morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #1665] [Bug] Four getter shapes still report a stale literal after the #1494 fix #563

New issue

Closed

opened 2026-10-15 18:26:11 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-15 18:26:11 +00:00

Owner

Originally created by @CassieFox23 on GitHub (Oct 11, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/1665

TL;DR: The getter fix for #1494 works for its six shapes. But four other getter shapes still give a wrong literal 1, with complete coverage. Real JavaScript gives 2 in all four. Three of them come from my #1569 test. The fourth, super.v, was right on #1569 but is wrong on main.

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

I tested main 4733fc810. It has both getter fixes, bc7846db9 and 639b73097. These four shapes report literal 1 with complete coverage. Real JavaScript gives 2.

Shape	Real JS	main `4733fc810`
Getter returns `this`, `box.self.x = 2; return box.x`	2	`literal 1`
Getter returns `this.s`, where `s` is the shared object	2	`literal 1`
Class getter returns a private field, `this.#s`	2	`literal 1`
Subclass getter returns `super.v`, `new B().v.x = 2`	2	`literal 1`

The result was the same on Node 22.23.1, 24.18.0 and 26.11.1 over the CLI, and on Node 24.18.0 over MCP.

Reproduction

Save this as app.js in an empty folder:

export function result() {
  const box = { x: 1, get self() { return this; } };
  box.self.x = 2;
  return box.x;
}

Run node scripts/rea.mjs analyze-javascript-application <folder> --artifact-format directory --json.
Look at the return value of result. It says literal 1, with complete coverage.
Run the file in Node. It gives 2.

The other three shapes are in the fold below.

Expected behavior

unknown, as the six #1494 shapes now give. Or the right value, 2.

Impact and scope

A caller reads a wrong value as complete. All four shapes write through an object that a getter returns. In each one, the getter returns the shared object by another route: this, a property of this, a private field, or super.

Not affected, on main: the six #1494 shapes now give unknown. 22 of the 26 extra probes from my #1569 test give unknown or the right literal. All six probes that should stay literal 1 still do. That includes a getter read with no write, which #1569 had turned into unknown.

REA version

main 4733fc810, built from source. Main has moved to 69a8b3a95, which changes no JavaScript analysis files.

Runtime and platform

Nobara 44 (Fedora 44 base), Linux 7.2.9, x86-64. Node 22.23.1, 24.18.0 and 26.11.1.

Target and artifact context

Small ES modules, one per shape, read as a directory.

Interface

CLI

Earliest failure stage

Native analysis or reconstruction

Relevant output or evidence

The other three shapes

// Getter returns this.s: real JS 2, main says literal 1
export function result() {
  const shared = { x: 1 };
  const box = { s: shared, get v() { return this.s; } };
  box.v.x = 2;
  return shared.x;
}

// Class getter returns a private field: real JS 2, main says literal 1
export function result() {
  const shared = { x: 1 };
  class B { #s = shared; get v() { return this.#s; } }
  new B().v.x = 2;
  return shared.x;
}

// Subclass getter returns super.v: real JS 2, main says literal 1
export function result() {
  const shared = { x: 1 };
  class A { get v() { return shared; } }
  class B extends A { get v() { return super.v; } }
  new B().v.x = 2;
  return shared.x;
}

All 26 extra probes, across three builds

Real JS is from plain Node. Coverage was complete in every cell. The PR column is from my #1569 comment, not rerun.

