fix(minifier): don't reorder a closed-over TDZ read when inlining a var by Dunqing · Pull Request #23771 · oxc-project/oxc

Dunqing · 2026-06-25T02:58:28Z

Summary

The single-use-variable inliner could merge let num = await f(); g(v, num) into g(v, await f()), moving the read of a closed-over lexical v ahead of the await. When the enclosing function runs while v is still in its Temporal Dead Zone (called before let v executes), the merged form throws ReferenceError: Cannot access 'v' before initialization while the original does not — a Svelte production-only crash surfaced via rolldown (rolldown/rolldown#9959, sveltejs/svelte#18454).
The fix adds a guard, is_tdz_closed_over_read, that blocks the reorder only for a block-scoped binding closed over from an enclosing function — the one shape that can observe the TDZ across an await/yield. Same-function lexicals, var, and parameters still inline; the member assignment-target path (v.x = await f()) gets the same guard.
Covered by inline_single_use_variable.rs::test_inline_read_before_await_tdz (closed-over let/const/using/class, generator yield, member targets, two-level nesting, plus the safe var / parameter / same-function cases). Full oxc_minifier suite passes; minsize unchanged except bundle.min.js (+~10 bytes).

The bug

The crash needs init() to run before let v initializes — here it is called in p's initializer (circular imports cause the same shape), so v is in its TDZ while init runs:

let p = init(), v = ext();
async function init() {
  let num = await foo();
  bar(v, num);          // reads `v` AFTER the await: the await suspends, module
                        // eval runs `v = ext()`, then `init` resumes → `v` is set
}
export { p };

Inlining merges the temp into the argument, moving the read before the await:

// before this PR (incorrect)
async function init() {
  bar(v, await foo());  // reads `v` before the await → still in TDZ →
}                       // ReferenceError: Cannot access 'v' before initialization

// after (correct): the temp is preserved, the read stays after the await
async function init() {
  let num = await foo();
  bar(v, num);
}

(With a normal late call — init imported and invoked after this module finishes evaluating — v is already initialized and there is no crash. The inliner still keeps the temp because it cannot prove the call is late.)

How it works

A reorder turns a working program into a crashing one in exactly one shape: the moved read is a block-scoped binding (let/const/using/class/enum) that is closed over from an enclosing function. The mechanism:

The enclosing async/generator function is called before the binding's declaration has run, so the binding is in its TDZ.
The original reads it after an await/yield. During that suspension, outer code runs the declaration and initializes the binding — so the read succeeds.
Inlining moves the read before the await (before the suspension), so it now observes the TDZ and throws.

A binding declared in the same function can't trigger this: the body runs top-to-bottom on every call, so the binding is always initialized before the read — it can't be initialized "mid-suspension" by the function's own later code. var / parameters have no TDZ at all.

So the guard blocks the reorder exactly when the read is block-scoped and closed over, and detects "closed over" structurally — walking from the read's scope out to the binding's declaration scope and checking whether a function boundary is crossed first (suspensions only live inside function scopes):

// unsafe to reorder iff: block-scoped binding AND the read crosses a
// function boundary before reaching the binding's declaration scope
is_block_scoped(symbol) && read_crosses_function_boundary(read_scope, decl_scope)

Blocked — closed over (kept)

Each is kept because v is a closed-over block-scoped binding and the inliner can't prove init is never called early (see The bug above). For the call-argument case, with that early call spelled out:

let p = init(), v = ext();   // init() runs before `v = ext()` → `v` in TDZ
async function init() {
  let num = await foo();
  bar(v, num);               // kept: merging would read `v` before the await → ReferenceError
}

The same guard covers a member assignment target (the object is read before the write) and generators (yield is a suspension point too):

// member target
let v = ext();
export async function init() { let num = await foo(); v.x = num; }   // kept

// generator
let v = ext();
export function* init() { let num = yield foo(); bar(v, num); }      // kept

Still inlined — no TDZ hazard

// parameter: not block-scoped, no TDZ
export async function init(v) {
  let num = await foo();
  bar(v, num);            // → bar(v, await foo())
}

