morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #4215] [Bug] demangle-swift reports an undecoded linked legacy name as demangled #1655

New issue

Closed

opened 2026-10-16 21:08:32 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-16 21:08:32 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 15, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/4215

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Native analysis or decompilation

Observed behavior

A public demangle-swift request containing __T0Bogus exits 0 but returns {"input":"__T0Bogus","output":"_T0Bogus","status":"demangled"}. The real Xcode producer removes the linkage underscore without decoding the symbol. Its expanded diagnostic reports <<NULL>> for both malformed spellings. The successful REA response contains native-macos Evidence and empty limitations.

__T0Bogus is deliberately malformed. It is a valid public symbol request under REA's input schema, not a claim that compiled Swift 4 code emits this name. The compiled Mach-O below supplies evidence identity only and is neither executed nor loaded.

Reproduction

From the repository root at the tested source revision below, use the repository-pinned toolchain and installed locked dependencies, and build with npm run build:cached. This standalone public CLI procedure was executed successfully and reproduced the incorrect record above:

set -eu
fixture_dir="$(mktemp -d)"
trap 'rm -rf "$fixture_dir"' EXIT
mkdir -p "$fixture_dir/home" "$fixture_dir/config" "$fixture_dir/cache" "$fixture_dir/runtime"
export HOME="$fixture_dir/home"
export XDG_CONFIG_HOME="$fixture_dir/config"
export XDG_CACHE_HOME="$fixture_dir/cache"
export XDG_RUNTIME_DIR="$fixture_dir/runtime"
export REA_LOG_LEVEL=silent
export REA_ANALYSIS_PROVIDER=auto
printf 'int main(void) { return 0; }\n' > "$fixture_dir/target.c"
xcrun clang "$fixture_dir/target.c" -o "$fixture_dir/symbol-target"
node scripts/rea.mjs demangle-swift "$fixture_dir/symbol-target" '__T0Bogus' --json

Read normalized_result.symbols in the JSON result. A separate mixed-symbol public CLI request reproduced the same record before and after a fresh runtime build. An independent replay of the standalone command also reproduced it.

The following real-producer diagnostic was also executed with exit 0 and empty stderr:

xcrun swift-demangle --expand -- '__T0Bogus' '_T0Bogus' '__T04main3FooV'

Expected behavior

An undecodable Swift mangling should receive invalid, retaining the caller's original input. Removing a linkage underscore alone should not claim successful decoding. The public input schema and operation contract admit nonempty single-line strings without NUL; the operation promises a per-input demangled, unchanged, or invalid status. The existing public MCP control test requires undecodable Swift-prefixed strings to be invalid, decoded strings demangled, and a non-Swift control unchanged.

Impact and scope

Impact assessment: P2, supported. An admitted malformed-symbol request receives an incorrect machine-readable decoding status in a successful public response. The demonstrated effect is bounded to result classification. No downstream workflow failure, data loss, core outage, or population frequency was established.

Workaround status: unverified. Substituting _T0Bogus is a different-input control, not recovery of the original request. The expanded diagnostic confirms failed decoding but does not correct REA's public response.

REA version

Executed source revision: 62bf09809ef7bb224028916424f8f07652a20f4f. The source-built CLI reports 6.5.0; this does not establish installed-package behavior. Current upstream main inspected at 663d07f02cd62c99d81c59391d2c6d745c875335 has identical cited contract, parser, provider, CLI registration, and control-test files. Current-main applicability is source-inspected, not a separate runtime reproduction. No installed release was reproduced.

Runtime and platform

Pinned Node v24.18.0 and npm 11.16.0; macOS arm64; Xcode 27.0 build 27A266a; selected swift-demangle reports LLVM 21.0.0. The exact macOS release was not captured.

Target and artifact context

Benign arm64 Mach-O executable compiled from the inline C fixture using that Xcode toolchain. It was read solely for evidence identity. The retained target's SHA-256 matched the digest returned in Evidence.

Interface

CLI. Existing MCP tests exercise controls; the exact failing symbol was exercised through CLI only.

Earliest failure stage

Native analysis or reconstruction. The real producer returns an undecoded normalized echo; REA assigns the incorrect typed status while parsing that output.

Relevant output or evidence

The observed public CLI matrix returned the same values before and after the focused runtime build:

input                 output        status
__T0Bogus             _T0Bogus      demangled
_T0Bogus              _T0Bogus      invalid
__T04main3FooV         main.Foo      demangled
_T04main3FooV          main.Foo      demangled
_$s4main3FooV          main.Foo      demangled
$s4main3FooV           main.Foo      demangled
$sBogus               $sBogus       invalid
plain_symbol          plain_symbol  unchanged
_printf               _printf       unchanged

The expanded producer diagnostic returned <<NULL>> and echoed _T0Bogus for both malformed inputs. The valid linked legacy control produced a Global/Structure tree with module main and identifier Foo, then rendered main.Foo. This distinguishes linkage normalization from successful decoding.

