morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #3934] [Bug] An undecodable Swift alias erases a decoded procedure category #1542

New issue

Closed

opened 2026-10-16 21:06:53 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-16 21:06:53 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 15, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/3934

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Native analysis or decompilation

Observed behavior

Adding a same-address Swift-looking alias whose category cannot be decoded causes analyze_swift_types to discard a class category established by another retained alias. The procedure moves to other, and requesting category: "classes" returns total: 0. The response still retains the procedure and both aliases in unclassified, so callers can recover the category manually, but category counts and filters lose usable evidence.

Observed through the production MCP server, with successful tool responses:

Alias inventory	Filter	total	classes.count	other.count	Unclassified reason
Decoded only	none	1	1	0	none
Decoded only	classes	1	1	0	none
Decoded and unresolved	none	1	0	1	category_not_decoded
Decoded and unresolved	classes	0	0	0	category_not_decoded
Unresolved only	none	1	0	1	category_not_decoded
Unresolved only	classes	0	0	0	category_not_decoded

In both failing two-alias responses, unclassified retains address 0x1, name main::Service::init, and mangled_names: ["_$s4main7ServiceCMa", "_$s4main04PairVMa"]. Removing the unresolved alias restores the class observation. A separate source-boundary run also reproduced the same loss with _$s4main13swiftIndirectySiAA7Scoring_p_SitF, a Swift global symbol retained in the repository's golden provider inventory, instead of the unresolved label above.

Reproduction

Use the baseline checkout with its pinned Node.js, locked dependencies installed, and runtime already built. Run the following from the repository root. It supplies one procedure named main::Service::init at 0x1 and varies only the same-address alias list. The decoded alias is _$s4main7ServiceCMa; the unresolved alias is _$s4main04PairVMa.

repro_home=$(mktemp -d)
HOME="$repro_home" node --input-type=module <<'NODE'
import { Client, InMemoryTransport } from '@modelcontextprotocol/client';
import { createServer } from './dist/server/createServer.js';
import { createAnalysisExecution } from './dist/application/AnalysisProvider.js';
import { parseEvidence } from './dist/domain/evidence.js';

const decoded = '_$s4main7ServiceCMa';
const unresolved = '_$s4main04PairVMa';
const provider = { id: 'fixture', name: 'Fixture analysis provider', version: '1' };
for (const aliases of [[decoded], [decoded, unresolved], [unresolved]]) {
  const server = createServer({ kind: 'fixed', analysis: {
    execute: async operation => ({ ok: true, value: createAnalysisExecution(
      operation === 'list_procedures'
        ? [{ address: '0x1', value: 'main::Service::init' }]
        : aliases.map(value => ({ address: '0x1', value })),
      provider,
    ) }),
  } });
  const client = new Client({ name: 'swift-category-reproduction', version: '1' });
  const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
  try {
    await server.connect(serverTransport);
    await client.connect(clientTransport);
    for (const args of [{}, { category: 'classes' }]) {
      const response = await client.callTool({ name: 'analyze_swift_types', arguments: args });
      if (response.isError) throw new Error(JSON.stringify(response));
      const result = parseEvidence(response.structuredContent).normalized_result;
      console.log(JSON.stringify({ aliases, args, result }));
    }
  } finally {
    await client.close();
    await server.close();
  }
}
NODE
rm -r "$repro_home"

Compare the decoded-only control with the two-alias case, both without a filter and with { "category": "classes" }. Inspect total, categories.classes.count, categories.other.count, and unclassified. The unresolved-only control establishes that absent category evidence must still remain unresolved.

Expected behavior

The tool categorizes procedures using their manglings or same-address Swift aliases and preserves unresolved evidence. Its classification invariant says that only decoded names vote and unresolved aliases must not erase a decoded category. For the two-alias case, both calls should return total: 1, categories.classes.count: 1, categories.other.count: 0, and an empty unclassified array. The class entry should retain both mangled_names.

The input does not require the unresolved label to be a fully valid Swift compiler mangling. REA recognizes it by its prefix, and the provider inventory admits it as a symbol name. An unresolved alias supplies no contrary decoded category.

Impact and scope

A bounded same-address alias combination discards an established class observation and produces incorrect category-filtered totals. Both source and built MCP workflows reproduced the result. The response preserves the underlying evidence, and prevalence in ordinary binaries is unknown.

