Merge pull request #18661 from asgerf/js/hoist-in-block

JS: Hoist function declarations to the top of a block statement

Author: asgerf

javascript/extractor/src/com/semmle/js/extractor/CFGExtractor.java

@@ -586,14 +586,6 @@ private static List<Identifier> of(List<Statement> body) {
     public static List<Identifier> of(Program p) {
       return of(p.getBody());
     }
-
-    public static List<Identifier> of(IFunction fn) {
-      Node body = fn.getBody();
-      if (body instanceof BlockStatement) return of(((BlockStatement) body).getBody());
-      // if the body of the function is missing or is an expression, then there are
-      // no hoisted functions
-      return Collections.emptyList();
-    }
   }
 
   /**
@@ -1096,8 +1088,6 @@ private void buildFunctionBody(IFunction nd) {
       if (nd.hasRest()) paramsAndDefaults.add((Expression) nd.getRest());
 
       Node entry = getEntryNode(nd);
-      List<Identifier> fns = HoistedFunDecls.of(nd);
-      hoistedFns.addAll(fns);
 
       // if this is the constructor of a class without a superclass, we need to
       // initialise all fields before running the body of the constructor
@@ -1117,7 +1107,7 @@ private void buildFunctionBody(IFunction nd) {
       if (firstField != null) fst = Collections.singleton(First.of(firstField));
       fst =
           visitSequence(
-              nd instanceof FunctionDeclaration ? null : nd.getId(), paramsAndDefaults, fns, fst);
+              nd instanceof FunctionDeclaration ? null : nd.getId(), paramsAndDefaults, fst);
       writeSuccessors(entry, fst);
 
       this.ctxt.pop();
@@ -1255,9 +1245,12 @@ public Void visit(Literal nd, SuccessorInfo i) {
 
     @Override
     public Void visit(BlockStatement nd, SuccessorInfo i) {
-      if (nd.getBody().isEmpty()) writeSuccessors(nd, i.getAllSuccessors());
-      else writeSuccessor(nd, First.of(nd.getBody().get(0)));
-      visitSequence(nd.getBody(), i.getAllSuccessors());
+      // Hoist function declarations in a block statement to the top of the block.
+      // This reflects non-standard behaviour implemented by most engines.
+      // See also: ECMAScript "B.3.2 Block-Level Function Declarations Web Legacy Compatibility Semantics".
+      List<Identifier> hoisted = HoistedFunDecls.of(nd.getBody());
+      hoistedFns.addAll(hoisted);
+      writeSuccessors(nd, visitSequence(hoisted, nd.getBody(), i.getAllSuccessors()));
       return null;
     }
 

javascript/extractor/src/com/semmle/js/extractor/Main.java

@@ -42,7 +42,7 @@ public class Main {
    * A version identifier that should be updated every time the extractor changes in such a way that
    * it may produce different tuples for the same file under the same {@link ExtractorConfig}.
    */
-  public static final String EXTRACTOR_VERSION = "2025-01-21";
+  public static final String EXTRACTOR_VERSION = "2025-02-03";
 
   public static final Pattern NEWLINE = Pattern.compile("\n");
 

javascript/extractor/tests/cfg/output/trap/classexpr3.js.trap

@@ -163,12 +163,12 @@ hasLocation(#20044,#20028)
 #20045=*
 exit_cfg_node(#20045,#20030)
 hasLocation(#20045,#20028)
-successor(#20035,#20036)
 successor(#20036,#20038)
 successor(#20040,#20039)
 successor(#20039,#20037)
 successor(#20038,#20040)
 successor(#20037,#20045)
+successor(#20035,#20036)
 successor(#20033,#20035)
 successor(#20044,#20033)
 successor(#20029,#20030)

javascript/extractor/tests/cfg/output/trap/classexpr4.js.trap

@@ -184,12 +184,12 @@ hasLocation(#20050,#20034)
 #20051=*
 exit_cfg_node(#20051,#20036)
 hasLocation(#20051,#20034)
-successor(#20041,#20042)
 successor(#20042,#20044)
 successor(#20046,#20045)
 successor(#20045,#20043)
 successor(#20044,#20046)
 successor(#20043,#20051)
+successor(#20041,#20042)
 successor(#20039,#20041)
 successor(#20050,#20039)
 successor(#20035,#20036)

javascript/extractor/tests/cfg/output/trap/fields.js.trap

@@ -671,7 +671,6 @@ exit_cfg_node(#20215,#20188)
 #20216=@"loc,{#10000},16,4,16,3"
 locations_default(#20216,#10000,16,4,16,3)
 hasLocation(#20215,#20216)
-successor(#20192,#20194)
 successor(#20203,#20205)
 successor(#20205,#20215)
 successor(#20198,#20202)
@@ -680,6 +679,7 @@ successor(#20207,#20203)
 successor(#20200,#20209)
 successor(#20194,#20196)
 successor(#20196,#20198)
+successor(#20192,#20194)
 successor(#20213,#20192)
 successor(#20187,#20188)
 successor(#20185,#20180)
@@ -729,9 +729,9 @@ exit_cfg_node(#20227,#20146)
 #20228=@"loc,{#10000},4,4,4,3"
 locations_default(#20228,#10000,4,4,4,3)
 hasLocation(#20227,#20228)
-successor(#20150,#20152)
 successor(#20152,#20154)
 successor(#20154,#20227)
+successor(#20150,#20152)
 successor(#20225,#20158)
 successor(#20145,#20146)
 successor(#20143,#20164)

