Skip to content

fix(semantic/cfg): connect for update exit to loop test#23791

Merged
graphite-app[bot] merged 1 commit into
mainfrom
fix/semantic-cfg-for-update
Jun 25, 2026
Merged

fix(semantic/cfg): connect for update exit to loop test#23791
graphite-app[bot] merged 1 commit into
mainfrom
fix/semantic-cfg-for-update

Conversation

@camc314

@camc314 camc314 commented Jun 25, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

Correct the CFG generated for for statements whose update expression spans multiple basic blocks, such as conditional or logical expressions.

This addresses the malformed CFG underlying #23789.

Problem

update_graph_ix identifies the entry of the update expression. After visiting the expression, cfg.current_node_ix identifies its exit block.

Previously, the loop backedge to the test originated from the update entry. This allowed control flow to bypass the update expression and left its exit block disconnected.

Before

flowchart LR
    Test["Loop test"] -->|truthy| Body["Loop body"]
    Test -->|falsy| After["After loop"]

    Body -->|backedge| Entry["Update entry"]
    Entry --> Update["Update expression blocks"]
    Update --> Exit["Update exit"]

    Entry -->|backedge| Test
Loading

After

flowchart LR
    Test["Loop test"] -->|truthy| Body["Loop body"]
    Test -->|falsy| After["After loop"]

    Body -->|backedge| Entry["Update entry"]
    Entry --> Update["Update expression blocks"]
    Update --> Exit["Update exit"]
    Exit -->|backedge| Test
Loading

Implementation

Record cfg.current_node_ix after visiting the update expression as after_update_graph_ix. The backedge to the loop test now originates from that exit block.

The loop body backedge and continue target still point to update_graph_ix, ensuring the complete update expression runs before the next test.

A dedicated CFG fixture covers a conditional update expression:

forward ? index++ : index--

@camc314 camc314 requested a review from Dunqing as a code owner June 25, 2026 17:16
@github-actions github-actions Bot added the A-semantic Area - Semantic label Jun 25, 2026
@camc314 camc314 mentioned this pull request Jun 25, 2026
Merged
@codspeed-hq

codspeed-hq Bot commented Jun 25, 2026

Copy link
Copy Markdown

Merging this PR will not alter performance

✅ 62 untouched benchmarks
⏩ 9 skipped benchmarks1

Comparing fix/semantic-cfg-for-update (af06514) with main (222e9f6)

Open in CodSpeed

Footnotes

  1. 9 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

@camc314 camc314 added the 0-merge Merge with Graphite Merge Queue label Jun 25, 2026
@camc314 camc314 self-assigned this Jun 25, 2026
@camc314 Graphite App

camc314 commented Jun 25, 2026 •
edited by graphite-app Bot
Loading

Copy link
Copy Markdown
Contributor Author

Merge activity

@camc314
fix(semantic/cfg): connect for update exit to loop test (#23791)
869ac20 
## Summary

Correct the CFG generated for `for` statements whose update expression spans multiple basic blocks, such as conditional or logical expressions.

This addresses the malformed CFG underlying #23789.

## Problem

`update_graph_ix` identifies the entry of the update expression. After visiting the expression, `cfg.current_node_ix` identifies its exit block.

Previously, the loop backedge to the test originated from the update entry. This allowed control flow to bypass the update expression and left its exit block disconnected.

### Before

```mermaid
flowchart LR
    Test["Loop test"] -->|truthy| Body["Loop body"]
    Test -->|falsy| After["After loop"]

    Body -->|backedge| Entry["Update entry"]
    Entry --> Update["Update expression blocks"]
    Update --> Exit["Update exit"]

    Entry -->|backedge| Test
```

### After

```mermaid
flowchart LR
    Test["Loop test"] -->|truthy| Body["Loop body"]
    Test -->|falsy| After["After loop"]

    Body -->|backedge| Entry["Update entry"]
    Entry --> Update["Update expression blocks"]
    Update --> Exit["Update exit"]
    Exit -->|backedge| Test
```

## Implementation

Record `cfg.current_node_ix` after visiting the update expression as `after_update_graph_ix`. The backedge to the loop test now originates from that exit block.