Workaround: Observed responses retain the procedure and both mangled_names in unclassified even with the class filter, allowing an analyst to inspect the decoded alias and recover the category manually without changing code or losing evidence. The automated category counts remain incorrect.

REA version

rea 6.5.0 at source commit 4692bb3330

Runtime and platform

Node 24.18.0; macOS arm64

Target and artifact context

Registered production MCP tool over in-memory transport with a fixed analysis provider. Same-address Swift aliases; no live Ghidra session.

Interface

MCP

Earliest failure stage

Native analysis or reconstruction

Relevant output or evidence

Expected source: src/contracts/enhancedToolContracts.ts:54-57 defines the MCP classification behavior; src/domain/symbolAnalysis.ts:118-119 states that unresolved aliases must not erase decoded evidence; src/domain/symbolAnalysis.test.ts:125 covers the related alias case where the category classifier returns no result.
Failure source: The runnable MCP reproduction above observes a class count change from 1 to 0 when the unresolved alias is added. Source-derived diagnosis at src/domain/symbolAnalysis.ts:120-125 shows that a recognized alias with a null category participates in the category set, which then suppresses the decoded class result.
Provider reachability, partly observed and partly source-derived: a constructed Mach-O text object containing both reported labels assembled successfully, and nm -n listed both at address 0000000000000000. The production Ghidra inventory parser accepted both records with complete symbol facts. bridge/ghidra/ReaGhidraBridge.java:1977-1988,2087-2115 preserves address-bearing symbol records without Swift grammar validation or address deduplication; src/ghidra/GhidraInventoryValues.ts:334-335 accepts the inventory arrays, and src/ghidra/GhidraProviderClient.ts:856-860 uses that parser. This establishes that a real provider can admit the pair; it does not establish live-provider reproduction or natural compiler emission of that exact pair.
Additional observed controls: unresolved-only evidence remains in other and unclassified; two aliases with decoded class and struct categories retain conflicting_categories. The focused source run completed 29 tests across the existing category tests, existing MCP Swift tests, and a temporary verification test. Those checks assert current behavior, including the defect, rather than a repaired result.
Source-derived real-inventory context: tests/fixtures/swift/ghidraInventory.ts:90-156 records several imported Swift aliases at one procedure address, and its global Swift symbol at lines 159-174 remains undecoded. Ordinary-binary frequency of the failing combination was not measured.

Typed outcome or recovery expected

Re-run the same MCP inputs. The two-alias case must match the decoded-only control for category counts and filtering: total: 1, one class entry, no other entry, and no unclassified record. The class entry must retain both aliases. The unresolved-only case must continue to appear in other and unclassified with reason category_not_decoded, including inline unclassified evidence under a class filter. Distinct decoded class and struct aliases must continue to report conflicting_categories. Apply the same preservation check to the additional unresolved global-symbol case. These checks restore evidence handling without requiring a broader Swift decoder.

Analysis or suspected cause

Source-derived explanation and exact locators are in Relevant output or evidence. Provider and transport limits are stated there separately from reproduced results.

Additional context

The unresolved alias is admitted by the prefix recognizer and provider inventory. Natural compiler emission and ordinary-binary frequency of the exact pair are unknown.

Freshness check: the cited source and contract files have no changes between the tested source commit and upstream main at 22ec8bdb2f.

