[GH-ISSUE #6552] [Bug] Ordinary functions resolve their implicit arguments object to an outer binding #3942

New issue

Closed

opened 2026-10-31 00:45:26 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:45:26 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 23, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/6552

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

The published semantic analyzer resolves arguments inside an ordinary function to an outer variable named arguments, publishes the outer value as an exact literal return, and emits a resolved closure capture of that outer variable. The function actually reads its own arguments object. The same fixture's arrow function correctly reads the outer variable.

Reproduction

Executed the installed production CommonJS parser, semantic analyzer and semantic-graph builder directly; the CLI/MCP workflow was not run. The fixture is valid CommonJS, with zero parser errors and complete semantic IR coverage.

var arguments = {0: "OUTER"};
function ordinary() {
  const selected = arguments[0];
  return selected;
}
const arrow = () => arguments[0];

Parse this text with parseJavaScriptSource(source, "fixture.cjs") from dist/domain/javascript/javascriptSourceParser.js, then pass the returned file to analyzeParsedJavaScriptSemantics from dist/domain/javascript/javascriptSemanticAnalysis.js.
Inspect the selected binding, ordinary's direct return value and the arguments references. Each is attributed to the program-scope arguments binding; both values are {status:"literal",value:"OUTER"}.
Project that IR with buildJavaScriptSemanticGraph from dist/application/javascript/JavaScriptSemanticGraphBuilder.js: a captures relation from the outer arguments binding to ordinary has resolution:"resolved".
In a fresh Node VM context, execute the fixture followed by JSON.stringify({ordinary:ordinary("INNER"),arrow:arrow()}). The observed result is {"ordinary":"INNER","arrow":"OUTER"}. One explicit CommonJS boundary check was executed; an earlier generic-parser observation also showed the mismatch but carried a mode warning and is not the completeness evidence here.

Expected behavior

An ordinary function's implicit arguments binding must stop resolution to outer variables with the same name. Its unknown caller-provided value must not become the outer literal or a resolved closure capture. The arrow-function control must retain its lexical reference to the outer variable. The Node execution above establishes the distinction; REA documents lexical definitions/reads and resolved unique static targets in Semantic relation tracing.

Impact and scope

The demonstrated input produces incorrect retained lexical identity, a false resolved capture and a wrong literal return fact. Semantic traces and consumers of these facts can attribute a function's input to unrelated outer data. Confirmed for the ordinary function and arrow control above; other function forms and real-application frequency were not measured. A safe analysis workaround was not established; inspecting the source or executing the relevant benign code independently exposes the discrepancy.

REA version

Published rea-agents npm package 6.7.0; source inspection at 6c4d880f2dd9ca7d42593be916f90ec19b8a09d7 shows the same missing implicit function-local binding.

Runtime and platform

Node.js v26.12.1; Linux x64. No provider, device or external service was used.

Target and artifact context

Synthetic CommonJS source text containing one ordinary function, an outer arguments variable and an arrow control; semantic IR and its application-layer semantic graph.

Interface

Other

Earliest failure stage

Artifact or evidence registration

Relevant output or evidence

Observed published-runtime production-boundary output:

{"runtime":{"ordinary":"INNER","arrow":"OUTER"},"parserErrors":[],"coverage":{"status":"complete","omittedCount":0},"selectedValue":{"status":"literal","value":"OUTER"},"ordinaryReturn":{"status":"literal","value":"OUTER"},"capture":{"relation":"captures","resolution":"resolved","source":"arguments","target":"ordinary"}}

Source-derived explanation: bindFunctionLocals binds explicit runtime parameters but adds no implicit arguments binding. The demonstrated lookup consequently escapes to the outer declaration. No full suite or build was run, and no finding was rerun after this draft was written.

Additional context

Restoration check (not executed): the same valid fixture must no longer resolve ordinary's arguments read or capture to the program binding or infer its return as "OUTER"; the arrow control must still resolve to that outer binding and value. This report does not require evaluating caller arguments precisely.

Triage assessment

Impact level: P2
Assessment status: supported
Impact basis: A bounded valid CommonJS fixture produces false resolved lexical/capture evidence and a demonstrably wrong literal return value.
Workaround status: unverified
Workaround basis: Independent source inspection or execution identifies the mismatch, but no available REA option preserving the requested semantic analysis was demonstrated.