The loop body backedge and `continue` target still point to `update_graph_ix`, ensuring the complete update expression runs before the next test.

A dedicated CFG fixture covers a conditional update expression:

```js
forward ? index++ : index--
```
@graphite-app graphite-app Bot force-pushed the fix/semantic-cfg-for-update branch from af06514 to 869ac20 Compare June 25, 2026 17:26
@graphite-app graphite-app Bot merged commit 869ac20 into main Jun 25, 2026
29 checks passed
@graphite-app graphite-app Bot removed the 0-merge Merge with Graphite Merge Queue label Jun 25, 2026
@graphite-app graphite-app Bot deleted the fix/semantic-cfg-for-update branch June 25, 2026 17:30
graphite-app Bot pushed a commit that referenced this pull request Jun 25, 2026
@camc314
test(linter/no-useless-assignment): cover conditional for updates (#2…
48c0e47 
…3792)

fixes #23789

closes #23789 by adding a regression test case.

The test verifies that both branches of a conditional `for` update expression are considered used by the next loop iteration:

```ts
forward ? index++ : index--
```

Note, this was fixed via the CFG correction in #23791 - the update branches were disconnected from the loop test and incorrectly reported as useless assignments.

Stacked on #23791.
@oxc-guard oxc-guard Bot mentioned this pull request Jun 29, 2026
Merged
camc314 added a commit that referenced this pull request Jun 29, 2026
@oxc-guard @Boshen @camc314
release(crates): oxc v0.138.0 (#23934)
8bf69a3 
### 💥 BREAKING CHANGES

- 94fbacb ast: [**BREAKING**] Only export `AstBuilder` and `NONE` in
`builder` module (#23876) (overlookmotel)
- 8de5122 ecmascript: [**BREAKING**] Switch to new `AstBuilder` (#23834)
(overlookmotel)
- dc0ef38 transformer: [**BREAKING**] Switch to new `AstBuilder`
(#23831) (overlookmotel)
- 88f4455 str: [**BREAKING**] `Str` and `Ident` methods take
`&GetAllocator` (#23781) (overlookmotel)
- 36009dd allocator: [**BREAKING**] `GetAllocator::allocator` take
`&self` (#23676) (overlookmotel)
- bd74f9d allocator: [**BREAKING**] Rename `AllocatorAccessor` trait to
`GetAllocator` (#23675) (overlookmotel)

### 🚀 Features

- 326fe25 transformer_plugins: Support `typeof` `define` keys (#23605)
(Alexander Lichter)
- f2091b3 ast: Unify old and new `AstBuilder`s (#23875) (overlookmotel)
- cd1fd12 codegen: Expose `Codegen::print_string` API (#23785) (camc314)
- 785461b ast: Add custom builder methods to AST types (#23651)
(overlookmotel)
- 05d1357 ast: Add AST creation methods to AST types (#23650)
(overlookmotel)
- 2580eda str: Add `Str::from_str_in` and `Ident::from_str_in` methods
(#23767) (overlookmotel)
- 6883fcf minifier: Fold write-once falsy var to false in boolean
context (#23540) (Dunqing)
- fcbf993 allocator: Add `Vec::from_value_in` method (#23718)
(overlookmotel)
- 989ddb7 allocator: Add `Vec::from_box_in` method (#23717)
(overlookmotel)
- 9d1aa7f allocator: Improve `PartialEq` for `Vec` (#23716)
(overlookmotel)