Probe	Real JS	main `6d8f95e38` (#1580)	PR `80b186b62` (#1569)	main `4733fc810`
Getter returns a fresh `{ x: 1 }`; `box.v.x = 2; return shared.x`	1	`literal 1`	`literal 1`	`literal 1`
Getter returns `this`; `box.self.x = 2; return box.x`	2	`literal 1` (wrong)	`literal 1` (wrong)	`literal 1` (wrong)
Subclass getter returns `super.v`; `new B().v.x = 2`	2	`literal 1` (wrong)	`unknown`	`literal 1` (wrong)
Getter on a prototype; `Object.create(proto).v.x = 2`	2	`unknown`	`unknown`	`unknown`
Setter-only object, empty setter; `box.v = { x: 2 }`	1	`literal 1`	`literal 1`	`literal 1`
Setter-only object, setter does `shared.x = a`; `box.v = 5`	5	`unknown`	`unknown`	`unknown`
Getter in class A, read through `new B().v.x = 2` (B extends A)	2	`literal 1` (wrong)	`unknown`	`unknown`
Getter returns `shared.inner`; `box.v.x = 2`	2	`literal 1` (wrong)	`unknown`	`unknown`
`box.v.x = 2; box.v.x = 3`	3	`literal 1` (wrong)	`unknown`	`unknown`
`const t = box.v; t.x = 2; box.v.x = 3`	3	`literal 1` (wrong)	`unknown`	`unknown`
`const { v } = box; v.x = 2`	2	`literal 1` (wrong)	`literal 1` (wrong)	`unknown`
`const copy = { ...box }; copy.v.x = 2`	2	`literal 1` (wrong)	`unknown`	`unknown`
Write inside a function that takes the box, `w(box)`	2	`unknown`	`unknown`	`unknown`
Getter returns `this.s`, where `s` is the shared object	2	`literal 1` (wrong)	`literal 1` (wrong)	`literal 1` (wrong)
Numeric key, `get 1()` and `box[1].x = 2`	2	`literal 1` (wrong)	`unknown`	`unknown`
String key, `get "a-b"()` and `box["a-b"].x = 2`	2	`literal 1` (wrong)	`unknown`	`unknown`
Getter returns `[shared.x]`; `box.v[0] = 2`	1	`literal 1`	`literal 1`	`literal 1`
`box.v.x++`	2	`literal 1` (wrong)	`unknown`	`unknown`
`delete box.v.x`	undefined	`literal 1` (wrong)	`unknown`	`unknown`
Getter returns the result of an arrow function that returns `shared`	2	`unknown`	`unknown`	`unknown`
`Object.assign(box.v, { x: 2 })`	2	`unknown`	`unknown`	`unknown`
`Reflect.get(box, "v").x = 2`	2	`unknown`	`unknown`	`unknown`
Class getter returns a private field, `this.#s`	2	`literal 1` (wrong)	`literal 1` (wrong)	`literal 1` (wrong)
`(true ? box.v : {}).x = 2`	2	`literal 1` (wrong)	`unknown`	`unknown`
`const k = box.v; const m = k.x;` with no write	1	`literal 1`	`unknown`	`literal 1`
A getter `v` exists, but the write is `box.w.x = 2`	1	`literal 1`	`literal 1`	`literal 1`

I rebuilt the 26 probes from the fold of my #1569 comment. As a check, I ran them on 6d8f95e38 (#1580). All 26 gave the same value as in that comment.

Typed outcome or recovery expected

unknown with the usual coverage note, as the six #1494 shapes now give.

Analysis or suspected cause

I did not read the code for this. I only know which shapes fail. In all four, the getter returns the shared object through this, a private field or super, not by name.

Additional context

Follows #1494 and my test of #1569. Thanks, morluto, for the getter fixes in bc7846db9 and 639b73097.

Test setup

Box: Nobara 44 (Fedora 44 base), Linux 7.2.9
CPU: AMD Ryzen 9 5900X, 12 cores / 24 threads
RAM: 32 GB DDR4-3600
Node: 22.23.1, 24.18.0, 26.11.1
Main: 4733fc810
REA: built from source with npm ci and npm run build, on Node 24.18.0

🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊

Originally created by @CassieFox23 on GitHub (Oct 11, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/1665 **TL;DR:** The getter fix for #1494 works for its six shapes. But four other getter shapes still give a wrong `literal 1`, with `complete` coverage. Real JavaScript gives 2 in all four. Three of them come from my #1569 test. The fourth, `super.v`, was right on #1569 but is wrong on main. ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Evidence, artifacts, or reconstruction ### Observed behavior I tested main 4733fc810. It has both getter fixes, bc7846db9 and 639b73097. These four shapes report `literal 1` with `complete` coverage. Real JavaScript gives 2. | Shape | Real JS | main 4733fc810 | |---|---|---| | Getter returns `this`, `box.self.x = 2; return box.x` | 2 | `literal 1` | | Getter returns `this.s`, where `s` is the shared object | 2 | `literal 1` | | Class getter returns a private field, `this.#s` | 2 | `literal 1` | | Subclass getter returns `super.v`, `new B().v.x = 2` | 2 | `literal 1` | The result was the same on Node 22.23.1, 24.18.0 and 26.11.1 over the CLI, and on Node 24.18.0 over MCP. ### Reproduction 1. Save this as `app.js` in an empty folder: ```js export function result() { const box = { x: 1, get self() { return this; } }; box.self.x = 2; return box.x; } ``` 2. Run `node scripts/rea.mjs analyze-javascript-application <folder> --artifact-format directory --json`. 3. Look at the return value of `result`. It says `literal 1`, with `complete` coverage. 4. Run the file in Node. It gives 2. The other three shapes are in the fold below. ### Expected behavior `unknown`, as the six #1494 shapes now give. Or the right value, 2. ### Impact and scope A caller reads a wrong value as complete. All four shapes write through an object that a getter returns. In each one, the getter returns the shared object by another route: `this`, a property of `this`, a private field, or `super`. Not affected, on main: the six #1494 shapes now give `unknown`. 22 of the 26 extra probes from my #1569 test give `unknown` or the right literal. All six probes that should stay `literal 1` still do. That includes a getter read with no write, which #1569 had turned into `unknown`. ### REA version main 4733fc810, built from source. Main has moved to 69a8b3a95, which changes no JavaScript analysis files. ### Runtime and platform Nobara 44 (Fedora 44 base), Linux 7.2.9, x86-64. Node 22.23.1, 24.18.0 and 26.11.1. ### Target and artifact context Small ES modules, one per shape, read as a directory. ### Interface CLI ### Earliest failure stage Native analysis or reconstruction ### Relevant output or evidence <details> <summary>The other three shapes</summary> ```js // Getter returns this.s: real JS 2, main says literal 1 export function result() { const shared = { x: 1 }; const box = { s: shared, get v() { return this.s; } }; box.v.x = 2; return shared.x; } // Class getter returns a private field: real JS 2, main says literal 1 export function result() { const shared = { x: 1 }; class B { #s = shared; get v() { return this.