javascript/extractor/tests/cfg/output/trap/tst.js.trap

@@ -1425,30 +1425,30 @@ successor(#20455,#20457)
 successor(#20457,#20461)
 successor(#20432,#20434)
 successor(#20434,#20436)
-successor(#20436,#20438)
 successor(#20438,#20442)
 successor(#20442,#20440)
 successor(#20440,#20443)
+successor(#20436,#20438)
 successor(#20414,#20416)
-successor(#20416,#20420)
 successor(#20420,#20418)
 successor(#20418,#20422)
 successor(#20418,#20432)
 successor(#20424,#20418)
 successor(#20422,#20424)
+successor(#20416,#20420)
 successor(#20425,#20429)
 successor(#20430,#20432)
 successor(#20429,#20430)
 successor(#20392,#20394)
 successor(#20394,#20412)
 successor(#20396,#20400)
-successor(#20401,#20403)
 successor(#20403,#20409)
 successor(#20411,#20407)
 successor(#20409,#20411)
 successor(#20407,#20412)
 successor(#20407,#20405)
 successor(#20405,#20412)
+successor(#20401,#20403)
 successor(#20400,#20401)
 successor(#20412,#20414)
 successor(#20371,#20392)
@@ -1462,7 +1462,6 @@ exit_cfg_node(#20468,#20371)
 #20469=@"loc,{#10000},18,2,18,1"
 locations_default(#20469,#10000,18,2,18,1)
 hasLocation(#20468,#20469)
-successor(#20379,#20383)
 successor(#20383,#20381)
 successor(#20381,#20384)
 successor(#20381,#20468)
@@ -1481,6 +1480,7 @@ successor(#20391,#20381)
 successor(#20384,#20387)
 successor(#20387,#20386)
 successor(#20386,#20388)
+successor(#20379,#20383)
 successor(#20377,#20379)
 successor(#20466,#20377)
 successor(#20365,#20367)
@@ -1504,7 +1504,6 @@ exit_cfg_node(#20475,#20322)
 #20476=@"loc,{#10000},10,2,10,1"
 locations_default(#20476,#10000,10,2,10,1)
 hasLocation(#20475,#20476)
-successor(#20328,#20330)
 successor(#20356,#20358)
 successor(#20358,#20359)
 successor(#20359,#20361)
@@ -1539,6 +1538,7 @@ successor(#20330,#20334)
 successor(#20335,#20332)
 successor(#20334,#20335)
 successor(#20332,#20336)
+successor(#20328,#20330)
 successor(#20474,#20328)
 successor(#20373,#20322)
 successor(#20324,#20373)

javascript/extractor/tests/es2015/output/trap/array_pattern_with_rest.js.trap

@@ -235,14 +235,14 @@ hasLocation(#20074,#20072)
 #20075=*
 exit_cfg_node(#20075,#20051)
 hasLocation(#20075,#20048)
-successor(#20058,#20060)
 successor(#20070,#20068)
 successor(#20068,#20075)
 successor(#20060,#20067)
 successor(#20064,#20066)
 successor(#20066,#20062)
 successor(#20067,#20064)
 successor(#20062,#20070)
+successor(#20058,#20060)
 successor(#20056,#20058)
 successor(#20074,#20056)
 successor(#20052,#20051)

javascript/extractor/tests/es2015/output/trap/arrowfn.js.trap

@@ -509,11 +509,11 @@ exit_cfg_node(#20163,#20143)
 #20164=@"loc,{#10000},3,40,3,39"
 locations_default(#20164,#10000,3,40,3,39)
 hasLocation(#20163,#20164)
-successor(#20146,#20148)
 successor(#20148,#20152)
 successor(#20154,#20150)
 successor(#20152,#20154)
 successor(#20150,#20163)
+successor(#20146,#20148)
 successor(#20161,#20146)
 successor(#20141,#20143)
 successor(#20139,#20160)

javascript/extractor/tests/es2015/output/trap/class_accessors.js.trap

@@ -434,14 +434,14 @@ exit_cfg_node(#20134,#20101)
 #20135=@"loc,{#10000},7,4,7,3"
 locations_default(#20135,#10000,7,4,7,3)
 hasLocation(#20134,#20135)
-successor(#20107,#20109)
 successor(#20109,#20115)
 successor(#20119,#20117)
 successor(#20117,#20111)
 successor(#20116,#20113)
 successor(#20115,#20116)
 successor(#20113,#20119)
 successor(#20111,#20134)
+successor(#20107,#20109)
 successor(#20105,#20107)
 successor(#20132,#20105)
 successor(#20100,#20101)
@@ -457,11 +457,11 @@ exit_cfg_node(#20138,#20086)
 #20139=@"loc,{#10000},4,4,4,3"
 locations_default(#20139,#10000,4,4,4,3)
 hasLocation(#20138,#20139)
-successor(#20090,#20096)
 successor(#20097,#20094)
 successor(#20096,#20097)
 successor(#20094,#20092)
 successor(#20092,#20138)
+successor(#20090,#20096)
 successor(#20136,#20090)
 successor(#20085,#20086)
 successor(#20083,#20100)

javascript/extractor/tests/es2015/output/trap/class_ctor.js.trap

@@ -246,13 +246,13 @@ exit_cfg_node(#20076,#20054)
 #20077=@"loc,{#10000},4,4,4,3"
 locations_default(#20077,#10000,4,4,4,3)
 hasLocation(#20076,#20077)
-successor(#20060,#20062)
 successor(#20062,#20068)
 successor(#20070,#20064)
 successor(#20069,#20066)
 successor(#20068,#20069)
 successor(#20066,#20070)
 successor(#20064,#20076)
+successor(#20060,#20062)
 successor(#20058,#20060)
 successor(#20074,#20058)
 successor(#20053,#20054)