[GH-ISSUE #1538] bug(javascript): wide receiver return expansion exceeds the function argument limit #521

New issue

Closed

opened 2026-10-15 18:25:49 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:25:49 +00:00

Owner

Originally created by @N0zoM1z0 on GitHub (Oct 10, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/1538

A valid 1,489,023-byte JavaScript source with a 160,000-property object returned by a receiver method fails application analysis on current main 3059d8a4. This is a separate, deterministic bounded-input failure found while reviewing #1065 / #1495.

Reproduction

Generate an inert local application source:

import { mkdirSync, writeFileSync } from "node:fs";
const properties = Array.from({ length: 160000 }, (_, i) => `p${i}:0`).join(",");
mkdirSync("wide-receiver", { recursive: true });
writeFileSync("wide-receiver/app.js",
  `export function result(){const shared={x:1};const box={wide(){return {${properties},last:shared}},noop(){}};box.noop();return {x:shared.x,keep:7};}`);

Run rea analyze-javascript-application wide-receiver --artifact-format directory --format json, or MCP analyze_javascript_application with { "input_path": "<absolute path>/wide-receiver", "format": "directory" }.

Observed

Compiled CLI exits 1.
The pinned default SDK over stdio MCP returns execution_failure; diagnostics identify RangeError: Maximum call stack size exceeded. The server remains pingable.
The compiled semantic analyzer's stack identifies escapedReferenceLeaves in javascriptSemanticMemberMutations, at pending.push(...expandedValues(node, value.path, "escape")). An unbounded source-derived collection is expanded into function arguments.
Node 24.18.0, Linux x64, two assigned CPUs; the paired public reproduction completed within a 768 MiB Node heap and 2,304 MiB family RSS budget. The guard's peak was 1,025,859,584 bytes, not a fatal V8 heap abort. Source SHA-256: 9f2f61211d62d502aa9475b9c8bafcad206a7346412ae22719d7e9316965f319.

Expected / fix boundary

Visit all expanded references without invoking an argument-count limit, preserving traversal order, binding identity, mutation uncertainty and unaffected literal facts. Add public CLI/MCP regressions for wide object/array representations without elapsed-time assertions or arbitrary truncation.

This does not reproduce or resolve the private exit-134 report in #1387. No Hopper/Ghidra workflow is involved.

Originally created by @N0zoM1z0 on GitHub (Oct 10, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/1538 A valid 1,489,023-byte JavaScript source with a 160,000-property object returned by a receiver method fails application analysis on current main `3059d8a4`. This is a separate, deterministic bounded-input failure found while reviewing #1065 / #1495. ### Reproduction Generate an inert local application source: ```js import { mkdirSync, writeFileSync } from "node:fs"; const properties = Array.from({ length: 160000 }, (_, i) => `p${i}:0`).join(","); mkdirSync("wide-receiver", { recursive: true }); writeFileSync("wide-receiver/app.js", `export function result(){const shared={x:1};const box={wide(){return {${properties},last:shared}},noop(){}};box.noop();return {x:shared.x,keep:7};}`); ``` Run `rea analyze-javascript-application wide-receiver --artifact-format directory --format json`, or MCP `analyze_javascript_application` with `{ "input_path": "<absolute path>/wide-receiver", "format": "directory" }`. ### Observed - Compiled CLI exits 1. - The pinned default SDK over stdio MCP returns `execution_failure`; diagnostics identify `RangeError: Maximum call stack size exceeded`. The server remains pingable. - The compiled semantic analyzer's stack identifies `escapedReferenceLeaves` in `javascriptSemanticMemberMutations`, at `pending.push(...expandedValues(node, value.path, "escape"))`. An unbounded source-derived collection is expanded into function arguments. - Node 24.18.0, Linux x64, two assigned CPUs; the paired public reproduction completed within a 768 MiB Node heap and 2,304 MiB family RSS budget. The guard's peak was 1,025,859,584 bytes, not a fatal V8 heap abort. Source SHA-256: `9f2f61211d62d502aa9475b9c8bafcad206a7346412ae22719d7e9316965f319`. ### Expected / fix boundary Visit all expanded references without invoking an argument-count limit, preserving traversal order, binding identity, mutation uncertainty and unaffected literal facts. Add public CLI/MCP regressions for wide object/array representations without elapsed-time assertions or arbitrary truncation. This does not reproduce or resolve the private exit-134 report in #1387. No Hopper/Ghidra workflow is involved.

bsakaguchi

2026-10-15 18:25:49 +00:00

closed this issue
added the
P1: high

triage

area: domain

bug

area: tests
labels

bsakaguchi referenced this issue

2026-10-16 21:13:41 +00:00

[PR #521] [MERGED] fix(workflows): preserve punctuation in filesystem source paths #2046

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#521

No description provided.

Rows
Columns