#s; } } new B().v.x = 2; return shared.x; } // Subclass getter returns super.v: real JS 2, main says literal 1 export function result() { const shared = { x: 1 }; class A { get v() { return shared; } } class B extends A { get v() { return super.v; } } new B().v.x = 2; return shared.x; } ``` </details> <details> <summary>All 26 extra probes, across three builds</summary> Real JS is from plain Node. Coverage was `complete` in every cell. The PR column is from my #1569 comment, not rerun. | Probe | Real JS | main 6d8f95e38 (#1580) | PR 80b186b62 (#1569) | main 4733fc810 | |---|---|---|---|---| | Getter returns a fresh `{ x: 1 }`; `box.v.x = 2; return shared.x` | 1 | `literal 1` | `literal 1` | `literal 1` | | Getter returns `this`; `box.self.x = 2; return box.x` | 2 | **`literal 1` (wrong)** | **`literal 1` (wrong)** | **`literal 1` (wrong)** | | Subclass getter returns `super.v`; `new B().v.x = 2` | 2 | **`literal 1` (wrong)** | `unknown` | **`literal 1` (wrong)** | | Getter on a prototype; `Object.create(proto).v.x = 2` | 2 | `unknown` | `unknown` | `unknown` | | Setter-only object, empty setter; `box.v = { x: 2 }` | 1 | `literal 1` | `literal 1` | `literal 1` | | Setter-only object, setter does `shared.x = a`; `box.v = 5` | 5 | `unknown` | `unknown` | `unknown` | | Getter in class A, read through `new B().v.x = 2` (B extends A) | 2 | **`literal 1` (wrong)** | `unknown` | `unknown` | | Getter returns `shared.inner`; `box.v.x = 2` | 2 | **`literal 1` (wrong)** | `unknown` | `unknown` | | `box.v.x = 2; box.v.x = 3` | 3 | **`literal 1` (wrong)** | `unknown` | `unknown` | | `const t = box.v; t.x = 2; box.v.x = 3` | 3 | **`literal 1` (wrong)** | `unknown` | `unknown` | | `const { v } = box; v.x = 2` | 2 | **`literal 1` (wrong)** | **`literal 1` (wrong)** | `unknown` | | `const copy = { ...box }; copy.v.x = 2` | 2 | **`literal 1` (wrong)** | `unknown` | `unknown` | | Write inside a function that takes the box, `w(box)` | 2 | `unknown` | `unknown` | `unknown` | | Getter returns `this.s`, where `s` is the shared object | 2 | **`literal 1` (wrong)** | **`literal 1` (wrong)** | **`literal 1` (wrong)** | | Numeric key, `get 1()` and `box[1].x = 2` | 2 | **`literal 1` (wrong)** | `unknown` | `unknown` | | String key, `get "a-b"()` and `box["a-b"].x = 2` | 2 | **`literal 1` (wrong)** | `unknown` | `unknown` | | Getter returns `[shared.x]`; `box.v[0] = 2` | 1 | `literal 1` | `literal 1` | `literal 1` | | `box.v.x++` | 2 | **`literal 1` (wrong)** | `unknown` | `unknown` | | `delete box.v.x` | undefined | **`literal 1` (wrong)** | `unknown` | `unknown` | | Getter returns the result of an arrow function that returns `shared` | 2 | `unknown` | `unknown` | `unknown` | | `Object.assign(box.v, { x: 2 })` | 2 | `unknown` | `unknown` | `unknown` | | `Reflect.get(box, "v").x = 2` | 2 | `unknown` | `unknown` | `unknown` | | Class getter returns a private field, `this.#s` | 2 | **`literal 1` (wrong)** | **`literal 1` (wrong)** | **`literal 1` (wrong)** | | `(true ? box.v : {}).x = 2` | 2 | **`literal 1` (wrong)** | `unknown` | `unknown` | | `const k = box.v; const m = k.x;` with no write | 1 | `literal 1` | `unknown` | `literal 1` | | A getter `v` exists, but the write is `box.w.x = 2` | 1 | `literal 1` | `literal 1` | `literal 1` | I rebuilt the 26 probes from the fold of my #1569 comment. As a check, I ran them on 6d8f95e38 (#1580). All 26 gave the same value as in that comment. </details> ### Typed outcome or recovery expected `unknown` with the usual coverage note, as the six #1494 shapes now give. ### Analysis or suspected cause I did not read the code for this. I only know which shapes fail. In all four, the getter returns the shared object through `this`, a private field or `super`, not by name. ### Additional context Follows #1494 and my test of #1569. Thanks, morluto, for the getter fixes in bc7846db9 and 639b73097. <details> <summary>Test setup</summary> - Box: Nobara 44 (Fedora 44 base), Linux 7.2.9 - CPU: AMD Ryzen 9 5900X, 12 cores / 24 threads - RAM: 32 GB DDR4-3600 - Node: 22.23.1, 24.18.0, 26.11.1 - Main: 4733fc810 - REA: built from source with `npm ci` and `npm run build`, on Node 24.18.0 </details> 🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊

