morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #5738] [Bug] Swift dispatch metadata drops conformances with inline Objective-C class names #3485

New issue

Closed

opened 2026-10-31 00:41:01 +00:00 by bsakaguchi · 3 comments

bsakaguchi commented

2026-10-31 00:41:01 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 21, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/5738

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Native analysis or decompilation

Observed behavior

inspect-native-dispatch-metadata exits 0 but omits both Swift conformances in a compiler-generated dylib extending NSObject and NSString. It returns no conformance or witness-slot rows and partial coverage with Unsupported Swift conformance type-reference kind. Both class names, local protocol descriptors, conformance descriptors and witness tables are present in the image. A separate ordinary Swift struct conformance decodes successfully through the same CLI/provider.

Reproduction

From the built source checkout with locked dependencies, on the macOS Apple Swift toolchain below. Compile and inspect these artifacts without executing them:

work_dir="$(mktemp -d)"
mkdir -p "$work_dir"/{home,cfg,data,cache,state,tmp}
cat > "$work_dir/fixture.swift" <<'SWIFT'
import Foundation
protocol LocalProto { func localValue() -> Int }
extension NSObject: LocalProto { func localValue() -> Int { 7 } }
protocol OtherProto { func other() -> String }
extension NSString: OtherProto { func other() -> String { "ns" } }
SWIFT
xcrun swiftc -Onone -g -parse-as-library -module-name objcconf \
  -module-cache-path "$work_dir/cache/swift" -emit-library \
  -o "$work_dir/libobjcconf.dylib" "$work_dir/fixture.swift"
rea_isolated() {
  env -i PATH="$PATH" HOME="$work_dir/home" \
    XDG_CONFIG_HOME="$work_dir/cfg" XDG_DATA_HOME="$work_dir/data" \
    XDG_CACHE_HOME="$work_dir/cache" XDG_STATE_HOME="$work_dir/state" \
    TMPDIR="$work_dir/tmp" REA_LOG_LEVEL=silent \
    node scripts/rea.mjs "$@"
}
rea_isolated inspect-native-dispatch-metadata \
  "$work_dir/libobjcconf.dylib" --json > "$work_dir/result.json"
jq '.normalized_result.result | {
  conformances: [.swift_conformances[] | {type_name, protocol_name, witness_table, decode}],
  slots: [.swift_dispatch_slots[] | {owner, implementation_address, decode}],
  coverage: [.coverage[] | select(.facet == "swift_conformances_static_witness_slots")]
}' "$work_dir/result.json"
nm -n "$work_dir/libobjcconf.dylib" | xcrun swift-demangle --compact | \
  grep -E 'protocol conformance descriptor|protocol witness table|protocol witness for'
xcrun dyld_info -fixups "$work_dir/libobjcconf.dylib"

cat > "$work_dir/control.swift" <<'SWIFT'
protocol ControlProto { func value() -> Int }
struct LocalType: ControlProto { func value() -> Int { 1 } }
SWIFT
xcrun swiftc -Onone -g -parse-as-library -module-name control \
  -module-cache-path "$work_dir/cache/swift" -emit-library \
  -o "$work_dir/libcontrol.dylib" "$work_dir/control.swift"
rea_isolated inspect-native-dispatch-metadata \
  "$work_dir/libcontrol.dylib" --json > "$work_dir/control.json"
jq '.normalized_result.result | {
  conformances: [.swift_conformances[] | {type_name, protocol_name, decode}],
  slots: [.swift_dispatch_slots[] | {owner, implementation_address, decode}],
  coverage: [.coverage[] | select(.facet == "swift_conformances_static_witness_slots")]
}' "$work_dir/control.json"

An independent verifier compiled and inspected both fixtures at the baseline below. The submitter rebuilt current main with npm run build:cached, then freshly compiled and replayed both fixtures once with the same failure/control result. Both main CLI calls exit 0 with empty stderr. Only these reduced fixtures were tested.

Expected behavior

Retain the available identities NSObject: LocalProto and NSString: OtherProto with their conformance and witness-table locations. Decode supported static synchronous witness slots, or retain accurate partial conformance records identifying any remaining unsupported witness facts. This does not require resolving external Swift nominal descriptors or supporting every Objective-C witness layout.