### 🐛 Bug Fixes

- da0e5bf minifier: Don't reorder a closed-over TDZ read when inlining a
var (#23771) (Dunqing)
- 0b3021f allocator: Remove `Vec::from_box_in` (#23873) (overlookmotel)
- 0ab64ec ast: Silence deprecation warnings within files defining
deprecated `AstBuilder` methods (#23889) (overlookmotel)
- 8c07cad all: Enable `disable_old_builder` Cargo feature for `oxc_ast`
crate in tests (#23888) (overlookmotel)
- 3800f01 ast: Legacy `AstBuilder` methods take `self` not `&self`
(#23891) (overlookmotel)
- 869ac20 semantic/cfg: Connect for update exit to loop test (#23791)
(camc314)
- d3e92d5 semantic/cfg: Connect while branches from condition exit
(#23790) (camc314)
- 025045d ast: `ExportNamedDeclaration` plain builder methods return
boxed nodes (#23783) (overlookmotel)
- 7537c58 ast: Fix name of `AstBuilder` method for
`Expression::V8IntrinsicExpression` (#23766) (overlookmotel)
- 3f574f5 traverse: Fix unsoundness in `Traverse` walk functions
(#23745) (overlookmotel)
- 585760f parser: String in AST reference arena (#23721) (overlookmotel)
- 7231d55 allocator: Fix unsound lifetime extension in `Box::new_in`
(#23685) (overlookmotel)

### ⚡ Performance

- d5c916a semantic: Flatten hoisting_variables to avoid per-scope map
allocation (#23927) (Lawrence Lin)
- e71609d minifier: Bail member-expr folding before the side-effect walk
(#23924) (Lawrence Lin)
- e1f89ab minifier: Reduce string allocations folding addition (#23846)
(overlookmotel)
- 9f6ee3b isolated-declarations: Pool scope maps to avoid per-scope
alloc/rehash (#23761) (Boshen)
- 0b07c4c semantic: Avoid heap alloc for catch-clause binding ids
(#23911) (Lawrence Lin)
- c5eef8b regular_expression: Skip capturing-group pre-parse when
pattern has no `(` (#23908) (Lawrence Lin)
- b4f5b4b isolated_declarations: Remove redundant clone of formal
parameter pattern (#23912) (Lawrence Lin)
- 53d083f isolated_declarations: Use `TakeIn` not `CloneIn` (#23847)
(overlookmotel)
- 3ea9304 react_compiler: Use faster API to arena allocate strings
(#23849) (overlookmotel)
- a6d8e45 parser: Avoid span lookup for arrow expression body (#23788)
(camc314)
- e1886a0 transformer, minifier: Use `static_ident!` macro to create
static `Ident`s (#23727) (overlookmotel)
- 5527bef transformer/object-rest-spread: Reduce iteration (#23720)
(overlookmotel)
- 680ffbc transformer: Allocate AST nodes in arena directly (#23711)
(overlookmotel)
- 1c63c66 parser: Allocate AST nodes in arena directly (#23712)
(overlookmotel)
- 3855f0c minifier: Allocate AST nodes in arena directly (#23710)
(overlookmotel)
- d025887 isolated_declarations: Allocate AST nodes in arena directly
(#23709) (overlookmotel)
- 10b96c6 parser: Remove string search from parsing JSX element name
(#23713) (overlookmotel)

### 📚 Documentation

- 3d61dea all: Correct capitalization in comments (#23887)
(overlookmotel)
- aa1ad74 ast: Add `#[deprecated]` to legacy `AstBuilder` methods
(#23877) (overlookmotel)
- a4676db ast: Correct doc comment for `NONE` (#23765) (overlookmotel)
- 419ec80 syntax: Fix typo in doc comment (#23674) (overlookmotel)

### 🛡️ Security

- 3cdd18f deps: Update npm packages (#23690) (renovate[bot])

Co-authored-by: Boshen <1430279+Boshen@users.noreply.github.com>
Co-authored-by: Cameron <cameron.clark@hey.com>
camc314 added a commit that referenced this pull request Jul 3, 2026
@camc314
fix(semantic/cfg): connect for update exit to loop test (#23791)
7f74cec 
## Summary

Correct the CFG generated for `for` statements whose update expression spans multiple basic blocks, such as conditional or logical expressions.

This addresses the malformed CFG underlying #23789.

## Problem

`update_graph_ix` identifies the entry of the update expression. After visiting the expression, `cfg.current_node_ix` identifies its exit block.