Evidence provenance: observed public CLI and real producer output; the explanation below is source-derived.
Local verification: reproduced through the complete public CLI, including a reduced one-symbol call.
Reproduction completeness: complete for the stated source revision and toolchain.
Focused verification: npm run test:focused -- src/native/parsers/demangle.test.ts tests/boundary/cli/nativeDemangleCli.test.ts tests/boundary/mcp/nativeDemangleMcp.test.ts freshly built the runtime and passed 3 files and 11 tests, with no failures or skips. These existing tests do not cover the newly reported spelling.

Typed outcome or recovery expected

Repeat the original __T0Bogus request through the public CLI. It must retain that exact input and return invalid without calling an undecoded echo demangled. Preserve the valid legacy and modern controls as demangled with main.Foo, malformed _T0Bogus and $sBogus as invalid, and plain controls as unchanged. Check the exact failing symbol through MCP when implementing the repair. Successful command completion and producer cleanup must remain intact.

Analysis or suspected cause

Source-derived: the native provider passes the original strings to swift-demangle --compact --. The parser assigns demangled whenever output differs from input, including this undecoded normalized echo. This report specifies the result contract and leaves the repair approach open.

Additional context

Closed prefix fix #3089 handles undecodable names whose output equals input; its fix is already present in the tested source. This request takes the changed-output branch. Open #3543 concerns a multiline validation rejection that fails to exit before a deadline, with a different trigger and closure signal.

NOT_ENOUGH_INFO: other Xcode versions and architectures, installed-release behavior, exact-case MCP reproduction, ordinary-binary frequency, and a workaround preserving the original request were not verified. No last-known-good version was established.

Originally created by @coygeek on GitHub (Oct 15, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/4215 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Native analysis or decompilation ### Observed behavior A public `demangle-swift` request containing `__T0Bogus` exits 0 but returns `{"input":"__T0Bogus","output":"_T0Bogus","status":"demangled"}`. The real Xcode producer removes the linkage underscore without decoding the symbol. Its expanded diagnostic reports `<<NULL>>` for both malformed spellings. The successful REA response contains native-macos Evidence and empty limitations. `__T0Bogus` is deliberately malformed. It is a valid public symbol request under REA's input schema, not a claim that compiled Swift 4 code emits this name. The compiled Mach-O below supplies evidence identity only and is neither executed nor loaded. ### Reproduction From the repository root at the tested source revision below, use the repository-pinned toolchain and installed locked dependencies, and build with `npm run build:cached`. This standalone public CLI procedure was executed successfully and reproduced the incorrect record above: ```sh set -eu fixture_dir="$(mktemp -d)" trap 'rm -rf "$fixture_dir"' EXIT mkdir -p "$fixture_dir/home" "$fixture_dir/config" "$fixture_dir/cache" "$fixture_dir/runtime" export HOME="$fixture_dir/home" export XDG_CONFIG_HOME="$fixture_dir/config" export XDG_CACHE_HOME="$fixture_dir/cache" export XDG_RUNTIME_DIR="$fixture_dir/runtime" export REA_LOG_LEVEL=silent export REA_ANALYSIS_PROVIDER=auto printf 'int main(void) { return 0; }\n' > "$fixture_dir/target.c" xcrun clang "$fixture_dir/target.c" -o "$fixture_dir/symbol-target" node scripts/rea.mjs demangle-swift "$fixture_dir/symbol-target" '__T0Bogus' --json ``` Read `normalized_result.symbols` in the JSON result. A separate mixed-symbol public CLI request reproduced the same record before and after a fresh runtime build. An independent replay of the standalone command also reproduced it. The following real-producer diagnostic was also executed with exit 0 and empty stderr: ```sh xcrun swift-demangle --expand -- '__T0Bogus' '_T0Bogus' '__T04main3FooV' ``` ### Expected behavior An undecodable Swift mangling should receive `invalid`, retaining the caller's original `input`. Removing a linkage underscore alone should not claim successful decoding. The [public input schema and operation contract](https://github.com/morluto/rea/blob/62bf09809ef7bb224028916424f8f07652a20f4f/src/contracts/native/nativeToolContracts.ts#L69-L128) admit nonempty single-line strings without NUL; the operation promises a per-input demangled, unchanged, or invalid status. The [existing public MCP control test](https://github.com/morluto/rea/blob/62bf09809ef7bb224028916424f8f07652a20f4f/tests/boundary/mcp/nativeDemangleMcp.test.ts#L69-L102) requires undecodable Swift-prefixed strings to be `invalid`, decoded strings `demangled`, and a non-Swift control `unchanged`. ### Impact and scope Impact assessment: P2, supported. An admitted malformed-symbol request receives an incorrect machine-readable decoding status in a successful public response. The demonstrated effect is bounded to result classification. No downstream workflow failure, data loss, core outage, or population frequency was established. Workaround status: unverified. Substituting `_T0Bogus` is a different-input control, not recovery of the original request. The expanded diagnostic confirms failed decoding but does not correct REA's public response. ### REA version Executed source revision: `62bf09809ef7bb224028916424f8f07652a20f4f`. The source-built CLI reports 6.5.0; this does not establish installed-package behavior. Current upstream main inspected at `663d07f02cd62c99d81c59391d2c6d745c875335` has identical cited contract, parser, provider, CLI registration, and control-test files. Current-main applicability is source-inspected, not a separate runtime reproduction. No installed release was reproduced. ### Runtime and platform Pinned Node v24.18.0 and npm 11.16.0; macOS arm64; Xcode 27.0 build 27A266a; selected `swift-demangle` reports LLVM 21.0.0. The exact macOS release was not captured. ### Target and artifact context Benign arm64 Mach-O executable compiled from the inline C fixture using that Xcode toolchain. It was read solely for evidence identity. The retained target's SHA-256 matched the digest returned in Evidence. ### Interface CLI. Existing MCP tests exercise controls; the exact failing symbol was exercised through CLI only. ### Earliest failure stage Native analysis or reconstruction. The real producer returns an undecoded normalized echo; REA assigns the incorrect typed status while parsing that output. ### Relevant output or evidence The observed public CLI matrix returned the same values before and after the focused runtime build: ```text input output status __T0Bogus _T0Bogus demangled _T0Bogus _T0Bogus invalid __T04main3FooV main.Foo demangled _T04main3FooV main.Foo demangled _$s4main3FooV main.Foo demangled $s4main3FooV main.Foo demangled $sBogus $sBogus invalid plain_symbol plain_symbol unchanged _printf _printf unchanged ``` The expanded producer diagnostic returned `<<NULL>>` and echoed `_T0Bogus` for both malformed inputs. The valid linked legacy control produced a `Global`/`Structure` tree with module `main` and identifier `Foo`, then rendered `main.Foo`. This distinguishes linkage normalization from successful decoding. - Evidence provenance: observed public CLI and real producer output; the explanation below is source-derived. - Local verification: reproduced through the complete public CLI, including a reduced one-symbol call. - Reproduction completeness: complete for the stated source revision and toolchain. - Focused verification: `npm run test:focused -- src/native/parsers/demangle.test.ts tests/boundary/cli/nativeDemangleCli.test.ts tests/boundary/mcp/nativeDemangleMcp.test.ts` freshly built the runtime and passed 3 files and 11 tests, with no failures or skips. These existing tests do not cover the newly reported spelling. ### Typed outcome or recovery expected Repeat the original `__T0Bogus` request through the public CLI. It must retain that exact `input` and return `invalid` without calling an undecoded echo demangled. Preserve the valid legacy and modern controls as `demangled` with `main.Foo`, malformed `_T0Bogus` and `$sBogus` as `invalid`, and plain controls as `unchanged`. Check the exact failing symbol through MCP when implementing the repair. Successful command completion and producer cleanup must remain intact. ### Analysis or suspected cause Source-derived: the [native provider](https://github.com/morluto/rea/blob/62bf09809ef7bb224028916424f8f07652a20f4f/src/native/NativeMacOSProvider.ts#L524-L563) passes the original strings to `swift-demangle --compact --`. The [parser](https://github.com/morluto/rea/blob/62bf09809ef7bb224028916424f8f07652a20f4f/src/native/parsers/demangle.ts#L29-L43) assigns `demangled` whenever output differs from input, including this undecoded normalized echo. This report specifies the result contract and leaves the repair approach open. ### Additional context [Closed prefix fix #3089](https://github.com/morluto/rea/pull/3089) handles undecodable names whose output equals input; its fix is already present in the tested source. This request takes the changed-output branch. [Open #3543](https://github.com/morluto/rea/issues/3543) concerns a multiline validation rejection that fails to exit before a deadline, with a different trigger and closure signal. NOT_ENOUGH_INFO: other Xcode versions and architectures, installed-release behavior, exact-case MCP reproduction, ordinary-binary frequency, and a workaround preserving the original request were not verified. No last-known-good version was established.