The simple-conformance documentation describes simple Swift conformances, static synchronous witness slots and exact metadata locations. The Architecture and Cleanup rule requires preservation of identity, partial facts and meaningful uncertainty. These fixtures have non-generic local protocols and locally readable class-name strings. The documentation does not explicitly enumerate every ABI type-reference kind; accurate partial records preserving available identities are an acceptable recovery.

Impact and scope

P2, supported: the tested valid dylib loses two conformance identities and local witness relationships from the static inventory. Aggregate partial coverage warns callers, so the loss is bounded and visible. The demonstrated manual workaround is nm with swift-demangle and dyld_info, which recover names, descriptors and local witness targets for this unstripped fixture; they do not establish an equivalent complete REA inventory. Production prevalence, other architectures, stripped artifacts and MCP were not tested. No target execution or mutation occurred.

REA version

rea-agents 6.7.0; independently verified at source baseline 9d8e7803326a382cbbb3ffdb900f5e93e5442d68. Rechecked after a fresh build of origin/main at d0067ba34a39ea47dd7e11bb2e6169bc0938cc3f, also 6.7.0: still reproduces.

Runtime and platform

Node.js v26.12.0; macOS 27.0.1 arm64; Apple Swift 6.4 (swiftlang-6.4.0.34.1 clang-2100.3.34.1), swift-driver 1.168.6. Native provider native-macos, version apple-metadata-reader-1. No Hopper/Ghidra session was used.

Target and artifact context

Self-built thin arm64 Mach-O dylibs inspected statically. The failing fixture extends NSObject and NSString with separate local protocols; the control uses a local Swift struct and protocol. Complete sources are inline above.

Interface

CLI

Earliest failure stage

Native analysis or reconstruction

Relevant output or evidence

Fresh main replay, CLI exit 0:

{
  "conformances": [],
  "slots": [],
  "coverage": [{
    "facet": "swift_conformances_static_witness_slots",
    "status": "partial",
    "reason": "conformance_decode_failed at 0xad0: Unsupported Swift conformance type-reference kind; conformance_decode_failed at 0xad4: Unsupported Swift conformance type-reference kind",
    "examined": 2,
    "decoded": 0
  }]
}

The main control returns LocalType: ControlProto, a decoded witness implementation at 0x690, and complete conformance coverage (examined: 1, decoded: 1).

On the failing main artifact, nm/demangler independently identify __C.NSObject: objcconf.LocalProto and __C.NSString: objcconf.OtherProto, conformance descriptors at 0x9d0/0x9ec, witness tables at 0x4000/0x4010, and witness thunks at 0x944/0x9a0. dyld_info reports local rebases from both witness-table headers to those descriptors and from their function slots to those thunks. Addresses vary between builds; the coverage failure addresses locate conformance-section entries.

At the baseline, the independent verifier also followed the signed-relative descriptor fields with a separate Mach-O byte reader. Both flags were 0x10 (type-reference kind 2); the type fields pointed to inline NSObject/NSString strings, the protocol fields to local kind-3 descriptors named LocalProto/OtherProto, and the witness fields to the two local tables. Evidence provenance: observed; local verification: independently reproduced and replayed on current main.

Typed outcome or recovery expected

Preserve both conformance identities and available descriptor/witness locations, with decoded supported witness targets or a concrete partial-record limitation. Preserve the ordinary Swift control. A proposed malformed/unsupported-reference control must retain truthful partial coverage without fabricated identities. No fix or restoration against modified code was tested.

Analysis or suspected cause

Source-derived explanation: the current main decoder recovers the local protocol name, then accepts only type-reference kinds 0 and 1. Kind 2 throws before the inline class name, witness address or conformance row is read. Entry recovery retains the diagnostic while discarding those recoverable facts. This is a REA reader guard; no bundled dependency was identified as the cause.

Additional context

Prepared with AI assistance and independently verified. No earlier known-good version was established.

Sibling #5683 concerns external Swift descriptor bindings losing identity before a false descriptor-kind read. Main's pointer/binding changes do not restore this case: the fresh main replay still hits the separate kind-2 guard with a local class-name string and local protocol descriptor. #4368 and open PRs #4429/#4472 concern malformed empty names invalidating the whole result; these valid nonempty names instead return a successful partial result with their rows omitted. #5682 concerns qualification of retained names, and #5685 concerns null class-vtable implementations. Those restoration checks do not restore inline Objective-C class-name conformances.