// `var`: function-scoped, no TDZ
export async function init() {
  var v = ext();
  let num = await foo();
  bar(v, num);            // → bar(ext(), await foo())
}

// same-function lexical: initialized before the read
export function outer() {
  const v = ext();
  return bar(v, ext2());  // → return bar(ext(), ext2())
}

Comparison with other minifiers

Verified by minifying each case and running the output (early-call repro where init() runs before let v initializes):

Case	Sound to fold?	this PR	esbuild	terser	SWC
closed-over `let v` as call arg `g(v, num)`	no (TDZ)	keep ✓	keep ✓	keep ✓	fold ✗
closed-over `let v` as member target `v.x = num`	no (TDZ)	keep ✓	keep ✓	keep ✓	fold ✗
plain assign `v = num`	yes	fold	fold	keep	fold
same-function `const` skipped past	yes	inline	keep	inline	inline
parameter `v` as call arg	yes	fold	keep	keep	fold

esbuild and terser already decline the unsound reorder; this PR aligns oxc with them on the two TDZ cases while keeping oxc's existing (sound) folds on the rest. SWC currently performs the same unsound reorder and reproduces the ReferenceError.

Dunqing · 2026-06-25T02:58:42Z

fix(minifier): don't reorder a closed-over TDZ read when inlining a var #23771 👈 (View in Graphite)
main

How to use the Graphite Merge Queue

Add either label to this PR to merge it via the merge queue:

0-merge - adds this PR to the back of the merge queue
hotfix - for urgent changes, fast-track this PR to the front of the merge queue

You must have a Graphite account in order to use the merge queue. Sign up using this link.

_{An organization admin has enabled the Graphite Merge Queue in this repository.} _{Please do not merge from GitHub as this will restart CI on PRs being processed by the merge queue.}

This stack of pull requests is managed by Graphite. Learn more about stacking.

codspeed-hq · 2026-06-25T03:07:00Z

Merging this PR will not alter performance

✅ 62 untouched benchmarks
⏩ 9 skipped benchmarks¹

_{Comparing fix/minifier-no-reorder-tdz-read (721e224) with main (57e4469)²}

9 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩
No successful run was found on main (3be5952) during the generation of this report, so 57e4469 was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

oxc-guard · 2026-06-29T03:28:19Z

Monitor Oxc

Commit: 8235aceb8408

suite	result
Build	✅
Isolated Declarations	✅
(dce)	✅
(compressor)	✅
(codegen)	✅
(whitespace)	✅
(transformer)	✅
(formatter)	❌
(mangler)	❌
(formatter_dcr)	✅

Dunqing · 2026-06-29T09:28:13Z

Merge activity

Jun 29, 9:28 AM UTC: The merge label '0-merge' was detected. This PR will be added to the Graphite merge queue once it meets the requirements.
Jun 29, 9:33 AM UTC: Dunqing added this pull request to the Graphite merge queue.
Jun 29, 9:39 AM UTC: Merged by the Graphite merge queue.

…ar (#23771) ## Summary - The single-use-variable inliner could merge `let num = await f(); g(v, num)` into `g(v, await f())`, moving the read of a closed-over lexical `v` ahead of the `await`. When the enclosing function runs while `v` is still in its Temporal Dead Zone (called before `let v` executes), the merged form throws `ReferenceError: Cannot access 'v' before initialization` while the original does not — a Svelte production-only crash surfaced via rolldown ([rolldown/rolldown#9959](rolldown/rolldown#9959), [sveltejs/svelte#18454](sveltejs/svelte#18454)). - The fix adds a guard, `is_tdz_closed_over_read`, that blocks the reorder only for a **block-scoped binding closed over from an enclosing function** — the one shape that can observe the TDZ across an `await`/`yield`. Same-function lexicals, `var`, and parameters still inline; the member assignment-target path (`v.x = await f()`) gets the same guard. - Covered by `inline_single_use_variable.rs::test_inline_read_before_await_tdz` (closed-over `let`/`const`/`using`/`class`, generator `yield`, member targets, two-level nesting, plus the safe `var` / parameter / same-function cases). Full `oxc_minifier` suite passes; `minsize` unchanged except `bundle.min.js` (+~10 bytes). ## The bug The crash needs `init()` to run *before* `let v` initializes — here it is called in `p`'s initializer (circular imports cause the same shape), so `v` is in its TDZ while `init` runs: ```js let p = init(), v = ext(); async function init() { let num = await foo(); bar(v, num); // reads `v` AFTER the await: the await suspends, module // eval runs `v = ext()`, then `init` resumes → `v` is set } export { p }; ``` Inlining merges the temp into the argument, moving the read *before* the await: ```js // before this PR (incorrect) async function init() { bar(v, await foo()); // reads `v` before the await → still in TDZ → } // ReferenceError: Cannot access 'v' before initialization // after (correct): the temp is preserved, the read stays after the await async function init() { let num = await foo(); bar(v, num); } ``` (With a *normal* late call — `init` imported and invoked after this module finishes evaluating — `v` is already initialized and there is no crash. The inliner still keeps the temp because it cannot prove the call is late.) ## How it works A reorder turns a **working** program into a **crashing** one in exactly one shape: the moved read is a **block-scoped binding** (`let`/`const`/`using`/`class`/`enum`) that is **closed over from an enclosing function**. The mechanism: 1. The enclosing `async`/generator function is called *before* the binding's declaration has run, so the binding is in its TDZ. 2. The original reads it *after* an `await`/`yield`. During that suspension, outer code runs the declaration and initializes the binding — so the read succeeds. 3. Inlining moves the read *before* the `await` (before the suspension), so it now observes the TDZ and throws. A binding declared in the **same** function can't trigger this: the body runs top-to-bottom on every call, so the binding is always initialized before the read — it can't be initialized "mid-suspension" by the function's own later code. `var` / parameters have no TDZ at all. So the guard blocks the reorder exactly when the read is **block-scoped and closed over**, and detects "closed over" structurally — walking from the read's scope out to the binding's declaration scope and checking whether a **function boundary** is crossed first (suspensions only live inside function scopes): ```rust // unsafe to reorder iff: block-scoped binding AND the read crosses a // function boundary before reaching the binding's declaration scope is_block_scoped(symbol) && read_crosses_function_boundary(read_scope, decl_scope) ``` ### Blocked — closed over (kept) Each is kept because `v` is a closed-over block-scoped binding and the inliner can't prove `init` is never called early (see **The bug** above). For the call-argument case, with that early call spelled out: ```js let p = init(), v = ext(); // init() runs before `v = ext()` → `v` in TDZ async function init() { let num = await foo(); bar(v, num); // kept: merging would read `v` before the await → ReferenceError } ``` The same guard covers a member assignment target (the object is read before the write) and generators (`yield` is a suspension point too): ```js // member target let v = ext(); export async function init() { let num = await foo(); v.x = num; } // kept // generator let v = ext(); export function* init() { let num = yield foo(); bar(v, num); } // kept ``` ### Still inlined — no TDZ hazard ```js // parameter: not block-scoped, no TDZ export async function init(v) { let num = await foo(); bar(v, num); // → bar(v, await foo()) } // `var`: function-scoped, no TDZ export async function init() { var v = ext(); let num = await foo(); bar(v, num); // → bar(ext(), await foo()) } // same-function lexical: initialized before the read export function outer() { const v = ext(); return bar(v, ext2()); // → return bar(ext(), ext2()) } ``` ## Comparison with other minifiers Verified by minifying each case and running the output (early-call repro where `init()` runs before `let v` initializes): | Case | Sound to fold? | this PR | esbuild | terser | SWC | |---|---|---|---|---|---| | closed-over `let v` as call arg `g(v, num)` | no (TDZ) | keep ✓ | keep ✓ | keep ✓ | fold ✗ | | closed-over `let v` as member target `v.x = num` | no (TDZ) | keep ✓ | keep ✓ | keep ✓ | fold ✗ | | plain assign `v = num` | yes | fold | fold | keep | fold | | same-function `const` skipped past | yes | inline | keep | inline | inline | | parameter `v` as call arg | yes | fold | keep | keep | fold | esbuild and terser already decline the unsound reorder; this PR aligns oxc with them on the two TDZ cases while keeping oxc's existing (sound) folds on the rest. SWC currently performs the same unsound reorder and reproduces the `ReferenceError`.

### 💥 BREAKING CHANGES - 94fbacb ast: [**BREAKING**] Only export `AstBuilder` and `NONE` in `builder` module (#23876) (overlookmotel) - 8de5122 ecmascript: [**BREAKING**] Switch to new `AstBuilder` (#23834) (overlookmotel) - dc0ef38 transformer: [**BREAKING**] Switch to new `AstBuilder` (#23831) (overlookmotel) - 88f4455 str: [**BREAKING**] `Str` and `Ident` methods take `&GetAllocator` (#23781) (overlookmotel) - 36009dd allocator: [**BREAKING**] `GetAllocator::allocator` take `&self` (#23676) (overlookmotel) - bd74f9d allocator: [**BREAKING**] Rename `AllocatorAccessor` trait to `GetAllocator` (#23675) (overlookmotel) ### 🚀 Features - 326fe25 transformer_plugins: Support `typeof` `define` keys (#23605) (Alexander Lichter) - f2091b3 ast: Unify old and new `AstBuilder`s (#23875) (overlookmotel) - cd1fd12 codegen: Expose `Codegen::print_string` API (#23785) (camc314) - 785461b ast: Add custom builder methods to AST types (#23651) (overlookmotel) - 05d1357 ast: Add AST creation methods to AST types (#23650) (overlookmotel) - 2580eda str: Add `Str::from_str_in` and `Ident::from_str_in` methods (#23767) (overlookmotel) - 6883fcf minifier: Fold write-once falsy var to false in boolean context (#23540) (Dunqing) - fcbf993 allocator: Add `Vec::from_value_in` method (#23718) (overlookmotel) - 989ddb7 allocator: Add `Vec::from_box_in` method (#23717) (overlookmotel) - 9d1aa7f allocator: Improve `PartialEq` for `Vec` (#23716) (overlookmotel) ### 🐛 Bug Fixes - da0e5bf minifier: Don't reorder a closed-over TDZ read when inlining a var (#23771) (Dunqing) - 0b3021f allocator: Remove `Vec::from_box_in` (#23873) (overlookmotel) - 0ab64ec ast: Silence deprecation warnings within files defining deprecated `AstBuilder` methods (#23889) (overlookmotel) - 8c07cad all: Enable `disable_old_builder` Cargo feature for `oxc_ast` crate in tests (#23888) (overlookmotel) - 3800f01 ast: Legacy `AstBuilder` methods take `self` not `&self` (#23891) (overlookmotel) - 869ac20 semantic/cfg: Connect for update exit to loop test (#23791) (camc314) - d3e92d5 semantic/cfg: Connect while branches from condition exit (#23790) (camc314) - 025045d ast: `ExportNamedDeclaration` plain builder methods return boxed nodes (#23783) (overlookmotel) - 7537c58 ast: Fix name of `AstBuilder` method for `Expression::V8IntrinsicExpression` (#23766) (overlookmotel) - 3f574f5 