mirror of https://github.com/oxc-project/oxc.git synced 2026-09-14 19:36:11 +08:00

Files

T

History

Kotaro Chikuba e82495ba54 fix(ecmascript): derive ToNumber of !x from ToBoolean (#25595 )

Found by the semantic fuzzer added in #25594 (seed `15979`).

## What

`ToNumber(!x)` was computed from `ToNumber(x)` instead of
`ToBoolean(x)`:

```rust
Expression::UnaryExpression(unary) if unary.operator.is_not() => {
    let number = unary.argument.to_number(ctx)?;
    Some(if number == 0.0 { 1.0 } else { 0.0 })
}
```

`!x` is `ToBoolean(x)` negated, so the two predicates must agree — and
they don't. `NaN` is falsy but does not number to `0`, while `"0"`, `"
"`, `"0.0"` and `[]` all number to `0` yet are truthy.

## Why it was not caught

`minimize_conditional_expression` rewrites `a ? 1 : 0` into `+!!a`. That
rewrite is correct, but when a parent expression evaluated the freshly
built `+!!a` in the same pass, the broken branch flipped the result:

```js
(NaN ? 1 : 0) || 2   // 2, minified to 0
('0' ? 1 : 0) || 2   // 1, minified to 2
([]  ? 1 : 0) || 2   // 1, minified to 2
```

A `!!x` written in the source is folded correctly by `fold_unary_expr`
before any parent observes it, so only pass-generated nodes were
affected. That is why existing tests and the conformance suites pass.

refs https://github.com/oxc-project/oxc/pull/8267

## How

Derive the value from `to_boolean`. This is strictly more conservative:
when `to_boolean` returns `None` the fold is skipped rather than
answered wrongly.

## Testing

- New regression test `test_conditional_to_unary_plus_uses_to_boolean`
covering `NaN`, `"0"`, `" "`, `"0.0"` and `[]`.
- `cargo test -p oxc_minifier -p oxc_ecmascript`, `cargo clippy
--all-targets`, `cargo fmt --check` all pass.
- `just minsize`: no snapshot change, so no size regression.

## AI disclosure

This change was produced with AI assistance (Claude Code). I have
reviewed and understand every line; the root cause and each minimal
reproduction were verified by hand against Node.js.

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-08-14 00:35:39 +00:00

src

fix(ecmascript): derive ToNumber of !x from ToBoolean (#25595 )

2026-08-14 00:35:39 +00:00

Cargo.toml

release(crates): oxc v0.144.0 (#25474 )

2026-08-10 09:57:10 +00:00

CHANGELOG.md

release(crates): oxc v0.144.0 (#25474 )

2026-08-10 09:57:10 +00:00

README.md

refactor(ecmascript)!: gate analysis APIs (#24739 )