counter, literal token and input, wrapper status
 /// and message, and completion timestamps and duration.
 pub(super) fn recover(
@@ -40,7 +23,28 @@ pub(super) fn recover(
     literals: &[RecordLiteral],
 ) -> Result<Envelope> {
     let listing = index.listing();
-    let counter = counter(index, creation).context("record counter field not found")?;
+    let header = index.header();
+    // The counter's key is a header register, or, in programs that unpack names where they
+    // use them, a register loaded in the creation state.
+    let keys = || {
+        let instructions = creation
+            .iter()
+            .filter_map(|pc| listing.instructions.get(pc));
+        instructions.flat_map(|instruction| {
+            instruction
+                .effects()
+                .filter_map(move |effect| match effect {
+                    Effect::SetProperty { key, .. } if let Term::Reg(register) = **key => {
+                        Some((instruction.pc, register))
+                    }
+                    _ => None,
+                })
+        })
+    };
+    let counter = keys()
+        .find_map(|(_, register)| header.get(&register).cloned())
+        .or_else(|| keys().find_map(|(pc, register)| index.text(pc, &Term::Reg(register))))
+        .context("record counter field not found")?;
     let written_from = |matches: &dyn Fn(&Probe, &JsValue) -> bool| {
         literals
             .iter()
@@ -63,11 +67,17 @@ pub(super) fn recover(
         },
     );
     let wrapper = property_values(index, &main);
+    // Prefers header names, as for the counter.
     let wrapper_field = |what: &str, wanted: fn(&Known<Term>) -> bool| {
-        wrapper
+        let mut fields = wrapper
             .iter()
-            .find(|(_, value)| wanted(value))
-            .map(|(field, _)| field.clone())
+            .filter(|(_, value)| wanted(value))
+            .map(|(field, _)| field);
+        fields
+            .clone()
+            .find(|field| header.values().any(|name| name == *field))
+            .or_else(|| fields.next())
+            .cloned()
             .with_context(|| format!("record {what} field not found"))
     };
     let status = wrapper_field("status", |value| {

data/vendor/cfsolve/src/stage2/analysis/recognize.rs

@@ -57,10 +57,8 @@ impl<'probe> Strings<'probe> {
     /// Decodes the inline descriptor after the first occurrence of `text` that has one.
     #[must_use]
     pub(crate) fn decoded_after(&self, text: &str) -> Option<String> {
-        self.features
-            .windows(2)
-            .filter(|pair| pair[0] == text && pair[1].starts_with('\0'))
-            .find_map(|pair| listing::decode_string(&pair[1], "").ok())
+        let pair = self.features.windows(2).find(|pair| pair[0] == text)?;
+        listing::decode_string(&pair[1], "").ok()
     }
 
     /// Returns the first inline-decoded string starting with `prefix`.
@@ -168,7 +166,7 @@ mod tests {
     #[test]
     fn each_recognizer_recovers_only_its_own_reference_probe() {
         let probes = &REFERENCE.probes;
-        assert_eq!(probes.len(), 38);
+        assert_eq!(probes.len(), 39);
         for kind in [
             Kind::Media,
             Kind::PrivateToken,

data/vendor/cfsolve/src/stage2/analysis.rs

@@ -16,7 +16,6 @@ mod controller;
 mod discovery;
 mod envelope;
 mod outcome;
-mod outputs;
 pub(crate) mod recognize;
 
 pub use analyze::{Analysis, Artifact, ProbeEvidence, analyze};