fix(javascript): emit no event operation for a missing listener argument

src/domain/javascript/javascriptAstValues.test.ts

@@ -2,6 +2,7 @@ import * as t from "@babel/types";
 import { expect, it } from "vitest";
 
 import {
+  javaScriptExpressionResultIsUsed,
   semanticMemberChain,
   semanticStaticPropertyKey,
   staticObjectProperty,
@@ -10,6 +11,102 @@ import {
   staticObjectPropertyNames,
 } from "./javascriptAstValues.js";
 
+it("keeps missing and mismatched result-parent edges conservative", () => {
+  const call = t.callExpression(t.identifier("invoke"), []);
+  const other = t.numericLiteral(0);
+  const parents = new WeakMap<t.Node, t.Node>();
+  expect(javaScriptExpressionResultIsUsed(call, parents)).toBe(true);
+  for (const parent of [
+    t.expressionStatement(other),
+    t.unaryExpression("void", other),
+    t.sequenceExpression([other]),
+    t.parenthesizedExpression(other),
+    t.tsAsExpression(other, t.tsUnknownKeyword()),
+    t.conditionalExpression(other, other, other),
+    t.logicalExpression("&&", other, other),
+    t.forStatement(other, null, other, t.emptyStatement()),
+  ]) {
+    parents.set(call, parent);
+    if (t.isExpression(parent))
+      parents.set(parent, t.expressionStatement(parent));
+    expect(javaScriptExpressionResultIsUsed(call, parents), parent.type).toBe(
+      true,
+    );
+  }
+});
+
+it("follows an explicit grouping wrapper through a final comma operand", () => {
+  const call = t.callExpression(t.identifier("invoke"), []);
+  const wrapper = t.parenthesizedExpression(call);
+  const sequence = t.sequenceExpression([t.numericLiteral(0), wrapper]);
+  const parents = new WeakMap<t.Node, t.Node>([
+    [call, wrapper],
+    [wrapper, sequence],
+  ]);
+  expect(javaScriptExpressionResultIsUsed(call, parents)).toBe(true);
+  parents.set(sequence, t.expressionStatement(sequence));
+  expect(javaScriptExpressionResultIsUsed(call, parents)).toBe(false);
+  parents.set(sequence, t.callExpression(t.identifier("consume"), [sequence]));
+  expect(javaScriptExpressionResultIsUsed(call, parents)).toBe(true);
+  parents.delete(sequence);
+  expect(javaScriptExpressionResultIsUsed(call, parents)).toBe(true);
+});
+
+it.each([128, 256, 512])(
+  "indexes comma membership once for %i sibling calls per parent map",
+  (count) => {
+    const calls = Array.from({ length: count }, () =>
+      t.callExpression(t.identifier("invoke"), []),
+    );
+    const sequence = t.sequenceExpression(calls);
+    let memberReads = 0;
+    sequence.expressions = new Proxy(sequence.expressions, {
+      get(target, key, receiver) {
+        if (typeof key === "string" && /^\d+$/u.test(key)) memberReads += 1;
+        return Reflect.get(target, key, receiver);
+      },
+    });
+    const parentMap = () =>
+      new WeakMap<t.Node, t.Node>([
+        ...calls.map((call): [t.Node, t.Node] => [call, sequence]),
+        [sequence, t.expressionStatement(sequence)],
+      ]);
+    const parents = parentMap();
+    for (const call of calls)
+      expect(javaScriptExpressionResultIsUsed(call, parents)).toBe(false);
+    expect(memberReads).toBeLessThanOrEqual(count * 2);
+    const firstReads = memberReads;
+    for (const call of calls)
+      expect(javaScriptExpressionResultIsUsed(call, parents)).toBe(false);
+    expect(memberReads - firstReads).toBeLessThanOrEqual(count);
+    const repeatedReads = memberReads;
+    const independentParents = parentMap();
+    for (const call of calls)
+      expect(javaScriptExpressionResultIsUsed(call, independentParents)).toBe(
+        false,
+      );
+    // A different analysis owns its own membership, even for the same AST.
+    expect(memberReads - repeatedReads).toBe(firstReads);
+  },
+);
+
+it("keeps sequence membership isolated and rejects mismatches after indexing", () => {
+  const first = t.callExpression(t.identifier("first"), []);
+  const second = t.callExpression(t.identifier("second"), []);
+  const firstSequence = t.sequenceExpression([first, t.numericLiteral(0)]);
+  const secondSequence = t.sequenceExpression([second, t.numericLiteral(0)]);
+  const parents = new WeakMap<t.Node, t.Node>([
+    [first, firstSequence],
+    [second, secondSequence],
+  ]);
+  expect(javaScriptExpressionResultIsUsed(first, parents)).toBe(false);
+  expect(javaScriptExpressionResultIsUsed(second, parents)).toBe(false);
+  parents.set(first, secondSequence);
+  expect(javaScriptExpressionResultIsUsed(first, parents)).toBe(true);
+  parents.delete(first);
+  expect(javaScriptExpressionResultIsUsed(first, parents)).toBe(true);
+});
+
 it("keeps string spread indices separate from named descriptor fields", () => {
   for (const text of ["", "x", "😀", "x".repeat(1_000_000)]) {
     const original = t.objectProperty(

src/domain/javascript/javascriptAstValues.ts

@@ -50,6 +50,65 @@ export const javaScriptExpressionWrapperTarget = (
     ? node.expression
     : undefined;
 
+// Parent facts and sequence children belong to one immutable parsed tree. Retain
+// only child membership; result use still follows the current outer parent edges.
+const sequenceMembersByParents = new WeakMap<
+  Pick<WeakMap<t.Node, t.Node>, "get">,
+  WeakMap<t.SequenceExpression, ReadonlySet<t.Node>>
+>();
+
+/** Follow only transparent result edges to an explicit value-discarding context. */
+export const javaScriptExpressionResultIsUsed = (
+  node: t.Node,
+  parents: Pick<WeakMap<t.Node, t.Node>, "get">,
+): boolean => {
+  let child = node;
+  for (
+    let parent = parents.get(child);
+    parent !== undefined;
+    parent = parents.get(child)
+  ) {
+    if (javaScriptExpressionWrapperTarget(parent) === child) {
+      child = parent;
+      continue;
+    }
+    if (
+      (t.isConditionalExpression(parent) &&
+        (parent.consequent === child || parent.alternate === child)) ||
+      (t.isLogicalExpression(parent) && parent.right === child)
+    ) {
+      child = parent;
+      continue;
+    }
+    if (t.isSequenceExpression(parent)) {
+      let sequences = sequenceMembersByParents.get(parents);
+      if (sequences === undefined) {
+        sequences = new WeakMap();
+        sequenceMembersByParents.set(parents, sequences);
+      }
+      let members = sequences.get(parent);
+      if (members === undefined) {
+        members = new Set(parent.expressions);
+        sequences.set(parent, members);
+      }
+      if (!members.has(child)) return true;
+      if (parent.expressions.at(-1) !== child) return false;
+      child = parent;
+      continue;
+    }
+    if (t.isExpressionStatement(parent)) return parent.expression !== child;
+    if (t.isUnaryExpression(parent, { operator: "void" }))
+      return parent.argument !== child;
+    // for/of and for/in heads use their expressions. A C-style for initializer
+    // or update discards the value, but a variable initializer still stores it.
+    return !(
+      t.isForStatement(parent) &&
+      (parent.init === child || parent.update === child)
+    );
+  }
+  return true;
+};
+
 /**
  * Remove wrappers that affect TypeScript or Flow checking but not runtime
  * expression identity. The returned depth lets bounded evaluators account for

src/domain/javascript/javascriptNetworkRequests.ts

@@ -3,16 +3,20 @@ import {
   semanticStaticPropertyName,
   unwrapJavaScriptExpression,
 } from "./javascriptAstValues.js";
-import { semanticBindingAtRead } from "./javascriptSemanticMutationInitializers.js";
-import { semanticOpaqueGlobalMayHaveChanged } from "./javascriptSemanticOpaqueEffects.js";
 import {
-  resolveSemanticBindingState,
-  semanticStableInitializer,
-  type JavaScriptBindingIndex,
-  type JavaScriptSemanticAnalysisState,
+  semanticConstructedReceiver,
+  semanticPrimitiveArguments,
+} from "./javascriptSemanticIntrinsicReceivers.js";
+import { semanticOpaqueGlobalMayHaveChanged } from "./javascriptSemanticOpaqueEffects.js";
+import type {
+  JavaScriptBindingIndex,
+  JavaScriptSemanticAnalysisState,
 } from "./javascriptSemanticState.js";
 import * as t from "@babel/types";
-import { isUnmodifiedGlobalReference } from "./javascriptSemanticAmbientWrites.js";
+import {
+  isUnmodifiedGlobalReference,
+  semanticAmbientPathMayHaveChangedAt,
+} from "./javascriptSemanticAmbientWrites.js";
 
 export const isFetchCall = (
   node: t.Node,
@@ -40,6 +44,7 @@ const isXhrOpenRequest = (
   node: t.Node,
   bindings: JavaScriptSemanticAnalysisState,
   index?: Pick<JavaScriptBindingIndex, "referenceMayHaveChangedAt">,
+  purpose: "request" | "receiver" = "request",
 ): boolean | undefined => {
   if (!t.isCallExpression(node) && !t.isOptionalCallExpression(node))
     return false;
@@ -49,60 +54,58 @@ const isXhrOpenRequest = (
     semanticStaticPropertyName(callee.property, callee.computed) !== "open"
   )
     return false;
+  // Native open can dispatch readystatechange. Its receiver is nonescaping
+  // only when no handler or prior opaque operation can have configured it.
+  // Primitive arguments also avoid user code during WebIDL string conversion.
   if (
-    ["XMLHttpRequest", "Object"].some((owner) =>
-      ["open", "__proto__"].some(
-        (member) =>
-          bindings.ambientWrites.covers([
-            "global",
-            owner,
-            "prototype",
-            member,
-          ]) ||
-          bindings.ambientEscapes.covers([
-            "global",
-            owner,
-            "prototype",
-            member,
-          ]),
+    purpose === "receiver" &&
+    !semanticPrimitiveArguments(node.arguments, bindings)
+  )
+    return false;
+  const prototypeOwners =
+    purpose === "receiver"
+      ? ["XMLHttpRequest", "XMLHttpRequestEventTarget", "EventTarget", "Object"]
+      : ["XMLHttpRequest", "Object"];
+  if (
+    prototypeOwners.some((owner) =>
+      (purpose === "receiver"
+        ? ["open", "__proto__", "onreadystatechange"]
+        : ["open", "__proto__"]
+      ).some((member) =>
+        semanticAmbientPathMayHaveChangedAt(
+          purpose === "receiver" ? node : callee,
+          bindings,
+          ["global", owner, "prototype", member],
+          node,
+        ),
       ),
     )
   )
     return false;
-  let receiver = unwrapJavaScriptExpression(callee.object).node;
-  const seen = new Set<string>();
-  while (t.isIdentifier(receiver)) {
-    if (
-      index !== undefined &&
-      (index.referenceMayHaveChangedAt(node, receiver, ["open"]) ||
-        index.referenceMayHaveChangedAt(node, receiver, ["__proto__"]))
-    )
-      return false;
-    const binding = resolveSemanticBindingState(
-      bindings,
-      receiver,
-      receiver.name,
-    );
-    if (binding === undefined || seen.has(binding.bindingId)) return false;
-    seen.add(binding.bindingId);
-    const initializer = semanticStableInitializer(binding, bindings);
-    if (
-      initializer === undefined ||
-      initializer.projection.length !== 0 ||
-      !semanticBindingAtRead(binding, receiver, bindings).hasDefiniteInitializer
-    )
-      return false;
-    receiver = unwrapJavaScriptExpression(initializer.node).node;
-  }
+  const receiver = semanticConstructedReceiver(callee.object, node, bindings, {
+    paths: purpose === "receiver" ? [[]] : [["open"], ["__proto__"]],
+    index,
+  });
   if (
-    !t.isNewExpression(receiver) ||
-    !isUnmodifiedGlobalReference(receiver.callee, bindings, "XMLHttpRequest") ||
+    receiver === undefined ||
+    !isUnmodifiedGlobalReference(
+      receiver.construction.callee,
+      bindings,
+      "XMLHttpRequest",
+    ) ||
     semanticOpaqueGlobalMayHaveChanged(callee, bindings)
   )
     return false;
-  return index === undefined && seen.size > 0 ? undefined : true;
+  return index === undefined && receiver.viaBinding ? undefined : true;
 };
 
+/** A pristine native open is safe for the mutation producer, not every XHR call. */
+export const isIntrinsicNonEscapingXhrOpen = (
+  node: t.Node,
+  bindings: JavaScriptSemanticAnalysisState,
+  index?: Pick<JavaScriptBindingIndex, "referenceMayHaveChangedAt">,
+): boolean | undefined => isXhrOpenRequest(node, bindings, index, "receiver");
+
 /** Resolve once through the shared mutation index when lexical proof needs it. */
 export const createXhrOpenRequestQuery =
   (index: JavaScriptBindingIndex): ((node: t.Node) => boolean) =>