traverse: Fix unsoundness in `Traverse` walk functions (#23745) (overlookmotel) - 585760f parser: String in AST reference arena (#23721) (overlookmotel) - 7231d55 allocator: Fix unsound lifetime extension in `Box::new_in` (#23685) (overlookmotel) ### ⚡ Performance - d5c916a semantic: Flatten hoisting_variables to avoid per-scope map allocation (#23927) (Lawrence Lin) - e71609d minifier: Bail member-expr folding before the side-effect walk (#23924) (Lawrence Lin) - e1f89ab minifier: Reduce string allocations folding addition (#23846) (overlookmotel) - 9f6ee3b isolated-declarations: Pool scope maps to avoid per-scope alloc/rehash (#23761) (Boshen) - 0b07c4c semantic: Avoid heap alloc for catch-clause binding ids (#23911) (Lawrence Lin) - c5eef8b regular_expression: Skip capturing-group pre-parse when pattern has no `(` (#23908) (Lawrence Lin) - b4f5b4b isolated_declarations: Remove redundant clone of formal parameter pattern (#23912) (Lawrence Lin) - 53d083f isolated_declarations: Use `TakeIn` not `CloneIn` (#23847) (overlookmotel) - 3ea9304 react_compiler: Use faster API to arena allocate strings (#23849) (overlookmotel) - a6d8e45 parser: Avoid span lookup for arrow expression body (#23788) (camc314) - e1886a0 transformer, minifier: Use `static_ident!` macro to create static `Ident`s (#23727) (overlookmotel) - 5527bef transformer/object-rest-spread: Reduce iteration (#23720) (overlookmotel) - 680ffbc transformer: Allocate AST nodes in arena directly (#23711) (overlookmotel) - 1c63c66 parser: Allocate AST nodes in arena directly (#23712) (overlookmotel) - 3855f0c minifier: Allocate AST nodes in arena directly (#23710) (overlookmotel) - d025887 isolated_declarations: Allocate AST nodes in arena directly (#23709) (overlookmotel) - 10b96c6 parser: Remove string search from parsing JSX element name (#23713) (overlookmotel) ### 📚 Documentation - 3d61dea all: Correct capitalization in comments (#23887) (overlookmotel) - aa1ad74 ast: Add `#[deprecated]` to legacy `AstBuilder` methods (#23877) (overlookmotel) - a4676db ast: Correct doc comment for `NONE` (#23765) (overlookmotel) - 419ec80 syntax: Fix typo in doc comment (#23674) (overlookmotel) ### 🛡️ Security - 3cdd18f deps: Update npm packages (#23690) (renovate[bot]) Co-authored-by: Boshen <1430279+Boshen@users.noreply.github.com> Co-authored-by: Cameron <cameron.clark@hey.com>

