eslint no-array-constructor: fix changes program behavior
Hypothesis Nemotron 3 Super predicted to fire fired 1×
Rewriting Array(0, 1, 2) to [0, 1, 2] alters semantics if Array is redefined globally, since the literal is unaffected by such redefinition but the constructor call would be.
Program
Output
redefined
literal
- fired
- 1 before · 0 after
- runs
- each version twice, same file name, no network
- minimizer
- 10 oracle evaluations
Judge Nemotron 3 Ultra advisory real · high
The program redefines `Array` to a custom function that returns an object with a `custom` property. The rule's documentation explicitly warns that `Array` may be redefined, yet the autofix replaces `Array(1, 2)` with the array literal `[1, 2]`, which calls the built-in Array constructor instead of the redefined function. This changes the runtime behavior from printing 'redefined' to 'literal', a silent wrong result in plausible code.
Explanation Nemotron 3 Super unverified
The original `Array` constructor was overridden to return plain objects with a `custom` property; calling `Array(1, 2)` produced such an object, making `arr.custom` truthy. The fix replaced that call with `[1, 2]`, which creates a real array instance lacking the `custom` property, so `arr.custom` becomes falsy and the output changes from "redefined" to "literal". This alters observable behavior because the redefined constructor’s side effect (adding `custom`) is lost when using the literal syntax instead of the constructor call.
Reproduce
- file
prog.js(the before program)- minimized program
- r2-p007.js
- evidence sheet
- r2-p007.md
- regression fixture
- r2-p007.js the minimized program with a header stating the observed change, for the tool's test suite
node prog.js npx eslint --no-config-lookup --rule 'no-array-constructor: error' --fix prog.js node prog.js
Upstream search GitHub issues Tavily Nemotron 3 Super + Ultra
no-array-constructor fix · no-array-constructor array constructor call · no-array-constructor new Array expression · no-array-constructor Array literal replacement
- related eslint/eslint/issues/19608 Rule change request to implement autofix for no-array-constructor, same rule but different construct (Array() vs redefined Array)
- related eslint/eslint/issues/17517 Similar bug in no-new-object rule where autofix changes behavior when constructor is redefined, same class of defect
- related eslint/eslint/issues/19494 Bug in no-array-constructor not detecting Array in sequence expression, same rule but different construct
Details
- program
- Global Array Redefinition
- hazard
- Rewriting Array(0, 1, 2) to [0, 1, 2] alters semantics if Array is redefined globally, since the literal is unaffected by such redefinition but the constructor call would be.
- oracle
stdout before: redefined stdout after: literal- run
- 2026-10-22T18-14-00-201Z-qgkx-eslint-no-array-constructor
generated program (4 lines) and the fix's diff
--- orig.js 2026-10-22 14:14:24.054524581 -0400 +++ fixed.js 2026-10-22 14:14:27.663604324 -0400 @@ -1,4 +1,4 @@ Array = function(...args) { return { length: args.length, custom: true }; }; Array.prototype.push = Array.prototype.push || function(){}; -const arr = Array(1, 2); +const arr = [1, 2]; console.log(arr.custom ? 'redefined' : 'literal');
rule documentation given to the models
Rule: no-array-constructor Fixable: code Type: suggestion Deprecated: no Description: Disallow `Array` constructors Docs: https://eslint.org/docs/latest/rules/no-array-constructor --- title: no-array-constructor rule_type: suggestion related_rules: - no-new-wrappers - no-object-constructor --- Use of the `Array` constructor to construct a new array is generally discouraged in favor of array literal notation because of the single-argument pitfall and because the `Array` global may be redefined. The exception is when the `Array` constructor is used to intentionally create sparse arrays of a specified size by giving the constructor a single numeric argument. ## Rule Details This rule disallows `Array` constructors. Examples of **incorrect** code for this rule: :::incorrect ```js /*eslint no-array-constructor: "error"*/ Array(); Array(0, 1, 2); new Array(0, 1, 2); Array(...args); ``` ::: Examples of **correct** code for this rule: :::correct ```js /*eslint no-array-constructor: "error"*/ Array(500); new Array(someOtherArray.length); [0, 1, 2]; const createArray = Array => new Array(); ``` ::: This rule additionally supports TypeScript type syntax. Examples of **correct** code for this rule: :::correct ```ts /*eslint no-array-constructor: "error"*/ new Array<number>(1, 2, 3); new Array<Foo>(); Array<number>(1, 2, 3); Array<Foo>(); Array?.foo(); ``` ::: Examples of **incorrect** code for this rule: :::incorrect ```ts /*eslint no-array-constructor: "error"*/ new Array(); new Array(0, 1, 2); Array?.(x, y); Array?.(0, 1, 2); ``` ::: ## Options This rule has no options. ## When Not To Use It This rule enforces a nearly universal stylistic concern. That being said, this rule may be disabled if the constructor style is preferred.