Skip to content

Oxc-minifier: Incorrect ||= optimization when variable is reassigned before property assignment #16647

Description

@kovalchukq

Summary

The minifier incorrectly uses the ||= (logical OR assignment) operator when a variable is reassigned within the same conditional block before a property is set on it. This causes a runtime error in strict mode.

JSField - https://jsfiddle.net/h9zt0fa4/1/

Minimal Reproduction

Working code before minification

function loadImage(input) {
    let imageElement = input;
    
    if (!imageElement.src) {
        imageElement = new Image();
        imageElement.src = typeof input === 'string' ? input : URL.createObjectURL(input);
    }
    
    return imageElement;
}
const result = loadImage('https://picsum.photos/200/300');
console.log('Success! Image src:', result.src);

Broken code after minification

function e(e) {
	let t = e;
	return t.src ||= (t = new Image(), typeof e == "string" ? e : URL.createObjectURL(e)), t;
}
const t = e("https://picsum.photos/200/300");
console.log("Success! Image src:", t.src);

The Problem

The ||= operator evaluates as:
t.src = t.src || (t=new Image, typeof e=='string'?e:URL.createObjectURL(e))
Execution order when t is a string 'https://example.com/image.jpg':

  1. Capture assignment target: t.src (at this point, t is the string)
  2. Evaluate left side: t.src → undefined (accessing .src on string)
  3. Since falsy, evaluate right side: (t=new Image, value) - t is reassigned to Image object. Comma operator returns the URL string
  4. Execute assignment: Try to set string.src = "https://..."
  5. In strict mode (ES modules): TypeError: Cannot create property 'src' on string

Expected Behavior

The minifier should recognize that when:

  1. A variable is reassigned inside the conditional expression
  2. A property is then set on that variable

Metadata

Metadata

Assignees

Labels

Type

Fields

Priority

None yet

Effort

None yet

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions