[PR #1471] [MERGED] fix(javascript): retain returned-reference mutation uncertainty #2909

New issue

Closed

opened 2026-10-17 21:11:41 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-17 21:11:41 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1471
Author: @N0zoM1z0
Created: 10/10/2026
Status: ✅ Merged
Merged: 10/10/2026
Merged by: @N0zoM1z0

Base: main ← Head: fix/javascript-returned-reference-aliases

📝 Commits (1)

8414ee4 fix(javascript): retain returned-reference mutation uncertainty

📊 Changes

6 files changed (+391 additions, -31 deletions)

View changed files

📝 docs/javascript-application-workflows.md (+4 -1)
➕ src/domain/javascript/javascriptSemanticCallableResults.ts (+53 -0)
📝 src/domain/javascript/javascriptSemanticMemberMutations.ts (+15 -5)
➕ src/domain/javascript/javascriptSemanticReturnedReferences.ts (+213 -0)
📝 src/domain/javascript/javascriptSemanticReturns.ts (+6 -25)
➕ tests/acceptance/applications/javascriptReturnedReferences.test.ts (+100 -0)

📄 Description

Fixes #1449. Local calls can hand back the same object, but mutation tracking stopped at their results and advertised stale literals after a subsequent write. Resolve candidate return/yield references through the existing escape tracking, sharing the direct-result AST collector with return projection.

The compiled CLI and real stdio MCP regression covers 34 variants: direct and captured calls, property-slot stores, object/class methods, aliases, constructors, recursive wrappers, awaited async results and yielded references. Scalar copies, unrelated containing properties and uninvoked nested callables retain their facts. This is conservative escape analysis: even read-only calls handing back references may become unknown; it does not claim execution or exact post-call values. No schemas, tool inventory or provider behavior change.

Validation: baseline CLI fails with stale 1; fixed public CLI/MCP regression passes, including output-contract validation, Evidence identity, text/structured results, subsequent ping and shutdown. The existing property-store/iteration CLI/MCP journeys also pass; six adjacent source suites pass 353 tests; npm run check:ci and test discovery pass. Controlled fixture execution and public MCP checks pass on Node 22.22.2 and 24.18.0. Real Hopper/Ghidra verification was not performed because this changes pure JavaScript semantics.

Related: #1468 independently addresses simple synchronous thunks. This change also covers the property-slot flow explicitly left open there and method/async/generator forms, using iterative AST traversal and the shared return collector.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1471 **Author:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Created:** 10/10/2026 **Status:** ✅ Merged **Merged:** 10/10/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `fix/javascript-returned-reference-aliases` --- ### 📝 Commits (1) - [`8414ee4`](https://github.com/morluto/rea/commit/8414ee491c5eb5f5e0932dc4b72517ba2fda1b9a) fix(javascript): retain returned-reference mutation uncertainty ### 📊 Changes **6 files changed** (+391 additions, -31 deletions) <details> <summary>View changed files</summary> 📝 `docs/javascript-application-workflows.md` (+4 -1) ➕ `src/domain/javascript/javascriptSemanticCallableResults.ts` (+53 -0) 📝 `src/domain/javascript/javascriptSemanticMemberMutations.ts` (+15 -5) ➕ `src/domain/javascript/javascriptSemanticReturnedReferences.ts` (+213 -0) 📝 `src/domain/javascript/javascriptSemanticReturns.ts` (+6 -25) ➕ `tests/acceptance/applications/javascriptReturnedReferences.test.ts` (+100 -0) </details> ### 📄 Description Fixes #1449. Local calls can hand back the same object, but mutation tracking stopped at their results and advertised stale literals after a subsequent write. Resolve candidate return/yield references through the existing escape tracking, sharing the direct-result AST collector with return projection. The compiled CLI and real stdio MCP regression covers 34 variants: direct and captured calls, property-slot stores, object/class methods, aliases, constructors, recursive wrappers, awaited async results and yielded references. Scalar copies, unrelated containing properties and uninvoked nested callables retain their facts. This is conservative escape analysis: even read-only calls handing back references may become unknown; it does not claim execution or exact post-call values. No schemas, tool inventory or provider behavior change. Validation: baseline CLI fails with stale `1`; fixed public CLI/MCP regression passes, including output-contract validation, Evidence identity, text/structured results, subsequent ping and shutdown. The existing property-store/iteration CLI/MCP journeys also pass; six adjacent source suites pass 353 tests; `npm run check:ci` and test discovery pass. Controlled fixture execution and public MCP checks pass on Node 22.22.2 and 24.18.0. Real Hopper/Ghidra verification was not performed because this changes pure JavaScript semantics. Related: #1468 independently addresses simple synchronous thunks. This change also covers the property-slot flow explicitly left open there and method/async/generator forms, using iterative AST traversal and the shared return collector. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-17 21:11:41 +00:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#2909

No description provided.

Rows
Columns