try to build an extended version of node to log every undefined property visiting

[jackfromeast]

What is the problem this feature will solve?

Hi there!

I am trying to build an extended version of node to print every undefined property visiting in the javascript code. For example, given the javascript code:

// test.js
let a = {}
console.log(a.b)

and when I run the expended node on this file, like ./node_detect_undefined test.js, I am expected to see that the property name b has been printed out.

What is the feature you are proposing to solve the problem?

To achieve this feature, I tired to add the following code in the node-18.14.0/deps/v8/src/runtime/runtime-object.cc::Runtime::GetObjectProperty where looks like the place that the object's properties has been looked up.

MaybeHandle<Object> Runtime::GetObjectProperty(
    Isolate* isolate, Handle<Object> lookup_start_object, Handle<Object> key,
    Handle<Object> receiver, bool* is_found) {
  // ...
  bool success = false;
  PropertyKey lookup_key(isolate, key, &success);
  if (!success) return MaybeHandle<Object>();
  LookupIterator it =
      LookupIterator(isolate, receiver, lookup_key, lookup_start_object);

  MaybeHandle<Object> result = Object::GetProperty(&it);
  
  // add
   if(result.ToHandleChecked()->IsUndefined(isolate)){
    printf("[!] Found undefined property: ");
    key->Print(std::cout);
    printf("\n");
   }
...

However, it doesn't work and outputs the following content:

ubuntu@ip-172-31-26-180:~/node-18.14.0$ ./node_g test.js
[!] Found undefined property: 0x330464033d11: [Symbol] in OldSpace
 - map: 0x2a608ddc18b9 <Map[24]>
 - hash: 1024201766
 - description: 0x3aabf4309589 <String[7]: #kHandle>
 - private: 0
 - private_name: 0
 - private_brand: 0
[!] Found undefined property: 0x330464033d11: [Symbol] in OldSpace
 - map: 0x2a608ddc18b9 <Map[24]>
 - hash: 1024201766
 - description: 0x3aabf4309589 <String[7]: #kHandle>
 - private: 0
 - private_name: 0
 - private_brand: 0
[!] Found undefined property: 0x330464033d11: [Symbol] in OldSpace
 - map: 0x2a608ddc18b9 <Map[24]>
 - hash: 1024201766
 - description: 0x3aabf4309589 <String[7]: #kHandle>
 - private: 0
 - private_name: 0
 - private_brand: 0
[!] Found undefined property: 0x620c7cd5951: [String] in OldSpace: #/home/ubuntu/node-18.14.0/test.js\x00
[!] Found undefined property: 0x620c7cda8b1: [String] in OldSpace: #MODULE
[!] Found undefined property: 0x620c7cdaf61: [String] in OldSpace: #/home/ubuntu/node-18.14.0/test.js
undefined
[!] Found undefined property: 0x3aabf431aa01: [String] in OldSpace: #exitCode
[!] Found undefined property: 0x620c7cf1c31: [String] in OldSpace: #beforeExit
[!] Foundundefined property: 0x3aabf431aa01: [String] in OldSpace: #exitCode
[!] Found undefined property: 0x3aabf431aa01: [String] in OldSpace: #exitCode

And then, I tried to modify the test.js code to get more undefined properties involved:

let a = {}
console.log(a.c)
console.log(a.d)
console.log(a.e)
console.log(a.f)
console.log(a.g)

but the output seems doesn't change:

[!] Found undefined property: 0x1f624a633d11: [Symbol] in OldSpace
 - map: 0x19047c5818b9 <Map[24]>
 - hash: 792699704
 - description: 0x00bb59a89589 <String[7]: #kHandle>
 - private: 0
 - private_name: 0
 - private_brand: 0
[!] Found undefined property: 0x1f624a633d11: [Symbol] in OldSpace
 - map: 0x19047c5818b9 <Map[24]>
 - hash: 792699704
 - description: 0x00bb59a89589 <String[7]: #kHandle>
 - private: 0
 - private_name: 0
 - private_brand: 0
[!] Found undefined property: 0x1f624a633d11: [Symbol] in OldSpace
 - map: 0x19047c5818b9 <Map[24]>
 - hash: 792699704
 - description: 0x00bb59a89589 <String[7]: #kHandle>
 - private: 0
 - private_name: 0
 - private_brand: 0
[!] Found undefined property: 0xee32a615951: [String] in OldSpace: #/home/ubuntu/node-18.14.0/test.js\x00
[!] Found undefined property: 0xee32a61a8b1: [String] in OldSpace: #MODULE
[!] Found undefined property: 0xee32a61af61: [String] in OldSpace: #/home/ubuntu/node-18.14.0/test.js
undefined
undefined
undefined
undefined
undefined
[!] Found undefined property: 0xbb59a9aa01: [String] in OldSpace: #exitCode
[!] Found undefined property: 0xee32a631d99: [String] in OldSpace: #beforeExit
[!] Found undefined property: 0xbb59a9aa01: [String] in OldSpace: #exitCode
[!] Found undefined property: 0xbb59a9aa01: [String] in OldSpace: #exitCode

I'm starting to question whether I should add the code somewhere else, or if the code I've written is unable to determine whether it's undefined or not.

What alternatives have you considered?

Can someone with more familiarity with Node.js and V8 provide me with some ideas on how to implement this feature? It doesn't seem like a very complicated task, so any suggestions or advice would be greatly appreciated.

[bnoordhuis]

I've converted this to a discussion because it's not the kind of feature request that's likely to get adopted.

Can someone with more familiarity with Node.js and V8 provide me with some ideas on how to implement this feature? It doesn't seem like a very complicated task, so any suggestions or advice would be greatly appreciated.

If you search the v8-dev and v8-users mailing lists, you can find threads where people ask the same question.

Unfortunately, it is a rather complicated task because V8 is a JIT compiler. That C++ code you found is not the common path. V8 normally emits machine code at runtime that loads values directly.

You may have seen *.tq files in deps/v8/src. Torque is V8's homegrown C++ lookalike for writing that machine code at a slightly higher level of abstraction than raw assembly (of which there is plenty inside V8 too, by the way.)

[jackfromeast]

Thanks, @bnoordhuis!

Do you have any suggestions on which part of V8 I should focus on to implement a specific feature? I'm unsure about V8's behavior after it compiles js into bytecodes; does V8 still rely on its runtime system to execute the bytecode? If so, is it possible to intercept and modify property lookups at that stage? Besides the c++ part that I have found, where are the other paths that are also used for property visiting?

[bnoordhuis]

V8 is big and complex. I can't really do it justice in just a few paragraphs but I don't want to write up a multi-page document either. :-)

Bits and pieces have been discussed on the V8 mailing lists before so I would recommend you consult those threads. Apart from that it's a matter of reading the code (of which there is lots, unfortunately.)

[j4k0xb]

it is a rather complicated task because V8 is a JIT compiler

It can be disabled with node --jitless, then the bytecode will be interpreted and you should be able to easily log property accesses
Also V8 heavily relies on inline caches (IC) instead of the runtime function GetObjectProperty
Should do it here for a.b:

node/deps/v8/src/interpreter/interpreter-generator.cc

Lines 541 to 574 in 7feff24

	// GetNamedProperty <object> <name_index> <slot>
	//
	// Calls the LoadIC at FeedBackVector slot <slot> for <object> and the name at
	// constant pool entry <name_index>.
	IGNITION_HANDLER(GetNamedProperty, InterpreterAssembler) {
	TNode<HeapObject> feedback_vector = LoadFeedbackVector();
	// Load receiver.
	TNode<Object> recv = LoadRegisterAtOperandIndex(0);
	// Load the name and context lazily.
	LazyNode<TaggedIndex> lazy_slot = [=] {
	return BytecodeOperandIdxTaggedIndex(2);
	};
	LazyNode<Name> lazy_name = [=] {
	return CAST(LoadConstantPoolEntryAtOperandIndex(1));
	};
	LazyNode<Context> lazy_context = [=] { return GetContext(); };
	Label done(this);
	TVARIABLE(Object, var_result);
	ExitPoint exit_point(this, &done, &var_result);
	AccessorAssembler::LazyLoadICParameters params(lazy_context, recv, lazy_name,
	lazy_slot, feedback_vector);
	AccessorAssembler accessor_asm(state());
	accessor_asm.LoadIC_BytecodeHandler(&params, &exit_point);
	BIND(&done);
	{
	SetAccumulator(var_result.value());
	Dispatch();
	}
	}

and a[b]:

node/deps/v8/src/interpreter/interpreter-generator.cc

Lines 597 to 613 in 7feff24

	// GetKeyedProperty <object> <slot>
	//
	// Calls the KeyedLoadIC at FeedBackVector slot <slot> for <object> and the key
	// in the accumulator.
	IGNITION_HANDLER(GetKeyedProperty, InterpreterAssembler) {
	TNode<Object> object = LoadRegisterAtOperandIndex(0);
	TNode<Object> name = GetAccumulator();
	TNode<TaggedIndex> slot = BytecodeOperandIdxTaggedIndex(1);
	TNode<HeapObject> feedback_vector = LoadFeedbackVector();
	TNode<Context> context = GetContext();
	TVARIABLE(Object, var_result);
	var_result = CallBuiltin(Builtin::kKeyedLoadIC, context, object, name, slot,
	feedback_vector);
	SetAccumulator(var_result.value());
	Dispatch();
	}

edit: just found this: https://yinzhicao.org/UoP/UoP-Oakland.pdf, your repo doesn't exist anymore though