promise.domain interferes with harden() in non-SES code and node REPL

[warner]

We learned that Promise instances acquire an extra property in code executed from the Node REPL:

$ node
> p = new Promise(r => 1)
> Object.getOwnPropertyNames(p)
[ 'domain' ]
> Object.getPrototypeOf(p.domain)
Domain {
  members: undefined,
  _errorHandler: [Function],
  enter: [Function],
  exit: [Function],
  add: [Function],
  remove: [Function],
  run: [Function],
  intercept: [Function],
  bind: [Function] }
> 

This seems to exist to support Node's deprecated "Domain" concept (https://nodejs.org/api/domain.html#domain_domains_and_promises), which provides a sort of on-exit notification when execution has left a particular region of the code (think server event handlers, and cleaning up resources allocated for a single event).

The .domain property is an object whose prototype is not a normal JS primordial.

When we run bin/vat shell --no-ses, any code which tries to harden() a Promise will fail, because it tries to harden p.domain, and then it sees that the prototype is not in the "fringe" (the set of all the primordials that SES would have frozen). In this way, our non-SES harden() behavior is successfully detecting something strange: a form of mutability that would have violated the goals of hardening.

But in practice, it's kind of a drag. Running the vat with --no-ses is awfully handy for tracking down the line numbers of crashes, so it's annoying that the code can't work without SES.

One fix might be to find this domain prototype and add it to the @agoric/harden fringe. Another might be for the vat to monkeypatch Promise (somehow?) to stop adding these domain properties. Since this is specific to the Node REPL, there may be some hook we can use to control the behavior without needing to muck with Promise too much.

[erights]

We should also file this as an issue against Node at https://github.com/nodejs/node/issues/new?template=1-bug-report.md

I suggest that we remove the extra property until we find that we broke something that we care about.

[erights]

Despite the title of this issue, the domain property that Node adds it might add to anything, not just promises.

We've discussed this with @bmeck and at the SES meetings. An interesting development is that the domain property or the code using it seems to be broken in Node, so perhaps there's hope of getting them to remove it. In any case, we cannot use Node securely until we're confident that it is not adding this as a property.

Assigning to myself to track this. But there's not much more we can do on our side other than remember that we cannot use node securely.

[erights]

@kriskowal closed this in endo.

@kriskowal , if I'm missing something, please reopen.