Skip to content

minifier: property write removal misses __proto__ setter installed after the write site #21248

Description

@Dunqing

Description

When property_write_side_effects is false, the minifier removes unused property writes like obj.a = 1 if all references to obj are member write targets. However, if __proto__ is assigned after the property write (e.g., via a hoisted function), the setter installed by __proto__ isn't detected, and the property write is incorrectly removed.

Reproduction

const obj = {}
f()
obj.a = 1

function f() {
  obj.__proto__ = { set a(v) { console.log("hello") } }
}

Currently obj.a = 1 may be removed, but at runtime f() installs a setter on obj via __proto__, so obj.a = 1 triggers console.log("hello") and must be preserved.

Root Cause

The current implementation tracks __proto__ writes as it encounters them during traversal. Since AST traversal is top-down, a __proto__ write inside a hoisted function that appears later in the source isn't recorded when the earlier obj.a = 1 is visited.

Possible Fix

Pre-scan all member write references to detect __proto__ writes before the removal pass, so that the tracking is complete regardless of source order.

Related

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    Fields

    Priority

    None yet

    Effort

    None yet

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions