fix(javascript): ignore a require call that a local binding shadows

src/domain/javascript/javascriptStaticAnalysis.shadowed_require.test.ts

@@ -0,0 +1,79 @@
+import { describe, expect, it } from "vitest";
+
+import { analyzeJavaScriptStaticSource } from "./javascriptStaticAnalysis.js";
+
+/** Every specifier the static analysis recorded as a loader call. */
+const requireSpecifiers = (source: string): readonly unknown[] =>
+  analyzeJavaScriptStaticSource(source)
+    .references.filter((reference) => reference.kind === "require")
+    .map((reference) => (reference as { specifier?: unknown }).specifier);
+
+describe("static require loader calls", () => {
+  it("records a require call that no binding shadows", () => {
+    expect(requireSpecifiers('const loaded = require("./real.cjs");')).toEqual([
+      "./real.cjs",
+    ]);
+  });
+
+  it("records a member loader call", () => {
+    expect(
+      requireSpecifiers('const loaded = module.require("./member.cjs");'),
+    ).toEqual(["./member.cjs"]);
+  });
+
+  it("records a loader a createRequire binding provides", () => {
+    expect(
+      requireSpecifiers(`
+        import { createRequire } from "node:module";
+        const require = createRequire(import.meta.url);
+        const loaded = require("./created.cjs");
+      `),
+    ).toEqual(["./created.cjs"]);
+  });
+
+  it("follows an aliased createRequire import from node:module", () => {
+    expect(
+      requireSpecifiers(`
+        import { createRequire as makeRequire } from "node:module";
+        const require = makeRequire(import.meta.url);
+        const loaded = require("./aliased.cjs");
+      `),
+    ).toEqual(["./aliased.cjs"]);
+  });
+
+  it("does not treat a local createRequire function as Node's factory", () => {
+    expect(
+      requireSpecifiers(`
+        function createRequire() { return () => "local"; }
+        const require = createRequire();
+        const loaded = require("./ghost.cjs");
+      `),
+    ).toEqual([]);
+  });
+
+  it("keeps the CommonJS wrapper loader separate from globalThis.require", () => {
+    expect(
+      requireSpecifiers(`
+        globalThis.require = shim;
+        const loaded = require("./wrapper.cjs");
+      `),
+    ).toEqual(["./wrapper.cjs"]);
+  });
+
+  it("keeps an uninitialized top-level var redeclaration of the wrapper loader", () => {
+    expect(requireSpecifiers('var require; require("./wrapper.cjs");')).toEqual(
+      ["./wrapper.cjs"],
+    );
+  });
+
+  it("ignores a require call that a local binding shadows", () => {
+    expect(
+      requireSpecifiers(`
+        function run(require) {
+          return require("./ghost.cjs");
+        }
+        console.log(run(() => "local"));
+      `),
+    ).toEqual([]);
+  });
+});

src/domain/javascript/javascriptStaticAnalysisCalls.ts

@@ -33,6 +33,7 @@
 } from "./javascriptStaticAnalysisState.js";
 import {
   resolveSemanticBindingState,
+  semanticStableInitializer,
   type JavaScriptSemanticAnalysisState,
 } from "./javascriptSemanticState.js";
 import {
@@ -57,7 +58,12 @@
   const first = stringValue(node.arguments[0]);
   const module = context.accumulator.moduleRangeIndex.find(node.start);
   const moduleRequireName = module?.requireName ?? null;
-  const requireCall = requireCallSpecifier(node, name, moduleRequireName);
+  const requireCall = requireCallSpecifier(
+    node,
+    name,
+    moduleRequireName,
+    isRequireLoaderReference(node.callee, bindings, name),
+  );
   if (requireCall !== null)
     addReference(context, {
       node,
@@ -210,12 +216,98 @@
       accumulator.mediaElementPreloads.add(property);
 };
 
+/**
+ * A `require` name is the loader unless a lexical binding replaces it. A binding
+ * proven to come from `createRequire(...)` is that loader; any other binding,
+ * such as a function parameter, is a different value that only shares the name.
+ */
+const isRequireLoaderReference = (
+  callee: t.Node,
+  state: JavaScriptSemanticAnalysisState,
+  name: string,
+): boolean => {
+  const binding = resolveSemanticBindingState(state, callee, name);
+  if (binding === undefined) {
+    // Node's CommonJS wrapper supplies a lexical `require` parameter. Writes
+    // to globalThis.require do not replace it; retain that possibility for
+    // script/CommonJS source where wrapper mode is possible.
+    if (name === "require" && isScriptProgram(callee, state)) return true;
+    return isUnmodifiedGlobalReference(callee, state, name);
+  }
+  if (
+    name === "require" &&
+    isTopLevelCommonJsVarRequire(binding, callee, state)
+  )
+    return true;
+  const initializer = semanticStableInitializer(binding, state)?.node;
+  const expression =
+    initializer !== undefined && t.isVariableDeclarator(initializer)
+      ? initializer.init
+      : initializer;
+  return (
+    expression !== null &&
+    expression !== undefined &&
+    t.isCallExpression(expression) &&
+    isNodeCreateRequireFactory(expression.callee, state)
+  );
+};
+
+const isNodeCreateRequireFactory = (
+  callee: t.Node,
+  state: JavaScriptSemanticAnalysisState,
+): boolean => {
+  if (!t.isIdentifier(callee)) return false;
+  const binding = resolveSemanticBindingState(state, callee, callee.name);
+  const [origin] = binding?.directOrigins ?? [];
+  return (
+    binding?.runtimeImport === true &&
+    binding.definitions.length === 1 &&
+    binding.directOrigins.length === 1 &&
+    origin !== undefined &&
+    (origin.specifier === "node:module" || origin.specifier === "module") &&
+    origin.importedPath.length === 1 &&
+    origin.importedPath[0] === "createRequire"
+  );
+};
+
+const isScriptProgram = (
+  node: t.Node,
+  state: JavaScriptSemanticAnalysisState,
+): boolean => {
+  let parent = state.parentsByNode.get(node);
+  while (parent !== undefined && !t.isProgram(parent))
+    parent = state.parentsByNode.get(parent);
+  return (
+    parent !== undefined &&
+    (parent.sourceType === "script" || parent.sourceType === "commonjs")
+  );
+};
+
+const isTopLevelCommonJsVarRequire = (
+  binding: NonNullable<ReturnType<typeof resolveSemanticBindingState>>,
+  node: t.Node,
+  state: JavaScriptSemanticAnalysisState,
+): boolean =>
+  binding.name === "require" &&
+  state.scopesById.get(binding.scopeId)?.kind === "program" &&
+  binding.definitions.length > 0 &&
+  binding.definitions.every(({ kind }) => kind === "variable") &&
+  binding.initializers.length === 0 &&
+  isScriptProgram(node, state);
+
 const requireCallSpecifier = (
   node: JavaScriptCallLike,
   name: string,
   moduleRequireName: string | null,
+  isGlobalRequire: boolean,
 ): { readonly specifier: string | undefined } | null => {
-  if (name === "require" || name.endsWith(".require"))
+  // A name alone does not make a loader call: a local binding named `require`
+  // shadows the ambient loader, so only an unshadowed reference to it counts.
+  // The module's own factory require name is a real binding, so it keeps its
+  // own lane below.
+  if (name === "require" && isGlobalRequire)
+    return { specifier: argumentValue(node.arguments[0]) };
+  if (name.endsWith(".require"))
     return { specifier: argumentValue(node.arguments[0]) };
   if (name === "__webpack_require__" || name === moduleRequireName)
     return { specifier: argumentValue(node.arguments[0]) };