[PR #1569] [CLOSED] fix(javascript): track shared references returned by getters #2978

New issue

Closed

opened 2026-10-17 21:12:28 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-17 21:12:28 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1569
Author: @cold-atom
Created: 10/10/2026
Status: ❌ Closed

Base: main ← Head: fix/issue-1494

📝 Commits (5)

9c57acb fix(javascript): track shared references returned by getters
f6aa113 fix(javascript): skip impossible getter lookups on deep member chains
5269476 fix(adb): escape hyphen in advertised identifier patterns
0b44a1e fix(adb): escape hyphen as \x5cx2d in identifier patterns
80b186b Merge upstream/main into fix/issue-1494

📊 Changes

8 files changed (+186 additions, -25 deletions)

View changed files

📝 src/apktool/ApktoolProvider.ts (+1 -1)
📝 src/application/UpdateMaintenance.ts (+3 -1)
📝 src/domain/adb/adbDeviceAnalysis.ts (+4 -4)
📝 src/domain/javascript/javascriptSemanticAnalysis.member_mutations.test.ts (+58 -0)
📝 src/domain/javascript/javascriptSemanticMemberMutations.ts (+14 -0)
📝 src/domain/javascript/javascriptSemanticReturnedReferences.ts (+86 -16)
📝 tests/acceptance/applications/javascriptReturnedReferences.test.ts (+17 -0)
📝 tests/boundary/filesystem/javascriptApplicationDeepReturns.test.ts (+3 -3)

📄 Description

Summary

Fixes #1494.

Track shared references returned by getters so JavaScript return-shape analysis no longer reports stale literal values after writes through those references.

Problem and expected behavior

The smallest reproducer is:

export function result() {
  const shared = { x: 1 };
  const box = { get v() { return shared; } };
  box.v.x = 2;
  return shared.x;
}

JavaScript returns 2, but the affected analysis reports literal 1 with complete return-shape coverage.

This change reports unknown instead, preserving mutation uncertainty rather than claiming a stale literal.

Change and scope

Extend the existing returned-reference resolver to distinguish getter reads from ordinary calls and method reads.
Track object, instance, static, copied-result, paired getter/setter, and optional getter reads.
Preserve static/instance class-member selection and overwritten-property behavior.
Avoid invoking getter analysis for direct property assignment or deletion.
Reuse indexed object-property lookup and cover a 2,000-getter collection.

Contract and boundary impact

Semantic owner and earliest changed stage: domain JavaScript semantic reference and mutation analysis.
CLI and MCP/tool-catalog contract: no schema, command, or inventory changes.
Provider, bridge, target-format, or platform compatibility: no provider or bridge changes.
Evidence, artifact, provenance, or reconstruction contract: affected return values retain uncertainty instead of a stale literal; source identity and provenance remain unchanged.
Process execution, authorization, cleanup, or containment impact: none.
Generated metadata, package, or installation impact: none; no generated outputs committed.

Evidence and regression coverage

Tests added or updated: getter regressions and negative cases in the domain mutation suite; a 2,000-getter capacity case; getter cases in the existing compiled CLI/stdio MCP acceptance workflow.
Base reproduction or other evidence: reproduced six failing getter cases on upstream main before applying the fix.
User-visible CLI/MCP output: the reported shared-object return changes from stale literal 1 to unknown.
Remaining proof gaps: exact pinned Node 24.18.0, Windows, and macOS were not tested.

For evidence-bearing changes:

Observed, derived, and inferred claims remain distinguishable.
Artifact identity, source provenance, and failed attempts remain preserved.
Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

npm run test:local -- src/domain/javascript/javascriptSemanticAnalysis.member_mutations.test.ts — final suite: 170 passed.
npx vitest run --project domain src/domain/javascript — 746 passed before the final additional capacity test.
npm run test:focused -- tests/acceptance/applications/javascriptReturnedReferences.test.ts — 2 passed, exercising compiled CLI and real stdio MCP with Evidence-ID parity and a successful follow-up ping.
npm run check — passed.
Final npm run check:fast — passed.
Formatting and git diff --check — passed.
Pre-commit and pre-push hooks — passed.

Compatibility, safety, and release

Breaking changes or migration steps: none.
Real Hopper/Ghidra, browser, or OS coverage: JavaScript analysis verified on Linux with Node 24.21.0 and npm 11.19.0 through CLI and stdio MCP; native providers and browsers are not involved.
Package or release metadata impact: none.
Security, privacy, process, or containment review: no new process execution, network access, or mutation authority; the analysis workflow does not execute the target JavaScript.