Previously, the loop backedge to the test originated from the update entry. This allowed control flow to bypass the update expression and left its exit block disconnected.

### Before

```mermaid
flowchart LR
    Test["Loop test"] -->|truthy| Body["Loop body"]
    Test -->|falsy| After["After loop"]

    Body -->|backedge| Entry["Update entry"]
    Entry --> Update["Update expression blocks"]
    Update --> Exit["Update exit"]

    Entry -->|backedge| Test
```

### After

```mermaid
flowchart LR
    Test["Loop test"] -->|truthy| Body["Loop body"]
    Test -->|falsy| After["After loop"]

    Body -->|backedge| Entry["Update entry"]
    Entry --> Update["Update expression blocks"]
    Update --> Exit["Update exit"]
    Exit -->|backedge| Test
```

## Implementation

Record `cfg.current_node_ix` after visiting the update expression as `after_update_graph_ix`. The backedge to the loop test now originates from that exit block.

The loop body backedge and `continue` target still point to `update_graph_ix`, ensuring the complete update expression runs before the next test.

A dedicated CFG fixture covers a conditional update expression:

```js
forward ? index++ : index--
```
camc314 added a commit that referenced this pull request Jul 3, 2026
@camc314
test(linter/no-useless-assignment): cover conditional for updates (#2…
2235f2f 
…3792)

fixes #23789

closes #23789 by adding a regression test case.

The test verifies that both branches of a conditional `for` update expression are considered used by the next loop iteration:

```ts
forward ? index++ : index--
```

Note, this was fixed via the CFG correction in #23791 - the update branches were disconnected from the loop test and incorrectly reported as useless assignments.

Stacked on #23791.
camc314 added a commit that referenced this pull request Jul 3, 2026
@oxc-guard @Boshen @camc314
release(crates): oxc v0.138.0 (#23934)
3ab7388 
### 💥 BREAKING CHANGES

- 94fbacb ast: [**BREAKING**] Only export `AstBuilder` and `NONE` in
`builder` module (#23876) (overlookmotel)
- 8de5122 ecmascript: [**BREAKING**] Switch to new `AstBuilder` (#23834)
(overlookmotel)
- dc0ef38 transformer: [**BREAKING**] Switch to new `AstBuilder`
(#23831) (overlookmotel)
- 88f4455 str: [**BREAKING**] `Str` and `Ident` methods take
`&GetAllocator` (#23781) (overlookmotel)
- 36009dd allocator: [**BREAKING**] `GetAllocator::allocator` take
`&self` (#23676) (overlookmotel)
- bd74f9d allocator: [**BREAKING**] Rename `AllocatorAccessor` trait to
`GetAllocator` (#23675) (overlookmotel)

### 🚀 Features

- 326fe25 transformer_plugins: Support `typeof` `define` keys (#23605)
(Alexander Lichter)
- f2091b3 ast: Unify old and new `AstBuilder`s (#23875) (overlookmotel)
- cd1fd12 codegen: Expose `Codegen::print_string` API (#23785) (camc314)
- 785461b ast: Add custom builder methods to AST types (#23651)
(overlookmotel)
- 05d1357 ast: Add AST creation methods to AST types (#23650)
(overlookmotel)
- 2580eda str: Add `Str::from_str_in` and `Ident::from_str_in` methods
(#23767) (overlookmotel)
- 6883fcf minifier: Fold write-once falsy var to false in boolean
context (#23540) (Dunqing)
- fcbf993 allocator: Add `Vec::from_value_in` method (#23718)
(overlookmotel)
- 989ddb7 allocator: Add `Vec::from_box_in` method (#23717)
(overlookmotel)
- 9d1aa7f allocator: Improve `PartialEq` for `Vec` (#23716)
(overlookmotel)