…ar (#23771) ## Summary - The single-use-variable inliner could merge `let num = await f(); g(v, num)` into `g(v, await f())`, moving the read of a closed-over lexical `v` ahead of the `await`. When the enclosing function runs while `v` is still in its Temporal Dead Zone (called before `let v` executes), the merged form throws `ReferenceError: Cannot access 'v' before initialization` while the original does not — a Svelte production-only crash surfaced via rolldown ([rolldown/rolldown#9959](rolldown/rolldown#9959), [sveltejs/svelte#18454](sveltejs/svelte#18454)). - The fix adds a guard, `is_tdz_closed_over_read`, that blocks the reorder only for a **block-scoped binding closed over from an enclosing function** — the one shape that can observe the TDZ across an `await`/`yield`. Same-function lexicals, `var`, and parameters still inline; the member assignment-target path (`v.x = await f()`) gets the same guard. - Covered by `inline_single_use_variable.rs::test_inline_read_before_await_tdz` (closed-over `let`/`const`/`using`/`class`, generator `yield`, member targets, two-level nesting, plus the safe `var` / parameter / same-function cases). Full `oxc_minifier` suite passes; `minsize` unchanged except `bundle.min.js` (+~10 bytes). ## The bug The crash needs `init()` to run *before* `let v` initializes — here it is called in `p`'s initializer (circular imports cause the same shape), so `v` is in its TDZ while `init` runs: ```js let p = init(), v = ext(); async function init() { let num = await foo(); bar(v, num); // reads `v` AFTER the await: the await suspends, module // eval runs `v = ext()`, then `init` resumes → `v` is set } export { p }; ``` Inlining merges the temp into the argument, moving the read *before* the await: ```js // before this PR (incorrect) async function init() { bar(v, await foo()); // reads `v` before the await → still in TDZ → } // ReferenceError: Cannot access 'v' before initialization // after (correct): the temp is preserved, the read stays after the await async function init() { let num = await foo(); bar(v, num); } ``` (With a *normal* late call — `init` imported and invoked after this module finishes evaluating — `v` is already initialized and there is no crash. The inliner still keeps the temp because it cannot prove the call is late.) ## How it works A reorder turns a **working** program into a **crashing** one in exactly one shape: the moved read is a **block-scoped binding** (`let`/`const`/`using`/`class`/`enum`) that is **closed over from an enclosing function**. The mechanism: 1. The enclosing `async`/generator function is called *before* the binding's declaration has run, so the binding is in its TDZ. 2. The original reads it *after* an `await`/`yield`. During that suspension, outer code runs the declaration and initializes the binding — so the read succeeds. 3. Inlining moves the read *before* the `await` (before the suspension), so it now observes the TDZ and throws. A binding declared in the **same** function can't trigger this: the body runs top-to-bottom on every call, so the binding is always initialized before the read — it can't be initialized "mid-suspension" by the function's own later code. `var` / parameters have no TDZ at all. So the guard blocks the reorder exactly when the read is **block-scoped and closed over**, and detects "closed over" structurally — walking from the read's scope out to the binding's declaration scope and checking whether a **function boundary** is crossed first (suspensions only live inside function scopes): ```rust // unsafe to reorder iff: block-scoped binding AND the read crosses a // function boundary before reaching the binding's declaration scope is_block_scoped(symbol) && read_crosses_function_boundary(read_scope, decl_scope) ``` ### Blocked — closed over (kept) Each is kept because `v` is a closed-over block-scoped binding and the inliner can't prove `init` is never called early (see **The bug** above). For the call-argument case, with that early call spelled out: ```js let p = init(), v = ext(); // init() runs before `v = ext()` → `v` in TDZ async function init() { let num = await foo(); bar(v, num); // kept: merging would read `v` before the await → ReferenceError } ``` The same guard covers a member assignment target (the object is read before the write) and generators (`yield` is a suspension point too): ```js // member target let v = ext(); export async function init() { let num = await foo(); v.x = num; } // kept // generator let v = ext(); export function* init() { let num = yield foo(); bar(v, num); } // kept ``` ### Still inlined — no TDZ hazard ```js // parameter: not block-scoped, no TDZ export async function init(v) { let num = await foo(); bar(v, num); // → bar(v, await foo()) } // `var`: function-scoped, no TDZ export async function init() { var v = ext(); let num = await foo(); bar(v, num); // → bar(ext(), await foo()) } // same-function lexical: initialized before the read export function outer() { const v = ext(); return bar(v, ext2()); // → return bar(ext(), ext2()) } ``` ## Comparison with other minifiers Verified by minifying each case and running the output (early-call repro where `init()` runs before `let v` initializes): | Case | Sound to fold? | this PR | esbuild | terser | SWC | |---|---|---|---|---|---| | closed-over `let v` as call arg `g(v, num)` | no (TDZ) | keep ✓ | keep ✓ | keep ✓ | fold ✗ | | closed-over `let v` as member target `v.x = num` | no (TDZ) | keep ✓ | keep ✓ | keep ✓ | fold ✗ | | plain assign `v = num` | yes | fold | fold | keep | fold | | same-function `const` skipped past | yes | inline | keep | inline | inline | | parameter `v` as call arg | yes | fold | keep | keep | fold | esbuild and terser already decline the unsound reorder; this PR aligns oxc with them on the two TDZ cases while keeping oxc's existing (sound) folds on the rest. SWC currently performs the same unsound reorder and reproduces the `ReferenceError`.

