fix(parser): possible crash with --minify-syntax and string -> dot conversions (#23078)

### What does this PR do?
Fixes code like `[(()=>{})()][''+'c']`.

We were calling `visitExpr` on a node that was already visited. This
code doesn't exist in esbuild, but we should keep it because it's an
optimization.

fixes #18629
fixes #15926

### How did you verify your code works?
Manually and added a test.
This commit is contained in:
Dylan Conway
2025-09-29 04:20:57 -07:00
committed by GitHub
parent 9c75db45fa
commit f4218ed40b
2 changed files with 15 additions and 1 deletions

View File

@@ -609,7 +609,8 @@ pub fn VisitExpr(
p.delete_target = dot.data;
}
return p.visitExprInOut(dot, in);
// don't call visitExprInOut on `dot` because we've already visited `target` above!
return dot;
}
// Handle property rewrites to ensure things

View File

@@ -3551,6 +3551,19 @@ it("does not crash with 9 comments and typescript type skipping", () => {
expect(exitCode).toBe(0);
});
it("does not crash with --minify-syntax and revisiting dot expressions", () => {
const { stdout, stderr, exitCode } = Bun.spawnSync({
cmd: [bunExe(), "-p", "[(()=>{})()][''+'c']"],
stdout: "pipe",
stderr: "pipe",
env: bunEnv,
});
expect(stderr.toString()).toBe("");
expect(stdout.toString()).toBe("undefined\n");
expect(exitCode).toBe(0);
});
it("runtime transpiler stack overflows", async () => {
expect(async () => await import("./fixtures/lots-of-for-loop.js")).toThrow(`Maximum call stack size exceeded`);
});