### 🐛 Bug Fixes

- da0e5bf minifier: Don't reorder a closed-over TDZ read when inlining a
var (#23771) (Dunqing)
- 0b3021f allocator: Remove `Vec::from_box_in` (#23873) (overlookmotel)
- 0ab64ec ast: Silence deprecation warnings within files defining
deprecated `AstBuilder` methods (#23889) (overlookmotel)
- 8c07cad all: Enable `disable_old_builder` Cargo feature for `oxc_ast`
crate in tests (#23888) (overlookmotel)
- 3800f01 ast: Legacy `AstBuilder` methods take `self` not `&self`
(#23891) (overlookmotel)
- 869ac20 semantic/cfg: Connect for update exit to loop test (#23791)
(camc314)
- d3e92d5 semantic/cfg: Connect while branches from condition exit
(#23790) (camc314)
- 025045d ast: `ExportNamedDeclaration` plain builder methods return
boxed nodes (#23783) (overlookmotel)
- 7537c58 ast: Fix name of `AstBuilder` method for
`Expression::V8IntrinsicExpression` (#23766) (overlookmotel)
- 3f574f5 traverse: Fix unsoundness in `Traverse` walk functions
(#23745) (overlookmotel)
- 585760f parser: String in AST reference arena (#23721) (overlookmotel)
- 7231d55 allocator: Fix unsound lifetime extension in `Box::new_in`
(#23685) (overlookmotel)

### ⚡ Performance

- d5c916a semantic: Flatten hoisting_variables to avoid per-scope map
allocation (#23927) (Lawrence Lin)
- e71609d minifier: Bail member-expr folding before the side-effect walk
(#23924) (Lawrence Lin)
- e1f89ab minifier: Reduce string allocations folding addition (#23846)
(overlookmotel)
- 9f6ee3b isolated-declarations: Pool scope maps to avoid per-scope
alloc/rehash (#23761) (Boshen)
- 0b07c4c semantic: Avoid heap alloc for catch-clause binding ids
(#23911) (Lawrence Lin)
- c5eef8b regular_expression: Skip capturing-group pre-parse when
pattern has no `(` (#23908) (Lawrence Lin)
- b4f5b4b isolated_declarations: Remove redundant clone of formal
parameter pattern (#23912) (Lawrence Lin)
- 53d083f isolated_declarations: Use `TakeIn` not `CloneIn` (#23847)
(overlookmotel)
- 3ea9304 react_compiler: Use faster API to arena allocate strings
(#23849) (overlookmotel)
- a6d8e45 parser: Avoid span lookup for arrow expression body (#23788)
(camc314)
- e1886a0 transformer, minifier: Use `static_ident!` macro to create
static `Ident`s (#23727) (overlookmotel)
- 5527bef transformer/object-rest-spread: Reduce iteration (#23720)
(overlookmotel)
- 680ffbc transformer: Allocate AST nodes in arena directly (#23711)
(overlookmotel)
- 1c63c66 parser: Allocate AST nodes in arena directly (#23712)
(overlookmotel)
- 3855f0c minifier: Allocate AST nodes in arena directly (#23710)
(overlookmotel)
- d025887 isolated_declarations: Allocate AST nodes in arena directly
(#23709) (overlookmotel)
- 10b96c6 parser: Remove string search from parsing JSX element name
(#23713) (overlookmotel)

### 📚 Documentation

- 3d61dea all: Correct capitalization in comments (#23887)
(overlookmotel)
- aa1ad74 ast: Add `#[deprecated]` to legacy `AstBuilder` methods
(#23877) (overlookmotel)
- a4676db ast: Correct doc comment for `NONE` (#23765) (overlookmotel)
- 419ec80 syntax: Fix typo in doc comment (#23674) (overlookmotel)

### 🛡️ Security

- 3cdd18f deps: Update npm packages (#23690) (renovate[bot])

Co-authored-by: Boshen <1430279+Boshen@users.noreply.github.com>
Co-authored-by: Cameron <cameron.clark@hey.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Dunqing Dunqing Awaiting requested review from Dunqing Dunqing is a code owner

Assignees

@camc314 camc314

Labels

A-semantic Area - Semantic

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@camc314