Originally created by @coygeek on GitHub (Oct 21, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/5738 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Native analysis or decompilation ### Observed behavior `inspect-native-dispatch-metadata` exits 0 but omits both Swift conformances in a compiler-generated dylib extending `NSObject` and `NSString`. It returns no conformance or witness-slot rows and partial coverage with `Unsupported Swift conformance type-reference kind`. Both class names, local protocol descriptors, conformance descriptors and witness tables are present in the image. A separate ordinary Swift struct conformance decodes successfully through the same CLI/provider. ### Reproduction From the built source checkout with locked dependencies, on the macOS Apple Swift toolchain below. Compile and inspect these artifacts without executing them: ```sh work_dir="$(mktemp -d)" mkdir -p "$work_dir"/{home,cfg,data,cache,state,tmp} cat > "$work_dir/fixture.swift" <<'SWIFT' import Foundation protocol LocalProto { func localValue() -> Int } extension NSObject: LocalProto { func localValue() -> Int { 7 } } protocol OtherProto { func other() -> String } extension NSString: OtherProto { func other() -> String { "ns" } } SWIFT xcrun swiftc -Onone -g -parse-as-library -module-name objcconf \ -module-cache-path "$work_dir/cache/swift" -emit-library \ -o "$work_dir/libobjcconf.dylib" "$work_dir/fixture.swift" rea_isolated() { env -i PATH="$PATH" HOME="$work_dir/home" \ XDG_CONFIG_HOME="$work_dir/cfg" XDG_DATA_HOME="$work_dir/data" \ XDG_CACHE_HOME="$work_dir/cache" XDG_STATE_HOME="$work_dir/state" \ TMPDIR="$work_dir/tmp" REA_LOG_LEVEL=silent \ node scripts/rea.mjs "$@" } rea_isolated inspect-native-dispatch-metadata \ "$work_dir/libobjcconf.dylib" --json > "$work_dir/result.json" jq '.normalized_result.result | { conformances: [.swift_conformances[] | {type_name, protocol_name, witness_table, decode}], slots: [.swift_dispatch_slots[] | {owner, implementation_address, decode}], coverage: [.coverage[] | select(.facet == "swift_conformances_static_witness_slots")] }' "$work_dir/result.json" nm -n "$work_dir/libobjcconf.dylib" | xcrun swift-demangle --compact | \ grep -E 'protocol conformance descriptor|protocol witness table|protocol witness for' xcrun dyld_info -fixups "$work_dir/libobjcconf.dylib" cat > "$work_dir/control.swift" <<'SWIFT' protocol ControlProto { func value() -> Int } struct LocalType: ControlProto { func value() -> Int { 1 } } SWIFT xcrun swiftc -Onone -g -parse-as-library -module-name control \ -module-cache-path "$work_dir/cache/swift" -emit-library \ -o "$work_dir/libcontrol.dylib" "$work_dir/control.swift" rea_isolated inspect-native-dispatch-metadata \ "$work_dir/libcontrol.dylib" --json > "$work_dir/control.json" jq '.normalized_result.result | { conformances: [.swift_conformances[] | {type_name, protocol_name, decode}], slots: [.swift_dispatch_slots[] | {owner, implementation_address, decode}], coverage: [.coverage[] | select(.facet == "swift_conformances_static_witness_slots")] }' "$work_dir/control.json" ``` An independent verifier compiled and inspected both fixtures at the baseline below. The submitter rebuilt current main with `npm run build:cached`, then freshly compiled and replayed both fixtures once with the same failure/control result. Both main CLI calls exit 0 with empty stderr. Only these reduced fixtures were tested. ### Expected behavior Retain the available identities `NSObject: LocalProto` and `NSString: OtherProto` with their conformance and witness-table locations. Decode supported static synchronous witness slots, or retain accurate partial conformance records identifying any remaining unsupported witness facts. This does not require resolving external Swift nominal descriptors or supporting every Objective-C witness layout. The [simple-conformance documentation](https://github.com/morluto/rea/blob/9d8e7803326a382cbbb3ffdb900f5e93e5442d68/docs/native-investigation.md#L419-L434) describes simple Swift conformances, static synchronous witness slots and exact metadata locations. The [Architecture and Cleanup rule](https://github.com/morluto/rea/blob/9d8e7803326a382cbbb3ffdb900f5e93e5442d68/AGENTS.md#architecture-and-cleanup) requires preservation of identity, partial facts and meaningful uncertainty. These fixtures have non-generic local protocols and locally readable class-name strings. The documentation does not explicitly enumerate every ABI type-reference kind; accurate partial records preserving available identities are an acceptable recovery. ### Impact and scope P2, supported: the tested valid dylib loses two