Originally created by @coygeek on GitHub (Oct 15, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/3934 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Native analysis or decompilation ### Observed behavior Adding a same-address Swift-looking alias whose category cannot be decoded causes `analyze_swift_types` to discard a class category established by another retained alias. The procedure moves to `other`, and requesting `category: "classes"` returns `total: 0`. The response still retains the procedure and both aliases in `unclassified`, so callers can recover the category manually, but category counts and filters lose usable evidence. Observed through the production MCP server, with successful tool responses: | Alias inventory | Filter | total | classes.count | other.count | Unclassified reason | | --- | --- | --- | --- | --- | --- | | Decoded only | none | 1 | 1 | 0 | none | | Decoded only | classes | 1 | 1 | 0 | none | | Decoded and unresolved | none | 1 | 0 | 1 | category_not_decoded | | Decoded and unresolved | classes | 0 | 0 | 0 | category_not_decoded | | Unresolved only | none | 1 | 0 | 1 | category_not_decoded | | Unresolved only | classes | 0 | 0 | 0 | category_not_decoded | In both failing two-alias responses, `unclassified` retains address `0x1`, name `main::Service::init`, and `mangled_names: ["_$s4main7ServiceCMa", "_$s4main04PairVMa"]`. Removing the unresolved alias restores the class observation. A separate source-boundary run also reproduced the same loss with `_$s4main13swiftIndirectySiAA7Scoring_p_SitF`, a Swift global symbol retained in the repository's golden provider inventory, instead of the unresolved label above. ### Reproduction 1. Use the baseline checkout with its pinned Node.js, locked dependencies installed, and runtime already built. Run the following from the repository root. It supplies one procedure named `main::Service::init` at `0x1` and varies only the same-address alias list. The decoded alias is `_$s4main7ServiceCMa`; the unresolved alias is `_$s4main04PairVMa`. ```sh repro_home=$(mktemp -d) HOME="$repro_home" node --input-type=module <<'NODE' import { Client, InMemoryTransport } from '@modelcontextprotocol/client'; import { createServer } from './dist/server/createServer.js'; import { createAnalysisExecution } from './dist/application/AnalysisProvider.js'; import { parseEvidence } from './dist/domain/evidence.js'; const decoded = '_$s4main7ServiceCMa'; const unresolved = '_$s4main04PairVMa'; const provider = { id: 'fixture', name: 'Fixture analysis provider', version: '1' }; for (const aliases of [[decoded], [decoded, unresolved], [unresolved]]) { const server = createServer({ kind: 'fixed', analysis: { execute: async operation => ({ ok: true, value: createAnalysisExecution( operation === 'list_procedures' ? [{ address: '0x1', value: 'main::Service::init' }] : aliases.map(value => ({ address: '0x1', value })), provider, ) }), } }); const client = new Client({ name: 'swift-category-reproduction', version: '1' }); const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair(); try { await server.connect(serverTransport); await client.connect(clientTransport); for (const args of [{}, { category: 'classes' }]) { const response = await client.callTool({ name: 'analyze_swift_types', arguments: args }); if (response.isError) throw new Error(JSON.stringify(response)); const result = parseEvidence(response.structuredContent).normalized_result; console.log(JSON.stringify({ aliases, args, result })); } } finally { await client.close(); await server.close(); } } NODE rm -r "$repro_home" ``` 2. Compare the decoded-only control with the two-alias case, both without a filter and with `{ "category": "classes" }`. Inspect `total`, `categories.classes.count`, `categories.other.count`, and `unclassified`. The unresolved-only control establishes that absent category evidence must still remain unresolved. ### Expected behavior The tool categorizes procedures using their manglings or same-address Swift aliases and preserves unresolved evidence. Its classification invariant says that only decoded names vote and unresolved aliases must not erase a decoded category. For the two-alias case, both calls should return `total: 1`, `categories.classes.count: 1`, `categories.other.count: 0`, and an empty `unclassified` array. The class entry should retain both `mangled_names`. The input does not require the unresolved label to be a fully valid Swift compiler mangling. REA recognizes it by its prefix, and the provider inventory admits it as a symbol name. An unresolved alias supplies no contrary decoded category. ### Impact and scope A bounded same-address alias combination discards an established class observation and produces incorrect category-filtered totals. Both source and built MCP workflows reproduced the result. The response preserves the underlying evidence, and prevalence in ordinary binaries is unknown. Workaround: Observed responses retain the procedure and both mangled_names in unclassified even with the class filter, allowing an analyst to inspect the decoded alias and recover the category manually without changing code or losing evidence. The automated category counts remain incorrect. ### REA version rea 6.5.0 at source commit 4692bb33300c7cb77b095b6cc0c33da861c1b860 ### Runtime and platform Node 24.18.0; macOS arm64 ### Target and artifact context Registered production MCP tool over in-memory transport with a fixed analysis provider. Same-address Swift aliases; no live Ghidra session. ### Interface MCP ### Earliest failure stage Native analysis or reconstruction ### Relevant output or evidence - Expected source: `src/contracts/enhancedToolContracts.ts:54-57` defines the MCP classification behavior; `src/domain/symbolAnalysis.ts:118-119` states that unresolved aliases must not erase decoded evidence; `src/domain/symbolAnalysis.test.ts:125` covers the related alias case where the category classifier returns no result. - Failure source: The runnable MCP reproduction above observes a class count change from 1 to 0 when the unresolved alias is added. Source-derived diagnosis at `src/domain/symbolAnalysis.ts:120-125` shows that a recognized alias with a null category participates in the category set, which then suppresses the decoded class result. - Provider reachability, partly observed and partly source-derived: a constructed Mach-O text object containing both reported labels assembled successfully, and `nm -n` listed both at address `0000000000000000`. The production Ghidra inventory parser accepted both records with complete symbol facts. `bridge/ghidra/ReaGhidraBridge.java:1977-1988,2087-2115` preserves address-bearing symbol records without Swift grammar validation or address deduplication; `src/ghidra/GhidraInventoryValues.ts:334-335` accepts the inventory arrays, and `src/ghidra/GhidraProviderClient.ts:856-860` uses that parser. This establishes that a real provider can admit the pair; it does not establish live-provider reproduction or natural compiler emission of that exact pair. - Additional observed controls: unresolved-only evidence remains in `other` and `unclassified`; two aliases with decoded class and struct categories retain `conflicting_categories`. The focused source run completed 29 tests across the existing category tests, existing MCP Swift tests, and a temporary verification test. Those checks assert current behavior, including the defect, rather than a repaired result. - Source-derived real-inventory context: `tests/fixtures/swift/ghidraInventory.ts:90-156` records several imported Swift aliases at one procedure address, and its global Swift symbol at lines 159-174 remains undecoded. Ordinary-binary frequency of the failing combination was not measured. ### Typed outcome or recovery expected Re-run the same MCP inputs. The two-alias case must match the decoded-only control for category counts and filtering: `total: 1`, one class entry, no `other` entry, and no unclassified record. The class entry must retain both aliases. The unresolved-only case must continue to appear in `other` and `unclassified` with reason `category_not_decoded`, including inline unclassified evidence under a class filter. Distinct decoded class and struct aliases must continue to report `conflicting_categories`. Apply the same preservation check to the additional unresolved global-symbol case. These checks restore evidence handling without requiring a broader Swift decoder. ### Analysis or suspected cause Source-derived explanation and exact locators are in Relevant output or evidence. Provider and transport limits are stated there separately from reproduced results. ### Additional context The unresolved alias is admitted by the prefix recognizer and provider inventory. Natural compiler emission and ordinary-binary frequency of the exact pair are unknown. Freshness check: the cited source and contract files have no changes between the tested source commit and upstream main at 22ec8bdb2f7d4626587f23b1eed4a207df600386.