### 💥 BREAKING CHANGES - 94fbacb ast: [**BREAKING**] Only export `AstBuilder` and `NONE` in `builder` module (#23876) (overlookmotel) - 8de5122 ecmascript: [**BREAKING**] Switch to new `AstBuilder` (#23834) (overlookmotel) - dc0ef38 transformer: [**BREAKING**] Switch to new `AstBuilder` (#23831) (overlookmotel) - 88f4455 str: [**BREAKING**] `Str` and `Ident` methods take `&GetAllocator` (#23781) (overlookmotel) - 36009dd allocator: [**BREAKING**] `GetAllocator::allocator` take `&self` (#23676) (overlookmotel) - bd74f9d allocator: [**BREAKING**] Rename `AllocatorAccessor` trait to `GetAllocator` (#23675) (overlookmotel) ### 🚀 Features - 326fe25 transformer_plugins: Support `typeof` `define` keys (#23605) (Alexander Lichter) - f2091b3 ast: Unify old and new `AstBuilder`s (#23875) (overlookmotel) - cd1fd12 codegen: Expose `Codegen::print_string` API (#23785) (camc314) - 785461b ast: Add custom builder methods to AST types (#23651) (overlookmotel) - 05d1357 ast: Add AST creation methods to AST types (#23650) (overlookmotel) - 2580eda str: Add `Str::from_str_in` and `Ident::from_str_in` methods (#23767) (overlookmotel) - 6883fcf minifier: Fold write-once falsy var to false in boolean context (#23540) (Dunqing) - fcbf993 allocator: Add `Vec::from_value_in` method (#23718) (overlookmotel) - 989ddb7 allocator: Add `Vec::from_box_in` method (#23717) (overlookmotel) - 9d1aa7f allocator: Improve `PartialEq` for `Vec` (#23716) (overlookmotel) ### 🐛 Bug Fixes - da0e5bf minifier: Don't reorder a closed-over TDZ read when inlining a var (#23771) (Dunqing) - 0b3021f allocator: Remove `Vec::from_box_in` (#23873) (overlookmotel) - 0ab64ec ast: Silence deprecation warnings within files defining deprecated `AstBuilder` methods (#23889) (overlookmotel) - 8c07cad all: Enable `disable_old_builder` Cargo feature for `oxc_ast` crate in tests (#23888) (overlookmotel) - 3800f01 ast: Legacy `AstBuilder` methods take `self` not `&self` (#23891) (overlookmotel) - 869ac20 semantic/cfg: Connect for update exit to loop test (#23791) (camc314) - d3e92d5 semantic/cfg: Connect while branches from condition exit (#23790) (camc314) - 025045d ast: `ExportNamedDeclaration` plain builder methods return boxed nodes (#23783) (overlookmotel) - 7537c58 ast: Fix name of `AstBuilder` method for `Expression::V8IntrinsicExpression` (#23766) (overlookmotel) - 3f574f5 traverse: Fix unsoundness in `Traverse` walk functions (#23745) (overlookmotel) - 585760f parser: String in AST reference arena (#23721) (overlookmotel) - 7231d55 allocator: Fix unsound lifetime extension in `Box::new_in` (#23685) (overlookmotel) ### ⚡ Performance - d5c916a semantic: Flatten hoisting_variables to avoid per-scope map allocation (#23927) (Lawrence Lin) - e71609d minifier: Bail member-expr folding before the side-effect walk (#23924) (Lawrence Lin) - e1f89ab minifier: Reduce string allocations folding addition (#23846) (overlookmotel) - 9f6ee3b isolated-declarations: Pool scope maps to avoid per-scope alloc/rehash (#23761) (Boshen) - 0b07c4c semantic: Avoid heap alloc for catch-clause binding ids (#23911) (Lawrence Lin) - c5eef8b regular_expression: Skip capturing-group pre-parse when pattern has no `(` (#23908) (Lawrence Lin) - b4f5b4b isolated_declarations: Remove redundant clone of formal parameter pattern (#23912) (Lawrence Lin) - 53d083f isolated_declarations: Use `TakeIn` not `CloneIn` (#23847) (overlookmotel) - 3ea9304 react_compiler: Use faster API to arena allocate strings (#23849) (overlookmotel) - a6d8e45 parser: Avoid span lookup for arrow expression body (#23788) (camc314) - e1886a0 transformer, minifier: Use `static_ident!` macro to create static `Ident`s (#23727) (overlookmotel) - 5527bef transformer/object-rest-spread: Reduce iteration (#23720) (overlookmotel) - 680ffbc transformer: Allocate AST nodes in arena directly (#23711) (overlookmotel) - 1c63c66 parser: Allocate AST nodes in arena directly (#23712) (overlookmotel) - 3855f0c minifier: Allocate AST nodes in arena directly (#23710) (overlookmotel) - d025887 isolated_declarations: Allocate AST nodes in arena directly (#23709) (overlookmotel) - 10b96c6 parser: Remove string search from parsing JSX element name (#23713) (overlookmotel) ### 📚 Documentation - 3d61dea all: Correct capitalization in comments (#23887) (overlookmotel) - aa1ad74 ast: Add `#[deprecated]` to legacy `AstBuilder` methods (#23877) (overlookmotel) - a4676db ast: Correct doc comment for `NONE` (#23765) (overlookmotel) - 419ec80 syntax: Fix typo in doc comment (#23674) (overlookmotel) ### 🛡️ Security - 3cdd18f deps: Update npm packages (#23690) (renovate[bot]) Co-authored-by: Boshen <1430279+Boshen@users.noreply.github.com> Co-authored-by: Cameron <cameron.clark@hey.com>