conformance identities and local witness relationships from the static inventory. Aggregate partial coverage warns callers, so the loss is bounded and visible. The demonstrated manual workaround is `nm` with `swift-demangle` and `dyld_info`, which recover names, descriptors and local witness targets for this unstripped fixture; they do not establish an equivalent complete REA inventory. Production prevalence, other architectures, stripped artifacts and MCP were not tested. No target execution or mutation occurred. ### REA version `rea-agents` 6.7.0; independently verified at source baseline `9d8e7803326a382cbbb3ffdb900f5e93e5442d68`. Rechecked after a fresh build of `origin/main` at `d0067ba34a39ea47dd7e11bb2e6169bc0938cc3f`, also 6.7.0: still reproduces. ### Runtime and platform Node.js v26.12.0; macOS 27.0.1 arm64; Apple Swift 6.4 (swiftlang-6.4.0.34.1 clang-2100.3.34.1), swift-driver 1.168.6. Native provider `native-macos`, version `apple-metadata-reader-1`. No Hopper/Ghidra session was used. ### Target and artifact context Self-built thin arm64 Mach-O dylibs inspected statically. The failing fixture extends `NSObject` and `NSString` with separate local protocols; the control uses a local Swift struct and protocol. Complete sources are inline above. ### Interface CLI ### Earliest failure stage Native analysis or reconstruction ### Relevant output or evidence Fresh main replay, CLI exit 0: ```json { "conformances": [], "slots": [], "coverage": [{ "facet": "swift_conformances_static_witness_slots", "status": "partial", "reason": "conformance_decode_failed at 0xad0: Unsupported Swift conformance type-reference kind; conformance_decode_failed at 0xad4: Unsupported Swift conformance type-reference kind", "examined": 2, "decoded": 0 }] } ``` The main control returns `LocalType: ControlProto`, a decoded witness implementation at `0x690`, and complete conformance coverage (`examined: 1`, `decoded: 1`). On the failing main artifact, `nm`/demangler independently identify `__C.NSObject: objcconf.LocalProto` and `__C.NSString: objcconf.OtherProto`, conformance descriptors at `0x9d0`/`0x9ec`, witness tables at `0x4000`/`0x4010`, and witness thunks at `0x944`/`0x9a0`. `dyld_info` reports local rebases from both witness-table headers to those descriptors and from their function slots to those thunks. Addresses vary between builds; the coverage failure addresses locate conformance-section entries. At the baseline, the independent verifier also followed the signed-relative descriptor fields with a separate Mach-O byte reader. Both flags were `0x10` (type-reference kind 2); the type fields pointed to inline `NSObject`/`NSString` strings, the protocol fields to local kind-3 descriptors named `LocalProto`/`OtherProto`, and the witness fields to the two local tables. Evidence provenance: observed; local verification: independently reproduced and replayed on current main. ### Typed outcome or recovery expected Preserve both conformance identities and available descriptor/witness locations, with decoded supported witness targets or a concrete partial-record limitation. Preserve the ordinary Swift control. A proposed malformed/unsupported-reference control must retain truthful partial coverage without fabricated identities. No fix or restoration against modified code was tested. ### Analysis or suspected cause Source-derived explanation: [the current main decoder](https://github.com/morluto/rea/blob/d0067ba34a39ea47dd7e11bb2e6169bc0938cc3f/src/native/AppleSwiftDispatchFacets.ts#L279-L295) recovers the local protocol name, then accepts only type-reference kinds 0 and 1. Kind 2 throws before the inline class name, witness address or conformance row is read. Entry recovery retains the diagnostic while discarding those recoverable facts. This is a REA reader guard; no bundled dependency was identified as the cause. ### Additional context Prepared with AI assistance and independently verified. No earlier known-good version was established. Sibling #5683 concerns external Swift descriptor bindings losing identity before a false descriptor-kind read. Main's pointer/binding changes do not restore this case: the fresh main replay still hits the separate kind-2 guard with a local class-name string and local protocol descriptor. #4368 and open PRs #4429/#4472 concern malformed empty names invalidating the whole result; these valid nonempty names instead return a successful partial result with their rows omitted. #5682 concerns qualification of retained names, and #5685 concerns null class-vtable implementations. Those restoration checks do not restore inline Objective-C class-name conformances.