bsakaguchi closed this issue

2026-10-16 21:08:32 +00:00

bsakaguchi commented

2026-10-16 21:08:33 +00:00

Author

Owner

@morluto commented on GitHub (Oct 16, 2026):

Fixed on main in 808339f0b. Swift demangle classification no longer labels recognized undecoded spellings as successful demangles, and preserves the producer output.

The final provider selection included actual Swift CLI/MCP output checks plus malformed-input and line-ending controls; other toolchain variants remain unverified.

Hosted main CI is still pending; this closure is based on the implemented fix and the scoped regression evidence.

@morluto commented on GitHub (Oct 16, 2026): Fixed on `main` in [808339f0b](https://github.com/morluto/rea/commit/808339f0b1cf3837445f392b5d5f1f362d64a27d). Swift demangle classification no longer labels recognized undecoded spellings as successful demangles, and preserves the producer output. The final provider selection included actual Swift CLI/MCP output checks plus malformed-input and line-ending controls; other toolchain variants remain unverified. Hosted main CI is still pending; this closure is based on the implemented fix and the scoped regression evidence.

bsakaguchi referenced this issue

2026-10-17 21:01:31 +00:00

[GH-ISSUE #2383] [Tracker] Audit analysis and debugging coverage for the TIOBE top 100 languages (October 2026) #794

bsakaguchi referenced this issue

2026-10-31 00:54:26 +00:00

[PR #1655] [MERGED] fix(browser): support Termux Android scenarios #4729