fix(javascript): retain returned-reference mutation uncertainty (#1471)

This commit is contained in:
Ysopwnable
2026-10-10 15:46:24 +08:00
committed by GitHub
parent 9defed9725
commit 782e0147cd
6 changed files with 391 additions and 31 deletions
+4 -1
View File
@@ -186,7 +186,10 @@ keys, and parser recovery remain partial or unknown.
Objects and arrays passed to calls, constructors, or tagged templates, used
as method receivers, or stored through property targets are not assumed
unchanged afterward. Property stores conservatively retain reference escape
uncertainty rather than pretending to execute later writes. Aliases
uncertainty rather than pretending to execute later writes. References
handed back by local functions, methods, constructors, async functions, and
generators also retain escape uncertainty, including when the call is read-only;
this does not establish that a mutation occurred. Aliases
and shared children in spread and rest copies retain that uncertainty; copied
primitive slots and unrelated containing properties remain known. Object rest
excludes consumed keys, array rest excludes the consumed prefix for known