It took me a looong while to understand what's going on here, but in the end your change seems to be the correct fix.

Here's my test case:

A.java

package a.b;

public class A {
  static class N1 {
    public int x = 1;
    public static int y = 1;
  }
  static protected class N2 {
    public int x = 1;
    public static int y = 1;
  }
}

Test.sclaa

package a.b {
  class C {
    class T1 extends A.N1
    class T2 extends A.N2
    def test(): Unit = {
      val n1 = new A.N1
      n1.x
      A.N1.y
      val n2 = new A.N2
      n2.x
      A.N2.y
    }

    class I extends A {
      class T1 extends A.N1
      class T2 extends A.N2
      def test(): Unit = {
        val n1 = new A.N1
        n1.x
        A.N1.y
        val n2 = new A.N2
        n2.x
        A.N2.y
      }
    }
  }
}

I was wondering why the bug only affects N2, but not N1. What's going on:

• The classfile parser for A creates symbols for all nested classes (enterOwnInnerClasses)
• When those inner symbols complete, the classfile parser runs on A$N1 / A$N2 etc
  • There is an invocation of propagatePackageBoundary, which sets the privateWithin for N1, because the classfile A$N1 has no access modifier
  • However, this does not happen for A$N2, because that classfile is marked public in bytecode (!). The JVM access rules require making the class public (this will probably change on Java 11 with nestmates?)

Could you

• Add a comment to your fix? Something like "need to set privateWithin here because the classfile of a nested protected class is public in bytecode, so propagatePackageBoundary will not set it when the symbols are completed"
• Extend the test case to test access to a static member within the nested class

Great, thank you! This looks good now. Could you squash all commits into a single one and write a summary for the commit message?