refl-cpp VS BLIB

You'd be surprised how much friction you'd have for C++ reflection. First, since it's a custom build step, you can do a mix of custom code gen and C++ constexpr/consteval for static reflection. Here's a header-only implementation for adding compile time reflection purely within the language [1]. And v8 already does dynamic code gen as part of its build process (to generate the snapshot to speedup instantiation of the isolate). Dynamic reflection is a must since JS is a dynamic language with reflection support.

Now of course, I don't know the specific details of reflection needed for the abstractions you reference and clearly V8 is still doing some amount of manual IR generation, so it's possible it would be a substantial investment to actually retrofit those techniques into v8. One would have to do a careful analysis of historical security exploits & specific techniques and their ability to prevent to figure out if it's worth adding those abstractions (especially since there is a potential performance tradeoff as you mention). As I said, I think there's insufficient research in this area to establish a compelling body of best practices (not to take away from the contributions of the GraalJS team to this space).

[1] https://github.com/veselink1/refl-cpp

I’ve been using https://github.com/veselink1/refl-cpp for my recent project where i needed reflections, especially for serialization. Cant wait for c++48 and reflections in standard

Link to my engine's version, though some things are a bit of a mess: https://github.com/benreid24/BLIB/tree/master/include/BLIB/Serialization