bsakaguchi closed this issue

2026-10-16 21:06:54 +00:00

bsakaguchi commented

2026-10-16 21:06:55 +00:00

Author

Owner

@XinwangTao commented on GitHub (Oct 15, 2026):

Confirmed: an alias whose category cannot be decoded should not erase the class category established by a decodable sibling alias — losing the classes count and filter is a real evidence regression even if unclassified still carries the raw data. The unresolved alias should degrade only its own contribution (or be reported as a separate not_decoded dimension) without collapsing the procedure category.

@XinwangTao commented on GitHub (Oct 15, 2026): Confirmed: an alias whose category cannot be decoded should not erase the class category established by a decodable sibling alias — losing the classes count and filter is a real evidence regression even if unclassified still carries the raw data. The unresolved alias should degrade only its own contribution (or be reported as a separate not_decoded dimension) without collapsing the procedure category.

bsakaguchi referenced this issue

2026-10-17 21:01:32 +00:00

[GH-ISSUE #2383] [Tracker] Audit analysis and debugging coverage for the TIOBE top 100 languages (October 2026) #794

bsakaguchi referenced this issue

2026-10-17 21:12:15 +00:00

[PR #1542] [MERGED] fix(javascript): yield inside semantic analysis and large projection passes #2957

bsakaguchi referenced this issue

2026-10-17 21:12:18 +00:00

[PR #1545] [MERGED] fix(javascript): yield during the largest AST traversals #2961