morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #8838] [Bug] analyze_javascript_application: spreading a self-recursive call result and calling a method on its property overflows the stack (parsed_javascript_files=0) #7769

New issue

Open

opened 2026-11-03 23:47:06 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-11-03 23:47:06 +00:00

Owner

Originally created by @Kolenkovskin on GitHub (Nov 3, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/8838

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Other (JavaScript application analysis)

Observed behavior

analyze_javascript_application fails the whole source file with Maximum call stack size exceeded when a function spreads the result of its own recursive call and calls a method on a property of that result. The file is reported with analysis_status: "interrupted", analysis_failure.code: "resource_constraint", and parsed_javascript_files: 0. The syntax is valid: the @babel/parser bundled with REA parses the file without errors.

Minimal source (one line, app.js):

function f(o) { const stay = f(o); return { ...stay, c: stay.sc.startsWith("k") }; }

It was first seen on a real 1.7 MB application file. That file failed as a whole although its AST is ordinary: 138,862 nodes, depth 51, the same depth as an earlier revision of the file that analyzes cleanly. Bisection over top-level statements isolated one ~4.3 KB function. Narrowing inside it showed that both conditions are needed: the spread of the self-recursive result, and a method call on one of its properties.

Reproduction

Create a directory containing only app.js with the one-line source above.

Run:

rea analyze-javascript-application <dir> --source-path app.js --detail summary --evidence_output <out.json> --format json

Observe: exit 0, parsed_javascript_files: 0, and the file limitation app.js: Resource constraint during analyze_javascript_application: Maximum call stack size exceeded.

The same result comes from MCP analyze_javascript_application on the same directory. It reproduces on every run (deterministic). The CLI run above was repeated today with fresh directories.

Controls, each run the same way. All of them return parsed_javascript_files: 1 with no stack overflow:

variant	source
no method call	`function f(o) { const stay = f(o); return { ...stay, c: stay.sc }; }`
no spread	`function f(o) { const stay = f(o); return { c: stay.sc.startsWith("k") }; }`
no method, wrapped	`function f(o) { const stay = f(o); return { ...stay, c: String(stay.sc) }; }`
call is not recursive	`function f(o) { const stay = g(o); return { ...stay, c: stay.sc.startsWith("k") }; }`

Expected behavior

The file is analyzed (parsed_javascript_files: 1). If the return-shape inference cannot settle the self-referential shape, that one value should be reported as unknown, and the whole file should not be lost. A resource limit, if one really applies, should come back as a typed, bounded limitation and not as an engine stack overflow.

Impact and scope

One recursive helper of this shape makes REA drop all static and semantic facts for the whole file. In a bundled application that can be most of the code. Workaround: in an analysis copy, rename the recursive call site (for example f(o) → f__rec(o)). With that change, the original 1.7 MB file analyzes completely (138,837 nodes). Only the recursion edge is lost. Other shapes, such as mutual recursion or deeper property chains, were not tested. Severity beyond this is unknown.

REA version

6.8.0 (rea --version), npm package rea-agents 6.8.0. Current main was not tested.

Runtime and platform

Node v24.22.2; Windows 11 Pro x64 (10.0.26200)

Target and artifact context

Plain JavaScript source directory (CommonJS-style script, no Electron). Minimal fixture is one line, shown above.

Interface

CLI

Earliest failure stage

Native analysis or reconstruction

Relevant output or evidence

From the CLI JSON result for the minimal fixture (excerpt):

"analysis_status":"interrupted","path":"app.js","operation":"analyze-javascript-source",
"limitation":"app.js: Resource constraint during analyze_javascript_application: Maximum call stack size exceeded",
"analysis_failure":{"code":"resource_constraint","category":"resource_constraint","message":"Maximum call stack size exceeded","retryable":false, ...}
summary: "parsed_javascript_files": 0

No stack trace was captured. The failing frame inside REA is NOT_ENOUGH_INFO.

Typed outcome or recovery expected

parsed_javascript_files: 1, with the recursive return shape recorded as an unknown or bounded limitation.

Analysis or suspected cause

Hypothesis, inferred from behavior only (REA source not read): return-shape or object-flow inference for f needs the shape of stay, which is f's own return value. The spread makes that shape part of f's return. Resolving the member stay.sc.startsWith then asks for f's return shape again, and this repeats with no cycle guard. Removing either the spread or the method call breaks the cycle, which matches the controls. This looks different from the wide-array push(...spread) argument-limit issues (#1538, #8455, #8545): the input here is tiny.