bsakaguchi

2026-10-15 18:26:11 +00:00

closed this issue
added the
area: runtime

bug
labels

bsakaguchi commented

2026-10-15 18:26:12 +00:00

Author

Owner

@CassieFox23 commented on GitHub (Oct 11, 2026):

TL;DR: All four shapes are fixed in 795693496. Each now gives unknown with complete coverage, not a wrong literal 1. No other probe changed.

What I checked

I built main at af88184ee, which includes 795693496. I ran the four shapes from this issue on Node 22.23.1, 24.18.0 and 26.11.1 over the CLI, and on Node 24.18.0 over MCP. Plain Node gives 2 in all four.

Shape	Real JS	main `4733fc810` (earlier run)	main `af88184ee`, all four runs
Getter returns `this`, `box.self.x = 2; return box.x`	2	`literal 1`	`unknown`
Getter returns `this.s`	2	`literal 1`	`unknown`
Class getter returns `this.#s`	2	`literal 1`	`unknown`
Subclass getter returns `super.v`	2	`literal 1`	`unknown`

Coverage was complete in every cell. unknown is the answer this issue asked for.

I also reran all 36 probes: the 26 from my #1569 test and the 10 from #1494. Only these four changed from main 4733fc810. All six probes that should stay literal 1 still do. Those are the fresh object, the empty setter, the array wrap, the other property, and two reads with no write. No probe that was right is now wrong. No probe reports a wrong literal.

Your two new test files pass on Node 24.18.0: 27 tests, exit code 0. The older #1494 tests also pass: 187 tests, exit code 0. Main has since moved to f88c99021. That move changes no JavaScript analysis files.

Not run

Windows and macOS.
Getters in real-world code, not small probes.
The #1494 probes on Node 22 and 26 over MCP.
The full test suite.

Thanks, morluto, for the fix.

Test setup

Box: Nobara 44 (Fedora 44 base), Linux 7.2.9
CPU: AMD Ryzen 9 5900X, 12 cores / 24 threads
RAM: 32 GB DDR4-3600
Node: 22.23.1, 24.18.0, 26.11.1
Main: af88184ee
REA: built from source with npm ci and npm run build, on Node 24.18.0, both exit code 0

All 36 probes

The 4733fc810 column is from my earlier run, not rerun. The af88184ee column is the same on all three Node versions over the CLI and on Node 24.18.0 over MCP. Coverage was complete in every cell. Real JS is from plain Node on all three versions.

Probe	Real JS	main `4733fc810` (earlier run)	main `af88184ee` (this run)
f01 Getter returns a fresh `{ x: 1 }`; `box.v.x = 2; return shared.x`	1	`literal 1`	`literal 1`
f02 Getter returns `this`; `box.self.x = 2; return box.x`	2	`literal 1` (wrong)	`unknown`
f03 Subclass getter returns `super.v`; `new B().v.x = 2`	2	`literal 1` (wrong)	`unknown`
f04 Getter on a prototype; `Object.create(proto).v.x = 2`	2	`unknown`	`unknown`
f05 Setter-only object, empty setter; `box.v = { x: 2 }`	1	`literal 1`	`literal 1`
f06 Setter-only object, setter does `shared.x = a`; `box.v = 5`	5	`unknown`	`unknown`
f07 Getter in class A, read through `new B().v.x = 2` (B extends A)	2	`unknown`	`unknown`
f08 Getter returns `shared.inner`; `box.v.x = 2`	2	`unknown`	`unknown`
f09 `box.v.x = 2; box.v.x = 3`	3	`unknown`	`unknown`
f10 `const t = box.v; t.x = 2; box.v.x = 3`	3	`unknown`	`unknown`
f11 `const { v } = box; v.x = 2`	2	`unknown`	`unknown`
f12 `const copy = { ...box }; copy.v.x = 2`	2	`unknown`	`unknown`
f13 Write inside a function that takes the box, `w(box)`	2	`unknown`	`unknown`
f14 Getter returns `this.s`, where `s` is the shared object	2	`literal 1` (wrong)	`unknown`
f15 Numeric key, `get 1()` and `box[1].x = 2`	2	`unknown`	`unknown`
f16 String key, `get "a-b"()` and `box["a-b"].x = 2`	2	`unknown`	`unknown`
f17 Getter returns `[shared.x]`; `box.v[0] = 2`	1	`literal 1`	`literal 1`
f18 `box.v.x++`	2	`unknown`	`unknown`
f19 `delete box.v.x`	undefined	`unknown`	`unknown`
f20 Getter returns the result of an arrow function that returns `shared`	2	`unknown`	`unknown`
f21 `Object.assign(box.v, { x: 2 })`	2	`unknown`	`unknown`
f22 `Reflect.get(box, "v").x = 2`	2	`unknown`	`unknown`
f23 Class getter returns a private field, `this.#s`	2	`literal 1` (wrong)	`unknown`
f24 `(true ? box.v : {}).x = 2`	2	`unknown`	`unknown`
f25 `const k = box.v; const m = k.x;` with no write	1	`literal 1`	`literal 1`
f26 A getter `v` exists, but the write is `box.w.x = 2`	1	`literal 1`	`literal 1`
C1 Object getter, `box.v.x = 2`	2	`unknown`	`unknown`
C2 Class getter, `new B().v.x = 2`	2	`unknown`	`unknown`
C3 Static getter, `B.v.x = 2`	2	`unknown`	`unknown`
C4 Getter copied first, `const t = box.v; t.x = 2`	2	`unknown`	`unknown`
C5 Class instance in a module variable	2	`unknown`	`unknown`
C6 Same instance, copied first	2	`unknown`	`unknown`
C7 Control: method call	2	`unknown`	`unknown`
C8 Control: getter stored in a slot	2	`unknown`	`unknown`
C9 Control: `Object.defineProperty` getter	2	`unknown`	`unknown`
C10 Control: getter read, no write	1	`literal 1`	`literal 1`

🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊

@CassieFox23 commented on GitHub (Oct 11, 2026): **TL;DR:** All four shapes are fixed in 795693496. Each now gives `unknown` with `complete` coverage, not a wrong `literal 1`. No other probe changed. ### What I checked I built main at af88184ee, which includes 795693496. I ran the four shapes from this issue on Node 22.23.1, 24.18.0 and 26.11.1 over the CLI, and on Node 24.18.0 over MCP. Plain Node gives 2 in all four. | Shape | Real JS | main 4733fc810 (earlier run) | main af88184ee, all four runs | |---|---|---|---| | Getter returns `this`, `box.self.x = 2; return box.x` | 2 | `literal 1` | `unknown` | | Getter returns `this.s` | 2 | `literal 1` | `unknown` | | Class getter returns `this.#s` | 2 | `literal 1` | `unknown` | | Subclass getter returns `super.v` | 2 | `literal 1` | `unknown` | Coverage was `complete` in every cell. `unknown` is the answer this issue asked for. I also reran all 36 probes: the 26 from my #1569 test and the 10 from #1494. Only these four changed from main 4733fc810. All six probes that should stay `literal 1` still do. Those are the fresh object, the empty setter, the array wrap, the other property, and two reads with no write. No probe that was right is now wrong. No probe reports a wrong literal. Your two new test files pass on Node 24.18.0: 27 tests, exit code 0. The older #1494 tests also pass: 187 tests, exit code 0. Main has since moved to f88c99021. That move changes no JavaScript analysis files. ### Not run - Windows and macOS. - Getters in real-world code, not small probes. - The #1494 probes on Node 22 and 26 over MCP. - The full test suite. Thanks, morluto, for the fix. <details> <summary>Test setup</summary> - Box: Nobara 44 (Fedora 44 base), Linux 7.2.9 - CPU: AMD Ryzen 9 5900X, 12 cores / 24 threads - RAM: 32 GB DDR4-3600 - Node: 22.23.1, 24.18.0, 26.11.1 - Main: af88184ee - REA: built from source with `npm ci` and `npm run build`, on Node 24.18.0, both exit code 0 </details> <details> <summary>All 36 probes</summary> The 4733fc810 column is from my earlier run, not rerun. The af88184ee column is the same on all three Node versions over the CLI and on Node 24.18.0 over MCP. Coverage was `complete` in every cell. Real JS is from plain Node on all three versions. | Probe | Real JS | main 4733fc810 (earlier run) | main af88184ee (this run) | |---|---|---|---| | f01 Getter returns a fresh `{ x: 1 }`; `box.v.x = 2; return shared.x` | 1 | `literal 1` | `literal 1` | | f02 Getter returns `this`; `box.self.x = 2; return box.x` | 2 | **`literal 1` (wrong)** | `unknown` | | f03 Subclass getter returns `super.v`; `new B().v.x = 2` | 2 | **`literal 1` (wrong)** | `unknown` | | f04 Getter on a prototype; `Object.create(proto).v.x = 2` | 2 | `unknown` | `unknown` | | f05 Setter-only object, empty setter; `box.v = { x: 2 }` | 1 | `literal 1` | `literal 1` | | f06 