Review checklist

This PR addresses a concrete problem or an agreed enhancement.
The PR has one focused outcome and the title follows type(scope): outcome.
Related issue is linked.
Tests cover changed observable behavior and meaningful failure paths.
Owning docs, contracts, and generated metadata are updated where needed; none require changes for this fix.
User-visible CLI/MCP changes include representative output.
I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1569 **Author:** [@cold-atom](https://github.com/cold-atom) **Created:** 10/10/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/issue-1494` --- ### 📝 Commits (5) - [`9c57acb`](https://github.com/morluto/rea/commit/9c57acb9f695e6da0902c9764b816b37aa76b1f5) fix(javascript): track shared references returned by getters - [`f6aa113`](https://github.com/morluto/rea/commit/f6aa113ceb4ab948f727dc98bf0d1bb5969e3735) fix(javascript): skip impossible getter lookups on deep member chains - [`5269476`](https://github.com/morluto/rea/commit/52694765503a21c5be8e3a736679cd9692cc6b8e) fix(adb): escape hyphen in advertised identifier patterns - [`0b44a1e`](https://github.com/morluto/rea/commit/0b44a1e0d412cecfb7ac0b9afc5e18eb8033e82c) fix(adb): escape hyphen as \x5cx2d in identifier patterns - [`80b186b`](https://github.com/morluto/rea/commit/80b186b62cdc477f987f14fd40a25509a00702c3) Merge upstream/main into fix/issue-1494 ### 📊 Changes **8 files changed** (+186 additions, -25 deletions) <details> <summary>View changed files</summary> 📝 `src/apktool/ApktoolProvider.ts` (+1 -1) 📝 `src/application/UpdateMaintenance.ts` (+3 -1) 📝 `src/domain/adb/adbDeviceAnalysis.ts` (+4 -4) 📝 `src/domain/javascript/javascriptSemanticAnalysis.member_mutations.test.ts` (+58 -0) 📝 `src/domain/javascript/javascriptSemanticMemberMutations.ts` (+14 -0) 📝 `src/domain/javascript/javascriptSemanticReturnedReferences.ts` (+86 -16) 📝 `tests/acceptance/applications/javascriptReturnedReferences.test.ts` (+17 -0) 📝 `tests/boundary/filesystem/javascriptApplicationDeepReturns.test.ts` (+3 -3) </details> ### 📄 Description ## Summary Fixes #1494. Track shared references returned by getters so JavaScript return-shape analysis no longer reports stale literal values after writes through those references. ## Problem and expected behavior The smallest reproducer is: ```js export function result() { const shared = { x: 1 }; const box = { get v() { return shared; } }; box.v.x = 2; return shared.x; } ``` JavaScript returns `2`, but the affected analysis reports literal `1` with complete return-shape coverage. This change reports `unknown` instead, preserving mutation uncertainty rather than claiming a stale literal. ## Change and scope - Extend the existing returned-reference resolver to distinguish getter reads from ordinary calls and method reads. - Track object, instance, static, copied-result, paired getter/setter, and optional getter reads. - Preserve static/instance class-member selection and overwritten-property behavior. - Avoid invoking getter analysis for direct property assignment or deletion. - Reuse indexed object-property lookup and cover a 2,000-getter collection. ## Contract and boundary impact - Semantic owner and earliest changed stage: domain JavaScript semantic reference and mutation analysis. - CLI and MCP/tool-catalog contract: no schema, command, or inventory changes. - Provider, bridge, target-format, or platform compatibility: no provider or bridge changes. - Evidence, artifact, provenance, or reconstruction contract: affected return values retain uncertainty instead of a stale literal; source identity and provenance remain unchanged. - Process execution, authorization, cleanup, or containment impact: none. - Generated metadata, package, or installation impact: none; no generated outputs committed. ## Evidence and regression coverage - Tests added or updated: getter regressions and negative cases in the domain mutation suite; a 2,000-getter capacity case; getter cases in the existing compiled CLI/stdio MCP acceptance workflow. - Base reproduction or other evidence: reproduced six failing getter cases on upstream main before applying the fix. - User-visible CLI/MCP output: the reported shared-object return changes from stale literal `1` to `unknown`. - Remaining proof gaps: exact pinned Node 24.18.0, Windows, and macOS were not tested. For evidence-bearing changes: - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed - `npm run test:local -- src/domain/javascript/javascriptSemanticAnalysis.member_mutations.test.ts` — final suite: 170 passed. - `npx vitest run --project domain src/domain/javascript` — 746 passed before the final additional capacity test. - `npm run test:focused -- tests/acceptance/applications/javascriptReturnedReferences.test.ts` — 2 passed, exercising compiled CLI and real stdio MCP with Evidence-ID parity and a successful follow-up ping. - `npm run check` — passed. - Final `npm run check:fast` — passed. - Formatting and `git diff --check` — passed. - Pre-commit and pre-push hooks — passed. ## Compatibility, safety, and release - Breaking changes or migration steps: none. - Real Hopper/Ghidra, browser, or OS coverage: JavaScript analysis verified on Linux with Node 24.21.0 and npm 11.19.0 through CLI and stdio MCP; native providers and browsers are not involved. - Package or release metadata impact: none. - Security, privacy, process, or containment review: no new process execution, network access, or mutation authority; the analysis workflow does not execute the target JavaScript. ## Review checklist - [x] This PR addresses a concrete problem or an agreed enhancement. - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Related issue is linked. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated where needed; none require changes for this fix. - [x] User-visible CLI/MCP changes include representative output. - [x] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-17 21:12:28 +00:00