feat(mangler): opt-out of direct eval (#9191)

Context:

* https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval
* https://esbuild.github.io/content-types/#direct-eval

Author: Boshen

crates/oxc_mangler/src/lib.rs

@@ -192,6 +192,11 @@ impl Mangler {
 
         assert!(scope_tree.has_child_ids(), "child_id needs to be generated");
 
+        // TODO: implement opt-out of direct-eval in a branch of scopes.
+        if scope_tree.root_flags().contains_direct_eval() {
+            return symbol_table;
+        }
+
         let (exported_names, exported_symbols) = if self.options.top_level {
             Mangler::collect_exported_symbols(program)
         } else {

crates/oxc_minifier/tests/mangler/mod.rs

@@ -16,6 +16,13 @@ fn mangle(source_text: &str, top_level: bool) -> String {
     CodeGenerator::new().with_symbol_table(Some(symbol_table)).build(&program).code
 }
 
+#[test]
+fn direct_eval() {
+    let source_text = "function foo() { let NO_MANGLE; eval('') }";
+    let mangled = mangle(source_text, false);
+    assert_eq!(mangled, "function foo() {\n\tlet NO_MANGLE;\n\teval(\"\");\n}\n");
+}
+
 #[test]
 fn mangler() {
     let cases = [

crates/oxc_minifier/tests/peephole/mod.rs

@@ -82,3 +82,24 @@ fn tagged_template() {
     test("foo(true && o.f)", "foo(o.f)");
     test("foo(true ? o.f : false)", "foo(o.f)");
 }
+
+#[test]
+fn eval() {
+    // Keep indirect-eval syntaxes
+    test_same("(!0 && eval)(x)");
+    test_same("(1 ? eval : 2)(x)");
+    test_same("(1 ? eval : 2)?.(x)");
+    test_same("(1, eval)(x)");
+    test_same("(1, eval)?.(x)");
+    test_same("(3, eval)(x)");
+    test_same("(4, eval)?.(x)");
+    test_same("(eval)(x)");
+    test_same("(eval)?.(x)");
+    test_same("eval(x)");
+    test_same("eval(x, y)");
+    test_same("eval(x,y)");
+    test_same("eval?.(x)");
+    test_same("eval?.(x)");
+    test_same("eval?.(x, y)");
+    test_same("eval?.(x,y)");
+}

crates/oxc_semantic/src/builder.rs

@@ -564,8 +564,12 @@ impl<'a> Visit<'a> for SemanticBuilder<'a> {
         // So we could `.unwrap()` here. But that seems to produce a small perf impact, probably because
         // `leave_scope` then doesn't get inlined because of its larger size due to the panic code.
         let parent_id = self.scope.get_parent_id(self.current_scope_id);
+
         debug_assert!(parent_id.is_some());
         if let Some(parent_id) = parent_id {
+            if self.scope.get_flags(self.current_scope_id).contains_direct_eval() {
+                self.scope.get_flags_mut(parent_id).insert(ScopeFlags::DirectEval);
+            }
             self.current_scope_id = parent_id;
         }
 
@@ -2069,6 +2073,11 @@ impl<'a> SemanticBuilder<'a> {
             AstKind::YieldExpression(_) => {
                 self.set_function_node_flags(NodeFlags::HasYield);
             }
+            AstKind::CallExpression(call_expr) => {
+                if !call_expr.optional && call_expr.callee.is_specific_id("eval") {
+                    self.scope.get_flags_mut(self.current_scope_id).insert(ScopeFlags::DirectEval);
+                }
+            }
             _ => {}
         }
     }

crates/oxc_semantic/tests/integration/scopes.rs

@@ -261,3 +261,25 @@ fn test_ts_conditional_types() {
         .has_number_of_references(0)
         .test();
 }
+
+#[test]
+fn test_eval() {
+    let direct_evals = ["eval('')", "function foo() { eval('') }"];
+    for code in direct_evals {
+        let tester = SemanticTester::js(code);
+        let semantic = tester.build();
+        assert!(semantic.scopes().root_flags().contains_direct_eval());
+    }
+
+    let indirect_evals = [
+        "eval?.('')",
+        "(0, eval)('')",
+        "const myEval = eval; myEval('')",
+        "const obj = { eval }; obj.eval('x + y')",
+    ];
+    for code in indirect_evals {
+        let tester = SemanticTester::js(code);
+        let semantic = tester.build();
+        assert!(!semantic.scopes().root_flags().contains_direct_eval());
+    }
+}

crates/oxc_syntax/src/scope.rs

@@ -79,6 +79,7 @@ bitflags! {
         const GetAccessor      = 1 << 7;
         const SetAccessor      = 1 << 8;
         const CatchClause      = 1 << 9;
+        const DirectEval       = 1 << 10; // <https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval#direct_and_indirect_eval>
         const Var = Self::Top.bits() | Self::Function.bits() | Self::ClassStaticBlock.bits() | Self::TsModuleBlock.bits();
     }
 }
@@ -153,4 +154,9 @@ impl ScopeFlags {
     pub fn is_catch_clause(&self) -> bool {
         self.contains(Self::CatchClause)
     }
+
+    #[inline]
+    pub fn contains_direct_eval(&self) -> bool {
+        self.contains(Self::DirectEval)
+    }
 }

tasks/coverage/snapshots/runtime.snap

@@ -65,7 +65,6 @@ static SKIP_INCLUDES: &[&str] = &[
 
 static SKIP_TEST_CASES: &[&str] = &[
     // node.js runtime error
-    "language/eval-code",
     "language/expressions/dynamic-import",
     "language/global-code/decl-func.js",
     "language/module-code",
@@ -77,12 +76,7 @@ static SKIP_TEST_CASES: &[&str] = &[
     "language/expressions/prefix-decrement/operator-prefix-decrement-x-calls-putvalue-lhs-newvalue",
 ];
 
-static SKIP_ESID: &[&str] = &[
-    // Always fail because they need to perform `eval`
-    "sec-performeval-rules-in-initializer",
-    "sec-privatefieldget",
-    "sec-privatefieldset",
-];
+static SKIP_ESID: &[&str] = &["sec-privatefieldget", "sec-privatefieldset"];
 
 pub struct Test262RuntimeCase {
     base: Test262Case,
@@ -113,13 +107,7 @@ impl Case for Test262RuntimeCase {
         let features = &self.base.meta().features;
         self.base.should_fail()
             || self.base.skip_test_case()
-            || (self
-                .base
-                .meta()
-                .esid
-                .as_ref()
-                .is_some_and(|esid| SKIP_ESID.contains(&esid.as_ref()))
-                && test262_path.contains("direct-eval"))
+            || self.base.meta().esid.as_ref().is_some_and(|esid| SKIP_ESID.contains(&esid.as_ref()))
             || base_path.contains("built-ins")
             || base_path.contains("staging")
             || base_path.contains("intl402")