Additional context

Found while analyzing our own application source, then reduced. The reduction scripts are simple top-level-statement bisection and are available on request.

Originally created by @Kolenkovskin on GitHub (Nov 3, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/8838 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Other (JavaScript application analysis) ### Observed behavior `analyze_javascript_application` fails the whole source file with `Maximum call stack size exceeded` when a function spreads the result of its own recursive call and calls a method on a property of that result. The file is reported with `analysis_status: "interrupted"`, `analysis_failure.code: "resource_constraint"`, and `parsed_javascript_files: 0`. The syntax is valid: the `@babel/parser` bundled with REA parses the file without errors. Minimal source (one line, `app.js`): ```js function f(o) { const stay = f(o); return { ...stay, c: stay.sc.startsWith("k") }; } ``` It was first seen on a real 1.7 MB application file. That file failed as a whole although its AST is ordinary: 138,862 nodes, depth 51, the same depth as an earlier revision of the file that analyzes cleanly. Bisection over top-level statements isolated one ~4.3 KB function. Narrowing inside it showed that both conditions are needed: the spread of the self-recursive result, and a method call on one of its properties. ### Reproduction 1. Create a directory containing only `app.js` with the one-line source above. 2. Run: ```sh rea analyze-javascript-application <dir> --source-path app.js --detail summary --evidence_output <out.json> --format json ``` 3. Observe: exit 0, `parsed_javascript_files: 0`, and the file limitation `app.js: Resource constraint during analyze_javascript_application: Maximum call stack size exceeded`. The same result comes from MCP `analyze_javascript_application` on the same directory. It reproduces on every run (deterministic). The CLI run above was repeated today with fresh directories. Controls, each run the same way. All of them return `parsed_javascript_files: 1` with no stack overflow: | variant | source | |---|---| | no method call | `function f(o) { const stay = f(o); return { ...stay, c: stay.sc }; }` | | no spread | `function f(o) { const stay = f(o); return { c: stay.sc.startsWith("k") }; }` | | no method, wrapped | `function f(o) { const stay = f(o); return { ...stay, c: String(stay.sc) }; }` | | call is not recursive | `function f(o) { const stay = g(o); return { ...stay, c: stay.sc.startsWith("k") }; }` | ### Expected behavior The file is analyzed (`parsed_javascript_files: 1`). If the return-shape inference cannot settle the self-referential shape, that one value should be reported as unknown, and the whole file should not be lost. A resource limit, if one really applies, should come back as a typed, bounded limitation and not as an engine stack overflow. ### Impact and scope One recursive helper of this shape makes REA drop all static and semantic facts for the whole file. In a bundled application that can be most of the code. Workaround: in an analysis copy, rename the recursive call site (for example `f(o)` → `f__rec(o)`). With that change, the original 1.7 MB file analyzes completely (138,837 nodes). Only the recursion edge is lost. Other shapes, such as mutual recursion or deeper property chains, were not tested. Severity beyond this is unknown. ### REA version 6.8.0 (`rea --version`), npm package `rea-agents` 6.8.0. Current `main` was not tested. ### Runtime and platform Node v24.22.2; Windows 11 Pro x64 (10.0.26200) ### Target and artifact context Plain JavaScript source directory (CommonJS-style script, no Electron). Minimal fixture is one line, shown above. ### Interface CLI ### Earliest failure stage Native analysis or reconstruction ### Relevant output or evidence From the CLI JSON result for the minimal fixture (excerpt): ```text "analysis_status":"interrupted","path":"app.js","operation":"analyze-javascript-source", "limitation":"app.js: Resource constraint during analyze_javascript_application: Maximum call stack size exceeded", "analysis_failure":{"code":"resource_constraint","category":"resource_constraint","message":"Maximum call stack size exceeded","retryable":false, ...} summary: "parsed_javascript_files": 0 ``` No stack trace was captured. The failing frame inside REA is NOT_ENOUGH_INFO. ### Typed outcome or recovery expected `parsed_javascript_files: 1`, with the recursive return shape recorded as an unknown or bounded limitation. ### Analysis or suspected cause Hypothesis, inferred from behavior only (REA source not read): return-shape or object-flow inference for `f` needs the shape of `stay`, which is `f`'s own return value. The spread makes that shape part of `f`'s return. Resolving the member `stay.sc.startsWith` then asks for `f`'s return shape again, and this repeats with no cycle guard. Removing either the spread or the method call breaks the cycle, which matches the controls. This looks different from the wide-array `push(...spread)` argument-limit issues (#1538, #8455, #8545): the input here is tiny. ### Additional context Found while analyzing our own application source, then reduced. The reduction scripts are simple top-level-statement bisection and are available on request.