bsakaguchi closed this issue

2026-10-31 00:41:01 +00:00

bsakaguchi commented

2026-10-31 00:41:02 +00:00

Author

Owner

@XinwangTao commented on GitHub (Oct 21, 2026):

Confirmed: the exit-0-with-partial-coverage combination makes this easy to miss — "Unsupported Swift conformance type-reference kind" for inline Objective-C class names looks like the conformance descriptor's type reference is emitted as a relative/indirect reference (class names are mangled differently when the superclass is an ObjC class), so the decoder hits the unsupported kind and silently drops the rows instead of reporting them. The fact that an ordinary struct conformance decodes fine suggests the parser handles direct type references but not this inline-class variant.

Suggestions: (1) emit an explicit warning row whenever a conformance is dropped, rather than exiting 0 with partial coverage; (2) add the mangled-name/demangled-class-name resolution path for the inline ObjC class reference kind; (3) include a regression fixture with a compiler-generated dylib extending NSObject/NSString to lock the expected conformance rows in.

@XinwangTao commented on GitHub (Oct 21, 2026): Confirmed: the exit-0-with-partial-coverage combination makes this easy to miss — "Unsupported Swift conformance type-reference kind" for inline Objective-C class names looks like the conformance descriptor's type reference is emitted as a relative/indirect reference (class names are mangled differently when the superclass is an ObjC class), so the decoder hits the unsupported kind and silently drops the rows instead of reporting them. The fact that an ordinary struct conformance decodes fine suggests the parser handles direct type references but not this inline-class variant. Suggestions: (1) emit an explicit warning row whenever a conformance is dropped, rather than exiting 0 with partial coverage; (2) add the mangled-name/demangled-class-name resolution path for the inline ObjC class reference kind; (3) include a regression fixture with a compiler-generated dylib extending NSObject/NSString to lock the expected conformance rows in.

bsakaguchi commented

2026-10-31 00:41:02 +00:00

Author

Owner

@XinwangTao commented on GitHub (Oct 21, 2026):

@XinwangTao commented on GitHub (Oct 21, 2026): Confirmed: the exit-0-with-partial-coverage combination makes this easy to miss — "Unsupported Swift conformance type-reference kind" for inline Objective-C class names looks like the conformance descriptor's type reference is emitted as a relative/indirect reference (class names are mangled differently when the superclass is an ObjC class), so the decoder hits the unsupported kind and silently drops the rows instead of reporting them. The fact that an ordinary struct conformance decodes fine suggests the parser handles direct type references but not this inline-class variant. Suggestions: (1) emit an explicit warning row whenever a conformance is dropped, rather than exiting 0 with partial coverage; (2) add the mangled-name/demangled-class-name resolution path for the inline ObjC class reference kind; (3) include a regression fixture with a compiler-generated dylib extending NSObject/NSString to lock the expected conformance rows in.

bsakaguchi commented

2026-10-31 00:41:02 +00:00

Author

Owner

@XinwangTao commented on GitHub (Oct 21, 2026):

Thanks for fixing this in 6b7d429 — decoding the inline Objective-C class-name type-reference kind is exactly what was needed here, and it brings NSObject/NSString extensions back in line with the ordinary struct conformance path. The regression fixture with a compiler-generated dylib extending NSObject/NSString will help keep this covered going forward.

@XinwangTao commented on GitHub (Oct 21, 2026): Thanks for fixing this in 6b7d429 — decoding the inline Objective-C class-name type-reference kind is exactly what was needed here, and it brings NSObject/NSString extensions back in line with the ordinary struct conformance path. The regression fixture with a compiler-generated dylib extending NSObject/NSString will help keep this covered going forward.

bsakaguchi referenced this issue

2026-10-31 01:09:19 +00:00

[PR #3485] [MERGED] fix(adb)!: keep the exact Android long version code #5771

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#3485

No description provided.

Rows
Columns