github-actions Bot added the A-minifier Area - Minifier label Jun 25, 2026

Dunqing force-pushed the fix/minifier-no-reorder-tdz-read branch 4 times, most recently from 1ed0a27 to 8235ace Compare June 29, 2026 03:26

Dunqing added the run-monitor-oxc Add to a PR to dispatch oxc-project/monitor-oxc CI against it label Jun 29, 2026

oxc-guard Bot removed the run-monitor-oxc Add to a PR to dispatch oxc-project/monitor-oxc CI against it label Jun 29, 2026

Dunqing marked this pull request as ready for review June 29, 2026 08:10

Dunqing requested a review from overlookmotel as a code owner June 29, 2026 08:10

Dunqing removed the request for review from overlookmotel June 29, 2026 08:26

Dunqing force-pushed the fix/minifier-no-reorder-tdz-read branch from 8235ace to 721e224 Compare June 29, 2026 09:22

Dunqing added the 0-merge Merge with Graphite Merge Queue label Jun 29, 2026

graphite-app Bot force-pushed the fix/minifier-no-reorder-tdz-read branch from 721e224 to da0e5bf Compare June 29, 2026 09:34

graphite-app Bot merged commit da0e5bf into main Jun 29, 2026
29 checks passed

graphite-app Bot removed the 0-merge Merge with Graphite Merge Queue label Jun 29, 2026

graphite-app Bot deleted the fix/minifier-no-reorder-tdz-read branch June 29, 2026 09:39

oxc-guard Bot mentioned this pull request Jun 29, 2026

release(crates): oxc v0.138.0 #23934

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(minifier): don't reorder a closed-over TDZ read when inlining a var#23771

fix(minifier): don't reorder a closed-over TDZ read when inlining a var#23771
graphite-app[bot] merged 1 commit into
mainfrom
fix/minifier-no-reorder-tdz-read

Dunqing commented Jun 25, 2026 •

edited

Loading

Uh oh!

Dunqing commented Jun 25, 2026

Uh oh!

codspeed-hq Bot commented Jun 25, 2026 •

edited

Loading

Uh oh!

oxc-guard Bot commented Jun 29, 2026 •

edited

Loading

Uh oh!

Dunqing commented Jun 29, 2026 •

edited by graphite-app Bot

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

Dunqing commented Jun 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

The bug

How it works

Blocked — closed over (kept)

Still inlined — no TDZ hazard

Comparison with other minifiers

Uh oh!

Dunqing commented Jun 25, 2026

How to use the Graphite Merge Queue

Uh oh!

codspeed-hq Bot commented Jun 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merging this PR will not alter performance

Footnotes

Uh oh!

oxc-guard Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Monitor Oxc

Uh oh!

Dunqing commented Jun 29, 2026 • edited by graphite-app Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merge activity

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Dunqing commented Jun 25, 2026 •

edited

Loading

codspeed-hq Bot commented Jun 25, 2026 •

edited

Loading

oxc-guard Bot commented Jun 29, 2026 •

edited

Loading

Dunqing commented Jun 29, 2026 •

edited by graphite-app Bot

Loading