bsakaguchi commented

2026-11-04 01:51:10 +00:00

Author

Owner

@SII-YDD commented on GitHub (Nov 4, 2026):

Reproduced on current main c3647ade1, Node 24.22.1 (Linux arm64 public workflows; macOS arm64 direct source control). The reported input throws in JavaScriptSymbolicBindings; the semantic-only entry and all four reductions complete.

The existing AST-evaluation depth guard does not cover lazy property/member queries. A returned object can defer those queries until its producing call has left #activeFunctions; newly produced values/environments then evade the value-identity guards. The direct stack includes #identifier → evaluate → #call → #propertyValue.

I have a separate local fix that makes evaluate, property, members, and unknownMembers share the existing 1,000,000-work /128-depth budget, with depth restored in finally. Exhaustion retains the existing explicit truncated/unknown result and known sibling fields, rather than losing the source file. It adds no new ceiling or function-name/argument cycle heuristic. Native Node controls caught precision loss in two discarded prototypes; the final version retains finite recursion with changed literal/object parameters, distinct captured closures, and later returned-closure invocation.

Executed evidence on pinned main plus the regressions: baseline 6 failed /94 passed; final Linux 100 passed, including compiled CLI and real stdio MCP. Both recursive files remain parsed and keep their independent endpoints; missing-input refusal → same-client ping → successful analysis → ping passes, explicit directory/source choices and quoted/percent paths remain, and source bytes are unchanged. Eight related source files: 357 passed. check:fast, check, check:ci, test discovery and docs:check pass on the final local tree; the original commit hook leaves that tree unchanged.

This is bounded symbolic analysis, not a determination of an infinite recursion's runtime value. The patch is not published as a PR yet and has no full hosted qualification. Windows and the original 1.7 MB application are unverified. Investigation and code are Codex-assisted.

@SII-YDD commented on GitHub (Nov 4, 2026):  Reproduced on current main `c3647ade1`, Node 24.22.1 (Linux arm64 public workflows; macOS arm64 direct source control). The reported input throws in `JavaScriptSymbolicBindings`; the semantic-only entry and all four reductions complete. The existing AST-evaluation depth guard does not cover lazy property/member queries. A returned object can defer those queries until its producing call has left `#activeFunctions`; newly produced values/environments then evade the value-identity guards. The direct stack includes `#identifier → evaluate → #call → #propertyValue`. I have a separate local fix that makes `evaluate`, `property`, `members`, and `unknownMembers` share the **existing** 1,000,000-work /128-depth budget, with depth restored in `finally`. Exhaustion retains the existing explicit `truncated`/unknown result and known sibling fields, rather than losing the source file. It adds no new ceiling or function-name/argument cycle heuristic. Native Node controls caught precision loss in two discarded prototypes; the final version retains finite recursion with changed literal/object parameters, distinct captured closures, and later returned-closure invocation. Executed evidence on pinned main plus the regressions: baseline **6 failed /94 passed**; final Linux **100 passed**, including compiled CLI and real stdio MCP. Both recursive files remain parsed and keep their independent endpoints; missing-input refusal → same-client ping → successful analysis → ping passes, explicit directory/source choices and quoted/percent paths remain, and source bytes are unchanged. Eight related source files: **357 passed**. `check:fast`, `check`, `check:ci`, test discovery and `docs:check` pass on the final local tree; the original commit hook leaves that tree unchanged. This is bounded symbolic analysis, not a determination of an infinite recursion's runtime value. The patch is not published as a PR yet and has no full hosted qualification. Windows and the original 1.7 MB application are unverified. Investigation and code are Codex-assisted.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#7769

No description provided.

Rows
Columns