Setter-only object, setter does `shared.x = a`; `box.v = 5` | 5 | `unknown` | `unknown` | | f07 Getter in class A, read through `new B().v.x = 2` (B extends A) | 2 | `unknown` | `unknown` | | f08 Getter returns `shared.inner`; `box.v.x = 2` | 2 | `unknown` | `unknown` | | f09 `box.v.x = 2; box.v.x = 3` | 3 | `unknown` | `unknown` | | f10 `const t = box.v; t.x = 2; box.v.x = 3` | 3 | `unknown` | `unknown` | | f11 `const { v } = box; v.x = 2` | 2 | `unknown` | `unknown` | | f12 `const copy = { ...box }; copy.v.x = 2` | 2 | `unknown` | `unknown` | | f13 Write inside a function that takes the box, `w(box)` | 2 | `unknown` | `unknown` | | f14 Getter returns `this.s`, where `s` is the shared object | 2 | **`literal 1` (wrong)** | `unknown` | | f15 Numeric key, `get 1()` and `box[1].x = 2` | 2 | `unknown` | `unknown` | | f16 String key, `get "a-b"()` and `box["a-b"].x = 2` | 2 | `unknown` | `unknown` | | f17 Getter returns `[shared.x]`; `box.v[0] = 2` | 1 | `literal 1` | `literal 1` | | f18 `box.v.x++` | 2 | `unknown` | `unknown` | | f19 `delete box.v.x` | undefined | `unknown` | `unknown` | | f20 Getter returns the result of an arrow function that returns `shared` | 2 | `unknown` | `unknown` | | f21 `Object.assign(box.v, { x: 2 })` | 2 | `unknown` | `unknown` | | f22 `Reflect.get(box, "v").x = 2` | 2 | `unknown` | `unknown` | | f23 Class getter returns a private field, `this.#s` | 2 | **`literal 1` (wrong)** | `unknown` | | f24 `(true ? box.v : {}).x = 2` | 2 | `unknown` | `unknown` | | f25 `const k = box.v; const m = k.x;` with no write | 1 | `literal 1` | `literal 1` | | f26 A getter `v` exists, but the write is `box.w.x = 2` | 1 | `literal 1` | `literal 1` | | C1 Object getter, `box.v.x = 2` | 2 | `unknown` | `unknown` | | C2 Class getter, `new B().v.x = 2` | 2 | `unknown` | `unknown` | | C3 Static getter, `B.v.x = 2` | 2 | `unknown` | `unknown` | | C4 Getter copied first, `const t = box.v; t.x = 2` | 2 | `unknown` | `unknown` | | C5 Class instance in a module variable | 2 | `unknown` | `unknown` | | C6 Same instance, copied first | 2 | `unknown` | `unknown` | | C7 Control: method call | 2 | `unknown` | `unknown` | | C8 Control: getter stored in a slot | 2 | `unknown` | `unknown` | | C9 Control: `Object.defineProperty` getter | 2 | `unknown` | `unknown` | | C10 Control: getter read, no write | 1 | `literal 1` | `literal 1` | </details> 🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊

bsakaguchi referenced this issue

2026-10-15 18:28:32 +00:00

[GH-ISSUE #2383] [Tracker] Audit analysis and debugging coverage for the TIOBE top 100 languages (October 2026) #794

bsakaguchi referenced this issue

2026-10-16 21:14:14 +00:00

[PR #597] [MERGED] fix!: repair boundary contracts across CLI and MCP #2097

bsakaguchi referenced this issue

2026-10-31 00:42:43 +00:00

[GH-ISSUE #5982] [Bug] Unparseable lipo slice output becomes a generic artifact I/O failure #3650