Originally created by @coygeek on GitHub (Oct 23, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/6552 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Evidence, artifacts, or reconstruction ### Observed behavior The published semantic analyzer resolves `arguments` inside an ordinary function to an outer variable named `arguments`, publishes the outer value as an exact literal return, and emits a resolved closure capture of that outer variable. The function actually reads its own arguments object. The same fixture's arrow function correctly reads the outer variable. ### Reproduction Executed the installed production CommonJS parser, semantic analyzer and semantic-graph builder directly; the CLI/MCP workflow was not run. The fixture is valid CommonJS, with zero parser errors and complete semantic IR coverage. ```js var arguments = {0: "OUTER"}; function ordinary() { const selected = arguments[0]; return selected; } const arrow = () => arguments[0]; ``` 1. Parse this text with `parseJavaScriptSource(source, "fixture.cjs")` from `dist/domain/javascript/javascriptSourceParser.js`, then pass the returned file to `analyzeParsedJavaScriptSemantics` from `dist/domain/javascript/javascriptSemanticAnalysis.js`. 2. Inspect the `selected` binding, `ordinary`'s direct return value and the `arguments` references. Each is attributed to the program-scope `arguments` binding; both values are `{status:"literal",value:"OUTER"}`. 3. Project that IR with `buildJavaScriptSemanticGraph` from `dist/application/javascript/JavaScriptSemanticGraphBuilder.js`: a `captures` relation from the outer `arguments` binding to `ordinary` has `resolution:"resolved"`. 4. In a fresh Node VM context, execute the fixture followed by `JSON.stringify({ordinary:ordinary("INNER"),arrow:arrow()})`. The observed result is `{"ordinary":"INNER","arrow":"OUTER"}`. One explicit CommonJS boundary check was executed; an earlier generic-parser observation also showed the mismatch but carried a mode warning and is not the completeness evidence here. ### Expected behavior An ordinary function's implicit `arguments` binding must stop resolution to outer variables with the same name. Its unknown caller-provided value must not become the outer literal or a resolved closure capture. The arrow-function control must retain its lexical reference to the outer variable. The Node execution above establishes the distinction; REA documents lexical definitions/reads and resolved unique static targets in [Semantic relation tracing](https://github.com/morluto/rea/blob/6c4d880f2dd9ca7d42593be916f90ec19b8a09d7/docs/javascript-application-workflows.md#semantic-relation-tracing). ### Impact and scope The demonstrated input produces incorrect retained lexical identity, a false resolved capture and a wrong literal return fact. Semantic traces and consumers of these facts can attribute a function's input to unrelated outer data. Confirmed for the ordinary function and arrow control above; other function forms and real-application frequency were not measured. A safe analysis workaround was not established; inspecting the source or executing the relevant benign code independently exposes the discrepancy. ### REA version Published `rea-agents` npm package `6.7.0`; source inspection at `6c4d880f2dd9ca7d42593be916f90ec19b8a09d7` shows the same missing implicit function-local binding. ### Runtime and platform Node.js `v26.12.1`; Linux x64. No provider, device or external service was used. ### Target and artifact context Synthetic CommonJS source text containing one ordinary function, an outer `arguments` variable and an arrow control; semantic IR and its application-layer semantic graph. ### Interface Other ### Earliest failure stage Artifact or evidence registration ### Relevant output or evidence Observed published-runtime production-boundary output: ```json {"runtime":{"ordinary":"INNER","arrow":"OUTER"},"parserErrors":[],"coverage":{"status":"complete","omittedCount":0},"selectedValue":{"status":"literal","value":"OUTER"},"ordinaryReturn":{"status":"literal","value":"OUTER"},"capture":{"relation":"captures","resolution":"resolved","source":"arguments","target":"ordinary"}} ``` Source-derived explanation: [`bindFunctionLocals`](https://github.com/morluto/rea/blob/6c4d880f2dd9ca7d42593be916f90ec19b8a09d7/src/domain/javascript/javascriptSemanticAnalysis.ts#L1716) binds explicit runtime parameters but adds no implicit `arguments` binding. The demonstrated lookup consequently escapes to the outer declaration. No full suite or build was run, and no finding was rerun after this draft was written. ### Additional context Restoration check (not executed): the same valid fixture must no longer resolve `ordinary`'s `arguments` read or capture to the program binding or infer its return as `"OUTER"`; the arrow control must still resolve to that outer binding and value. This report does not require evaluating caller arguments precisely. ## Triage assessment - Impact level: P2 - Assessment status: supported - Impact basis: A bounded valid CommonJS fixture produces false resolved lexical/capture evidence and a demonstrably wrong literal return value. - Workaround status: unverified - Workaround basis: Independent source inspection or execution identifies the mismatch, but no available REA option preserving the requested semantic analysis was demonstrated.

bsakaguchi closed this issue

2026-10-31 00:45:27 +00:00

bsakaguchi referenced this issue

2026-10-31 01:11:22 +00:00

[PR #4074] [MERGED] fix(adb): keep a bare numeric wm density as the physical density #6038

bsakaguchi referenced this issue

2026-10-31 01:11:55 +00:00

[PR #4167] [CLOSED] fix(adb): parse the bare numeric wm density form #6107