False positive: java/field-masks-super-field triggered on Kotlin sealed class with open val constructor parameters #22361

Activity

1. jketema commented on Aug 17, 2026

   

   jketema

   on Aug 17, 2026

   Contributor

   More actions

   Hi @shreyasingh824,

   I'm not able to reproduce the problem based on the minimal reproducer you provided. When I create a test with that code, and run java/field-masks-super-field there are no results.
2. shreyasingh824 commented on Aug 18, 2026

   

   shreyasingh824

   on Aug 18, 2026

   Author

   More actions

   Hi @jketema,

   Thank you for checking! That actually makes sense - I've done further investigation since opening this issue
   and I believe the root cause is different from what I
   described in the original report.

   After opening the actual alerts in the GitHub UI browser, the real shadowed field name shown is $stable - not
   width or height. Every single one of our 1118 alerts shows $stable as the shadowed field.

   $stable is a synthetic field injected by the Jetpack Compose compiler plugin into every class it processes
   for stability inference. Because Compose adds it to both parent and child classes with the same name, CodeQL fires
   the rule - even though no developer wrote either field.

   So the actual reproducer is:

   • Any sealed class or class hierarchy where the Compose compiler has processed the classes
   • Both parent and subclass get $stable injected
   • CodeQL sees same field name in both → fires the rule

   This is the same category as the LiveLiteral exclusion in PR #10859 — Compose-generated synthetic fields — but
   $stable was not covered by that fix.

   Could the fix be extended to also exclude $stable fields, similar to how LiveLiteral is already excluded?

   Thanks again for looking into this.
3. jketema

   added

   awaiting-responseThe CodeQL team is awaiting further input or clarification from the original reporter of this issue.The CodeQL team is awaiting further input or clarification from the original reporter of this issue.

   and removed

   awaiting-responseThe CodeQL team is awaiting further input or clarification from the original reporter of this issue.The CodeQL team is awaiting further input or clarification from the original reporter of this issue.

   on Aug 18, 2026
4. jketema commented on Aug 18, 2026

   

   jketema

   on Aug 18, 2026

   Contributor

   More actions

   Again. I cannot reproduce this. You need to provide a complete example with reproducing steps.
5. shreyasingh824 commented on Aug 18, 2026

   

   shreyasingh824

   on Aug 18, 2026

   Author

   More actions

   Hi @jketema,

   I ran javap on the actual compiled classes from the flagged file to get the ground truth on the bytecode.

   Alert #9135 — FnFInterruptState.kt

   

   Alert #9136 — ExperimentationCoreApplicationManager.kt

   

   Both alerts show:

   This field shadows another field called $stable in a superclass.

   Here's the actual javap output for the class hierarchy:

   FnFInterruptState (parent class):

   public abstract class FnFInterruptState {
     public static final int $stable;
     private FnFInterruptState();
     public final boolean isDataCheckCompleted();
     static {};
   }

   FnFInterruptState$Success (subclass):

   public final class FnFInterruptState$Success
       extends FnFInterruptState {
     private final ImmutableList images;
     private final int pageTitle;
     private final String searchTerm;
     private final String actualTerm;
     private final int totalProductCount;
     private final boolean hasPrimaryResult;
     private final int fnfWidgetInsertPos;
     public static final int $stable;
     static {};
   }

   FnFInterruptState$Loading (subclass):

   public final class FnFInterruptState$Loading
       extends FnFInterruptState {
     private final int fnfWidgetInsertPos;
     public static final int $stable;
     static {};
   }

   Checking every field against the query's own filter logic (not this.isPrivate() and not this.isStatic()):

   Field	In parent	In subclass	Static	Private	Can rule fire
   $stable	yes	yes	yes, public static final	no	no — excluded by not this.isStatic()
   fnfWidgetInsertPos	no	yes	no	yes, private final	no — excluded by not this.isPrivate()
   all other fields	no	yes	no	yes, private final	no — excluded by not this.isPrivate()

   There's no field in this hierarchy that's both non-static and non-private. Under the query's own logic, the rule shouldn't be able to fire here at all.

   Is it possible CodeQL's Kotlin extractor represents $stable as a non-static field internally, even though the compiled bytecode declares it as public static final int $stable? That would explain the mismatch between what javap shows and what the alert reports.

   We have 1118 open alerts, all showing $stable as the shadowed field. Happy to provide any more detail or run further checks on our end if that helps.
6. jketema commented on Aug 18, 2026

   

   jketema

   on Aug 18, 2026

   Contributor

   More actions

   Note that I have no way to inspect the issues you're linking to, as they are internal to you organization.

   There are two paths forward here:

   • either you provide all the necessary steps here to reproduce the problem, or
   • you open a support request with GitHub support and share a database with them in private; it seems you're a paying customer and hence should be able to do so.